Use `editpe` for trampoline resource edits by zanieb · Pull Request #18713 · astral-sh/uv

zanieb · 2026-03-25T14:38:43Z

Windows trampoline resource updates currently depend on Win32 APIs that are unavailable on NanoServer and can contend with antivirus software while reopening temporary executables. Use upstream editpe 0.2.4 to edit PE resources in memory across all supported Windows architectures, and restore the NanoServer integration test.

Closes #18663.
Closes #20955.

…ation (#18712) Reproduces #18663 Requires #18713 Co-authored-by: Claude <noreply@anthropic.com>

The Windows NanoServer integration test added in #18712 is failing on `main` because NanoServer does not support the Windows resource-update APIs used to build Python launchers. Revert the test until the fix in #18713 is ready. Co-authored-by: Zanie Blue <contact@zanie.dev>

woodruffw · 2026-08-05T15:40:12Z

(Tagging myself for a review since I think we can maybe use Windows' native APIs for this, but with an in-memory PE rather than round-tripping through disk. I need to investigate that though.)

Edit: oh right, forgot about NanoServer...

astral-sh-bot · 2026-09-10T14:58:03Z

uv test inventory changes

This PR changes the tests when compared with the main base revision.

Added tests: 5
Removed tests: 0
Changed suites: 1

uv-trampoline-builder: +5 / -0

Added:

uv-trampoline-builder::resource_tests::empty_script_resource_is_preserved
uv-trampoline-builder::resource_tests::large_script_survives_launcher_rewrites
uv-trampoline-builder::resource_tests::resources_match_native_windows_updates
uv-trampoline-builder::test::empty_kind_resource_is_rejected
uv-trampoline-builder::test::malformed_trampoline_is_not_recognized

Removed: none

woodruffw · 2026-09-10T15:25:31Z

 checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b"

+[[package]]
+name = "debug-ignore"


TIL about this dep, pretty cool.

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.7` → `0.12.13` | `0.12.7` → `0.12.13` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.7` → `0.12.13` (astral-sh/uv)</summary> ### 0.12.8 ## Release Notes Released on 2026-08-31. ### Enhancements - Warn about invalid tool directories and continue upgrading valid tools with `uv tool upgrade --all` ([#21368](astral-sh/uv#21368)) ### Preview features - Deduplicate identical files within and across cached wheels with the `content-addressed-cache` preview feature ([#21327](astral-sh/uv#21327)) - Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files ([#21340](astral-sh/uv#21340)) - Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk ([#21344](astral-sh/uv#21344)) ### Performance - Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once ([#21379](astral-sh/uv#21379)) - Speed up dependency graph construction from large lockfiles by indexing packages during traversal ([#21373](astral-sh/uv#21373)) - Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks ([#21377](astral-sh/uv#21377)) - Speed up warm resolutions by reducing repeated marker interner work ([#21300](astral-sh/uv#21300)) ### Bug fixes - Do not trust hashes from direct URLs discovered only in wheel metadata when installing with `--require-hashes` ([#21348](astral-sh/uv#21348)) - Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled ([#21366](astral-sh/uv#21366)) - Redact Azure shared access signature (`sig`) query parameters from displayed URLs ([#21360](astral-sh/uv#21360)) - Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery ([#21341](https://github.com/astra… (truncated) ### 0.12.9 ## Release Notes Released on 2026-09-01. ### Python - Add CPython 3.15.0rc2 ([#21413](astral-sh/uv#21413), [#21415](astral-sh/uv#21415)) ### Enhancements - Add `--no-locked` and `--no-frozen` to disable lock modes enabled by `UV_LOCKED` and `UV_FROZEN` for a single invocation ([#21408](astral-sh/uv#21408)) - Report the exact command-line lock-mode flag in warnings and errors ([#21402](astral-sh/uv#21402)) ### Performance - Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files ([#21372](astral-sh/uv#21372)) ### Bug fixes - Update `async_http_range_reader` to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels ([#21401](astral-sh/uv#21401)) - Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes ([#21382](astral-sh/uv#21382)) - Redact secrets in signed URLs from retry diagnostics, including nested request errors ([#21381](astral-sh/uv#21381)) - Give `--locked`, `--frozen`, `--check`, and `--check-exists` precedence over conflicting `UV_LOCKED` and `UV_FROZEN` values ([#21396](astral-sh/uv#21396)) - Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel ([#21400](astral-sh/uv#21400)) ## Install uv 0.12.9 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex" ``` ## Downlo… (truncated) ### 0.12.10 ## Release Notes Released on 2026-09-04. ### Enhancements - Attempt to revoke short-lived PyPI trusted-publishing tokens after `uv publish` completes, including when publishing fails ([#21423](astral-sh/uv#21423)) ### Preview features - Omit `exclude-newer-package` settings for packages outside the resolution from `uv.lock` with the `missing-exclude-newer-package-lock` preview feature ([#21455](astral-sh/uv#21455)) - Show terminal dependency cycles in `uv tree --invert` output ([#21404](astral-sh/uv#21404)) ### Performance - Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification ([#21399](astral-sh/uv#21399)) - Speed up `uv publish` by hashing each artifact in a single blocking task and reusing the buffer across reads ([#21389](astral-sh/uv#21389)) ### Bug fixes - Prevent `--locked` from failing when `exclude-newer-package` settings differ only for packages outside the resolution ([#21454](astral-sh/uv#21454)) - Allow `uv lock --check` to reuse a lockfile when an absolute `exclude-newer` cutoff is moved later ([#19571](astral-sh/uv#19571)) - Allow `uv lock --check` to reuse a lockfile when a package-specific `exclude-newer` cutoff is disabled ([#21450](astral-sh/uv#21450)) - Require an explicit `--name` when `uv init` would infer a project name reserved for a Python interpreter ([#21395](astral-sh/uv#21395)) - Write package-specific `exclude-newer` cutoffs to `uv.lock` in a deterministic order ([#21453](astral-sh/uv#21453)) ## Install uv 0.12.10 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.10/uv-installer.sh | sh ``` ### Instal… (truncated) ### 0.12.11 ## Release Notes Released on 2026-09-08. ### Preview features - Generate missing artifact hashes when exporting `pylock.toml` files to ensure they conform to PEP 751 ([#20146](astral-sh/uv#20146)) - Warn when `pylock.toml` artifact hash tables are empty, which will be rejected in a future uv release ([#21462](astral-sh/uv#21462)) ### Performance - Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements ([#21478](astral-sh/uv#21478)) - Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files ([#21468](astral-sh/uv#21468)) - Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads ([#21500](astral-sh/uv#21500)) - Speed up local wheel installs by reusing ZIP readers and buffers across extracted files ([#21499](astral-sh/uv#21499)) - Avoid transitive dependency checks and unnecessary resolution when `uv pip install --no-deps` finds the requested packages already installed ([#21523](astral-sh/uv#21523)) ### Bug fixes - Verify source archives against hashes recorded in `uv.lock` before reading their metadata or running their build backends ([#21223](astral-sh/uv#21223)) - Verify supplied hashes for registry requirements pinned with `===` under both `--verify-hashes` and `--require-hashes` ([#21543](astral-sh/uv#21543)) - Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided ([#21544](astral-sh/uv#21544)) - Support PowerShell virtual environment activation from UNC paths, including WSL paths ([#19159](astral-sh/uv#19159)) - Tri… (truncated) ### 0.12.12 ## Release Notes Released on 2026-09-09. The executables in our macOS and Windows release archives and `uv` and `uv_build` wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives. ### Bug fixes - Exclude distributions uploaded after the `exclude-newer` cutoff from lockfiles and generated requirement hashes ([#21539](astral-sh/uv#21539)) ## Install uv 0.12.12 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.ps1 | iex" ``` ## Download uv 0.12.12 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i68… (truncated) ### 0.12.13 ## Release Notes Released on 2026-09-10. ### Python - Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431)) ### Enhancements - Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563)) ### Preview features - Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555)) ### Performance - Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279)) ### Bug fixes - Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713)) - Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563)) ## Install uv 0.12.13 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex" ``` ## Download uv 0.12.13 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc… (truncated) </details> </details> Modified files: - `.mise.toml`

