Skip to content

Preserve local path intent when merging dependency metadata - #20631

Merged
EliteTK merged 4 commits into
mainfrom
tk/fix-lossy-source-merging
Sep 15, 2026
Merged

EliteTK merged 4 commits into
mainfrom
tk/fix-lossy-source-merging

Conversation

@EliteTK

@EliteTK EliteTK commented Jul 23, 2026 •

Copy link
Copy Markdown
Member

Summary

Fixes #20477.

When a project and one of its dependencies refer to the same local package, the path to that local package can end up mangled by backends etc. This means we could end up losing the original spelling from pyproject.toml which we use when creating the lockfile, thus making the result an absolute path.

This PR handles merging this information properly, preferring the local metadata, so that the lockfile ends up with the right kind of path.

Broadly:

  • VerbatimUrl gains a force_relative marker, the intent being that it can be set for URLs which don't originate from sources the user can easily control and cleared for URLs that the user can override (to change relative -> absolute or vice versa).
  • Metadata from dependencies (from_metadata23) is a clear source of this kind of URL and has all of its local URLs overridden. Metadata from other sources is initially left alone.
  • Metadata loaded through from_workspace is a mixture, so, if it's not also actually selected from tool.uv.dependency-metadata it is set as true late in build_wheel_metadata and then subsequently overridden based on which package the metadata is from in:
    • source_tree - since the metadata is coming from the user e.g. via uv pip compile pyproject.toml
    • Manifest::with_lookaheads for any lookaheads which come from the current project or workspace members.
    • ResolverOutput::add_version for the current project and workspace members (Manifest::with_lookaheads changes a different copy. This duplication is potentially avoidable but would be a bigger refactor.)
  • Urls::from_manifest merges requirements in a specific order, to ensure that user preferences get preserved while not affecting that order, it is first merged in the normal order, with force_relative = true on all relevant URLs, and then any requirement which had a url without force_relative = true is merged again at the end. The merging picks the last URL so this preserves the existing editable/conflict handling.
  • We use our existing try_relative_to_if logic when serialising, except now there's a prefers_relative rather than was_given_absolute which incorporates the force_relative field.

Test Plan

A regression test for the original issue, and some additional coverage because the fix was broadened to avoid this class of problems in general.

@EliteTK
EliteTK force-pushed the tk/fix-lossy-source-merging branch from 18e2de1 to 59cc94d Compare July 24, 2026 00:43
@EliteTK
EliteTK force-pushed the tk/fix-lossy-source-merging branch from 59cc94d to 152cae1 Compare July 24, 2026 22:19
EliteTK added a commit that referenced this pull request Aug 14, 2026
…he manifest (#21132)

## Summary

Minor cleanup related to #20631.

## Test Plan

Existing coverage.
astral-automations-bot Bot pushed a commit to astral-sh/uv-dev that referenced this pull request Aug 14, 2026
## Summary

This PR does three things:

* It fixes an issue where we were printing raw URLs in errors which
could themselves contain credentials.
* It cleans up the error messages for end users, into a form which in my
opinion is cleaner and clearer.
* It makes the underlying code simpler. ~~Which I need as a preparatory
change for astral-sh#20631.~~ (turns out I might not need it in the end)

## Test Plan

Snapshots adjusted, and a test-case for the issue has been added.
@EliteTK
EliteTK force-pushed the tk/fix-lossy-source-merging branch from 152cae1 to b2005b7 Compare August 21, 2026 13:10
@EliteTK
EliteTK changed the base branch from main to tk/relabs-path-tests August 21, 2026 13:10
@EliteTK EliteTK changed the title Preserve original path spelling when merging transitive requirements Preserve local path intent when merging dependency metadata Aug 21, 2026
@konstin
konstin self-requested a review August 21, 2026 14:30
@EliteTK
EliteTK marked this pull request as ready for review August 26, 2026 10:49
Base automatically changed from tk/relabs-path-tests to main September 3, 2026 17:38
@EliteTK
EliteTK force-pushed the tk/fix-lossy-source-merging branch from b2005b7 to 623c076 Compare September 4, 2026 02:05

@konstin konstin left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can see from the tests that this gives the correct output, but I'm trouble following why this happens. In what order are we calling with_force_relative with which values, and why this give us the desired output? Intuitively, I'd have said that we need to look at whether the pyproject.toml input paths are absolute or relative, where generated cases (workspace members) are always relative, but that doesn't seem to be the case.

Comment thread crates/uv-pep508/src/verbatim_url.rs Resolved
@EliteTK
EliteTK force-pushed the tk/fix-lossy-source-merging branch from 623c076 to 1021c55 Compare September 4, 2026 20:29
@astral-sh-bot

astral-sh-bot Bot commented Sep 4, 2026

Copy link
Copy Markdown

uv test inventory changes

This PR changes the tests when compared with the main base revision.

