Skip to content

Python: Build(deps-dev): bump the basics group in /python with 2 updates - #8207

Merged
Eduard van Valkenburg (eavanvalkenburg) merged 2 commits into
mainfrom
dependabot/pip/python/basics-695df9510e
Sep 10, 2026
Merged

Eduard van Valkenburg (eavanvalkenburg) merged 2 commits into
mainfrom
dependabot/pip/python/basics-695df9510e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the basics group in /python with 2 updates: uv and prek.

Updates uv from 0.12.7 to 0.12.9

Release notes

Sourced from uv's releases.

0.12.9

Release Notes

Released on 2026-09-01.

Python

Enhancements

  • Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
  • Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

  • Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

  • Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
  • Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
  • Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
  • Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
  • Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

Install uv 0.12.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex"

Download uv 0.12.9

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.9

Released on 2026-09-01.

Python

Enhancements

  • Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
  • Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

  • Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

  • Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
  • Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
  • Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
  • Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
  • Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

0.12.8

Released on 2026-08-31.

Enhancements

  • Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

  • Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
  • Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
  • Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

  • Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
  • Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
  • Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
  • Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

  • Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
  • Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)

... (truncated)

Commits

Updates prek from 0.5.0 to 0.5.2

Release notes

Sourced from prek's releases.

0.5.2

Release Notes

Released on 2026-09-03.

Enhancements

  • Allow unknown tags by default in check-yaml (#2678)

Contributors

Install prek 0.5.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.2

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum
prek-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
prek-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
prek-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
prek-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

</tr></table> 

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.2

Released on 2026-09-03.

Enhancements

  • Allow unknown tags by default in check-yaml (#2678)

Contributors

0.5.1

Released on 2026-09-01.

Enhancements

  • Add --hide-status <passed|failed|skipped> for hook reports (#2644)
  • Add prek init for repository setup (#2636)
  • Apply hook env during environment creation (#2650)
  • Disable error snippets in check-yaml diagnostics (#2664)
  • Show hooks excluded by skip selectors (#2645)
  • Support Pixi for Conda environments (#2667)
  • Support cargo-binstall for Rust CLI dependencies (#2658)
  • Warn about unused keys in user settings (#2665)

Bug fixes

  • Reject unsupported YAML tags in check-yaml (#2656)

Documentation

  • Clarify local hook documentation (#2640)
  • Clarify pre-commit command compatibility (#2635)
  • Document automatic PR fixes with autofix.ci (#2643)
  • Document check-yaml unsafe support (#2632)
  • Improve setup and workflow documentation (#2637)

Other changes

  • Drop low-usage release targets (#2651)
  • Generate a prek manifest JSON schema (#2648)

Contributors

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the basics group in /python with 2 updates: [uv](https://github.com/astral-sh/uv) and [prek](https://github.com/j178/prek).


Updates `uv` from 0.12.7 to 0.12.9
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.7...0.12.9)

Updates `prek` from 0.5.0 to 0.5.2
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.5.0...v0.5.2)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.12.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: basics
- dependency-name: prek
  dependency-version: 0.5.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: basics
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Usage: [Issues, PRs], Target: dependencies in the project python Usage: [Issues, PRs], Target: Python labels Sep 9, 2026
Copilot AI balanced review requested due to automatic review settings September 9, 2026 22:21
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 9, 2026 22:21 Inactive
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 9, 2026 22:21 Inactive
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 9, 2026 22:22 Inactive
@github-actions github-actions Bot changed the title Build(deps-dev): bump the basics group in /python with 2 updates Python: Build(deps-dev): bump the basics group in /python with 2 updates Sep 9, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 9, 2026 22:22 Inactive

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Another Python package (python/packages/lab/pyproject.toml) still pins the previous uv/prek versions, leaving inconsistent dev-tool versions across the repo.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the Python workspace’s developer tooling pins to newer versions, keeping the /python dev dependency group current.

Changes:

  • Bump uv from 0.12.7 to 0.12.9 in python/pyproject.toml.
  • Bump prek from 0.5.0 to 0.5.2 in python/pyproject.toml.
File summaries
File Description
python/pyproject.toml Updates pinned dev-tool versions (uv, prek) in the Python workspace dev dependency group.
Review details
  • Files reviewed: 1/1 changed files
  • Comments generated: 1
  • Review effort level: Lite

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Comment thread python/pyproject.toml Resolved
@moonbox3

Copy link
Copy Markdown
Contributor

Copilot address open PR comment and fix CI/CD failures

Co-authored-by: moonbox3 <35585003+moonbox3@users.noreply.github.com>

Copilot AI commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Copilot address open PR comment and fix CI/CD failures

Done in 5aa1ccc: bumped uv==0.12.9 / prek==0.5.2 in python/packages/lab/pyproject.toml to keep dev-tool versions in sync, and regenerated both python/uv.lock and python/packages/lab/uv.lock (the stale root lockfile was what made the uv-lock pre-commit hook fail in the Code Quality workflow).

@agent-framework-automation agent-framework-automation Bot added the lab Usage: [Issues, PRs], Target: lab packages label Sep 10, 2026
@github-code-quality

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: Python

Python / code-coverage/python

The overall line coverage in commit 5aa1ccc in the dependabot/pip/pytho... branch is 91%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.
File main dependabot/pip/pytho... 5aa1ccc +/-
packages/core/a...work/_skills.py — 95% —
packages/core/a...rk/_sessions.py — 95% —
packages/core/a...ework/_tools.py — 94% —
packages/core/a.../_compaction.py — 94% —
packages/core/a...ework/_types.py — 93% —
packages/core/a...bservability.py — 93% —
packages/openai..._chat_client.py — 92% —
packages/core/a...amework/_mcp.py — 91% —
packages/ag-ui/...i/_agent_run.py — 91% —
packages/core/a...ork/security.py — 85% —

Merged via the queue into main with commit 630a55e Sep 10, 2026
59 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/python/basics-695df9510e branch September 10, 2026 06:14

This branch was previously deployed

1 inactive deployment
github-app-auth — 5aa1ccc7 Deployed Sep 10, 2026 by Copilot via add_label #22356
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Usage: [Issues, PRs], Target: dependencies in the project lab Usage: [Issues, PRs], Target: lab packages python Usage: [Issues, PRs], Target: Python

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants