Python: build(deps-dev): bump the basics group across 2 directories with 2 updates by dependabot[bot] · Pull Request #8959 · microsoft/agent-framework

dependabot · 2026-10-02T01:33:52Z

Bumps the basics group with 2 updates in the /python directory: uv and ruff.
Bumps the basics group with 2 updates in the /python/packages/lab directory: uv and ruff.

Updates uv from 0.12.16 to 0.12.19

Release notes

Sourced from uv's releases.

0.12.19

Release Notes

Released on 2026-09-24.

Python

Add PyPy 3.11.16 and 3.12.14 (#21847)

Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

Format upload URLs with backticks in uv publish errors (#21934)

Preview features

Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)

Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)

Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)

Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)

Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

Make individual preview-feature reference entries linkable by name (#21950)

Install uv 0.12.19

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex"
Download uv 0.12.19

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.19

Released on 2026-09-24.

Python

Add PyPy 3.11.16 and 3.12.14 (#21847)

Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

Format upload URLs with backticks in uv publish errors (#21934)

Preview features

Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)

Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)

Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)

Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)

Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

Make individual preview-feature reference entries linkable by name (#21950)

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)

Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)

Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

... (truncated)

Commits

bea1384 Bump version to 0.12.19 (#21975)
299a93d Sync latest Python releases (#21970)
30de9e2 Preserve query parameters in direct URL metadata (#21971)
0e7433e Filter distribution hashes in tests (#21941)
c73db78 Omit unused runtime settings from lockfiles (#21913)
ad12342 Add a preview feature for lazy build backend imports (#21967)
dd965a2 Restore FlatDistributions for downstream resolvers (#21965)
214d7f6 Use Astra for PR security reviews (#21959)
3db6652 Disable incremental compilation when publishing docs (#21955)
e18f413 Reproduce editable project relocation failure (#21948)
Additional commits viewable in compare view

Updates ruff from 0.16.7 to 0.16.9

Release notes

Sourced from ruff's releases.

0.16.9

Release Notes

Released on 2026-09-24.

Preview features

[ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

[flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)

[flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

Update LibCST-based fixes for Python 3.15 (#28616)

[flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

Fix horizontal overflow on the rules documentation page (#28699)

Update rules table with category information (#28651)

[flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)

[flake8-bugbear] Document type-checker interaction (B010) (#28509)

[flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)

[ruff] Mention related isort settings (RUF022) (#28719)

Contributors

@qinpei-dev

@sanjayrohith

@ntBre

@webdevsamran

@zaniebot

@ewdurbin

@MichaReiser

@spaceone

@IbrahimKhan12

@devtechedge

@GruffElixir

Install ruff 0.16.9

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.9

Released on 2026-09-24.

Preview features

[ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

[flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)

[flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

Update LibCST-based fixes for Python 3.15 (#28616)

[flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

Fix horizontal overflow on the rules documentation page (#28699)

Update rules table with category information (#28651)

[flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)

[flake8-bugbear] Document type-checker interaction (B010) (#28509)

[flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)

[ruff] Mention related isort settings (RUF022) (#28719)

Contributors

@qinpei-dev

@sanjayrohith

@ntBre

@webdevsamran

@zaniebot

@ewdurbin

@MichaReiser

@spaceone

@IbrahimKhan12

@devtechedge

@GruffElixir

0.16.8

Released on 2026-09-16.

Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)

[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)

[flake8-simplify] Preserve operand order in SIM109 fix (#27824)

... (truncated)

Commits

0be08a2 Bump version to 0.16.9 (#28882)
b4920b7 Rename ruff_cli to ruff_command_line (#28881)
47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
5edf5a1 Use target form in rooster.version_files (#28876)
915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
4710e1a ci(github): update version number in placeholder of issue template (#28871)
eedfc62 [ty] Propagate outer type context through cast calls (#28855)
ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
Additional commits viewable in compare view

Updates uv from 0.12.16 to 0.12.19

Release notes

Sourced from uv's releases.

0.12.19

Release Notes

Released on 2026-09-24.

Python

Add PyPy 3.11.16 and 3.12.14 (#21847)

Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

Format upload URLs with backticks in uv publish errors (#21934)

Preview features

Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)

Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)

Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)

Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)

Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

Make individual preview-feature reference entries linkable by name (#21950)

Install uv 0.12.19

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex"
Download uv 0.12.19

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.19

Released on 2026-09-24.

