Skip to content

Python: Update uv-build requirement from <0.9.0,>=0.8.2 to >=0.8.2,<0.12.0 in /python - #7021

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/uv-build-gte-0.8.2-and-lt-0.12.0
Closed

Python: Update uv-build requirement from <0.9.0,>=0.8.2 to >=0.8.2,<0.12.0 in /python#7021
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/uv-build-gte-0.8.2-and-lt-0.12.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 9, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on uv-build to permit the latest version.

Release notes

Sourced from uv-build's releases.

0.11.28

Release Notes

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

  • Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

  • Improve trace logs for unexpected error chains (#20220)
  • Move lockfile update guidance to a hint (#20219)
  • Preserve indentation for multiline error causes (#20156)
  • Render user errors with their cause chains (#20217)
  • Route final command errors through the printer to respect -q and -qq (#20163)
  • Use standard rendering for uv build errors (#20159)
  • Use standard rendering for tool requirement errors (#20160)

Performance

  • Only compile bytecode for installed distributions in uv pip install (#19914)
  • Avoid allocating URL-safe Git revisions (#20194)
  • Avoid allocating canonical Python request strings (#20193)
  • Avoid allocating custom Astral mirror URLs (#20204)
  • Avoid allocating expanded compatibility tags (#20190)
  • Avoid allocating shell strings that need no escaping (#20196)
  • Avoid allocating static ABI descriptions (#20201)
  • Avoid allocating static Windows executable names (#20200)
  • Avoid allocating static dependency table names (#20199)
  • Avoid allocating static platform triple components (#20195)
  • Avoid allocating static resolver report labels (#20198)
  • Avoid allocating static unavailable-version messages (#20197)
  • Avoid allocating unchanged Python download architectures (#20202)
  • Avoid allocating unchanged paths during case normalization (#20203)
  • Avoid allocations when expanding group conflicts (#20211)
  • Avoid allocations when formatting requirements (#20206)
  • Avoid cloning credential lookup services (#20210)
  • Avoid cloning dry-run distributions (#20209)
  • Avoid cloning owned dependency metadata (#20212)
  • Avoid redundant direct URL clones (#20207)
  • Create metadata version errors lazily (#20205)
  • Optimize expanded tag compatibility checks (#20171)
  • Optimize parsing of single-digit three-part versions (#20118)

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.11.28

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

  • Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

  • Improve trace logs for unexpected error chains (#20220)
  • Move lockfile update guidance to a hint (#20219)
  • Preserve indentation for multiline error causes (#20156)
  • Render user errors with their cause chains (#20217)
  • Route final command errors through the printer to respect -q and -qq (#20163)
  • Use standard rendering for uv build errors (#20159)
  • Use standard rendering for tool requirement errors (#20160)

Performance

  • Only compile bytecode for installed distributions in uv pip install (#19914)
  • Avoid allocating URL-safe Git revisions (#20194)
  • Avoid allocating canonical Python request strings (#20193)
  • Avoid allocating custom Astral mirror URLs (#20204)
  • Avoid allocating expanded compatibility tags (#20190)
  • Avoid allocating shell strings that need no escaping (#20196)
  • Avoid allocating static ABI descriptions (#20201)
  • Avoid allocating static Windows executable names (#20200)
  • Avoid allocating static dependency table names (#20199)
  • Avoid allocating static platform triple components (#20195)
  • Avoid allocating static resolver report labels (#20198)
  • Avoid allocating static unavailable-version messages (#20197)
  • Avoid allocating unchanged Python download architectures (#20202)
  • Avoid allocating unchanged paths during case normalization (#20203)
  • Avoid allocations when expanding group conflicts (#20211)
  • Avoid allocations when formatting requirements (#20206)
  • Avoid cloning credential lookup services (#20210)
  • Avoid cloning dry-run distributions (#20209)
  • Avoid cloning owned dependency metadata (#20212)
  • Avoid redundant direct URL clones (#20207)
  • Create metadata version errors lazily (#20205)
  • Optimize expanded tag compatibility checks (#20171)
  • Optimize parsing of single-digit three-part versions (#20118)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Update uv-build requirement in /python
bce0955 
Updates the requirements on [uv-build](https://github.com/astral-sh/uv) to permit the latest version.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.8.2...0.11.28)

---
updated-dependencies:
- dependency-name: uv-build
  dependency-version: 0.11.28
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Usage: [Issues, PRs], Target: dependencies in the project python Usage: [Issues, PRs], Target: Python labels Jul 9, 2026
Copilot AI review requested due to automatic review settings July 9, 2026 14:36
Copilot AI reviewed Jul 9, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

@github-actions github-actions Bot changed the title Update uv-build requirement from <0.9.0,>=0.8.2 to >=0.8.2,<0.12.0 in /python Python: Update uv-build requirement from <0.9.0,>=0.8.2 to >=0.8.2,<0.12.0 in /python Jul 9, 2026
@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Python Test Coverage

Python Test Coverage Report •
FileStmtsMissCoverMissing
TOTAL44093527488% 
report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests Skipped Failures Errors Time
8825 33 💤 0 ❌ 0 🔥 2m 17s ⏱️

@moonbox3 Evan Mattson (moonbox3) mentioned this pull request Jul 9, 2026
Merged
5 tasks
@moonbox3

Evan Mattson (moonbox3) commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Superseded by #7033

@dependabot @github

dependabot Bot commented on behalf of github Jul 10, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/uv/python/uv-build-gte-0.8.2-and-lt-0.12.0 branch July 10, 2026 00:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

dependencies Usage: [Issues, PRs], Target: dependencies in the project python Usage: [Issues, PRs], Target: Python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@moonbox3