  • Added tests: 1
  • Removed tests: 0
  • Changed suites: 1
uv-pep508: +1 / -0

Added:

  • uv-pep508::verbatim_url::tests::forced_relative_overrides_absolute_spelling

Removed: none

@EliteTK

EliteTK commented Sep 8, 2026

Copy link
Copy Markdown
Member Author

@konstin I've made some adjustments in the most recent commit and in the PR description.

@konstin

konstin commented Sep 14, 2026

Copy link
Copy Markdown
Member

(to change relative -> absolute or vice versa).

I see how this changes absolute -> relative, since METADATA URLs are absolute, but do we also change a relative input we get to an absolute one?

Keep the output preference separate from URL identity and expose it in Debug output. The default preserves existing behaviour.
Carry local-path formatting policy from metadata loading through URL selection and output. Preserve authored source spelling while making ordinary dependency metadata portable, without changing source identity.
@EliteTK

EliteTK commented Sep 15, 2026

Copy link
Copy Markdown
Member Author

@konstin there's a possibility of that if we end up losing the original wording, but otherwise it should never happen.

@EliteTK
EliteTK force-pushed the tk/fix-lossy-source-merging branch from 311d926 to b0f6410 Compare September 15, 2026 10:32
@EliteTK
EliteTK merged commit ad55255 into main Sep 15, 2026
61 checks passed
@EliteTK
EliteTK deleted the tk/fix-lossy-source-merging branch September 15, 2026 11:28
luketainton pushed a commit to luketainton/luke_rsu that referenced this pull request Sep 18, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.12.15` → `0.12.16` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216)

[Compare Source](astral-sh/uv@0.12.15...0.12.16)

Released on 2026-09-17.

##### Python

- Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#&#8203;21741](astral-sh/uv#21741))

##### Enhancements

- Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#&#8203;21562](astral-sh/uv#21562))
- Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#&#8203;21467](astral-sh/uv#21467))
- Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#&#8203;21766](astral-sh/uv#21766))
- Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#&#8203;21779](astral-sh/uv#21779))

##### Preview features

- Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#&#8203;21163](astral-sh/uv#21163))
- Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#&#8203;21776](astral-sh/uv#21776))
- Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#&#8203;21777](astral-sh/uv#21777))
- Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#&#8203;21744](astral-sh/uv#21744))

##### Bug fixes

- Redact Azure shared access signatures from displayed and logged URLs ([#&#8203;21755](astral-sh/uv#21755))
- Check archive sizes from `pylock.toml` before reusing cached distributions ([#&#8203;21609](astral-sh/uv#21609))
- Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#&#8203;20631](astral-sh/uv#20631))
- Use the bundled `uv_build` backend only when its version matches active version pins ([#&#8203;21742](astral-sh/uv#21742))
- Handle malformed index URLs without panicking when credentials are configured ([#&#8203;21784](astral-sh/uv#21784))
- Report a configuration error instead of panicking for proxy URLs without a host ([#&#8203;21781](astral-sh/uv#21781))
- Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#&#8203;21783](astral-sh/uv#21783))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45Ny40IiwidXBkYXRlZEluVmVyIjoiNDQuOTcuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9kZXBlbmRlbmNpZXMiXX0=-->

Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/46
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
luketainton pushed a commit to luketainton/repos_labmcp that referenced this pull request Sep 18, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.12.15` → `0.12.16` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/51) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216)

[Compare Source](astral-sh/uv@0.12.15...0.12.16)

Released on 2026-09-17.

##### Python

- Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#&#8203;21741](astral-sh/uv#21741))

##### Enhancements

- Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#&#8203;21562](astral-sh/uv#21562))
- Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#&#8203;21467](astral-sh/uv#21467))
- Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#&#8203;21766](astral-sh/uv#21766))
- Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#&#8203;21779](astral-sh/uv#21779))

##### Preview features

- Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#&#8203;21163](astral-sh/uv#21163))
- Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#&#8203;21776](astral-sh/uv#21776))
- Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#&#8203;21777](astral-sh/uv#21777))
- Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#&#8203;21744](astral-sh/uv#21744))

##### Bug fixes

- Redact Azure shared access signatures from displayed and logged URLs ([#&#8203;21755](astral-sh/uv#21755))
- Check archive sizes from `pylock.toml` before reusing cached distributions ([#&#8203;21609](astral-sh/uv#21609))
- Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#&#8203;20631](astral-sh/uv#20631))
- Use the bundled `uv_build` backend only when its version matches active version pins ([#&#8203;21742](astral-sh/uv#21742))
- Handle malformed index URLs without panicking when credentials are configured ([#&#8203;21784](astral-sh/uv#21784))
- Report a configuration error instead of panicking for proxy URLs without a host ([#&#8203;21781](astral-sh/uv#21781))
- Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#&#8203;21783](astral-sh/uv#21783))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45Ny40IiwidXBkYXRlZEluVmVyIjoiNDQuOTcuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9kZXBlbmRlbmNpZXMiXX0=-->

Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/57
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
hbjydev pushed a commit to hbjydev/phoebe that referenced this pull request Sep 20, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [uv](https://github.com/astral-sh/uv) | tools | patch | `0.12.13` → `0.12.17` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (uv)</summary>

### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217)

[Compare Source](astral-sh/uv@0.12.16...0.12.17)

Released on 2026-09-18.

