Bump uv from 0.11.17 to 0.11.28 in /python

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps uv from 0.11.17 to 0.11.28.

Release notes

Sourced from uv's releases.

0.11.28

Release Notes

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

• Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

• Improve trace logs for unexpected error chains (#20220)
• Move lockfile update guidance to a hint (#20219)
• Preserve indentation for multiline error causes (#20156)
• Render user errors with their cause chains (#20217)
• Route final command errors through the printer to respect -q and -qq (#20163)
• Use standard rendering for uv build errors (#20159)
• Use standard rendering for tool requirement errors (#20160)

Performance

• Only compile bytecode for installed distributions in uv pip install (#19914)
• Avoid allocating URL-safe Git revisions (#20194)
• Avoid allocating canonical Python request strings (#20193)
• Avoid allocating custom Astral mirror URLs (#20204)
• Avoid allocating expanded compatibility tags (#20190)
• Avoid allocating shell strings that need no escaping (#20196)
• Avoid allocating static ABI descriptions (#20201)
• Avoid allocating static Windows executable names (#20200)
• Avoid allocating static dependency table names (#20199)
• Avoid allocating static platform triple components (#20195)
• Avoid allocating static resolver report labels (#20198)
• Avoid allocating static unavailable-version messages (#20197)
• Avoid allocating unchanged Python download architectures (#20202)
• Avoid allocating unchanged paths during case normalization (#20203)
• Avoid allocations when expanding group conflicts (#20211)
• Avoid allocations when formatting requirements (#20206)
• Avoid cloning credential lookup services (#20210)
• Avoid cloning dry-run distributions (#20209)
• Avoid cloning owned dependency metadata (#20212)
• Avoid redundant direct URL clones (#20207)
• Create metadata version errors lazily (#20205)
• Optimize expanded tag compatibility checks (#20171)
• Optimize parsing of single-digit three-part versions (#20118)

... (truncated)

Changelog

Sourced from uv's changelog.

0.11.28

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

• Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

• Improve trace logs for unexpected error chains (#20220)
• Move lockfile update guidance to a hint (#20219)
• Preserve indentation for multiline error causes (#20156)
• Render user errors with their cause chains (#20217)
• Route final command errors through the printer to respect -q and -qq (#20163)
• Use standard rendering for uv build errors (#20159)
• Use standard rendering for tool requirement errors (#20160)

Performance

• Only compile bytecode for installed distributions in uv pip install (#19914)
• Avoid allocating URL-safe Git revisions (#20194)
• Avoid allocating canonical Python request strings (#20193)
• Avoid allocating custom Astral mirror URLs (#20204)
• Avoid allocating expanded compatibility tags (#20190)
• Avoid allocating shell strings that need no escaping (#20196)
• Avoid allocating static ABI descriptions (#20201)
• Avoid allocating static Windows executable names (#20200)
• Avoid allocating static dependency table names (#20199)
• Avoid allocating static platform triple components (#20195)
• Avoid allocating static resolver report labels (#20198)
• Avoid allocating static unavailable-version messages (#20197)
• Avoid allocating unchanged Python download architectures (#20202)
• Avoid allocating unchanged paths during case normalization (#20203)
• Avoid allocations when expanding group conflicts (#20211)
• Avoid allocations when formatting requirements (#20206)
• Avoid cloning credential lookup services (#20210)
• Avoid cloning dry-run distributions (#20209)
• Avoid cloning owned dependency metadata (#20212)
• Avoid redundant direct URL clones (#20207)
• Create metadata version errors lazily (#20205)
• Optimize expanded tag compatibility checks (#20171)
• Optimize parsing of single-digit three-part versions (#20118)

... (truncated)

Commits

• ebf0f43 Bump version to 0.11.28 (#20226)
• dee7a10 fix(uv): uv tree fails on dependency-group-only pyproject.tomls (#19975) (#20...
• 95e2f57 Improve trace logs for debugging the error chain (#20220)
• 4fab9d3 Use standard rendering for tool requirement errors (#20160)
• f436bb3 Move canonical and Git URL clones to callers (#20221)
• 6dc1dad Move lockfile update guidance to a hint (#20219)
• 83158f4 Render user errors with their cause chains (#20217)
• 3cfcabe Route final command errors through the printer (#20163)
• da1613b Model final command errors explicitly (#20188)
• 0ea325e Document the bytecode compilation timeout override (#20189)
• Additional commits viewable in compare view

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	44098	5270	88%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
8833	33 💤	0 ❌	0 🔥	2m 7s ⏱️

[Evan Mattson (moonbox3)]

Superseded by #7033

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.