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.7` → `0.12.13` | `0.12.7` → `0.12.13` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.7` → `0.12.13` (astral-sh/uv)</summary> ### 0.12.8 ## Release Notes Released on 2026-08-31. ### Enhancements - Warn about invalid tool directories and continue upgrading valid tools with `uv tool upgrade --all` ([#21368](astral-sh/uv#21368)) ### Preview features - Deduplicate identical files within and across cached wheels with the `content-addressed-cache` preview feature ([#21327](astral-sh/uv#21327)) - Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files ([#21340](astral-sh/uv#21340)) - Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk ([#21344](astral-sh/uv#21344)) ### Performance - Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once ([#21379](astral-sh/uv#21379)) - Speed up dependency graph construction from large lockfiles by indexing packages during traversal ([#21373](astral-sh/uv#21373)) - Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks ([#21377](astral-sh/uv#21377)) - Speed up warm resolutions by reducing repeated marker interner work ([#21300](astral-sh/uv#21300)) ### Bug fixes - Do not trust hashes from direct URLs discovered only in wheel metadata when installing with `--require-hashes` ([#21348](astral-sh/uv#21348)) - Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled ([#21366](astral-sh/uv#21366)) - Redact Azure shared access signature (`sig`) query parameters from displayed URLs ([#21360](astral-sh/uv#21360)) - Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery ([#21341](https://github.com/astra… (truncated) ### 0.12.9 ## Release Notes Released on 2026-09-01. ### Python - Add CPython 3.15.0rc2 ([#21413](astral-sh/uv#21413), [#21415](astral-sh/uv#21415)) ### Enhancements - Add `--no-locked` and `--no-frozen` to disable lock modes enabled by `UV_LOCKED` and `UV_FROZEN` for a single invocation ([#21408](astral-sh/uv#21408)) - Report the exact command-line lock-mode flag in warnings and errors ([#21402](astral-sh/uv#21402)) ### Performance - Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files ([#21372](astral-sh/uv#21372)) ### Bug fixes - Update `async_http_range_reader` to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels ([#21401](astral-sh/uv#21401)) - Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes ([#21382](astral-sh/uv#21382)) - Redact secrets in signed URLs from retry diagnostics, including nested request errors ([#21381](astral-sh/uv#21381)) - Give `--locked`, `--frozen`, `--check`, and `--check-exists` precedence over conflicting `UV_LOCKED` and `UV_FROZEN` values ([#21396](astral-sh/uv#21396)) - Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel ([#21400](astral-sh/uv#21400)) ## Install uv 0.12.9 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex" ``` ## Downlo… (truncated) ### 0.12.10 ## Release Notes Released on 2026-09-04. ### Enhancements - Attempt to revoke short-lived PyPI trusted-publishing tokens after `uv publish` completes, including when publishing fails ([#21423](astral-sh/uv#21423)) ### Preview features - Omit `exclude-newer-package` settings for packages outside the resolution from `uv.lock` with the `missing-exclude-newer-package-lock` preview feature ([#21455](astral-sh/uv#21455)) - Show terminal dependency cycles in `uv tree --invert` output ([#21404](astral-sh/uv#21404)) ### Performance - Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification ([#21399](astral-sh/uv#21399)) - Speed up `uv publish` by hashing each artifact in a single blocking task and reusing the buffer across reads ([#21389](astral-sh/uv#21389)) ### Bug fixes - Prevent `--locked` from failing when `exclude-newer-package` settings differ only for packages outside the resolution ([#21454](astral-sh/uv#21454)) - Allow `uv lock --check` to reuse a lockfile when an absolute `exclude-newer` cutoff is moved later ([#19571](astral-sh/uv#19571)) - Allow `uv lock --check` to reuse a lockfile when a package-specific `exclude-newer` cutoff is disabled ([#21450](astral-sh/uv#21450)) - Require an explicit `--name` when `uv init` would infer a project name reserved for a Python interpreter ([#21395](astral-sh/uv#21395)) - Write package-specific `exclude-newer` cutoffs to `uv.lock` in a deterministic order ([#21453](astral-sh/uv#21453)) ## Install uv 0.12.10 