Skip to content

build(deps): bump astral-sh/uv from 0.12.1 to 0.12.8 - #61

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/docker/astral-sh/uv-0.12.8
Closed

build(deps): bump astral-sh/uv from 0.12.1 to 0.12.8#61
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/docker/astral-sh/uv-0.12.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps astral-sh/uv from 0.12.1 to 0.12.8.

Release notes

Sourced from astral-sh/uv's releases.

0.12.8

Release Notes

Released on 2026-08-31.

Enhancements

  • Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

  • Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
  • Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
  • Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

  • Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
  • Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
  • Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
  • Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

  • Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
  • Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)
  • Redact Azure shared access signature (sig) query parameters from displayed URLs (#21360)
  • Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#21341)

Other changes

  • Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#21346)

Install uv 0.12.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.8/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.8/uv-installer.ps1 | iex"

Download uv 0.12.8

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from astral-sh/uv's changelog.

0.12.8

Released on 2026-08-31.

Enhancements

  • Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

  • Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
  • Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
  • Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

  • Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
  • Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
  • Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
  • Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

  • Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
  • Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)
  • Redact Azure shared access signature (sig) query parameters from displayed URLs (#21360)
  • Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#21341)

Other changes

  • Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#21346)

0.12.7

Released on 2026-08-27.

Python

  • Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

  • Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
  • Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

  • Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump astral-sh/uv from 0.12.1 to 0.12.8
8cb5c25 
Bumps [astral-sh/uv](https://github.com/astral-sh/uv) from 0.12.1 to 0.12.8.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.1...0.12.8)

---
updated-dependencies:
- dependency-name: astral-sh/uv
  dependency-version: 0.12.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: containers, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot mentioned this pull request Sep 1, 2026
Closed
@veil-chow-fyaic veil-chow-fyaic mentioned this pull request Sep 2, 2026
Merged
veil-chow-fyaic added a commit that referenced this pull request Sep 2, 2026
@veil-chow-fyaic
build: coordinate dependency updates and MCP 2.1 smoke (#66)
6343087 
## Outcome

Consolidates the broken one-file Dependabot updates into one verified
maintenance change and removes the wildcard review rule that
automatically requested a personal review on every repository change.

## Changes

- upgrades the Python runtime/development groups from #64 and #65 with a
regenerated lock;
- coordinates the uv 0.12.8 pin from #61 across Docker, CI, release,
acceptance and documentation;
- adapts the MCP 2.1 anticipated-error boundary so unavailable sources
remain sanitized and fail closed;
- adds stdio MCP to the isolated live four-source CLI/REST/CRM parity
gate;
- fixes the Redocly 2.49.0 execution pin left inconsistent after #62;
- scopes CODEOWNERS to governed/security-sensitive paths;
- moves version-update cadence to quarterly, limits concurrent update
PRs, and disables uncoordinated Docker version PRs while retaining
security updates;
- adds the dependency labels referenced by Dependabot.

Python 3.14 from #63 is intentionally not included: it is a runtime
major migration, not a patch update, and its Compose acceptance
currently fails the repository's supported Python 3.13.14 contract.

## Verification

- `./scripts/check.sh`: 2,088 tests, 100% statement/branch coverage,
package/docs/OpenAPI/secret/dependency checks pass; no known
vulnerabilities.
- `./scripts/test_compose.sh`: full PostgreSQL 18.4 reference deployment
passes with zero project residue.
- `./scripts/test_official_screening_live.sh`: current four-source
refresh/replay and CLI/REST/CRM/MCP parity pass with zero residue (EU
FSF 6,234; Annex I 384; OFAC SDN 19,321; Consolidated 481).
- Stale-source and invalid-input MCP paths remain fail closed; no
mutating/clearance tool is exposed.

Evidence: `docs/evidence/dependency-and-mcp-smoke-2026-09-02.md`.

Relates to #47. Supersedes #61, #64 and #65 after merge.
@veil-chow-fyaic

veil-chow-fyaic commented Sep 2, 2026

Copy link
Copy Markdown
Collaborator

Superseded by #66, which coordinates uv 0.12.8 across Docker, CI, release, pyproject, acceptance scripts and documentation and passed all repository, Compose and live MCP gates. Closing this one-file update because it could not satisfy the repository's cross-file version contract.

@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/docker/astral-sh/uv-0.12.8 branch September 2, 2026 03:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@veil-chow-fyaic veil-chow-fyaic Awaiting requested review from veil-chow-fyaic

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@veil-chow-fyaic