Allow manually specifying build dependency hashes in configuration by zsol · Pull Request #21467 · astral-sh/uv

zsol · 2026-09-04T16:33:14Z

Summary

Project build constraints can pin versions, but cannot attach hashes to those pins. Allow build-constraint-dependencies to contain { requirement, hashes } entries alongside strings, and retain the hashes in uv.lock and tool receipts.

Verify supplied hashes when uv downloads build dependencies for project, script, build, pip, and tool commands. This includes the build used to infer a tool's name and fresh uv run --no-sync --with overlays. Build dependencies without supplied hashes remain allowed.

Stacked on #21459.

zsol · 2026-09-04T17:10:38Z

(not ready for review yet 😜 )

konstin · 2026-09-08T10:42:11Z

+#[derive(
+    Debug, Clone, Eq, PartialEq, Ord, PartialOrd, Hash, serde::Serialize, serde::Deserialize,
+)]
 pub struct NameRequirementSpecification {


Is there a reason it's named NameRequirementSpecification? It looks more like RequirmentWithHashes.

I agree but this was preexisting and didn't want to change it in this PR. I can followup

zanieb · 2026-09-09T15:26:01Z

Shouldn't this be titled like... "Allow including hashes for build-constraint-dependencies"?

zsol · 2026-09-09T16:48:13Z

Shouldn't this be titled like... "Allow including hashes for build-constraint-dependencies"?

Agreed the current title is hot garbage and your suggestion is much better, but I think I can do better than even that

konstin · 2026-09-14T16:20:29Z

+```toml
+[tool.uv]
+build-constraint-dependencies = [
+    { requirement = "setuptools==68.2.2", hashes = ["sha256:b454a35605876da60632df1a60f736524eb73cc47bbc9f3f1ef1b644de74fd2a"] },


Does this still format well if you have to have a list of hashes, e.g. with maturin?

I can see two main ways of formatting a large list of hashes. On a single, long line; or like this:

[tool.uv] build-constraint-dependencies = [ { requirement = "maturin==1.9.6", hashes = [ "sha256:26e3ab1a42a7145824210e9d763f6958f2c46afb1245ddd0bab7d78b1f59bb3f", "sha256:5263dda3f71feef2e4122baf5c4620e4b3710dbb7f2121f85a337182de214369", "sha256:fe78262c2800c92f67d1ce3c0f6463f958a692cc67bfb572e5dbf5b4b696a8ba", "sha256:7ab827c6e8c022eb2e1e7fb6deede54549c8460b20ccc2e9268cc6e8cde957a8", "sha256:0246202377c49449315305209f45c8ecef6e2d6bd27a04b5b6f1ab3e4ea47238", "sha256:f5bac167700fbb6f8c8ed1a97b494522554b4432d7578e11403b894b6a91d99f", "sha256:7f53d3b1d8396d3fea3e1ee5fd37558bca5719090f3d194ba1c02b0b56327ae3", "sha256:7f506eb358386d94d6ec3208c003130cf4b69cab26034fc0cbbf8bf83afa4c2e", "sha256:f2d6984ab690af509f525dbd2b130714207c06ebb14a5814edbe1e42b17ae0de", "sha256:5c2252b0956bb331460ac750c805ddf0d9b44442449fc1f16e3b66941689d0bc", "sha256:f2c58d29ebdd4346fd004e6be213d071fdd94a77a16aa91474a21a4f9dbf6309", "sha256:1b39a5d82572c240d20d9e8be024d722dfb311d330c5e28ddeb615211755941a", "sha256:ac02a30083553d2a781c10cd6f5480119bf6692fd177e743267406cad2ad198c", "sha256:2c2ae37144811d365509889ed7220b0598487f1278c2441829c3abf56cc6324a", ] }, "wheel<1", ]

This is essentially taplo/tombi/etc's output format. Prettier preserves either approach.

konstin · 2026-09-14T20:15:55Z

                        .flatten()
                        .map(|lock| (lock, project.workspace().install_path().to_owned()));
                }
+                // `--with` may still build an overlay under `--no-sync`. Unless explicitly frozen,


This is such a good gotcha caught here

this one was all Codex, I claim no credit (apart from making it explicit with a comment)

konstin · 2026-09-14T20:25:16Z

-            build_constraints
-                .iter()
-                .map(|entry| (&entry.requirement, entry.hashes.as_slice())),
+        // Under `--require-hashes`, include all command-line constraints, but only workspace


I have trouble understanding this section, is this saying that we drop constraints without hashes if we're in hash checking mode? (If so, why do we need to do this filtering here explicitly?)

This is the same discussion we had in #21467 (comment)

does that explanation make sense?

