Skip to content

Python: Build(deps-dev): bump the basics group in /python/packages/lab with 2 updates - #8209

Merged
Evan Mattson (moonbox3) merged 1 commit into
mainfrom
dependabot/uv/python/packages/lab/basics-695df9510e
Sep 9, 2026
Merged

Evan Mattson (moonbox3) merged 1 commit into
mainfrom
dependabot/uv/python/packages/lab/basics-695df9510e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the basics group in /python/packages/lab with 2 updates: uv and prek.

Updates uv from 0.12.7 to 0.12.9

Release notes

Sourced from uv's releases.

0.12.9

Release Notes

Released on 2026-09-01.

Python

Enhancements

  • Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
  • Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

  • Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

  • Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
  • Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
  • Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
  • Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
  • Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

Install uv 0.12.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex"

Download uv 0.12.9

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.9

Released on 2026-09-01.

Python

Enhancements

  • Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
  • Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

  • Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

  • Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
  • Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
  • Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
  • Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
  • Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

0.12.8

Released on 2026-08-31.

Enhancements

  • Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

  • Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
  • Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
  • Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

  • Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
  • Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
  • Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
  • Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

  • Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
  • Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)

... (truncated)

Commits

Updates prek from 0.5.0 to 0.5.2

Release notes

Sourced from prek's releases.

0.5.2

Release Notes

Released on 2026-09-03.

Enhancements

  • Allow unknown tags by default in check-yaml (#2678)

Contributors

Install prek 0.5.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.2

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum
prek-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
prek-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
prek-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
prek-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

</tr></table> 

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.2

Released on 2026-09-03.

Enhancements

  • Allow unknown tags by default in check-yaml (#2678)

Contributors

0.5.1

Released on 2026-09-01.

Enhancements

  • Add --hide-status <passed|failed|skipped> for hook reports (#2644)
  • Add prek init for repository setup (#2636)
  • Apply hook env during environment creation (#2650)
  • Disable error snippets in check-yaml diagnostics (#2664)
  • Show hooks excluded by skip selectors (#2645)
  • Support Pixi for Conda environments (#2667)
  • Support cargo-binstall for Rust CLI dependencies (#2658)
  • Warn about unused keys in user settings (#2665)

Bug fixes

  • Reject unsupported YAML tags in check-yaml (#2656)

Documentation

  • Clarify local hook documentation (#2640)
  • Clarify pre-commit command compatibility (#2635)
  • Document automatic PR fixes with autofix.ci (#2643)
  • Document check-yaml unsafe support (#2632)
  • Improve setup and workflow documentation (#2637)

Other changes

  • Drop low-usage release targets (#2651)
  • Generate a prek manifest JSON schema (#2648)

Contributors

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the basics group in /python/packages/lab with 2 updates: [uv](https://github.com/astral-sh/uv) and [prek](https://github.com/j178/prek).


Updates `uv` from 0.12.7 to 0.12.9
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.7...0.12.9)

Updates `prek` from 0.5.0 to 0.5.2
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.5.0...v0.5.2)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.12.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: basics
- dependency-name: prek
  dependency-version: 0.5.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: basics
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Usage: [Issues, PRs], Target: dependencies in the project lab Usage: [Issues, PRs], Target: lab packages python Usage: [Issues, PRs], Target: Python labels Sep 9, 2026
Copilot AI balanced review requested due to automatic review settings September 9, 2026 22:23
@dependabot dependabot Bot added the python Usage: [Issues, PRs], Target: Python label Sep 9, 2026
@dependabot dependabot Bot added lab Usage: [Issues, PRs], Target: lab packages dependencies Usage: [Issues, PRs], Target: dependencies in the project labels Sep 9, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 9, 2026 22:23 Inactive
@github-actions github-actions Bot changed the title Build(deps-dev): bump the basics group in /python/packages/lab with 2 updates Python: Build(deps-dev): bump the basics group in /python/packages/lab with 2 updates Sep 9, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 9, 2026 22:24 Inactive
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 9, 2026 22:24 Inactive
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 9, 2026 22:24 Inactive

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The changes are limited to Lab-scoped dev dependency bumps plus a corresponding lockfile refresh with no production/runtime code impact.

Pull request overview

Updates the Python Lab package’s dev tooling dependencies (uv, prek) and refreshes the Lab-specific uv.lock to reflect the new resolved graph (including normalized environment markers).

Changes:

  • Bump uv from 0.12.7 → 0.12.9 in python/packages/lab.
  • Bump prek from 0.5.0 → 0.5.2 in python/packages/lab.
  • Regenerate python/packages/lab/uv.lock to capture the updated versions and resulting dependency/marker normalization.
File summaries
File Description
python/packages/lab/pyproject.toml Updates dev dependency pins for uv and prek.
python/packages/lab/uv.lock Refreshes the Lab lockfile with the updated tool versions and the new resolved metadata/markers.
Review details
  • Files reviewed: 1/2 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

@moonbox3
Evan Mattson (moonbox3) added this pull request to the merge queue Sep 9, 2026
Merged via the queue into main with commit 5e0536c Sep 9, 2026
63 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/python/packages/lab/basics-695df9510e branch September 9, 2026 22:56

This branch was previously deployed

1 inactive deployment
github-app-auth — 457f97b1 Deployed Sep 9, 2026 by dependabot[bot] via limit_open_prs #1189
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Usage: [Issues, PRs], Target: dependencies in the project lab Usage: [Issues, PRs], Target: lab packages python Usage: [Issues, PRs], Target: Python

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants