Skip to content

Verify sidecar hashes - #21563

Merged
charliermarsh merged 4 commits into
mainfrom
tk/verify-sidecar-hashes
Sep 9, 2026
Merged

Verify sidecar hashes#21563
charliermarsh merged 4 commits into
mainfrom
tk/verify-sidecar-hashes

Conversation

@EliteTK

@EliteTK EliteTK commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Previously we ignored index-provided hashes when downloading PEP 658 metadata sidecars. This PR stores those hashes in cached index responses (necessitating a bump of the simple and flat-index cache buckets) so we can reference them when downloading a sidecar, and verifies the sidecar bytes if the index provided a hash.

This also includes a fix for PEP 714 compliance where we could previously incorrectly pick dist-info-metadata or data-dist-info-metadata over core-metadata depending on the order in the json (HTML was already correct).

Existing cached sidecars are reused without hash verification; only freshly downloaded sidecars are checked against index-provided hashes.

Since this bumps cache, there's a commit removing the legacy zstd fields from CachedFile and File.

@EliteTK
prefer core-metadata over dist-info-metadata
857325e 
Previously we'd parse out the first non-null key between the two, which
meant that for registries which supported the newer `core-metadata` we'd
just ignore it if it happened to appear after `dist-info-metadata`.

Now we prefer it if it exists.

This is also now compliant with [PEP 714]

[PEP 714]: <https://peps.python.org/pep-0714/#clients>
@EliteTK
cache metadata hashes
18e0399 
If we go via the cache, we want to also have the metadata hashes if they
were initially present, so we can verify metadata integrity in that
case.
@EliteTK
Verify downloaded sidecars against index hashes
18eef91 
Check every supported digest advertised for a freshly downloaded sidecar
before parsing or caching its metadata, using the existing archive hasher.
Preserve ordinary reuse of already cached metadata.

Cover fresh and cached index responses, rejection without cache admission,
matching uppercase hashes, and reuse after a successful download.
@EliteTK
Remove obsolete zstd cache fields
904740f
@EliteTK
EliteTK requested a review from zsol September 9, 2026 17:45
@EliteTK EliteTK added bug Something isn't working do-not-merge Pull request is not ready to merge enhancement New feature or improvement to existing functionality and removed bug Something isn't working do-not-merge Pull request is not ready to merge labels Sep 9, 2026
@astral-sh-bot

astral-sh-bot Bot commented Sep 9, 2026

Copy link
Copy Markdown

uv test inventory changes

This PR changes the tests when compared with the main base revision.

  • Added tests: 3
  • Removed tests: 1
  • Changed suites: 3
uv-client: +1 / -1

Added:

  • uv-client::flat_index::tests::cached_files_round_trip

Removed:

  • uv-client::flat_index::tests::cached_files_ignore_deprecated_zstd
uv-pypi-types: +1 / -0

Added:

  • uv-pypi-types::simple_json::tests::pypi_core_metadata_precedence

Removed: none

uv::lock: +1 / -0

Added:

  • uv::lock::lock::lock_core_metadata_hash

Removed: none

charliermarsh
charliermarsh reviewed Sep 9, 2026
View reviewed changes
Comment thread crates/uv-pypi-types/src/simple_json.rs
if core_metadata.is_none() && dist_info_metadata.is_none() =>
{
dist_info_metadata = access.next_value()?;
}

@charliermarsh charliermarsh Sep 9, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the future, could plausibly be its own PR (but not important to carve it out at this point).

charliermarsh
charliermarsh approved these changes Sep 9, 2026
View reviewed changes

@charliermarsh charliermarsh left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great, thanks.

@charliermarsh
charliermarsh merged commit 6bdd893 into main Sep 9, 2026
230 of 233 checks passed
@charliermarsh
charliermarsh deleted the tk/verify-sidecar-hashes branch September 9, 2026 23:30
@zanieb zanieb mentioned this pull request Sep 10, 2026
Merged
@BrewTestBot BrewTestBot mentioned this pull request Sep 10, 2026
Merged
zanieb added a commit that referenced this pull request Sep 11, 2026
@zanieb
Consistently format error chains (by removing the miette path) (#17110)
2d7f589 
Route the remaining package-operation errors through `UvError` and the
standard error-chain renderer, then remove uv's direct `miette`
dependency and global hook. Diagnostics use the same source-chain
formatting and hint collection as other commands, with cause-specific
hints before general command advice. No-solution headings omit trailing
punctuation, retain their command context, and are not repeated inside
build-dependency errors. Final errors remain visible with `-q` and are
suppressed with `-qq`.

Classify operation failures by their underlying cause instead of by
which renderer handles them. Each error type owns its classification,
and type-erased build errors forward it. Expected package, resolution,
build, integrity, and lock-validation failures use code 1, while
recognized transport, cache, filesystem, and internal failures use code
2. This deliberately changes some previously inconsistent statuses
without attempting to normalize every standalone command or opaque
archive-error path. Command-line argument errors remain code 2.
Third-party dependencies may still use `miette` internally.

