chore(deps): update all non-major dependencies - #124
Open
martynvdijke wants to merge 1 commit into
Open
Conversation
martynvdijke
force-pushed
the
renovate/all-minor-patch
branch
from
July 28, 2026 05:36
e164139 to
6661033
Compare
martynvdijke
changed the title
martynvdijke
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
August 1, 2026 05:44
923d728 to
1e9f13d
Compare
martynvdijke
force-pushed
the
renovate/all-minor-patch
branch
from
August 3, 2026 06:01
1e9f13d to
da0f2a9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v46.1.20→v46.2.1>=0.11.0,<0.12.0→>=0.12.1,<0.13.05.109.0→5.109.27.2.1→7.2.2Release Notes
renovatebot/github-action (renovatebot/github-action)
v46.2.1Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.2.0Compare Source
Features
Documentation
Miscellaneous Chores
Continuous Integration
v46.1.21Compare Source
Documentation
GITHUB_TOKENcan be used (#1064) (13e8ee8)Miscellaneous Chores
Build System
Continuous Integration
astral-sh/uv (uv_build)
v0.12.1Compare Source
Released on 2026-07-31.
Enhancements
--prerelease-package(#20837)activate.xsh) (#19740)uv add --indexwhen updatingpyproject.toml(#20817)Preview features
uv checkwith--fix(#20793)uv check(#20742)Performance
Bug fixes
uv tool update-shellanduv python update-shellexit (#20842)--find-linkspaths in requirements files relative to the containing file (#20832)uv tool list --outdated(#20770)Documentation
v0.12.0Compare Source
Released on 2026-07-28.
Since we released uv 0.11.0 in March, we've accumulated changes that improve correctness, safety, and compatibility with specifications, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution.
We expect most users to be able to upgrade without making changes.
There are no breaking changes to the configuration of the uv build backend. If your
[build-system]table includes an upper bound onuv_build, update it to allowuv_build0.12, e.g.,uv_build>=0.11.32,<0.13.Breaking changes
Define build systems by default with
uv init(#19197)Projects created with
uv initnow declare a build system and are packaged by default. This was the default project layout all the way back in v0.3, but we found that the use of thehatchlingbuild system was confusing to newcomers and consequently dropped use of a build system by default in v0.4. Since then, we've created our own build system (uv_build) with tight integration with uv and are excited to restore the default to a best-practice project layout.Previously,
uv init examplecreated an unpackaged layout containingmain.pyand apyproject.tomlwithout a build system. The project could declare dependencies but was not itself installed into its virtual environment.Now,
uv init exampledefines a[build-system]usinguv_build, places application source code insrc/example, and includes a[project.scripts]entry namedexample. Defining a build system allows the project to be imported from tests or other code, installed as a dependency, and run as a command:Existing projects are unaffected. Use
uv init --no-package exampleto create the previous unpackaged layout without a build system.See the project creation documentation for more details.
This stabilizes the
packaged-initpreview feature.Reject unsupported source distribution and wheel archive formats (#18927)
PEP 625 requires source distributions to use
.tar.gzarchives. Previously, uv also accepted legacy formats such as.tar.bz2and.tar.xz. Those formats are now rejected, including when referenced by an existing lockfile. Legacy.zipsource distributions remain supported for backwards compatibility.Wheels and other ZIP archives can no longer contain entries compressed with bzip2, LZMA, or XZ. Entries must use the stored, DEFLATE, or zstd compression methods.
Removing support for uncommon compression methods reduces uv's compression dependencies and the attack surface exposed when processing untrusted packages.
You cannot opt out of this behavior. If you depend on a legacy source distribution that uses an unsupported format, we recommend rebuilding it as a
.tar.gzarchive and regenerating any lockfile containing references to the legacy archive.Reject wheel files that could replace the Python interpreter (#20748, #20749)
uv already rejected wheel entry points named
python, but case variants such asPythonwere still accepted. On case-insensitive filesystems, including common macOS and Windows setups, these entry points could overwrite the virtual environment's interpreter.Wheels could also place interpreter files in their
.data/scriptsdirectory or in paths such as.data/data/bin/python, bypassing the entry-point check and replacing the interpreter during installation.uv now rejects case-insensitive variants of reserved interpreter names and wheel data files that would be installed over an interpreter. This includes names such as
Python,python.py, andPython.exe, along with other reserved interpreter names and their versioned variants.You cannot opt out of these checks. Rename conflicting entry points or wheel data files and rebuild the affected wheel.