Python

Add PyPy 3.11.16 and 3.12.14 (#21847)

Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

Format upload URLs with backticks in uv publish errors (#21934)

Preview features

Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)

Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)

Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)

Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)

Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

Make individual preview-feature reference entries linkable by name (#21950)

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)

Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)

Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

... (truncated)

Commits

bea1384 Bump version to 0.12.19 (#21975)
299a93d Sync latest Python releases (#21970)
30de9e2 Preserve query parameters in direct URL metadata (#21971)
0e7433e Filter distribution hashes in tests (#21941)
c73db78 Omit unused runtime settings from lockfiles (#21913)
ad12342 Add a preview feature for lazy build backend imports (#21967)
dd965a2 Restore FlatDistributions for downstream resolvers (#21965)
214d7f6 Use Astra for PR security reviews (#21959)
3db6652 Disable incremental compilation when publishing docs (#21955)
e18f413 Reproduce editable project relocation failure (#21948)
Additional commits viewable in compare view

Updates ruff from 0.16.7 to 0.16.9

Release notes

Sourced from ruff's releases.

0.16.9

Release Notes

Released on 2026-09-24.

Preview features

[ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

[flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)

[flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

Update LibCST-based fixes for Python 3.15 (#28616)

[flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

Fix horizontal overflow on the rules documentation page (#28699)

Update rules table with category information (#28651)

[flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)

[flake8-bugbear] Document type-checker interaction (B010) (#28509)

[flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)

[ruff] Mention related isort settings (RUF022) (#28719)

Contributors

@qinpei-dev

@sanjayrohith

@ntBre

@webdevsamran

@zaniebot

@ewdurbin

@MichaReiser

@spaceone

@IbrahimKhan12

@devtechedge

@GruffElixir

Install ruff 0.16.9

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.9

Released on 2026-09-24.

Preview features

[ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

[flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)

[flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

Update LibCST-based fixes for Python 3.15 (#28616)

[flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

Fix horizontal overflow on the rules documentation page (#28699)

Update rules table with category information (#28651)

[flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)

[flake8-bugbear] Document type-checker interaction (B010) (#28509)

[flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)

[ruff] Mention related isort settings (RUF022) (#28719)

Contributors

@qinpei-dev

@sanjayrohith

@ntBre

@webdevsamran

@zaniebot

@ewdurbin

@MichaReiser

@spaceone

@IbrahimKhan12

@devtechedge

@GruffElixir

0.16.8

Released on 2026-09-16.

Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)

[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)

[flake8-simplify] Preserve operand order in SIM109 fix (#27824)

... (truncated)

Commits

0be08a2 Bump version to 0.16.9 (#28882)
b4920b7 Rename ruff_cli to ruff_command_line (#28881)
47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
5edf5a1 Use target form in rooster.version_files (#28876)
915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
4710e1a ci(github): update version number in placeholder of issue template (#28871)
eedfc62 [ty] Propagate outer type context through cast calls (#28855)
ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
Additional commits viewable in compare view

Updates uv from 0.12.18 to 0.12.19

Release notes

Sourced from uv's releases.

0.12.19

Release Notes

Released on 2026-09-24.

Python

Add PyPy 3.11.16 and 3.12.14 (#21847)

Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

Format upload URLs with backticks in uv publish errors (#21934)

Preview features

Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)

Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)

Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)

Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)

Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

Make individual preview-feature reference entries linkable by name (#21950)

Install uv 0.12.19

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex"
Download uv 0.12.19

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.19

Released on 2026-09-24.

Python

Add PyPy 3.11.16 and 3.12.14 (#21847)

Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

Format upload URLs with backticks in uv publish errors (#21934)

Preview features

Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)

Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)

Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)

Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)

Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

Make individual preview-feature reference entries linkable by name (#21950)

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)

Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)

Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

... (truncated)

Commits

bea1384 Bump version to 0.12.19 (#21975)
299a93d Sync latest Python releases (#21970)
30de9e2 Preserve query parameters in direct URL metadata (#21971)
0e7433e Filter distribution hashes in tests (#21941)
c73db78 Omit unused runtime settings from lockfiles (#21913)
ad12342 Add a preview feature for lazy build backend imports (#21967)
dd965a2 Restore FlatDistributions for downstream resolvers (#21965)
214d7f6 Use Astra for PR security reviews (#21959)
3db6652 Disable incremental compilation when publishing docs (#21955)
e18f413 Reproduce editable project relocation failure (#21948)
Additional commits viewable in compare view

Updates ruff from 0.16.8 to 0.16.9

Release notes

Sourced from ruff's releases.

0.16.9

Release Notes

Released on 2026-09-24.

