build(deps): bump astral-sh/uv from 0.11.32 to 0.12.10 in /controller

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps astral-sh/uv from 0.11.32 to 0.12.10.

Release notes

Sourced from astral-sh/uv's releases.

0.12.10

Release Notes

Released on 2026-09-04.

Enhancements

• Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#21423)

Preview features

• Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#21455)
• Show terminal dependency cycles in uv tree --invert output (#21404)

Performance

• Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#21399)
• Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#21389)

Bug fixes

• Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#21454)
• Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#19571)
• Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#21450)
• Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#21395)
• Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#21453)

Install uv 0.12.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.10/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.10/uv-installer.ps1 | iex"

Download uv 0.12.10

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum

... (truncated)

Changelog

Sourced from astral-sh/uv's changelog.

0.12.10

Released on 2026-09-04.

Enhancements

• Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#21423)

Preview features

• Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#21455)
• Show terminal dependency cycles in uv tree --invert output (#21404)

Performance

• Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#21399)
• Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#21389)

Bug fixes

• Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#21454)
• Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#19571)
• Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#21450)
• Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#21395)
• Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#21453)

0.12.9

Released on 2026-09-01.

Python

• Add CPython 3.15.0rc2 (#21413, #21415)

Enhancements

• Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
• Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

• Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

• Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
• Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
• Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
• Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
• Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

... (truncated)

Commits

• 3c979ab Bump version to 0.12.10 (#21475)
• e302ffe Fix signing dry-run secret access and manifest generation (#21474)
• 18ab295 Allow release preparation to update the lockfile (#21473)
• 944d45d Upgrade release preparation to uv 0.12.9 (#21472)
• 3e98bf5 Exercise signing for GitHub release archives (#21445)
• 802a2d2 Use Python for signed wheel assembly (#21448)
• fc5bcca Add Azure-backed release binary signing to release dry-runs (#21418)
• e90047b Add a uv-dev inject-signed-wheel-binaries command (#20622)
• a5fc364 Omit unused exclude-newer-package settings (#21455)
• 227d1db Ignore unused exclude-newer-package settings (#21454)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)