Prior work:

- #14546 removed `miette` from `uv venv`.
- #17535 added first-party line wrapping.
- #18090 established the `Hint` and `Hints` APIs.
- #20155 made hints explicit in error-chain rendering.
- #20156 preserved indentation in multiline causes.
- #20159 migrated `uv build` errors to standard rendering.
- #20160 migrated tool requirement errors to standard rendering.
- #20188 introduced the explicit `UvError` model.
- #20163 routed final errors through `Printer` for `-q` and `-qq`.
- #20217 enabled cause-chain rendering for user errors.
- #21563 added verification of index-provided metadata hashes.
- #21279 reused URL-provided hashes during resolution.
- #21584 renamed the hint-producing trait to `Hinted`.
- #21577 added explicit hint ordering.

Follow-up work:

- #21566 collects hints for batched `uv tool upgrade` failures and fixes
their quiet-mode output.
- #21568 routes Python upgrade request errors and version-file hints
through `UvError`.
- #21587 separates operation-specific diagnostic context from
exit-status classification.
- #21599 renders error and warning causes with compact tree connectors.
@ghappforreleaseplease ghappforreleaseplease Bot mentioned this pull request Sep 11, 2026
Merged
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Sep 11, 2026
@github-actions @jylenhof
chore(mise): upgrade uv
222d580 
Automated mise tool upgrades from local config.

mise-managed tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.12.7` → `0.12.13` | `0.12.7` → `0.12.13` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.12.7` → `0.12.13` (astral-sh/uv)</summary>

### 0.12.8

## Release Notes

Released on 2026-08-31.

### Enhancements

- Warn about invalid tool directories and continue upgrading valid tools with `uv tool upgrade --all` ([#21368](astral-sh/uv#21368))

### Preview features

- Deduplicate identical files within and across cached wheels with the `content-addressed-cache` preview feature ([#21327](astral-sh/uv#21327))
- Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files ([#21340](astral-sh/uv#21340))
- Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk ([#21344](astral-sh/uv#21344))

### Performance

- Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once ([#21379](astral-sh/uv#21379))
- Speed up dependency graph construction from large lockfiles by indexing packages during traversal ([#21373](astral-sh/uv#21373))
- Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks ([#21377](astral-sh/uv#21377))
- Speed up warm resolutions by reducing repeated marker interner work ([#21300](astral-sh/uv#21300))

### Bug fixes

- Do not trust hashes from direct URLs discovered only in wheel metadata when installing with `--require-hashes` ([#21348](astral-sh/uv#21348))
- Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled ([#21366](astral-sh/uv#21366))
- Redact Azure shared access signature (`sig`) query parameters from displayed URLs ([#21360](astral-sh/uv#21360))
- Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery ([#21341](https://github.com/astra… (truncated)

### 0.12.9

## Release Notes

Released on 2026-09-01.

### Python

- Add CPython 3.15.0rc2 ([#21413](astral-sh/uv#21413), [#21415](astral-sh/uv#21415))

### Enhancements

- Add `--no-locked` and `--no-frozen` to disable lock modes enabled by `UV_LOCKED` and `UV_FROZEN` for a single invocation ([#21408](astral-sh/uv#21408))
- Report the exact command-line lock-mode flag in warnings and errors ([#21402](astral-sh/uv#21402))

### Performance

- Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files ([#21372](astral-sh/uv#21372))

### Bug fixes

- Update `async_http_range_reader` to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels ([#21401](astral-sh/uv#21401))
- Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes ([#21382](astral-sh/uv#21382))
- Redact secrets in signed URLs from retry diagnostics, including nested request errors ([#21381](astral-sh/uv#21381))
- Give `--locked`, `--frozen`, `--check`, and `--check-exists` precedence over conflicting `UV_LOCKED` and `UV_FROZEN` values ([#21396](astral-sh/uv#21396))
- Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel ([#21400](astral-sh/uv#21400))

## Install uv 0.12.9

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex"
```

## Downlo… (truncated)

### 0.12.10

## Release Notes

Released on 2026-09-04.

### Enhancements

- Attempt to revoke short-lived PyPI trusted-publishing tokens after `uv publish` completes, including when publishing fails ([#21423](astral-sh/uv#21423))

### Preview features

- Omit `exclude-newer-package` settings for packages outside the resolution from `uv.lock` with the `missing-exclude-newer-package-lock` preview feature ([#21455](astral-sh/uv#21455))
- Show terminal dependency cycles in `uv tree --invert` output ([#21404](astral-sh/uv#21404))

### Performance

- Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification ([#21399](astral-sh/uv#21399))
- Speed up `uv publish` by hashing each artifact in a single blocking task and reusing the buffer across reads ([#21389](astral-sh/uv#21389))

### Bug fixes

- Prevent `--locked` from failing when `exclude-newer-package` settings differ only for packages outside the resolution ([#21454](astral-sh/uv#21454))
- Allow `uv lock --check` to reuse a lockfile when an absolute `exclude-newer` cutoff is moved later ([#19571](astral-sh/uv#19571))
- Allow `uv lock --check` to reuse a lockfile when a package-specific `exclude-newer` cutoff is disabled ([#21450](astral-sh/uv#21450))
- Require an explicit `--name` when `uv init` would infer a project name reserved for a Python interpreter ([#21395](astral-sh/uv#21395))
- Write package-specific `exclude-newer` cutoffs to `uv.lock` in a deterministic order ([#21453](astral-sh/uv#21453))

## Install uv 0.12.10

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.10/uv-installer.sh | sh
```

### Instal… (truncated)

### 0.12.11

## Release Notes

Released on 2026-09-08.

### Preview features

- Generate missing artifact hashes when exporting `pylock.toml` files to ensure they conform to PEP 751 ([#20146](astral-sh/uv#20146))
- Warn when `pylock.toml` artifact hash tables are empty, which will be rejected in a future uv release ([#21462](astral-sh/uv#21462))

### Performance

- Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements ([#21478](astral-sh/uv#21478))
- Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files ([#21468](astral-sh/uv#21468))
- Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads ([#21500](astral-sh/uv#21500))
- Speed up local wheel installs by reusing ZIP readers and buffers across extracted files ([#21499](astral-sh/uv#21499))
- Avoid transitive dependency checks and unnecessary resolution when `uv pip install --no-deps` finds the requested packages already installed ([#21523](astral-sh/uv#21523))

### Bug fixes

- Verify source archives against hashes recorded in `uv.lock` before reading their metadata or running their build backends ([#21223](astral-sh/uv#21223))
- Verify supplied hashes for registry requirements pinned with `===` under both `--verify-hashes` and `--require-hashes` ([#21543](astral-sh/uv#21543))
- Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided ([#21544](astral-sh/uv#21544))
- Support PowerShell virtual environment activation from UNC paths, including WSL paths ([#19159](astral-sh/uv#19159))
- Tri… (truncated)

### 0.12.12

## Release Notes

Released on 2026-09-09.

The executables in our macOS and Windows release archives and `uv` and `uv_build` wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

### Bug fixes

- Exclude distributions uploaded after the `exclude-newer` cutoff from lockfiles and generated requirement hashes ([#21539](astral-sh/uv#21539))

## Install uv 0.12.12

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.ps1 | iex"
```

## Download uv 0.12.12

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-x86_64-apple-darwin.tar.gz.sha256) |
| [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-pc-windows-msvc.zip.sha256) |
| [uv-i68… (truncated)

### 0.12.13

## Release Notes

Released on 2026-09-10.

### Python

- Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431))

### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563))

### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555))

### Performance

- Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279))

### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563))

## Install uv 0.12.13

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"
```

## Download uv 0.12.13

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) |
| [uv-aarch64-pc… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/github-actions-resources that referenced this pull request Sep 11, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade uv (#93)
f6f869c 
Automated mise tool upgrades from local config.

mise-managed tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.12.7` → `0.12.13` | `0.12.7` → `0.12.13` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.12.7` → `0.12.13` (astral-sh/uv)</summary>

### 0.12.8

## Release Notes

Released on 2026-08-31.

### Enhancements

- Warn about invalid tool directories and continue upgrading valid tools with `uv tool upgrade --all` ([#21368](astral-sh/uv#21368))

### Preview features

- Deduplicate identical files within and across cached wheels with the `content-addressed-cache` preview feature ([#21327](astral-sh/uv#21327))
- Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files ([#21340](astral-sh/uv#21340))
- Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk ([#21344](astral-sh/uv#21344))

### Performance

- Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once ([#21379](astral-sh/uv#21379))
- Speed up dependency graph construction from large lockfiles by indexing packages during traversal ([#21373](astral-sh/uv#21373))
- Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks ([#21377](astral-sh/uv#21377))
- Speed up warm resolutions by reducing repeated marker interner work ([#21300](astral-sh/uv#21300))

### Bug fixes

- Do not trust hashes from direct URLs discovered only in wheel metadata when installing with `--require-hashes` ([#21348](astral-sh/uv#21348))
- Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled ([#21366](astral-sh/uv#21366))
- Redact Azure shared access signature (`sig`) query parameters from displayed URLs ([#21360](astral-sh/uv#21360))
- Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery ([#21341](https://github.com/astra… (truncated)

### 0.12.9

## Release Notes

Released on 2026-09-01.

### Python

- Add CPython 3.15.0rc2 ([#21413](astral-sh/uv#21413), [#21415](astral-sh/uv#21415))

### Enhancements

- Add `--no-locked` and `--no-frozen` to disable lock modes enabled by `UV_LOCKED` and `UV_FROZEN` for a single invocation ([#21408](astral-sh/uv#21408))
- Report the exact command-line lock-mode flag in warnings and errors ([#21402](astral-sh/uv#21402))

### Performance

- Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files ([#21372](astral-sh/uv#21372))

### Bug fixes

- Update `async_http_range_reader` to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels ([#21401](astral-sh/uv#21401))
- Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes ([#21382](astral-sh/uv#21382))
- Redact secrets in signed URLs from retry diagnostics, including nested request errors ([#21381](astral-sh/uv#21381))
- Give `--locked`, `--frozen`, `--check`, and `--check-exists` precedence over conflicting `UV_LOCKED` and `UV_FROZEN` values ([#21396](astral-sh/uv#21396))
- Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel ([#21400](astral-sh/uv#21400))

## Install uv 0.12.9

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex"
```

## Downlo… (truncated)

### 0.12.10

## Release Notes

Released on 2026-09-04.

### Enhancements

- Attempt to revoke short-lived PyPI trusted-publishing tokens after `uv publish` completes, including when publishing fails ([#21423](astral-sh/uv#21423))

### Preview features

- Omit `exclude-newer-package` settings for packages outside the resolution from `uv.lock` with the `missing-exclude-newer-package-lock` preview feature ([#21455](astral-sh/uv#21455))
- Show terminal dependency cycles in `uv tree --invert` output ([#21404](astral-sh/uv#21404))

### Performance

- Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification ([#21399](astral-sh/uv#21399))
- Speed up `uv publish` by hashing each artifact in a single blocking task and reusing the buffer across reads ([#21389](astral-sh/uv#21389))

### Bug fixes

- Prevent `--locked` from failing when `exclude-newer-package` settings differ only for packages outside the resolution ([#21454](astral-sh/uv#21454))
- Allow `uv lock --check` to reuse a lockfile when an absolute `exclude-newer` cutoff is moved later ([#19571](astral-sh/uv#19571))
- Allow `uv lock --check` to reuse a lockfile when a package-specific `exclude-newer` cutoff is disabled ([#21450](astral-sh/uv#21450))
- Require an explicit `--name` when `uv init` would infer a project name reserved for a Python interpreter ([#21395](astral-sh/uv#21395))
- Write package-specific `exclude-newer` cutoffs to `uv.lock` in a deterministic order ([#21453](astral-sh/uv#21453))

## Install uv 0.12.10

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.10/uv-installer.sh | sh
```

### Instal… (truncated)

### 0.12.11

## Release Notes

Released on 2026-09-08.

### Preview features

- Generate missing artifact hashes when exporting `pylock.toml` files to ensure they conform to PEP 751 ([#20146](astral-sh/uv#20146))
- Warn when `pylock.toml` artifact hash tables are empty, which will be rejected in a future uv release ([#21462](astral-sh/uv#21462))

### Performance

- Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements ([#21478](astral-sh/uv#21478))
- Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files ([#21468](astral-sh/uv#21468))
- Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads ([#21500](astral-sh/uv#21500))
- Speed up local wheel installs by reusing ZIP readers and buffers across extracted files ([#21499](astral-sh/uv#21499))
- Avoid transitive dependency checks and unnecessary resolution when `uv pip install --no-deps` finds the requested packages already installed ([#21523](astral-sh/uv#21523))

### Bug fixes

- Verify source archives against hashes recorded in `uv.lock` before reading their metadata or running their build backends ([#21223](astral-sh/uv#21223))
- Verify supplied hashes for registry requirements pinned with `===` under both `--verify-hashes` and `--require-hashes` ([#21543](astral-sh/uv#21543))
- Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided ([#21544](astral-sh/uv#21544))
- Support PowerShell virtual environment activation from UNC paths, including WSL paths ([#19159](astral-sh/uv#19159))
- Tri… (truncated)

### 0.12.12

## Release Notes

Released on 2026-09-09.

The executables in our macOS and Windows release archives and `uv` and `uv_build` wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

### Bug fixes

- Exclude distributions uploaded after the `exclude-newer` cutoff from lockfiles and generated requirement hashes ([#21539](astral-sh/uv#21539))

## Install uv 0.12.12

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.ps1 | iex"
```

## Download uv 0.12.12

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-x86_64-apple-darwin.tar.gz.sha256) |
| [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-pc-windows-msvc.zip.sha256) |
| [uv-i68… (truncated)

### 0.12.13

## Release Notes

Released on 2026-09-10.

### Python

- Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431))

### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563))

### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555))

### Performance

- Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279))

### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563))

## Install uv 0.12.13

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"
```

## Download uv 0.12.13

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) |
| [uv-aarch64-pc… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This was referenced Sep 11, 2026
Merged
Merged
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Sep 11, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade uv (#222)
5185fdd 
Automated mise tool upgrades from local config.

mise-managed tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.12.12` → `0.12.13` | `0.12.12` → `0.12.13` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.12.12` → `0.12.13` (astral-sh/uv)</summary>

### 0.12.13

## Release Notes

Released on 2026-09-10.