Arguably the hash checker should be smarter, but that's a larger change we should visit separately. If you prefer, I can drop this special-casing until we revisit that

konstin · 2026-09-14T20:28:24Z

-    /// Read the required hashes from a set of [`UnresolvedRequirement`] entries.
+    /// Collect hashes from [`UnresolvedRequirement`] entries and constraints.
+    ///
+    /// For duplicate registry pins and local files, the last nonempty constraint hash list wins.


Is there a reason for that specific rule?

Purely for consistency with regular (non-build) constraints

I noticed this duplication in #21467, this centralizes `--find-links` flat-index loading into `FlatIndex::load`.

Use the same hash pinning rules for project, command-line, and tool build constraints. Verify supplied hashes on pinned requirements; ignore hashes on unpinned requirements in Verify mode while retaining version limits. For a locked PEP 723 script, `--no-sync` does not skip environment sync. Keep its lockfile build constraints for `--with` overlays so a replaced build dependency wheel fails hash verification before the backend runs. Trim overlapping integration cases and align documentation and comments with the behavior.

Record backend execution in the shared fixture and reuse the nested-project setup across run tests. Pass build constraint file paths directly and retain pip install and sync coverage because they construct separate hash strategies. Align the project build hash explanation with the surrounding documentation.

Distinguish build constraint hashes from runtime package hash verification and remove the redundant mention of lockfile persistence.

Use the shared flat-index loader for requirement name inference and classify its errors through the client. Update wheel fixtures for the entry-point argument and refresh snapshots for the shared error renderer.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.12.15` → `0.12.16` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216) [Compare Source](astral-sh/uv@0.12.15...0.12.16) Released on 2026-09-17. ##### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ##### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ##### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ##### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active version pins ([#21742](astral-sh/uv#21742)) - Handle malformed index URLs without panicking when credentials are configured ([#21784](astral-sh/uv#21784)) - Report a configuration error instead of panicking for proxy URLs without a host ([#21781](astral-sh/uv#21781)) - Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#21783](astral-sh/uv#21783)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/46 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.12.15` → `0.12.16` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/51) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216) [Compare Source](astral-sh/uv@0.12.15...0.12.16) Released on 2026-09-17. ##### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ##### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ##### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ##### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active version pins ([#21742](astral-sh/uv#21742)) - Handle malformed index URLs without panicking when credentials are configured ([#21784](astral-sh/uv#21784)) - Report a configuration error instead of panicking for proxy URLs without a host ([#21781](astral-sh/uv#21781)) - Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#21783](astral-sh/uv#21783)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/57 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

Moves `uv` from 0.12.13 to 0.12.17 in both harness actions and in the generator's `UV_VERSION`, which renders the `setup-uv` step of every generated workflow. `mitmproxy` stays at 12.2.3 — already the latest release — so this moves alone rather than as the usual uv-plus-mitmproxy pair. uv matters on two paths tend owns: it installs the pinned mitmproxy that holds the bot PAT and the model credential, and it is the agent's pinned fallback inside the sandbox. Two changes in this range touch those directly: - **0.12.16 verifies downloaded wheels and source distributions against the hashes the package index supplies** ([#21562](astral-sh/uv#21562)), and extends hash verification to `build-constraint-dependencies` ([#21467](astral-sh/uv#21467)). Every uv download in a tend job goes through the credential proxy, so index-supplied hash checking is checked at the far end of exactly that hop. - **0.12.16 redacts Azure shared access signatures from displayed and logged URLs** ([#21755](astral-sh/uv#21755)). Not a path tend takes — no Azure index — but it is a credentials-in-logs fix, and tend's session logs upload as artifacts. **0.12.15 is the reason not to stop at 0.12.14**: it fixes 0.12.14 regressions when installing to symlinked destinations and under `uv pip install --target .` ([#21699](astral-sh/uv#21699)). The rest is resolver performance, error rendering, and preview features tend does not enable. Nothing changes `uv run --script`, which is how the shipped skills invoke their helpers. `uv_build>=0.12,<0.13` in `generator/pyproject.toml` already contains 0.12.17, so the build backend range needs no move. Regenerated regtest outputs carry the same one-line change; the full Python suite passes apart from the two `test_refresh_consumers.py` cases that need DNS, which no tend session has. <details><summary>Releases crossed</summary> [0.12.14](https://github.com/astral-sh/uv/releases/tag/0.12.14), [0.12.15](https://github.com/astral-sh/uv/releases/tag/0.12.15), [0.12.16](https://github.com/astral-sh/uv/releases/tag/0.12.16), [0.12.17](https://github.com/astral-sh/uv/releases/tag/0.12.17). The `uv-pre-commit` hook rev moves to 0.12.17 too, but in the repo-only pin PR rather than here — it runs in this repo's lint, not in a consumer's job. </details> Weekly pin sweep. Co-authored-by: tend-agent <tend-agent@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [uv](https://github.com/astral-sh/uv) | tools | patch | `0.12.13` → `0.12.17` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217) [Compare Source](astral-sh/uv@0.12.16...0.12.17) Released on 2026-09-18. ##### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ##### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ##### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ##### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ##### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216) [Compare Source](astral-sh/uv@0.12.15...0.12.16) Released on 2026-09-17. ##### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ##### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ##### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ##### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active version pins ([#21742](astral-sh/uv#21742)) - Handle malformed index URLs without panicking when credentials are configured ([#21784](astral-sh/uv#21784)) - Report a configuration error instead of panicking for proxy URLs without a host ([#21781](astral-sh/uv#21781)) - Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#21783](astral-sh/uv#21783)) ### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215) [Compare Source](astral-sh/uv@0.12.14...0.12.15) Released on 2026-09-15. This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using `uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#21699](astral-sh/uv#21699)) ##### Performance - Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#21675](astral-sh/uv#21675)) ##### Bug fixes - Revert "Reject symlinked wheel installation destinations" ([#21699](astral-sh/uv#21699)) ### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214) [Compare Source](astral-sh/uv@0.12.13...0.12.14) Released on 2026-09-15. Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#17110](astral-sh/uv#17110), [#21599](astral-sh/uv#21599), [#21603](astral-sh/uv#21603)) Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#17110](astral-sh/uv#17110)) ##### Enhancements - Resume interrupted downloads with HTTP Range requests when supported ([#21570](astral-sh/uv#21570)) - Show underlying causes and hints in user warnings ([#21565](astral-sh/uv#21565)) - Show resolver hints for failed `uv tool upgrade` operations ([#21566](astral-sh/uv#21566)) ##### Preview features - Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#21618](astral-sh/uv#21618)) ##### Performance - Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#21619](astral-sh/uv#21619)) - Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#21593](astral-sh/uv#21593)) - Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#21621](astral-sh/uv#21621)) ##### Bug fixes - Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#21672](astral-sh/uv#21672)) - Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#21625](astral-sh/uv#21625)) - Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#21639](astral-sh/uv#21639)) - Redact credentials and signatures from missing-path-segment URL errors ([#21616](astral-sh/uv#21616)) - Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#21640](astral-sh/uv#21640)) - Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#21559](astral-sh/uv#21559)) - Suppress managed-Python fallback warnings under `--quiet` ([#21565](astral-sh/uv#21565)) - Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#21566](astral-sh/uv#21566)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/632

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Add `--require-build-hashes` to require an exact version or direct URL and a trusted hash for every build dependency, including transitive dependencies. This builds on the supplied-hash verification in #21467, which still allows dependencies without hashes. The requirement applies to builds run by project, build, tool, and pip commands, including builds needed to resolve metadata during locking or compilation. Hashes can come from `tool.uv.build-constraint-dependencies`, a `--build-constraint` file, or URL fragments in `build-system.requires`. Dependencies discovered through backend hooks or package metadata still need hashes declared upfront; hashes supplied only by those hooks or metadata do not satisfy the requirement. Enable the setting with `require-build-hashes = true` or the shared `UV_REQUIRE_BUILD_HASHES` environment variable. Pip commands can override the top-level setting in `[tool.uv.pip]`. CLI flags take precedence over the environment, which takes precedence over configuration. `--no-require-build-hashes` turns off the requirement without disabling verification of supplied hashes. This complements `--require-hashes` for runtime dependencies. The existing `uv build --require-hashes` behavior for command-line build constraints is unchanged. Requiring build hashes needs build isolation, except when uv uses its bundled `uv_build` backend, which is part of the executable. It does not retroactively verify installed packages or previously built wheels. The option is experimental and warns unless `--preview-features build-dependency-hashes` is enabled. Stacked on #21708. --------- Co-authored-by: Zanie Blue <contact@zanie.dev>

Add `--require-build-hashes` to require an exact version or direct URL and a trusted hash for every build dependency, including transitive dependencies. This builds on the supplied-hash verification in astral-sh#21467, which still allows dependencies without hashes. The requirement applies to builds run by project, build, tool, and pip commands, including builds needed to resolve metadata during locking or compilation. Hashes can come from `tool.uv.build-constraint-dependencies`, a `--build-constraint` file, or URL fragments in `build-system.requires`. Dependencies discovered through backend hooks or package metadata still need hashes declared upfront; hashes supplied only by those hooks or metadata do not satisfy the requirement. Enable the setting with `require-build-hashes = true` or the shared `UV_REQUIRE_BUILD_HASHES` environment variable. Pip commands can override the top-level setting in `[tool.uv.pip]`. CLI flags take precedence over the environment, which takes precedence over configuration. `--no-require-build-hashes` turns off the requirement without disabling verification of supplied hashes. This complements `--require-hashes` for runtime dependencies. The existing `uv build --require-hashes` behavior for command-line build constraints is unchanged. Requiring build hashes needs build isolation, except when uv uses its bundled `uv_build` backend, which is part of the executable. It does not retroactively verify installed packages or previously built wheels. The option is experimental and warns unless `--preview-features build-dependency-hashes` is enabled. Stacked on astral-sh#21708. --------- Co-authored-by: Zanie Blue <contact@zanie.dev>

zsol had a problem deploying to automations September 4, 2026 16:34 — with GitHub Actions Error

zsol had a problem deploying to automations September 4, 2026 18:34 — with GitHub Actions Error

zsol marked this pull request as ready for review September 4, 2026 20:32

zsol force-pushed the zsol/verify-build-constraint-hashes branch from b56f11b to 2055fec Compare September 7, 2026 13:08

zsol had a problem deploying to automations September 7, 2026 13:09 — with GitHub Actions Error

zsol force-pushed the zsol/verify-build-constraint-hashes branch from 2055fec to 73b0c02 Compare September 7, 2026 16:24

zsol had a problem deploying to automations September 7, 2026 16:25 — with GitHub Actions Error

konstin reviewed Sep 8, 2026

View reviewed changes

zsol force-pushed the zsol/verify-build-constraint-hashes branch from 73b0c02 to ac5ce44 Compare September 8, 2026 13:37

zsol had a problem deploying to automations September 8, 2026 13:37 — with GitHub Actions Error

zsol had a problem deploying to automations September 8, 2026 13:46 — with GitHub Actions Error

zsol mentioned this pull request Sep 9, 2026

Support required hashes for build dependencies #21411

Merged

zsol changed the title ~~Verify supplied build dependency hashes~~ Allow manually specifying build dependency hashes in configuration Sep 9, 2026

zsol force-pushed the zsol/verify-build-constraint-hashes branch from 04a299c to b3f0b61 Compare September 10, 2026 10:54

zsol had a problem deploying to automations September 10, 2026 10:54 — with GitHub Actions Error

konstin approved these changes Sep 14, 2026

View reviewed changes

konsti-openai mentioned this pull request Sep 14, 2026

Deduplicate flat index loading boilerplate #21684

Merged

Base automatically changed from zsol/preserve-constraint-hashes to main September 15, 2026 10:42

zsol force-pushed the zsol/verify-build-constraint-hashes branch from 0466a0e to 85b82da Compare September 15, 2026 12:16

zsol mentioned this pull request Sep 15, 2026

Honor hashed uv-build version pins in bundled builds #21708

Closed

zsol added 3 commits September 15, 2026 13:24

Verify supplied build dependency hashes

698348d

zsol added 3 commits September 15, 2026 13:24

Clarify requirement path conversion docs

72cec92

Clarify build dependency hash documentation

5692c64

Distinguish build constraint hashes from runtime package hash verification and remove the redundant mention of lockfile persistence.

Update build hash verification for current APIs

80bcb3e

Use the shared flat-index loader for requirement name inference and classify its errors through the client. Update wheel fixtures for the entry-point argument and refresh snapshots for the shared error renderer.

zsol force-pushed the zsol/verify-build-constraint-hashes branch from 85b82da to 80bcb3e Compare September 15, 2026 12:35

zsol had a problem deploying to automations September 15, 2026 12:36 — with GitHub Actions Error

zsol removed this pull request from stack #21469 September 15, 2026 12:37

zsol added this pull request to stack #21709 September 15, 2026 12:40

zsol merged commit ac9201b into main Sep 15, 2026
60 of 61 checks passed

zsol deleted the zsol/verify-build-constraint-hashes branch September 15, 2026 13:25

zsol added the enhancement New feature or improvement to existing functionality label Sep 15, 2026

BrewTestBot mentioned this pull request Sep 18, 2026

uv 0.12.16 Homebrew/homebrew-core#311913

Merged

tend-agent mentioned this pull request Sep 20, 2026

chore: bump uv to 0.12.17 max-sixty/tend#1331

Merged

saidsef mentioned this pull request Sep 20, 2026

chore(deps): review astral-sh/uv 0.12.13 → 0.12.17 (#447) saidsef/mcp-github-pr-issue-analyser#450

Closed

5 tasks done

scottames-github-bot Bot mentioned this pull request Sep 23, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1074

Merged

1 task

Conversation

zsol commented Sep 4, 2026

Summary

Uh oh!

zsol commented Sep 4, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zanieb commented Sep 9, 2026

Uh oh!

zsol commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

zsol commented Sep 9, 2026 •

edited

Loading