##### Enhancements

- Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#&#8203;21780](astral-sh/uv#21780))

##### Preview features

- Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#&#8203;21651](astral-sh/uv#21651))
- Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#&#8203;20746](astral-sh/uv#20746))
- Keep `uv workspace metadata` read-only unless `--sync` is provided ([#&#8203;21821](astral-sh/uv#21821))
- Apply `uv check` lock modes when retrieving workspace metadata ([#&#8203;21821](astral-sh/uv#21821))

##### Performance

- Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#&#8203;21650](astral-sh/uv#21650))
- Reduce resolver allocations when deduplicating package and distribution requests ([#&#8203;21810](astral-sh/uv#21810))

##### Bug fixes

- Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#&#8203;21825](astral-sh/uv#21825))

##### Documentation

- Clarify the 0.12.14 and 0.12.15 release notes ([#&#8203;21817](astral-sh/uv#21817))

### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216)

[Compare Source](astral-sh/uv@0.12.15...0.12.16)

Released on 2026-09-17.

##### Python

- Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#&#8203;21741](astral-sh/uv#21741))

##### Enhancements

- Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#&#8203;21562](astral-sh/uv#21562))
- Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#&#8203;21467](astral-sh/uv#21467))
- Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#&#8203;21766](astral-sh/uv#21766))
- Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#&#8203;21779](astral-sh/uv#21779))

##### Preview features

- Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#&#8203;21163](astral-sh/uv#21163))
- Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#&#8203;21776](astral-sh/uv#21776))
- Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#&#8203;21777](astral-sh/uv#21777))
- Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#&#8203;21744](astral-sh/uv#21744))

##### Bug fixes

- Redact Azure shared access signatures from displayed and logged URLs ([#&#8203;21755](astral-sh/uv#21755))
- Check archive sizes from `pylock.toml` before reusing cached distributions ([#&#8203;21609](astral-sh/uv#21609))
- Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#&#8203;20631](astral-sh/uv#20631))
- Use the bundled `uv_build` backend only when its version matches active version pins ([#&#8203;21742](astral-sh/uv#21742))
- Handle malformed index URLs without panicking when credentials are configured ([#&#8203;21784](astral-sh/uv#21784))
- Report a configuration error instead of panicking for proxy URLs without a host ([#&#8203;21781](astral-sh/uv#21781))
- Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#&#8203;21783](astral-sh/uv#21783))

### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215)

[Compare Source](astral-sh/uv@0.12.14...0.12.15)

Released on 2026-09-15.

This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using
`uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#&#8203;21699](astral-sh/uv#21699))

##### Performance

- Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#&#8203;21675](astral-sh/uv#21675))

##### Bug fixes

- Revert "Reject symlinked wheel installation destinations" ([#&#8203;21699](astral-sh/uv#21699))

### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214)

[Compare Source](astral-sh/uv@0.12.13...0.12.14)

Released on 2026-09-15.

Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#&#8203;17110](astral-sh/uv#17110), [#&#8203;21599](astral-sh/uv#21599), [#&#8203;21603](astral-sh/uv#21603))

Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#&#8203;17110](astral-sh/uv#17110))

##### Enhancements

- Resume interrupted downloads with HTTP Range requests when supported ([#&#8203;21570](astral-sh/uv#21570))
- Show underlying causes and hints in user warnings ([#&#8203;21565](astral-sh/uv#21565))
- Show resolver hints for failed `uv tool upgrade` operations ([#&#8203;21566](astral-sh/uv#21566))

##### Preview features

- Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#&#8203;21618](astral-sh/uv#21618))

##### Performance

- Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#&#8203;21619](astral-sh/uv#21619))
- Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#&#8203;21593](astral-sh/uv#21593))
- Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#&#8203;21621](astral-sh/uv#21621))

##### Bug fixes

- Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#&#8203;21672](astral-sh/uv#21672))
- Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#&#8203;21625](astral-sh/uv#21625))
- Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#&#8203;21639](astral-sh/uv#21639))
- Redact credentials and signatures from missing-path-segment URL errors ([#&#8203;21616](astral-sh/uv#21616))
- Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#&#8203;21640](astral-sh/uv#21640))
- Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#&#8203;21559](astral-sh/uv#21559))
- Suppress managed-Python fallback warnings under `--quiet` ([#&#8203;21565](astral-sh/uv#21565))
- Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#&#8203;21566](astral-sh/uv#21566))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45MC4yIiwidXBkYXRlZEluVmVyIjoiNDQuMTA0LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlL2dpdGh1Yi1yZWxlYXNlIiwidHlwZS9wYXRjaCJdfQ==-->

Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/632
VedantMadane added a commit to VedantMadane/uv that referenced this pull request Sep 21, 2026
…he manifest (astral-sh#21132)

## Summary

Minor cleanup related to astral-sh#20631.

## Test Plan

Existing coverage.
VedantMadane added a commit to VedantMadane/uv that referenced this pull request Sep 21, 2026
## Summary

This PR does three things:

* It fixes an issue where we were printing raw URLs in errors which
could themselves contain credentials.
* It cleans up the error messages for end users, into a form which in my
opinion is cleaner and clearer.
* It makes the underlying code simpler. ~~Which I need as a preparatory
change for astral-sh#20631.~~ (turns out I might not need it in the end)

## Test Plan

Snapshots adjusted, and a test-case for the issue has been added.
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Sep 22, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `actionlint`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint aube
editorconfig-checker ghalint pinact pipx:gh-action-pulse prek rumdl
shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (3 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` |
| `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` |
| `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` |

</details>

<details>
<summary>Release notes (3 tools)</summary>

<details>
<summary>editorconfig-checker: `4.0.1` → `4.0.2`
(editorconfig-checker/editorconfig-checker)</summary>

### v4.0.2

##
[4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2)
(2026-09-16)


### Bug Fixes

* **encoding:** detect 7-bit content with control characters as ASCII
([#629](editorconfig-checker/editorconfig-checker#629))
([289dc53](editorconfig-checker/editorconfig-checker@289dc53)),
closes
[#627](editorconfig-checker/editorconfig-checker#627)
* keep the file's existing line ending when adding a final newline
([#622](editorconfig-checker/editorconfig-checker#622))
([cea460f](editorconfig-checker/editorconfig-checker@cea460f))

</details>
<details>
<summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary>

### v0.2.74

### Added

- **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck
modes
([77f0e55](rvben/rumdl@77f0e55))

### Fixed

- **MD092**: allow scoped suppression of documented conflicts
([6f9a6cb](rvben/rumdl@6f9a6cb))
- **MD032**: keep parent list items open after nested lists
([952c507](rvben/rumdl@952c507))
- **MD026**: delete a setext heading's trailing punctuation where it
stands
([7f0981c](rvben/rumdl@7f0981c))
- **parser**: keep link reference definitions out of a setext heading
([80fdfc3](rvben/rumdl@80fdfc3))
- **parser**: read the whole paragraph as a setext heading
([5d7b046](rvben/rumdl@5d7b046))
- **parser**: lint the headings a short or quoted setext underline makes
([e183924](rvben/rumdl@e183924))
- **parser**: keep a container open below a block written inside it
([e2c13b7](rvben/rumdl@e2c13b7))
- **parser**: read an empty list item under a paragraph as its text
([68a04ae](rvben/rumdl@68a04ae))
- **MD013**: write one space at a soft break after a trailing space
([6388794](rvben/rumdl@6388794))
- **MD013**: keep a whole-line display math expression on its own line
([cc518ab](rvben/rumdl@cc518ab))
- **MD013**: read no math span through a code span
([f069246](rvben/rumdl@f069246))
- **MD013**: keep a definition-list marker written on its o… (truncated)

</details>
<details>
<summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary>

### 0.12.16

## Release Notes

Released on 2026-09-17.

### Python

- Add Pyodide 314.0.7, 0.29.5, and 0.27.8
([#21741](astral-sh/uv#21741))

### Enhancements

- Verify downloaded wheels and source distributions against hashes
supplied by package indexes
([#21562](astral-sh/uv#21562))
- Allow `build-constraint-dependencies` entries to include hashes for
verifying downloaded build dependencies
([#21467](astral-sh/uv#21467))
- Honor Darwin `platform_release` markers in `required-environments`
using macOS wheel deployment targets
([#21766](astral-sh/uv#21766))
- Reject unsupported Git URL schemes while parsing lockfiles instead of
panicking during frozen exports
([#21779](astral-sh/uv#21779))

### Preview features

- Support `lock-without-metadata` across all dependency types while
retaining `package.metadata` for remote URL dependencies to enable
offline validation
([#21163](astral-sh/uv#21163))
- Honor configured and command-line index settings, including
credentials, in `uv upgrade`
([#21776](astral-sh/uv#21776))
- Allow `uv check` to run in projects that are not managed by uv and
outside workspaces
([#21777](astral-sh/uv#21777))
- Respect `--python` and `UV_PYTHON` when selecting the Python version
for `uv check` ([#21744](astral-sh/uv#21744))

### Bug fixes

- Redact Azure shared access signatures from displayed and logged URLs
([#21755](astral-sh/uv#21755))
- Check archive sizes from `pylock.toml` before reusing cached
distributions ([#21609](astral-sh/uv#21609))
- Keep user-authored local dependency paths relative in lockfiles when
backend metadata reports absolute paths
([#20631](astral-sh/uv#20631))
- Use the bundled `uv_build` backend only when its version matches
active versi… (truncated)

### 0.12.17

## Release Notes

Released on 2026-09-18.

### Enhancements

- Reject unsupported Git archive paths in lockfiles with a clear error
instead of panicking during frozen exports
([#21780](astral-sh/uv#21780))

### Preview features

- Set minimum glibc and musl versions that universal resolutions must
support with `minimum-libc-version`
([#21651](astral-sh/uv#21651))
- Reject `pylock.toml` files whose wheel filenames do not match their
declared package names or versions
([#20746](astral-sh/uv#20746))
- Keep `uv workspace metadata` read-only unless `--sync` is provided
([#21821](astral-sh/uv#21821))
- Apply `uv check` lock modes when retrieving workspace metadata
([#21821](astral-sh/uv#21821))

### Performance

- Speed up builds with many exclusion patterns by avoiding quadratic
deduplication ([#21650](astral-sh/uv#21650))
- Reduce resolver allocations when deduplicating package and
distribution requests
([#21810](astral-sh/uv#21810))

### Bug fixes

- Prevent `required-environments` from selecting package versions whose
wheels require a newer macOS version than the configured Darwin baseline
([#21825](astral-sh/uv#21825))

### Documentation

- Clarify the 0.12.14 and 0.12.15 release notes
([#21817](astral-sh/uv#21817))

## Install uv 0.12.17

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex"
```

## Download uv 0.12.17

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Sep 22, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary>

### 0.12.16

## Release Notes

Released on 2026-09-17.

### Python

- Add Pyodide 314.0.7, 0.29.5, and 0.27.8
([#21741](astral-sh/uv#21741))

### Enhancements

- Verify downloaded wheels and source distributions against hashes
supplied by package indexes
([#21562](astral-sh/uv#21562))
- Allow `build-constraint-dependencies` entries to include hashes for
verifying downloaded build dependencies
([#21467](astral-sh/uv#21467))
- Honor Darwin `platform_release` markers in `required-environments`
using macOS wheel deployment targets
([#21766](astral-sh/uv#21766))
- Reject unsupported Git URL schemes while parsing lockfiles instead of
panicking during frozen exports
([#21779](astral-sh/uv#21779))

### Preview features

- Support `lock-without-metadata` across all dependency types while
retaining `package.metadata` for remote URL dependencies to enable
offline validation
([#21163](astral-sh/uv#21163))
- Honor configured and command-line index settings, including
credentials, in `uv upgrade`
([#21776](astral-sh/uv#21776))
- Allow `uv check` to run in projects that are not managed by uv and
outside workspaces
([#21777](astral-sh/uv#21777))
- Respect `--python` and `UV_PYTHON` when selecting the Python version
for `uv check` ([#21744](astral-sh/uv#21744))

### Bug fixes

- Redact Azure shared access signatures from displayed and logged URLs
([#21755](astral-sh/uv#21755))
- Check archive sizes from `pylock.toml` before reusing cached
distributions ([#21609](astral-sh/uv#21609))
- Keep user-authored local dependency paths relative in lockfiles when
backend metadata reports absolute paths
([#20631](astral-sh/uv#20631))
- Use the bundled `uv_build` backend only when its version matches
active versi… (truncated)

### 0.12.17

## Release Notes

Released on 2026-09-18.

### Enhancements

- Reject unsupported Git archive paths in lockfiles with a clear error
instead of panicking during frozen exports
([#21780](astral-sh/uv#21780))

### Preview features

- Set minimum glibc and musl versions that universal resolutions must
support with `minimum-libc-version`
([#21651](astral-sh/uv#21651))
- Reject `pylock.toml` files whose wheel filenames do not match their
declared package names or versions
([#20746](astral-sh/uv#20746))
- Keep `uv workspace metadata` read-only unless `--sync` is provided
([#21821](astral-sh/uv#21821))
- Apply `uv check` lock modes when retrieving workspace metadata
([#21821](astral-sh/uv#21821))

### Performance

- Speed up builds with many exclusion patterns by avoiding quadratic
deduplication ([#21650](astral-sh/uv#21650))
- Reduce resolver allocations when deduplicating package and
distribution requests
([#21810](astral-sh/uv#21810))

### Bug fixes

- Prevent `required-environments` from selecting package versions whose
wheels require a newer macOS version than the configured Darwin baseline
([#21825](astral-sh/uv#21825))

### Documentation

- Clarify the 0.12.14 and 0.12.15 release notes
([#21817](astral-sh/uv#21817))

## Install uv 0.12.17

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex"
```