Prefer stable releases before falling back to pre-releases (#19993)
A dependency can introduce a pre-release requirement after resolution starts. uv previously required each package's pre-release eligibility to be known before resolution began: the default
if-necessary-or-explicitmode allowed them for direct requirements that explicitly requested a pre-release, or for packages that only published pre-releases.This meant that a pre-release requirement discovered in a dependency's metadata, e.g.,
example>=2.0.0b1, would fail to resolve even when a compatible pre-release existed. To resolve it, you had to add that dependency as a direct requirement or allow pre-releases across your entire dependency graph.The default mode is now
if-necessary. uv tries stable candidates first and falls back to pre-releases when no stable candidate satisfies the active constraints. Like pip, uv now supports pre-release requirements discovered transitively, but can select different versions than previous uv releases when both stable and pre-release candidates are available.You can opt out of automatic pre-release selection with
--prerelease disallow. Alternatively,--prerelease allowconsiders pre-releases without first preferring stable releases, and--prerelease explicitonly allows them for direct requirements that mention a pre-release.The old
if-necessary-or-explicitmode distinguished between explicitly requested pre-releases and packages with no stable releases. That distinction is unnecessary now thatif-necessaryhandles both cases, including transitive requirements. The old name remains available as an alias but is deprecated and will be removed in a future release.Respect
--require-hashesdirectives inrequirements.txt(#19336)Previously,
uv pip installanduv pip syncwarned about--require-hashesinside arequirements.txtfile but still installed dependencies without checking their hashes. Now, the directive enables hash-checking mode, just as if--require-hasheshad been passed on the command line.For example, this requirements file is no longer accepted because the requirement is neither pinned nor hashed:
You cannot opt out while the directive is present. Pin every requirement with
==and provide its hash, or remove--require-hashesif hash checking is not intended.Reject MD5-only hashes in hash-checking mode (#20758)
Previously,
uv pip install --require-hashesanduv pip sync --require-hashesaccepted requirements whose only available digest used MD5. MD5 is not collision-resistant, so relying on it undermined installations that require hash verification and differed from pip's behavior.Hash-checking mode now requires at least one secure digest for every requirement. For example, the following requirement is rejected unless a secure hash, such as SHA-256, is also supplied:
A secure hash can be supplied directly on the requirement or in a matching constraints file. Ordinary hash verification without
--require-hashescontinues to support MD5.You cannot opt out while hash checking is required. Regenerate affected hashes with SHA-256 or another supported secure hash.
Reject invalid
pylock.tomlfiles and artifacts (#20402, #20440, #20443)uv now validates additional requirements from the
pylock.tomlspecification:packagesarray must be present. Previously, uv interpreted a missing array as an empty lockfile, souv pip synccould uninstall an environment instead of rejecting malformed input. An explicitly emptypackages = []array remains valid.pylock.tomlor a single-name variant such aspylock.dev.toml. Names such aspylock..tomlandpylock.foo.bar.tomlare rejected.size, the downloaded or cached artifact must match. Previously, an incorrect size was accepted when the hash was correct. Sizes reported by package indexes remain advisory.You cannot opt out of these checks. Regenerate malformed lockfiles, rename invalid filenames, and either correct or remove an incorrect optional
sizevalue.Honor explicit certificate overrides even when no certificates can be loaded (#20741, #20767)
Previously, uv ignored
SSL_CERT_FILEorSSL_CERT_DIRvalues that pointed to missing or inaccessible paths, empty files or directories, or sources without valid certificates. Instead, it fell back to its default trust roots, potentially allowing HTTPS connections that the configured override was intended to reject.Now, any non-empty
SSL_CERT_FILEorSSL_CERT_DIRvalue replaces uv's default certificate roots, even when no valid certificates can be loaded. In that case, HTTPS requests fail because no certificates are trusted. This applies to package downloads and remote scripts, including GitHub Gists.Fix or unset the certificate override. Unsetting it restores the default trust store; empty environment-variable values continue to be ignored.
Support pip-compatible
--certhandling inuv pip(#20418)The
uv pipinterface now accepts--cert <path>, e.g.:$ uv pip install --cert ./company-ca.pem exampleAs in pip, the provided PEM bundle replaces all other certificate sources for that invocation, including system certificates and
SSL_CERT_FILEorSSL_CERT_DIR. This change has no effect unless you pass--cert. Include the necessary certificate authorities in the bundle.--certis only supported byuv pipcommands; other uv commands continue to use their existing certificate configuration.Discover projects relative to the script passed to
uv run(#20225)Previously,
uv run project/script.pydiscovered its project from the current directory, even when the script belonged to another project. uv now starts project and workspace discovery from the script's directory instead.For example, running
uv run other-project/script.pynow usesother-projectand its dependencies. This fixes scripts that previously failed because their own dependencies were not installed, but can select a different environment than before.You can opt out of script-relative discovery by selecting a project explicitly, e.g.,
uv run --project . other-project/script.py.This stabilizes the
target-workspace-discoverypreview feature.Require
--forcebefore clearing a directory that is not a virtual environment (#20225)uv venv --clearpreviously removed any existing target directory, even if it was not a virtual environment. uv emitted a warning but still deleted the directory and its contents. Now, uv refuses to clear directories that do not contain a virtual environment.You can opt out of this safety check by explicitly passing
--force, e.g.,uv venv --clear --force ./not-a-virtualenv.This stabilizes the
venv-safe-clearpreview feature.Reject
--projectwhen initializing a project (#20225)--projectselects an existing project, so it is not meaningful when initializing a new one. Previously,uv init --project examplewarned and initializedexampleanyway; if a positional path was also provided,--projectwas ignored.This usage is now an error. Use
uv init exampleto initialize a project at the requested path, oruv init --directory exampleto change the working directory first.This stabilizes the
init-project-flagpreview feature.Reject missing or invalid
--projectpaths (#20225)uv previously warned when
--projectreferred to a missing directory or a file other thanpyproject.toml, but then attempted to continue. This could produce confusing errors later or run against an unintended project.Now,
uv run --project missing pythonfails immediately instead of continuing. You cannot opt out of this behavior. Create the directory first or select an existing project. Passing--project path/to/pyproject.tomlremains supported and selects the file's parent directory.This stabilizes the
project-directory-must-existpreview feature.Skip distributions with non-normalized filenames when publishing (#20225)
Distribution filenames must use normalized package names and versions. For example, a wheel for version
1.01.0should be namedexample-1.1.0-py3-none-any.whl, notexample-1.01.0-py3-none-any.whl.Previously,
uv publishwarned about non-normalized filenames but still attempted to upload them. It now skips the affected wheels and source distributions instead.You cannot opt out of this behavior. Rebuild distributions with normalized filenames before publishing.
This stabilizes the
publish-require-normalizedpreview feature.Classify Conda environments named
baseandrootby their paths (#20225)Conda environments named
baseorrootwere previously assumed to be the base Conda environment, even when they were ordinary child environments. uv now recognizes child Conda environments namedbaseorrootbased on their paths, as it already does for other names.You can opt out of automatic interpreter selection by requesting an interpreter explicitly with
--python /path/to/python.This stabilizes the
special-conda-env-namespreview feature.Reject broken
.venvsymlinks during environment discovery (#20433)Previously, uv could ignore a broken
.venvsymlink and continue searching parent directories for another virtual environment. As a result, commands such asuv pip installcould unexpectedly modify an unrelated ancestor environment.uv now stops at a broken
.venvsymlink and reports its exact path. Errors encountered while reading virtual environment metadata, including permission failures, are also reported immediately instead of being ignored.You cannot opt out of this behavior. Repair or remove the broken
.venvsymlink and correct any permissions that prevent uv from inspecting the environment.Reinstall matching installed Python patch versions instead of upgrading implicitly (#20659)
Before Python upgrades were supported,
uv python install 3.12 --reinstalldoubled as a way to install the latest Python 3.12 patch release. Now that--upgradeis available,--reinstallreinstalls the matching patch releases that are already present.For example, if Python 3.12.6 and 3.12.7 are installed,
uv python install 3.12 --reinstallreinstalls both versions instead of installing the latest available 3.12 release.You can recover the previous upgrade behavior with
uv python install 3.12 --upgrade. Combine--upgrade --reinstallto reinstall only the latest patch.Require
--upgrade-groupto name an existing dependency group (#18957)Previously,
uv lock --upgrade-group docssilently succeeded even if nodocsdependency group existed. uv now validates the requested group against the project, its workspace members, and workspace-level dependency groups.You cannot opt out of this behavior. Correct the group name or add it to
[dependency-groups]. Legacytool.uv.dev-dependenciesstill satisfies--upgrade-group dev.Resolve relative indexes and find-links against
--directory(#20740)The
--directoryoption changes the directory in which uv operates. Previously, relative index and find-links paths supplied on the command line were still resolved against the original working directory.uv now resolves
--index,--default-index,--index-url,--extra-index-url, and--find-linksrelative to the directory selected by--directory. For example:$ uv add --directory project --index ./packages exampleThis now uses
project/packagesinstead of./packagesin the original working directory. Absolute paths and indexes loaded from configuration files are unaffected.To preserve the previous target, pass an absolute path or adjust the relative path, e.g.,
--index ../packages.Preserve absolute paths provided to
uv add(#18402)uv addpreviously converted every local dependency into a project-relative path, even when the original request used an absolute path or a literalfile://URL. It now preserves the form of the request inpyproject.tomlanduv.lock:Absolute paths make a project less portable. Use a relative path to avoid recording an absolute path. URLs containing expanded variables retain their existing relative-path behavior.
