chore(deps): update uv-version to v0.8.11 (patch) #185
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.8.4->0.8.110.8.0->0.8.110.8.12Note: The
pre-commitmanager in Renovate is not supported by thepre-commitmaintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.Release Notes
astral-sh/uv-pre-commit (astral-sh/uv-pre-commit)
v0.8.11Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.8.11
v0.8.10Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.8.10
v0.8.9Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.8.9
v0.8.8Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.8.8
v0.8.7Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.8.7
v0.8.6Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.8.6
v0.8.5Compare Source
See: https://github.com/astral-sh/uv/releases/tag/0.8.5
astral-sh/uv (uv)
v0.8.11Compare Source
Python
Enhancements
extra-build-dependencieshint for any missing module on build failure (#15252)Bug fixes
Rust API
reqwestclients toRegistryClient(#15281)v0.8.10Compare Source
Python
Enhancements
aarch64(#14399)Preview
v0.8.9Compare Source
Enhancements
--reinstallflag touv python upgrade(#15194)Bug fixes
uv python upgradeif they don't already exist (#15192)Documentation
v0.8.8Compare Source
Bug fixes
find_uv_bincompatibility with Python <3.10 (#15177)v0.8.7Compare Source
Python
tkaggbackend (the default on Linux), Pillow'sPIL.ImageTklibrary, and other extension modules that need to use libtcl/libtk directly.See the
python-build-standalonerelease notes for details.Enhancements
uv.lockwhen using--isolated(#15154)--prefixand--withinstallations infind_uv_bin(#14184)find_uv_bin(#14181)find_uv_bin(#14182)Preview features
package-level conflicts in workspaces (#14906)Configuration
UV_DEVandUV_NO_DEVenvironment variables (for--devand--no-dev) (#15010)Bug fixes
--require-hashesapplied to build dependencies inuv pip install(#15153)find_uv_bin(#14191)Documentation
.) to list elements inFeaturesdocs page (#15138)v0.8.6Compare Source
This release contains hardening measures to address differentials in behavior between uv and Python's built-in ZIP parser (CVE-2025-54368).
Prior to this release, attackers could construct ZIP files that would be extracted differently by pip, uv, and other tools. As a result, ZIPs could be constructed that would be considered harmless by (e.g.) scanners, but contain a malicious payload when extracted by uv. As of v0.8.6, uv now applies additional checks to reject such ZIPs.
Thanks to a triage effort with the Python Security Response Team and PyPI maintainers, we were able to determine that these differentials were not exploited via PyPI during the time they were present. The PyPI team has also implemented similar checks and now guards against these parsing differentials on upload.
Although the practical risk of exploitation is low, we take the hypothetical risk of parser differentials very seriously. Out of an abundance of caution, we have assigned this advisory a CVE identifier and have given it a "moderate" severity suggestion.
These changes have been validated against the top 15,000 PyPI packages; however, it's plausible that a non-malicious ZIP could be falsely rejected with this additional hardening. As an escape hatch, users who do encounter breaking changes can enable
UV_INSECURE_NO_ZIP_VALIDATIONto restore the previous behavior. If you encounter such a rejection, please file an issue in uv and to the upstream package.For additional information, please refer to the following blog posts:
Security
Python
Configuration
Bug fixes
UV_HTTP_RETRIESinuv publish(#15106)UV_NO_EDITABLEwhere--no-editableis supported (#15107)cargo-distto addUV_INSTALLER_URLto PowerShell installer (#15114)h2again to avoidtoo_many_internal_resetserrors (#15111)pythonwwhen copying entry points in uv run (#15134)Documentation
v0.8.5Compare Source
Enhancements
uv runwith a GitHub Gist (#15058)uv tool install(#14014)Preview features
extra-build-dependencieswarnings foruv pip(#15088)pylockwarning (#15089)Bug fixes
python-preference = systemwhen managed interpreters are on the PATH (#15059)--systemis used (#15061)h2upgrade (#15079)Documentation
v0.8.4Compare Source
Enhancements
Preview features
extra-build-dependencies(#14735)Configuration
exclude-newerdates viaexclude-newer-package(#14489)Bug fixes
pythonvspython3(#14970)environmentsandrequired-environmentsinuv.toml(#14905)Documentation
uv_buildin projects documentation (#14968)UV_prefix to installer environment variables (#14964)uvfrom--build-backendoptions (#14939)v0.8.3Compare Source
Python
See the
python-build-standalonerelease notes for more details.Enhancements
uv_build(#14867)Bug fixes
--withversions over base environment versions (#14863)Documentation
uv_buildreference documentation (#14853)v0.8.2Compare Source
Enhancements
Configuration
UV_INIT_BUILD_BACKEND(#14821)Bug fixes
Rust API
tls_built_in_root_certsfor client (#14816)Documentation
v0.8.1Compare Source
Python
Enhancements
extra-build-dependencieshint for any missing module on build failure (#15252)Bug fixes
Rust API
reqwestclients toRegistryClient(#15281)Configuration
📅 Schedule: Branch creation - Between 04:00 PM and 06:59 PM, only on Monday ( * 16-18 * * 1 ) in timezone America/Mexico_City, Automerge - Between 07:00 AM and 09:59 AM, only on Wednesday ( * 7-9 * * 3 ) in timezone America/Mexico_City.
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.