Update dependency uv to v0.12.9 (dev)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
uv	tools	patch	0.12.7 → 0.12.9	0.12.10

---

Release Notes

astral-sh/uv (uv)

v0.12.9

Compare Source

Released on 2026-09-01.

Python

• Add CPython 3.15.0rc2 (#​21413, #​21415)

Enhancements

• Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#​21408)
• Report the exact command-line lock-mode flag in warnings and errors (#​21402)

Performance

• Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#​21372)

Bug fixes

• Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#​21401)
• Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#​21382)
• Redact secrets in signed URLs from retry diagnostics, including nested request errors (#​21381)
• Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#​21396)
• Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#​21400)

v0.12.8

Compare Source

Released on 2026-08-31.

Enhancements

• Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#​21368)

Preview features

• Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#​21327)
• Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#​21340)
• Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#​21344)

Performance

• Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#​21379)
• Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#​21373)
• Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#​21377)
• Speed up warm resolutions by reducing repeated marker interner work (#​21300)

Bug fixes

• Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#​21348)
• Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#​21366)
• Redact Azure shared access signature (sig) query parameters from displayed URLs (#​21360)
• Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#​21341)

Other changes

• Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#​21346)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.