Remove older PyPy distributions that are only available as bzip2 archives (#20423)
Older PyPy patch releases that are only distributed as
.tar.bz2archives are no longer available throughuv python install. These releases require unsupported bzip2 archives.The latest PyPy release for each supported Python minor version is available as a gzip-compressed archive and remains supported. For example,
uv python list 3.10 --all-versionsstill includes the latest PyPy 3.10 release, but older bzip2-only patch releases are omitted.You cannot opt out of this behavior. Request a newer PyPy patch release instead.
Omit excluded-package comments when annotations are disabled (#20085)
uv pip compile --no-annotatesuppresses comments describing the generated requirements file. Previously, a footer listing packages excluded with--unsafe-packagewas still included, even though annotations were disabled. That footer is now omitted.You can recover the footer by removing
--no-annotate.Stabilizations
TOML 1.0-compatible source distributions (#20225)
uv_buildnow writes a TOML 1.0-compatiblepyproject.tomlwhen building source distributions, allowing older Python build frontends to consume projects that use newer TOML syntax. The original project file remains available in the archive aspyproject.toml.orig.This stabilizes the
toml-backwards-compatibilitypreview feature.Automatic open-file limit adjustment on Unix (#20225)
On Linux and macOS, uv now attempts to raise the soft open-file limit at startup toward the hard limit, capped at 1,048,576 descriptors. The new limit also applies to subprocesses and reduces failures caused by running out of file descriptors. If the limit cannot be raised, uv continues running with the existing limit.
This stabilizes the
adjust-ulimitpreview feature.Preview features
uv upgradeto target multiple packages, upgrade all production dependencies, and exclude selected dependencies (#20338)Bug fixes
webpack/webpack (webpack)
v5.109.2Compare Source
Patch Changes
Resolve aliases pointing at a package directory whose name ends with
.jsagain. (by @alexander-akait in #21542)Name CSS sources in source maps by their resource path, without the
cssprefix. (by @bjohansebas in #21536)Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @bjohansebas in #21528)
Report
"universal"as the loader context target for the universal target. (by @alexander-akait in #21540)Skip
require().propin dead branches gated by inlined imported constants. (by @hai-x in #21517)Annotate configuration options and public hooks in the generated types with the
@sinceJSDoc tag. (by @bjohansebas in #21473)v5.109.1Compare Source
Patch Changes
Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @alexander-akait in #21533)
Make
require(esm)module.exportsre-export analysis independent of module processing order. (by @alexander-akait in #21521)Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so
compiler.close()succeeds on Bun. (by @alexander-akait in #21521)Name the failing key when DefinePlugin fails to evaluate a
typeofvalue. (by @alexander-akait in #21503)Improve Deno compatibility: guard
setNoDelayand force-close connections on lazy-compilation backend dispose, and return a realArrayBufferfrom the Node async/sync wasm loader soWebAssembly.instantiateaccepts it. (by @alexander-akait in #21524)Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @alexander-akait in #21492)
Track CommonJS build dependencies by parsing sources when
require.cachechildren are unavailable (e.g. Bun). (by @alexander-akait in #21531)Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @alexander-akait in #21500)
Build the CSS
parseA*AST on the SoA store instead of node classes, cutting parse memory and time. (by @alexander-akait in #21498)Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @alexander-akait in #21504)
Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @alexander-akait in #21511)
Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @alexander-akait in #21506)
Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @bjohansebas in #21520)
Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @alexander-akait in #21516)
Enable the Node.js compile cache in the webpack CLI entry point. (by @bjohansebas in #21523)
Encode the persistent cache with V8's value serializer. (by @avivkeller in #21514)
Speed up SplitChunksPlugin: reject non-subset chunk sets with 64-bit signatures, cache unnamed entry keys, and drop per-module closures. (by @avivkeller in #21529)
Initialize
NormalModule._astin the constructor so each instance keeps a single hidden-class shape. (by @alexander-akait in #21515)Reduce allocations in the binary serialization hot paths. (by @alexander-akait in #21526)
Deduplicate and simplify several lib modules and speed up AggressiveMergingPlugin. (by @alexander-akait in #21525)
Rename nested
const/let __webpack_require__and__webpack_exports__declarations in bundled webpack output. (by @hai-x in #21508)webpack/webpack-cli (webpack-cli)
v7.2.2Compare Source
Patch Changes
module.enableCompileCache, available on Node.js >= 22.8.0) to speed up CLI startup (by @bjohansebas in #4818)Configuration
📅 Schedule: (in timezone UTC+1)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.