chore(deps): update all non-breaking dependencies

[rafaels-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change	Pending
astral-sh/uv	uses-with	patch	0.12.23 → 0.12.24	0.13.0
github/codeql-action	action	patch	v4.38.2 → v4.38.3

---

Release Notes

astral-sh/uv (astral-sh/uv)

v0.12.24

Compare Source

Release Notes

Released on 2026-10-08.

Enhancements

• Remove orphaned temporary build environments with uv cache prune (#​22171)
• Accept PEP 508 marker operators directly before grouped expressions (#​22309)
• Reject malformed requirements-file options instead of partially parsing or ignoring them (#​22317)
• Show underlying filesystem and registry errors when managed Python uninstallation fails (#​22362)
• Identify the invalid source URL in Python mirror errors (#​22364)

Preview features

• Display preferred advisory IDs in uv audit reports, prioritizing PYSEC, GHSA, then CVE identifiers (#​22292)

Configuration

• Support custom installation mirrors for GraalPy (#​22269)
• Support custom installation mirrors for Pyodide (#​22271)
• Allow UV_NO_CACHE=false to override no-cache = true in configuration (#​22324)
• Report more precise error locations for invalid trusted-host ports and preview-feature list entries (#​22144)

Performance

• Speed up later commands after creating an environment by warming its interpreter cache (#​21304)
• Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (#​22246)
• Enforce resource limits when parsing package indexes and --find-links pages with astral-html (#​22203)
• Reduce standalone uv-build executable size by 7.5% by omitting unused Zstandard support (#​22242)
• Reduce uv's binary size by about 232 KB by simplifying configuration deserialization (#​22144)
• Reduce Python download error formatting code size by sharing its formatter (#​22141)

Bug fixes

• Verify supplied hashes even when hash presence is disabled with --no-require-hashes or require-hashes = false (#​22369)
• Honor exact managed Python patch pins when creating script environments instead of following patch upgrades (#​22360)
• Prevent dependency overrides and constraints from activating optional dependencies when their extras are not selected (#​22237)
• Exclude optional dependencies from exports when their extras are activated only in incompatible environments (#​22234)
• Give explicit uv publish --trusted-publishing values precedence over configuration (#​22279)
• Allow UV_OFFLINE=false to override offline = true in configuration (#​22283)
• Allow UV_SYSTEM_CERTS=false to override system-certs = true in configuration (#​22291)
• Allow uv auth login over IPv6 loopback addresses (#​22306)
• Resolve GitHub dependencies whose Git references contain # or % characters (#​22281)
• Recognize existing Pyodide interpreters as satisfying Pyodide Python requests (#​22322)
• Preserve JSON output from uv version and uv self version with a single --quiet flag (#​22280)
• Preserve trailing spaces and tabs in passwords returned by subprocess keyrings (#​22284)
• Restore wheel incompatibility hints when WHEEL metadata contains multiple expanded Tag: rows (#​22235)
• Preserve Windows wheel-script rename errors unless a cross-drive copy fallback applies (#​22302)
• Prevent workspace-cache assertion failures after modifying a project at the workspace root (#​22236)
• Hide the ignored --keyring-provider option from uv auth help (#​19520)
• Report HTTP client setup failures directly when resolving unnamed uv tool requirements (#​22320)

Documentation

• Update Docker and AWS Lambda examples to cache dependency layers using frozen lockfiles without project manifests (#​22172)
• Fix stale links and descriptions in Rust crate documentation (#​22311, #​22361)
• Fix a typo in the required-environments documentation (#​22238)

Install uv 0.12.24

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.24/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.24/uv-installer.ps1 | iex"

Download uv 0.12.24

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

github/codeql-action (github/codeql-action)

v4.38.3

Compare Source

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
• Update default CodeQL bundle version to 2.27.2. #​4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

---

Configuration

📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.