## Download uv 0.12.17

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Sep 22, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `actionlint`
- `editorconfig-checker`
- `ghalint`
- `lychee`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint
editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek
rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (3 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` |
| `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` |
| `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` |

</details>

<details>
<summary>Release notes (3 tools)</summary>

<details>
<summary>editorconfig-checker: `4.0.1` → `4.0.2`
(editorconfig-checker/editorconfig-checker)</summary>

### v4.0.2

##
[4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2)
(2026-09-16)


### Bug Fixes

* **encoding:** detect 7-bit content with control characters as ASCII
([#629](editorconfig-checker/editorconfig-checker#629))
([289dc53](editorconfig-checker/editorconfig-checker@289dc53)),
closes
[#627](editorconfig-checker/editorconfig-checker#627)
* keep the file's existing line ending when adding a final newline
([#622](editorconfig-checker/editorconfig-checker#622))
([cea460f](editorconfig-checker/editorconfig-checker@cea460f))

</details>
<details>
<summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary>

### v0.2.74

### Added

- **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck
modes
([77f0e55](rvben/rumdl@77f0e55))

### Fixed

- **MD092**: allow scoped suppression of documented conflicts
([6f9a6cb](rvben/rumdl@6f9a6cb))
- **MD032**: keep parent list items open after nested lists
([952c507](rvben/rumdl@952c507))
- **MD026**: delete a setext heading's trailing punctuation where it
stands
([7f0981c](rvben/rumdl@7f0981c))
- **parser**: keep link reference definitions out of a setext heading
([80fdfc3](rvben/rumdl@80fdfc3))
- **parser**: read the whole paragraph as a setext heading
([5d7b046](rvben/rumdl@5d7b046))
- **parser**: lint the headings a short or quoted setext underline makes
([e183924](rvben/rumdl@e183924))
- **parser**: keep a container open below a block written inside it
([e2c13b7](rvben/rumdl@e2c13b7))
- **parser**: read an empty list item under a paragraph as its text
([68a04ae](rvben/rumdl@68a04ae))
- **MD013**: write one space at a soft break after a trailing space
([6388794](rvben/rumdl@6388794))
- **MD013**: keep a whole-line display math expression on its own line
([cc518ab](rvben/rumdl@cc518ab))
- **MD013**: read no math span through a code span
([f069246](rvben/rumdl@f069246))
- **MD013**: keep a definition-list marker written on its o… (truncated)

</details>
<details>
<summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary>

### 0.12.16

## Release Notes

Released on 2026-09-17.

### Python

- Add Pyodide 314.0.7, 0.29.5, and 0.27.8
([#21741](astral-sh/uv#21741))

### Enhancements

- Verify downloaded wheels and source distributions against hashes
supplied by package indexes
([#21562](astral-sh/uv#21562))
- Allow `build-constraint-dependencies` entries to include hashes for
verifying downloaded build dependencies
([#21467](astral-sh/uv#21467))
- Honor Darwin `platform_release` markers in `required-environments`
using macOS wheel deployment targets
([#21766](astral-sh/uv#21766))
- Reject unsupported Git URL schemes while parsing lockfiles instead of
panicking during frozen exports
([#21779](astral-sh/uv#21779))

### Preview features

- Support `lock-without-metadata` across all dependency types while
retaining `package.metadata` for remote URL dependencies to enable
offline validation
([#21163](astral-sh/uv#21163))
- Honor configured and command-line index settings, including
credentials, in `uv upgrade`
([#21776](astral-sh/uv#21776))
- Allow `uv check` to run in projects that are not managed by uv and
outside workspaces
([#21777](astral-sh/uv#21777))
- Respect `--python` and `UV_PYTHON` when selecting the Python version
for `uv check` ([#21744](astral-sh/uv#21744))

### Bug fixes

- Redact Azure shared access signatures from displayed and logged URLs
([#21755](astral-sh/uv#21755))
- Check archive sizes from `pylock.toml` before reusing cached
distributions ([#21609](astral-sh/uv#21609))
- Keep user-authored local dependency paths relative in lockfiles when
backend metadata reports absolute paths
([#20631](astral-sh/uv#20631))
- Use the bundled `uv_build` backend only when its version matches
active versi… (truncated)

### 0.12.17

## Release Notes

Released on 2026-09-18.

