chore(deps): bump astral-sh/uv from 0.12.5 to 0.12.16

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps astral-sh/uv from 0.12.5 to 0.12.16.

Release notes

Sourced from astral-sh/uv's releases.

0.12.16

Release Notes

Released on 2026-09-17.

Python

• Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#21741)

Enhancements

• Verify downloaded wheels and source distributions against hashes supplied by package indexes (#21562)
• Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#21467)
• Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#21766)
• Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#21779)

Preview features

• Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#21163)
• Honor configured and command-line index settings, including credentials, in uv upgrade (#21776)
• Allow uv check to run in projects that are not managed by uv and outside workspaces (#21777)
• Respect --python and UV_PYTHON when selecting the Python version for uv check (#21744)

Bug fixes

• Redact Azure shared access signatures from displayed and logged URLs (#21755)
• Check archive sizes from pylock.toml before reusing cached distributions (#21609)
• Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#20631)
• Use the bundled uv_build backend only when its version matches active version pins (#21742)
• Handle malformed index URLs without panicking when credentials are configured (#21784)
• Report a configuration error instead of panicking for proxy URLs without a host (#21781)
• Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#21783)

Install uv 0.12.16

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1 | iex"

Download uv 0.12.16

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from astral-sh/uv's changelog.

0.12.16

Released on 2026-09-17.

Python

• Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#21741)

Enhancements

• Verify downloaded wheels and source distributions against hashes supplied by package indexes (#21562)
• Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#21467)
• Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#21766)
• Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#21779)

Preview features

• Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#21163)
• Honor configured and command-line index settings, including credentials, in uv upgrade (#21776)
• Allow uv check to run in projects that are not managed by uv and outside workspaces (#21777)
• Respect --python and UV_PYTHON when selecting the Python version for uv check (#21744)

Bug fixes

• Redact Azure shared access signatures from displayed and logged URLs (#21755)
• Check archive sizes from pylock.toml before reusing cached distributions (#21609)
• Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#20631)
• Use the bundled uv_build backend only when its version matches active version pins (#21742)
• Handle malformed index URLs without panicking when credentials are configured (#21784)
• Report a configuration error instead of panicking for proxy URLs without a host (#21781)
• Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#21783)

0.12.15

Released on 2026-09-15.

Performance

• Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#21675)

Bug fixes

• Fix regressions in 0.12.14 when installing to symlinked destinations or using uv pip install --target . (#21699)

0.12.14

Released on 2026-09-15.

Enhancements

... (truncated)

Commits

• 761ff13 Bump version to 0.12.16 (#21809)
• a2f820a Assign release pull requests to the workflow initiator (#21808)
• 6dffe7e Ignore UV_NATIVE_TLS when UV_SYSTEM_CERTS is set (#21805)
• 7bc3676 Avoid warning when both native-tls and system-certs are configured (#21806)
• 07b838a Avoid warning when both UV_NATIVE_TLS and UV_SYSTEM_CERTS are set (#21788)
• 5d64ede Remove Hash API (#21786)
• 9ddc430 Move shared thread initialization into uv-threads (#21746)
• ef1e068 Make Git stamping opt-in for development builds (#21750)
• 6ce0977 Avoid panics for non-base index URLs (#21784)
• 47f19ec Return an error for failed VerbatimUrl path conversions (#21783)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.45%. Comparing base (53c93af) to head (651cb57).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #21   +/-   ##
=======================================
  Coverage   78.45%   78.45%           
=======================================
  Files          27       27           
  Lines        5054     5054           
=======================================
  Hits         3965     3965           
  Misses       1089     1089           

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 53c93af...651cb57. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dependabot]

Superseded by #22.