Preview features

[ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

[flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)

[flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

Update LibCST-based fixes for Python 3.15 (#28616)

[flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

Fix horizontal overflow on the rules documentation page (#28699)

Update rules table with category information (#28651)

[flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)

[flake8-bugbear] Document type-checker interaction (B010) (#28509)

[flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)

[ruff] Mention related isort settings (RUF022) (#28719)

Contributors

@qinpei-dev

@sanjayrohith

@ntBre

@webdevsamran

@zaniebot

@ewdurbin

@MichaReiser

@spaceone

@IbrahimKhan12

@devtechedge

@GruffElixir

Install ruff 0.16.9

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.9

Released on 2026-09-24.

Preview features

[ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

[flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)

[flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

Update LibCST-based fixes for Python 3.15 (#28616)

[flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

Fix horizontal overflow on the rules documentation page (#28699)

Update rules table with category information (#28651)

[flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)

[flake8-bugbear] Document type-checker interaction (B010) (#28509)

[flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)

[ruff] Mention related isort settings (RUF022) (#28719)

Contributors

@qinpei-dev

@sanjayrohith

@ntBre

@webdevsamran

@zaniebot

@ewdurbin

@MichaReiser

@spaceone

@IbrahimKhan12

@devtechedge

@GruffElixir

0.16.8

Released on 2026-09-16.

Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)

[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)

[flake8-simplify] Preserve operand order in SIM109 fix (#27824)

... (truncated)

Commits

0be08a2 Bump version to 0.16.9 (#28882)
b4920b7 Rename ruff_cli to ruff_command_line (#28881)
47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
5edf5a1 Use target form in rooster.version_files (#28876)
915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
4710e1a ci(github): update version number in placeholder of issue template (#28871)
eedfc62 [ty] Propagate outer type context through cast calls (#28855)
ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
Additional commits viewable in compare view

Updates uv from 0.12.18 to 0.12.19

Release notes

Sourced from uv's releases.

0.12.19

Release Notes

Released on 2026-09-24.

Python

Add PyPy 3.11.16 and 3.12.14 (#21847)

Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

Format upload URLs with backticks in uv publish errors (#21934)

Preview features

Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)

Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)

Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)

Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)

Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

Make individual preview-feature reference entries linkable by name (#21950)

Install uv 0.12.19

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex"
Download uv 0.12.19

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.19

Released on 2026-09-24.

Python

Add PyPy 3.11.16 and 3.12.14 (#21847)

Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

Format upload URLs with backticks in uv publish errors (#21934)

Preview features

Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)

Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)

Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)

Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)

Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

Make individual preview-feature reference entries linkable by name (#21950)

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)

Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)

Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

... (truncated)

Comm...

Description has been truncated

…dates Bumps the basics group with 2 updates in the /python directory: [uv](https://github.com/astral-sh/uv) and [ruff](https://github.com/astral-sh/ruff). Bumps the basics group with 2 updates in the /python/packages/lab directory: [uv](https://github.com/astral-sh/uv) and [ruff](https://github.com/astral-sh/ruff). Updates `uv` from 0.12.16 to 0.12.19 - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.12.16...0.12.19) Updates `ruff` from 0.16.7 to 0.16.9 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.7...0.16.9) Updates `uv` from 0.12.16 to 0.12.19 - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.12.16...0.12.19) Updates `ruff` from 0.16.7 to 0.16.9 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.7...0.16.9) Updates `uv` from 0.12.18 to 0.12.19 - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.12.16...0.12.19) Updates `ruff` from 0.16.8 to 0.16.9 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.7...0.16.9) Updates `uv` from 0.12.18 to 0.12.19 - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.12.16...0.12.19) Updates `ruff` from 0.16.8 to 0.16.9 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.7...0.16.9) --- updated-dependencies: - dependency-name: uv dependency-version: 0.12.19 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: basics - dependency-name: ruff dependency-version: 0.16.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: basics - dependency-name: uv dependency-version: 0.12.19 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: basics - dependency-name: ruff dependency-version: 0.16.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: basics - dependency-name: uv dependency-version: 0.12.19 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: basics - dependency-name: ruff dependency-version: 0.16.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: basics - dependency-name: uv dependency-version: 0.12.19 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: basics - dependency-name: ruff dependency-version: 0.16.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: basics ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Both corresponding lockfiles remain stale and will cause frozen dependency synchronization to fail.

Review effort: Balanced
Findings: 2

Open (2)

Regenerate lab uv.lock for updated uv and ruff pins · New
Regenerate uv.lock for updated uv and ruff pins · New

What changed in this PR

Updates Python development tooling dependencies across the root workspace and lab package.

Changes:

Bumps uv to 0.12.19.
Bumps ruff to 0.16.9.

File	Description
`python/pyproject.toml`	Updates root development-tool pins.
`python/packages/lab/pyproject.toml`	Updates lab development-tool pins.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

+    "uv==0.12.19",
+    "ruff==0.16.9",


 [dependency-groups]
 dev = [
-    "uv==0.12.16",
+    "uv==0.12.19",


dependabot · 2026-10-02T11:37:22Z

Looks like these dependencies are no longer updatable, so this is no longer needed.

dependabot Bot added dependencies Usage: [Issues, PRs], Target: dependencies in the project python Usage: [Issues, PRs], Target: Python labels Oct 2, 2026

Copilot AI balanced review requested due to automatic review settings October 2, 2026 01:33

dependabot Bot added python Usage: [Issues, PRs], Target: Python dependencies Usage: [Issues, PRs], Target: dependencies in the project labels Oct 2, 2026

dependabot Bot requested review from SergeyMenshykh, Tao Chen (TaoChenOSU), Eduard van Valkenburg (eavanvalkenburg), Giles Odigwe (giles17), Jose Alvarez (jpalvarezl), Evan Mattson (moonbox3), Roger Barreto (rogerbarreto), sophia-ramsey and westey (westey-m) as code owners October 2, 2026 01:33

dependabot Bot temporarily deployed to github-app-auth October 2, 2026 01:33 Inactive

dependabot Bot mentioned this pull request Oct 2, 2026

Python: build(deps-dev): bump the basics group across 2 directories with 2 updates #8941

Closed

github-actions Bot changed the title ~~build(deps-dev): bump the basics group across 2 directories with 2 updates~~ Python: build(deps-dev): bump the basics group across 2 directories with 2 updates Oct 2, 2026

dependabot Bot temporarily deployed to github-app-auth October 2, 2026 01:34 Inactive

agent-framework-automation Bot added the lab Usage: [Issues, PRs], Target: lab packages label Oct 2, 2026

Copilot started reviewing October 2, 2026 01:34

View session

Copilot AI reviewed Oct 2, 2026

View reviewed changes

Comment thread python/packages/lab/pyproject.toml

Comment on lines +61 to +62

"uv==0.12.19",

"ruff==0.16.9",

Comment thread python/pyproject.toml

[dependency-groups]

dev = [

"uv==0.12.16",

"uv==0.12.19",

dependabot Bot temporarily deployed to github-app-auth October 2, 2026 11:36 Inactive

dependabot Bot closed this Oct 2, 2026

dependabot Bot deleted the dependabot/pip/python/basics-f01379b540 branch October 2, 2026 11:37

dependabot Bot temporarily deployed to github-app-auth October 2, 2026 11:37 Inactive

Navigation Menu

Repository navigation

Python: build(deps-dev): bump the basics group across 2 directories with 2 updates - #8959

Python: build(deps-dev): bump the basics group across 2 directories with 2 updates#8959
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python/basics-f01379b540

dependabot Bot commented on behalf of github Oct 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

dependabot Bot commented on behalf of github Oct 2, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

0.12.19

Release Notes

Python

Enhancements

Preview features

Bug fixes

Rust API

Documentation

Install uv 0.12.19

Install prebuilt binaries via shell script

Install prebuilt binaries via powershell script

Download uv 0.12.19

0.12.19

Python

Enhancements

Preview features

Bug fixes

Rust API

Documentation

0.12.18

Enhancements

Preview features

Performance

0.16.9

Release Notes

Preview features

Bug fixes

Rule changes

Documentation

Contributors

Install ruff 0.16.9

Install prebuilt binaries via shell script

0.16.9

Preview features

Bug fixes

Rule changes

Documentation

Contributors

0.16.8

Bug fixes

0.12.19

Release Notes

Python

Enhancements

Preview features

Bug fixes

Rust API

Documentation

Install uv 0.12.19

Install prebuilt binaries via shell script

Install prebuilt binaries via powershell script

Download uv 0.12.19

0.12.19

Python

Enhancements

Preview features

Bug fixes

Rust API

Documentation

0.12.18

Enhancements

Preview features

Performance

0.16.9

Release Notes

Preview features

Bug fixes

Rule changes

Documentation

Contributors

Install ruff 0.16.9

Install prebuilt binaries via shell script

0.16.9

Preview features

Bug fixes

Rule changes

Documentation

dependabot Bot commented on behalf of github Oct 2, 2026 •

edited

Loading