[rafaels-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change	Pending
astral-sh/setup-uv	action	minor	v10.1.0 → v10.2.0
astral-sh/uv	uses-with	patch	0.12.15 → 0.12.18	0.12.19
github/codeql-action	action	patch	v4.38.0 → v4.38.1	v4.38.2

---

Release Notes

astral-sh/setup-uv (astral-sh/setup-uv)

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

• Disable automatic cache saves for merge queues @​eifinger (#​1056)

🧰 Maintenance

• chore: update known checksums for 0.12.17 @​github-actions[bot] (#​1058)
• chore: update known checksums for 0.12.16 @​github-actions[bot] (#​1057)
• chore: update known checksums for 0.12.15 @​github-actions[bot] (#​1054)
• chore: update known checksums for 0.12.14 @​github-actions[bot] (#​1053)
• chore: update known checksums for 0.12.13 @​github-actions[bot] (#​1045)

📚 Documentation

• docs: update version references to v10.1.0 @​github-actions[bot] (#​1044)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#​1059)

astral-sh/uv (astral-sh/uv)

v0.12.18

Compare Source

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

• Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#​21893)
• Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#​21844)
• Identify failures from get_requires_for_build_* hooks correctly in build errors (#​21881)

Preview features

• Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#​21880)

Performance

• Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#​21918)

Bug fixes

• Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#​21835, #​21836)
• Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#​21860, #​21856)
• Use configured dependency-metadata when checking whether installed requirements are satisfied (#​21843)
• Reject archive entries that normalize to absolute Windows paths (#​21923)
• Recognize distribution filenames and archive extensions when URL fragments contain ? (#​21920)
• Generate correctly lowercased platform tags for BSD and Haiku releases (#​21853)
• Avoid rebuilding a Windows relative path into an absolute form (#​21923)

v0.12.17

Compare Source

Released on 2026-09-18.

Enhancements

• Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#​21780)

Preview features

• Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#​21651)
• Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#​20746)
• Keep uv workspace metadata read-only unless --sync is provided (#​21821)
• Apply uv check lock modes when retrieving workspace metadata (#​21821)

Performance

• Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#​21650)
• Reduce resolver allocations when deduplicating package and distribution requests (#​21810)

Bug fixes

• Prevent required-environments from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline (#​21825)

Documentation

• Clarify the 0.12.14 and 0.12.15 release notes (#​21817)

v0.12.16

Compare Source

Released on 2026-09-17.

Python

• Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#​21741)

Enhancements

• Verify downloaded wheels and source distributions against hashes supplied by package indexes (#​21562)
• Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#​21467)
• Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#​21766)
• Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#​21779)

Preview features

• Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#​21163)
• Honor configured and command-line index settings, including credentials, in uv upgrade (#​21776)
• Allow uv check to run in projects that are not managed by uv and outside workspaces (#​21777)
• Respect --python and UV_PYTHON when selecting the Python version for uv check (#​21744)

Bug fixes

• Redact Azure shared access signatures from displayed and logged URLs (#​21755)
• Check archive sizes from pylock.toml before reusing cached distributions (#​21609)
• Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#​20631)
• Use the bundled uv_build backend only when its version matches active version pins (#​21742)
• Handle malformed index URLs without panicking when credentials are configured (#​21784)
• Report a configuration error instead of panicking for proxy URLs without a host (#​21781)
• Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#​21783)

github/codeql-action (github/codeql-action)

v4.38.1

Compare Source

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

---

Configuration

📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.