### Python

- Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431))

### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563))

### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555))

### Performance

- Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279))

### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563))

## Install uv 0.12.13

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"
```

## Download uv 0.12.13

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) |
| [uv-aarch64-pc… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Sep 12, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#79)
44bfe04 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `actionlint`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (2 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `rumdl` | `0.2.70` → `0.2.71` | `0.2.70` → `0.2.71` |
| `uv` | `0.12.12` → `0.12.13` | `0.12.12` → `0.12.13` |

</details>

<details>
<summary>Release notes (2 tools)</summary>

<details>
<summary>rumdl: `0.2.70` → `0.2.71` (rvben/rumdl)</summary>

### v0.2.71

### Fixed

- **MD034**: do not report the tail of a schemed URI as a bare email ([a8df862](rvben/rumdl@a8df862))
- **lsp**: write the mailto scheme when converting a bare email to a link ([600e229](rvben/rumdl@600e229))
- **config**: measure suggestion distance in characters, not bytes ([eabdf80](rvben/rumdl@eabdf80))
- **MD034**: emit a link, not an autolink, when fixing bare URLs in MDX ([98a6255](rvben/rumdl@98a6255))
- **config**: suggestion panics on multibyte characters ([dd88a4a](rvben/rumdl@dd88a4a))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.71-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://git… (truncated)

</details>
<details>
<summary>uv: `0.12.12` → `0.12.13` (astral-sh/uv)</summary>

### 0.12.13

## Release Notes

Released on 2026-09-10.

### Python

- Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431))

### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563))

### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555))

### Performance

- Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279))

### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563))

## Install uv 0.12.13

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"
```

## Download uv 0.12.13

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) |
| [uv-aarch64-pc… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
hbjydev pushed a commit to hbjydev/phoebe that referenced this pull request Sep 14, 2026
hayden-bot git.hayden.moe Instance
fix(github-release): update release uv (0.12.12 → 0.12.13) (#563)
c2e7fa2 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [uv](https://github.com/astral-sh/uv) | tools | patch | `0.12.12` → `0.12.13` |

---

### Release Notes

<details>
<summary>astral-sh/uv (uv)</summary>

### [`v0.12.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01213)

[Compare Source](astral-sh/uv@0.12.12...0.12.13)

Released on 2026-09-10.

##### Python

- Add GraalPy 3.13.0 ([#&#8203;21431](astral-sh/uv#21431))

##### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars ([#&#8203;21563](astral-sh/uv#21563))

##### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#&#8203;21555](astral-sh/uv#21555))

##### Performance

- Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#&#8203;21279](astral-sh/uv#21279))

##### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#&#8203;18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses ([#&#8203;21563](astral-sh/uv#21563))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4yIiwidXBkYXRlZEluVmVyIjoiNDQuODMuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvZ2l0aHViLXJlbGVhc2UiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/563
This was referenced Sep 14, 2026
Merged
Merged
jylenhof pushed a commit to jylenhof/mise-en-place-resources that referenced this pull request Sep 15, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade local tools (#66)
14e024d 
Automated mise tool upgrades from local config.

mise-managed tools:
- `action-validator`
- `actionlint`
- `editorconfig-checker`
- `ghalint`
- `lychee`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint
editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek
rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (5 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `pinact` | `4.1.1` → `5.0.0` | `4.1.1` → `5.0.0` |
| `prek` | `0.5.2` → `0.5.3` | `0.5.2` → `0.5.3` |
| `rumdl` | `0.2.70` → `0.2.73` | `0.2.70` → `0.2.73` |
| `tombi` | `1.5.4` → `1.5.5` | `1.5.4` → `1.5.5` |
| `uv` | `0.12.12` → `0.12.13` | `0.12.12` → `0.12.13` |

</details>

<details>
<summary>Release notes (5 tools)</summary>

<details>
<summary>pinact: `4.1.1` → `5.0.0` (suzuki-shunsuke/pinact)</summary>

### v5.0.0

suzuki-shunsuke/pinact@v4.1.1...v5.0.0

[Upgrade
Guide](https://github.com/suzuki-shunsuke/pinact/blob/v5.0.0/docs/upgrade_guide/v5.md)

## 🤖 pinact is now AI friendly

v5 is about coding agents. An agent that is asked about pinact, or that
hits a pinact error in CI, has until now had to answer from its training
data, from the source code, or from whichever version of the website it
happened to land on. v5 gives it three things so that it answers from
the pinact that is actually installed:

#1708 An Agent Skill
#1708 `pinact docs`: the documentation, embedded in the binary
#1705 `pinact json-schema`: the JSON Schema of the configuration file,
embedded in the binary

### An Agent Skill

```sh
gh skill install suzuki-shunsuke/pinact pinact
```

The skill carries no documentation of its own, deliberately. It is
installed separately from the binary, so anything copied into it would
go stale, and an agent would confidently describe a flag or an error
code of a version that isn't the one on the machine. Instead the skill
tells the agent to run `pinact docs list` and `pinact docs show <name>`
before answering, so the answer always comes from the installed pinact
and the skill and the binary can never disagree about a version.

It adds only the few things an agent gets wrong unless it is told: that
`pinact run` edits files and `--check` is the way to look without
touching them, that `--update` changes which version a workflow uses,
and that the exit codes 1 and 2 are findings rather than pinact failing.

### `pinact docs`

```console
$ pinact docs list          # the name and the description of every document, as JSON
$ pinact docs show config   # one document
$ pinact docs show codes/005
```

The documents are embedded in the binary, so there is nothing to fetch.
An agent doesn't need network access to read them, doesn't have to guess
which branch or tag of the repository to read, and cannot land on the
documentation of a versi… (truncated)

</details>
<details>
<summary>prek: `0.5.2` → `0.5.3` (j178/prek)</summary>

### v0.5.3

## Release Notes

Released on 2026-09-13.

### Enhancements

- Add PEP 740 attestations for PyPI releases
([#2705](j178/prek#2705))
- Add a `check-jsonc` builtin hook
([#2682](j178/prek#2682))
- Allow disabling automatic uv installation
([#2702](j178/prek#2702))

### Bug fixes

- Fix Julia additional dependency specifiers
([#2703](j178/prek#2703))
- Update `granit-parser` to fix YAML flow indentation
([#2707](j178/prek#2707))

### Contributors

- @​clbarnes
- @​j178
- @​tisonkun

## Install prek 0.5.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

## Download prek 0.5.3

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-apple-darwin.tar.gz.sha256)
|
|
[prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-apple-darwin.tar.gz.sha256)
|
|
[prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-pc-windows-msvc.zip)
| ARM64 Windows |
[checksum](https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-pc-windows-msvc.zip.sha256)
|
|
[prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/downloa…
(truncated)

</details>
<details>
<summary>rumdl: `0.2.70` → `0.2.73` (rvben/rumdl)</summary>

### v0.2.71

### Fixed

- **MD034**: do not report the tail of a schemed URI as a bare email
([a8df862](rvben/rumdl@a8df862))
- **lsp**: write the mailto scheme when converting a bare email to a
link
([600e229](rvben/rumdl@600e229))
- **config**: measure suggestion distance in characters, not bytes
([eabdf80](rvben/rumdl@eabdf80))
- **MD034**: emit a link, not an autolink, when fixing bare URLs in MDX
([98a6255](rvben/rumdl@98a6255))
- **config**: suggestion panics on multibyte characters
([dd88a4a](rvben/rumdl@dd88a4a))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz)
| Linux x86_64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz)
| Linux ARM64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.71-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-musl.tar.gz)
| Linux ARM64 (musl) | [checksum](https://git… (truncated)

### v0.2.72

### Added

- **MD090**: add rule flagging horizontal rules directly before headings
([09dcae5](rvben/rumdl@09dcae5))

### Fixed

- **MD013**: end a sentence after a closing marker run of any shape
([e63206c](rvben/rumdl@e63206c))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.72-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.72-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-unknown-linux-musl.tar.gz)
| Linux x86_64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.72-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-aarch64-unknown-linux-gnu.tar.gz)
| Linux ARM64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-aarch64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.72-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-aarch64-unknown-linux-musl.tar.gz)
| Linux ARM64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-aarch64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.72-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-apple-darwin.tar.gz)
| macOS x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-apple-darwin.tar.gz.sha256)
|
|
[rumdl-v0.2.72-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/…
(truncated)

### v0.2.73

### Fixed

- **MD022,MD031,MD032,MD058**: count a comment-only line as a blank line
([b394e30](rvben/rumdl@b394e30))
- **MD057**: stop requiring index.md for directory links in filesystem
mode
([c04ae4e](rvben/rumdl@c04ae4e))
- **MD051**: validate fragments in repository-absolute cross-file links
([ead5f39](rvben/rumdl@ead5f39))
- **parser**: stop reading headings inside blocks whose body is not
Markdown
([59958b1](rvben/rumdl@59958b1))
- **MD077**: carry a code block's interior indentation when reindenting
its fence
([00c578d](rvben/rumdl@00c578d))


## Downloads

| File | Platform | Checksum |
|------|----------|----------|
|
[rumdl-v0.2.73-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-x86_64-unknown-linux-gnu.tar.gz)
| Linux x86_64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-x86_64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.73-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-x86_64-unknown-linux-musl.tar.gz)
| Linux x86_64 (musl) |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-x86_64-unknown-linux-musl.tar.gz.sha256)
|
|
[rumdl-v0.2.73-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-aarch64-unknown-linux-gnu.tar.gz)
| Linux ARM64 |
[checksum](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-aarch64-unknown-linux-gnu.tar.gz.sha256)
|
|
[rumdl-v0.2.73-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-aarch64-unknown-linux-musl.tar.gz)
| L… (truncated)

</details>
<details>
<summary>tombi: `1.5.4` → `1.5.5` (tombi-toml/tombi)</summary>

### v1.5.5

<!-- Release notes generated using configuration in .github/release.yml
at v1.5.5 -->

## What's Changed
### 🛠️ Other Changes
* fix(lsp): stop logging empty workspace diagnostics by @​ya7010 in
tombi-toml/tombi#2177
* fix(vscode): persist status bar item visibility by @​ya7010 in
tombi-toml/tombi#2178
* fix(lsp): skip workspace diagnostics when lsp.diagnostic is disabled
by @​ya7010 in tombi-toml/tombi#2179


**Full Changelog**:
tombi-toml/tombi@v1.5.4...v1.5.5

</details>
<details>
<summary>uv: `0.12.12` → `0.12.13` (astral-sh/uv)</summary>

### 0.12.13

## Release Notes

Released on 2026-09-10.

### Python

- Add GraalPy 3.13.0
([#21431](astral-sh/uv#21431))

### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars
([#21563](astral-sh/uv#21563))

### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members
of a virtual workspace
([#21555](astral-sh/uv#21555))

### Performance

- Avoid full wheel downloads during resolution by reusing supported
hashes from direct URL fragments when metadata is available separately
([#21279](astral-sh/uv#21279))

### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano
Server and reduce antivirus contention
([#18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses
([#21563](astral-sh/uv#21563))

## Install uv 0.12.13

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"
```

## Download uv 0.12.13

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256)
|
| [uv-aarch64-pc… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
jylenhof pushed a commit to jylenhof/mise-en-place-tips that referenced this pull request Sep 16, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade uv (#95)
18ca7c7 
Automated mise tool upgrades from local config.

mise-managed tools:
- `uv`

Command: `mise upgrade --bump --local uv`

<details>
<summary>Version changelog (uv)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `uv` | `0.12.12` → `0.12.13` | `0.12.12` → `0.12.13` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>uv: `0.12.12` → `0.12.13` (astral-sh/uv)</summary>

### 0.12.13

## Release Notes

Released on 2026-09-10.

### Python

- Add GraalPy 3.13.0
([#21431](astral-sh/uv#21431))

### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars
([#21563](astral-sh/uv#21563))

### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members
of a virtual workspace
([#21555](astral-sh/uv#21555))

### Performance

- Avoid full wheel downloads during resolution by reusing supported
hashes from direct URL fragments when metadata is available separately
([#21279](astral-sh/uv#21279))

### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano
Server and reduce antivirus contention
([#18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses
([#21563](astral-sh/uv#21563))

## Install uv 0.12.13

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"
```

## Download uv 0.12.13

|  File  | Platform | Checksum |
|--------|----------|----------|
|
[uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz)
| Apple Silicon macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256)
|
|
[uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz)
| Intel macOS |
[checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256)
|
| [uv-aarch64-pc… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@scottames-github-bot scottames-github-bot Bot mentioned this pull request Sep 16, 2026
Merged
1 task
luketainton pushed a commit to luketainton/repos_labmcp that referenced this pull request Sep 16, 2026
renovate[bot] @luketainton
chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.15 (#55)
4d2c44e 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.12.12` → `0.12.15` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/51) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215)

[Compare Source](astral-sh/uv@0.12.14...0.12.15)

Released on 2026-09-15.

This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using
`uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#&#8203;21699](astral-sh/uv#21699))

##### Performance

- Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#&#8203;21675](astral-sh/uv#21675))

##### Bug fixes

- Revert "Reject symlinked wheel installation destinations" ([#&#8203;21699](astral-sh/uv#21699))

### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214)

[Compare Source](astral-sh/uv@0.12.13...0.12.14)

Released on 2026-09-15.

Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#&#8203;17110](astral-sh/uv#17110), [#&#8203;21599](astral-sh/uv#21599), [#&#8203;21603](astral-sh/uv#21603))

Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#&#8203;17110](astral-sh/uv#17110))

##### Enhancements

- Resume interrupted downloads with HTTP Range requests when supported ([#&#8203;21570](astral-sh/uv#21570))
- Show underlying causes and hints in user warnings ([#&#8203;21565](astral-sh/uv#21565))
- Show resolver hints for failed `uv tool upgrade` operations ([#&#8203;21566](astral-sh/uv#21566))

##### Preview features

- Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#&#8203;21618](astral-sh/uv#21618))

##### Performance

- Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#&#8203;21619](astral-sh/uv#21619))
- Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#&#8203;21593](astral-sh/uv#21593))
- Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#&#8203;21621](astral-sh/uv#21621))

##### Bug fixes

- Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#&#8203;21672](astral-sh/uv#21672))
- Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#&#8203;21625](astral-sh/uv#21625))
- Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#&#8203;21639](astral-sh/uv#21639))
- Redact credentials and signatures from missing-path-segment URL errors ([#&#8203;21616](astral-sh/uv#21616))
- Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#&#8203;21640](astral-sh/uv#21640))
- Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#&#8203;21559](astral-sh/uv#21559))
- Suppress managed-Python fallback warnings under `--quiet` ([#&#8203;21565](astral-sh/uv#21565))
- Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#&#8203;21566](astral-sh/uv#21566))

### [`v0.12.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01213)

[Compare Source](astral-sh/uv@0.12.12...0.12.13)

Released on 2026-09-10.

##### Python

- Add GraalPy 3.13.0 ([#&#8203;21431](astral-sh/uv#21431))

##### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars ([#&#8203;21563](astral-sh/uv#21563))

##### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#&#8203;21555](astral-sh/uv#21555))

##### Performance

- Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#&#8203;21279](astral-sh/uv#21279))

##### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#&#8203;18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses ([#&#8203;21563](astral-sh/uv#21563))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43Ny4wIiwidXBkYXRlZEluVmVyIjoiNDQuNzcuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9kZXBlbmRlbmNpZXMiXX0=-->

Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/55
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
luketainton pushed a commit to luketainton/luke_rsu that referenced this pull request Sep 16, 2026
renovate[bot] @luketainton
chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.15 (#44)
6f2776a 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.12.12` → `0.12.15` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215)

[Compare Source](astral-sh/uv@0.12.14...0.12.15)

Released on 2026-09-15.

This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using
`uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#&#8203;21699](astral-sh/uv#21699))

##### Performance

- Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#&#8203;21675](astral-sh/uv#21675))

##### Bug fixes

- Revert "Reject symlinked wheel installation destinations" ([#&#8203;21699](astral-sh/uv#21699))

### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214)

[Compare Source](astral-sh/uv@0.12.13...0.12.14)

Released on 2026-09-15.

Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#&#8203;17110](astral-sh/uv#17110), [#&#8203;21599](astral-sh/uv#21599), [#&#8203;21603](astral-sh/uv#21603))

Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#&#8203;17110](astral-sh/uv#17110))

##### Enhancements

- Resume interrupted downloads with HTTP Range requests when supported ([#&#8203;21570](astral-sh/uv#21570))
- Show underlying causes and hints in user warnings ([#&#8203;21565](astral-sh/uv#21565))
- Show resolver hints for failed `uv tool upgrade` operations ([#&#8203;21566](astral-sh/uv#21566))

##### Preview features

- Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#&#8203;21618](astral-sh/uv#21618))

##### Performance

- Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#&#8203;21619](astral-sh/uv#21619))
- Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#&#8203;21593](astral-sh/uv#21593))
- Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#&#8203;21621](astral-sh/uv#21621))

##### Bug fixes

- Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#&#8203;21672](astral-sh/uv#21672))
- Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#&#8203;21625](astral-sh/uv#21625))
- Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#&#8203;21639](astral-sh/uv#21639))
- Redact credentials and signatures from missing-path-segment URL errors ([#&#8203;21616](astral-sh/uv#21616))
- Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#&#8203;21640](astral-sh/uv#21640))
- Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#&#8203;21559](astral-sh/uv#21559))
- Suppress managed-Python fallback warnings under `--quiet` ([#&#8203;21565](astral-sh/uv#21565))
- Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#&#8203;21566](astral-sh/uv#21566))

### [`v0.12.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01213)

[Compare Source](astral-sh/uv@0.12.12...0.12.13)

Released on 2026-09-10.

##### Python

- Add GraalPy 3.13.0 ([#&#8203;21431](astral-sh/uv#21431))

##### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars ([#&#8203;21563](astral-sh/uv#21563))

##### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#&#8203;21555](astral-sh/uv#21555))

##### Performance

- Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#&#8203;21279](astral-sh/uv#21279))

##### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#&#8203;18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses ([#&#8203;21563](astral-sh/uv#21563))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43Ny4wIiwidXBkYXRlZEluVmVyIjoiNDQuNzcuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9kZXBlbmRlbmNpZXMiXX0=-->

Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/44
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
social4hyq pushed a commit to social4hyq/homebrew-core that referenced this pull request Sep 20, 2026
HarmonybrewBot HarmonybrewBot
!20056 merge bump-uv-0.12.13 into main
34aa884 
uv 0.12.13

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre>## Release Notes

Released on 2026-09-10.

### Python

- Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431))

### Enhancements

- Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563))

### Preview features

- Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555))

### Performance

- Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279))

### Bug fixes

- Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713))
- Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563))

## Install uv 0.12.13

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"
```

## Download uv 0.12.13

|  File  | Platform | Checksum |
|--------|----------|----------|
| [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) |
| [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) |
| [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-pc-windows-msvc.zip.sha256) |
| [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-pc-windows-msvc.zip.sha256) |
| [uv-x86_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-pc-windows-msvc.zip.sha256) |
| [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-unknown-linux-gnu.tar.gz.sha256) |
| [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) |
| [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) |
| [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-s390x-unknown-linux-gnu.tar.gz.sha256) |
| [uv-x86_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) |
| [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-musl.tar.gz.sha256) |
| [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-unknown-linux-musl.tar.gz.sha256) |
| [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) |
| [uv-x86_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) |
| [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) |

## Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify):
```sh
gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv
```

You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly:
```sh
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
```


</pre>
  <p>View the full release notes at <a href="https://github.com/astral-sh/uv/releases/tag/0.12.13">https://github.com/astral-sh/uv/releases/tag/0.12.13</a>.</p>
</details>
<hr>

See merge request: Harmonybrew/homebrew-core!20056

This branch was previously deployed

1 inactive deployment
automations — 904740fd Deployed Sep 9, 2026 by EliteTK via review / security review #46196
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@charliermarsh charliermarsh charliermarsh approved these changes
@zsol zsol Awaiting requested review from zsol

Assignees

No one assigned

Labels

enhancement New feature or improvement to existing functionality

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@EliteTK @charliermarsh