Skip to content

chore(deps): bump the python-minor-patch group across 1 directory with 2 updates - #339

Merged
lelia merged 1 commit into
mainfrom
dependabot/uv/python-minor-patch-5f24c056e7
Sep 8, 2026
Merged

chore(deps): bump the python-minor-patch group across 1 directory with 2 updates#339
lelia merged 1 commit into
mainfrom
dependabot/uv/python-minor-patch-5f24c056e7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 2 updates in the / directory: ruff and uv.

Updates ruff from 0.16.4 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Commits

Updates uv from 0.12.5 to 0.12.8

Release notes

Sourced from uv's releases.

0.12.8

Release Notes

Released on 2026-08-31.

Enhancements

  • Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

  • Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
  • Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
  • Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

  • Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
  • Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
  • Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
  • Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

  • Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
  • Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)
  • Redact Azure shared access signature (sig) query parameters from displayed URLs (#21360)
  • Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#21341)

Other changes

  • Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#21346)

Install uv 0.12.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.8/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.8/uv-installer.ps1 | iex"

Download uv 0.12.8

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.8

Released on 2026-08-31.

Enhancements

  • Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

  • Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
  • Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
  • Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

  • Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
  • Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
  • Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
  • Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

  • Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
  • Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)
  • Redact Azure shared access signature (sig) query parameters from displayed URLs (#21360)
  • Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#21341)

Other changes

  • Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#21346)

0.12.7

Released on 2026-08-27.

Python

  • Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

  • Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
  • Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

  • Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 4, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 4, 2026 00:25
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 4, 2026
@socket-security

socket-security Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​uv@​0.12.5 ⏵ 0.12.8100100100100100
Updatedpypi/​ruff@​0.16.4 ⏵ 0.16.5100100100100100

View full report

@socket-security-staging

socket-security-staging Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​uv@​0.12.5 ⏵ 0.12.8100100100100100
Updatedpypi/​ruff@​0.16.4 ⏵ 0.16.5100100100100100

View full report

@dependabot dependabot Bot changed the title chore(deps): bump the python-minor-patch group with 2 updates chore(deps): bump the python-minor-patch group across 1 directory with 2 updates Sep 8, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-patch-5f24c056e7 branch from b568039 to a9418b6 Compare September 8, 2026 11:55
@dependabot
chore(deps): bump the python-minor-patch group across 1 directory wit…
5a83ca0 
…h 2 updates

Bumps the python-minor-patch group with 2 updates in the / directory: [ruff](https://github.com/astral-sh/ruff) and [uv](https://github.com/astral-sh/uv).


Updates `ruff` from 0.16.4 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.4...0.16.5)

Updates `uv` from 0.12.5 to 0.12.8
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.5...0.12.8)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: uv
  dependency-version: 0.12.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-patch-5f24c056e7 branch from a9418b6 to 5a83ca0 Compare September 8, 2026 20:41
@lelia
lelia merged commit f0b8a9f into main Sep 8, 2026
28 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/python-minor-patch-5f24c056e7 branch September 8, 2026 21:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lelia lelia lelia approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lelia