### Enhancements

- Reject unsupported Git archive paths in lockfiles with a clear error
instead of panicking during frozen exports
([#21780](astral-sh/uv#21780))

### Preview features

- Set minimum glibc and musl versions that universal resolutions must
support with `minimum-libc-version`
([#21651](astral-sh/uv#21651))
- Reject `pylock.toml` files whose wheel filenames do not match their
declared package names or versions
([#20746](astral-sh/uv#20746))
- Keep `uv workspace metadata` read-only unless `--sync` is provided
([#21821](astral-sh/uv#21821))
- Apply `uv check` lock modes when retrieving workspace metadata
([#21821](astral-sh/uv#21821))

### Performance

- Speed up builds with many exclusion patterns by avoiding quadratic
deduplication ([#21650](astral-sh/uv#21650))
- Reduce resolver allocations when deduplicating package and
distribution requests
([#21810](astral-sh/uv#21810))

### Bug fixes

- Prevent `required-environments` from selecting package versions whose
wheels require a newer macOS version than the configured Darwin baseline
([#21825](astral-sh/uv#21825))

### Documentation

- Clarify the 0.12.14 and 0.12.15 release notes
([#21817](astral-sh/uv#21817))

## Install uv 0.12.17

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex"
```

## Download uv 0.12.17

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-tips that referenced this pull request Sep 22, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary>

### 0.12.16

## Release Notes

Released on 2026-09-17.

### Python

- Add Pyodide 314.0.7, 0.29.5, and 0.27.8
([#21741](astral-sh/uv#21741))

### Enhancements

- Verify downloaded wheels and source distributions against hashes
supplied by package indexes
([#21562](astral-sh/uv#21562))
- Allow `build-constraint-dependencies` entries to include hashes for
verifying downloaded build dependencies
([#21467](astral-sh/uv#21467))
- Honor Darwin `platform_release` markers in `required-environments`
using macOS wheel deployment targets
([#21766](astral-sh/uv#21766))
- Reject unsupported Git URL schemes while parsing lockfiles instead of
panicking during frozen exports
([#21779](astral-sh/uv#21779))

### Preview features

- Support `lock-without-metadata` across all dependency types while
retaining `package.metadata` for remote URL dependencies to enable
offline validation
([#21163](astral-sh/uv#21163))
- Honor configured and command-line index settings, including
credentials, in `uv upgrade`
([#21776](astral-sh/uv#21776))
- Allow `uv check` to run in projects that are not managed by uv and
outside workspaces
([#21777](astral-sh/uv#21777))
- Respect `--python` and `UV_PYTHON` when selecting the Python version
for `uv check` ([#21744](astral-sh/uv#21744))

### Bug fixes

- Redact Azure shared access signatures from displayed and logged URLs
([#21755](astral-sh/uv#21755))
- Check archive sizes from `pylock.toml` before reusing cached
distributions ([#21609](astral-sh/uv#21609))
- Keep user-authored local dependency paths relative in lockfiles when
backend metadata reports absolute paths
([#20631](astral-sh/uv#20631))
- Use the bundled `uv_build` backend only when its version matches
active versi… (truncated)

### 0.12.17

## Release Notes

Released on 2026-09-18.

### Enhancements

- Reject unsupported Git archive paths in lockfiles with a clear error
instead of panicking during frozen exports
([#21780](astral-sh/uv#21780))

### Preview features

- Set minimum glibc and musl versions that universal resolutions must
support with `minimum-libc-version`
([#21651](astral-sh/uv#21651))
- Reject `pylock.toml` files whose wheel filenames do not match their
declared package names or versions
([#20746](astral-sh/uv#20746))
- Keep `uv workspace metadata` read-only unless `--sync` is provided
([#21821](astral-sh/uv#21821))
- Apply `uv check` lock modes when retrieving workspace metadata
([#21821](astral-sh/uv#21821))

### Performance

- Speed up builds with many exclusion patterns by avoiding quadratic
deduplication ([#21650](astral-sh/uv#21650))
- Reduce resolver allocations when deduplicating package and
distribution requests
([#21810](astral-sh/uv#21810))

### Bug fixes

- Prevent `required-environments` from selecting package versions whose
wheels require a newer macOS version than the configured Darwin baseline
([#21825](astral-sh/uv#21825))

### Documentation

- Clarify the 0.12.14 and 0.12.15 release notes
([#21817](astral-sh/uv#21817))

## Install uv 0.12.17

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex"
```

## Download uv 0.12.17

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Sep 23, 2026
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `actionlint`
- `editorconfig-checker`
- `ghalint`
- `lychee`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint
editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek
rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (3 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` |
| `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` |
| `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` |

</details>

<details>
<summary>Release notes (3 tools)</summary>

<details>
<summary>editorconfig-checker: `4.0.1` → `4.0.2`
(editorconfig-checker/editorconfig-checker)</summary>

### v4.0.2

##
[4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2)
(2026-09-16)


### Bug Fixes

* **encoding:** detect 7-bit content with control characters as ASCII
([#629](editorconfig-checker/editorconfig-checker#629))
([289dc53](editorconfig-checker/editorconfig-checker@289dc53)),
closes
[#627](editorconfig-checker/editorconfig-checker#627)
* keep the file's existing line ending when adding a final newline
([#622](editorconfig-checker/editorconfig-checker#622))
([cea460f](editorconfig-checker/editorconfig-checker@cea460f))

</details>
<details>
<summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary>

### v0.2.74

### Added

- **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck
modes
([77f0e55](rvben/rumdl@77f0e55))

### Fixed

- **MD092**: allow scoped suppression of documented conflicts
([6f9a6cb](rvben/rumdl@6f9a6cb))
- **MD032**: keep parent list items open after nested lists
([952c507](rvben/rumdl@952c507))
- **MD026**: delete a setext heading's trailing punctuation where it
stands
([7f0981c](rvben/rumdl@7f0981c))
- **parser**: keep link reference definitions out of a setext heading
([80fdfc3](rvben/rumdl@80fdfc3))
- **parser**: read the whole paragraph as a setext heading
([5d7b046](rvben/rumdl@5d7b046))
- **parser**: lint the headings a short or quoted setext underline makes
([e183924](rvben/rumdl@e183924))
- **parser**: keep a container open below a block written inside it
([e2c13b7](rvben/rumdl@e2c13b7))
- **parser**: read an empty list item under a paragraph as its text
([68a04ae](rvben/rumdl@68a04ae))
- **MD013**: write one space at a soft break after a trailing space
([6388794](rvben/rumdl@6388794))
- **MD013**: keep a whole-line display math expression on its own line
([cc518ab](rvben/rumdl@cc518ab))
- **MD013**: read no math span through a code span
([f069246](rvben/rumdl@f069246))
- **MD013**: keep a definition-list marker written on its o… (truncated)

</details>
<details>
<summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary>

### 0.12.16

## Release Notes

Released on 2026-09-17.

### Python

- Add Pyodide 314.0.7, 0.29.5, and 0.27.8
([#21741](astral-sh/uv#21741))

### Enhancements

- Verify downloaded wheels and source distributions against hashes
supplied by package indexes
([#21562](astral-sh/uv#21562))
- Allow `build-constraint-dependencies` entries to include hashes for
verifying downloaded build dependencies
([#21467](astral-sh/uv#21467))
- Honor Darwin `platform_release` markers in `required-environments`
using macOS wheel deployment targets
([#21766](astral-sh/uv#21766))
- Reject unsupported Git URL schemes while parsing lockfiles instead of
panicking during frozen exports
([#21779](astral-sh/uv#21779))

### Preview features

- Support `lock-without-metadata` across all dependency types while
retaining `package.metadata` for remote URL dependencies to enable
offline validation
([#21163](astral-sh/uv#21163))
- Honor configured and command-line index settings, including
credentials, in `uv upgrade`
([#21776](astral-sh/uv#21776))
- Allow `uv check` to run in projects that are not managed by uv and
outside workspaces
([#21777](astral-sh/uv#21777))
- Respect `--python` and `UV_PYTHON` when selecting the Python version
for `uv check` ([#21744](astral-sh/uv#21744))

### Bug fixes

- Redact Azure shared access signatures from displayed and logged URLs
([#21755](astral-sh/uv#21755))
- Check archive sizes from `pylock.toml` before reusing cached
distributions ([#21609](astral-sh/uv#21609))
- Keep user-authored local dependency paths relative in lockfiles when
backend metadata reports absolute paths
([#20631](astral-sh/uv#20631))
- Use the bundled `uv_build` backend only when its version matches
active versi… (truncated)

### 0.12.17

## Release Notes

Released on 2026-09-18.

### Enhancements

- Reject unsupported Git archive paths in lockfiles with a clear error
instead of panicking during frozen exports
([#21780](astral-sh/uv#21780))

### Preview features

- Set minimum glibc and musl versions that universal resolutions must
support with `minimum-libc-version`
([#21651](astral-sh/uv#21651))
- Reject `pylock.toml` files whose wheel filenames do not match their
declared package names or versions
([#20746](astral-sh/uv#20746))
- Keep `uv workspace metadata` read-only unless `--sync` is provided
([#21821](astral-sh/uv#21821))
- Apply `uv check` lock modes when retrieving workspace metadata
([#21821](astral-sh/uv#21821))

### Performance

- Speed up builds with many exclusion patterns by avoiding quadratic
deduplication ([#21650](astral-sh/uv#21650))
- Reduce resolver allocations when deduplicating package and
distribution requests
([#21810](astral-sh/uv#21810))

### Bug fixes

- Prevent `required-environments` from selecting package versions whose
wheels require a newer macOS version than the configured Darwin baseline
([#21825](astral-sh/uv#21825))

### Documentation

- Clarify the 0.12.14 and 0.12.15 release notes
([#21817](astral-sh/uv#21817))

## Install uv 0.12.17

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex"
```

## Download uv 0.12.17

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

This branch was previously deployed

1 inactive deployment
automations — b0f64105 Deployed Sep 15, 2026 by EliteTK via review / security review #46717
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Relative tool.uv.sources paths written as absolute in uv.lock since 0.10.10

2 participants