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.10/uv-installer.sh | sh ``` ### Instal… (truncated) ### 0.12.11 ## Release Notes Released on 2026-09-08. ### Preview features - Generate missing artifact hashes when exporting `pylock.toml` files to ensure they conform to PEP 751 ([#20146](astral-sh/uv#20146)) - Warn when `pylock.toml` artifact hash tables are empty, which will be rejected in a future uv release ([#21462](astral-sh/uv#21462)) ### Performance - Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements ([#21478](astral-sh/uv#21478)) - Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files ([#21468](astral-sh/uv#21468)) - Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads ([#21500](astral-sh/uv#21500)) - Speed up local wheel installs by reusing ZIP readers and buffers across extracted files ([#21499](astral-sh/uv#21499)) - Avoid transitive dependency checks and unnecessary resolution when `uv pip install --no-deps` finds the requested packages already installed ([#21523](astral-sh/uv#21523)) ### Bug fixes - Verify source archives against hashes recorded in `uv.lock` before reading their metadata or running their build backends ([#21223](astral-sh/uv#21223)) - Verify supplied hashes for registry requirements pinned with `===` under both `--verify-hashes` and `--require-hashes` ([#21543](astral-sh/uv#21543)) - Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided ([#21544](astral-sh/uv#21544)) - Support PowerShell virtual environment activation from UNC paths, including WSL paths ([#19159](astral-sh/uv#19159)) - Tri… (truncated) ### 0.12.12 ## Release Notes Released on 2026-09-09. The executables in our macOS and Windows release archives and `uv` and `uv_build` wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives. ### Bug fixes - Exclude distributions uploaded after the `exclude-newer` cutoff from lockfiles and generated requirement hashes ([#21539](astral-sh/uv#21539)) ## Install uv 0.12.12 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.ps1 | iex" ``` ## Download uv 0.12.12 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i68… (truncated) ### 0.12.13 ## Release Notes Released on 2026-09-10. ### Python - Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431)) ### Enhancements - Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563)) ### Preview features - Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555)) ### Performance - Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279)) ### Bug fixes - Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713)) - Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563)) ## Install uv 0.12.13 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex" ``` ## Download uv 0.12.13 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.12` → `0.12.13` | `0.12.12` → `0.12.13` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.12` → `0.12.13` (astral-sh/uv)</summary> ### 0.12.13 ## Release Notes Released on 2026-09-10. ### Python - Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431)) ### Enhancements - Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563)) ### Preview features - Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555)) ### Performance - Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279)) ### Bug fixes - Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713)) - Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563)) ## Install uv 0.12.13 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex" ``` ## Download uv 0.12.13 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (2 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `rumdl` | `0.2.70` → `0.2.71` | `0.2.70` → `0.2.71` | | `uv` | `0.12.12` → `0.12.13` | `0.12.12` → `0.12.13` | </details> <details> <summary>Release notes (2 tools)</summary> <details> <summary>rumdl: `0.2.70` → `0.2.71` (rvben/rumdl)</summary> ### v0.2.71 ### Fixed - **MD034**: do not report the tail of a schemed URI as a bare email ([a8df862](rvben/rumdl@a8df862)) - **lsp**: write the mailto scheme when converting a bare email to a link ([600e229](rvben/rumdl@600e229)) - **config**: measure suggestion distance in characters, not bytes ([eabdf80](rvben/rumdl@eabdf80)) - **MD034**: emit a link, not an autolink, when fixing bare URLs in MDX ([98a6255](rvben/rumdl@98a6255)) - **config**: suggestion panics on multibyte characters ([dd88a4a](rvben/rumdl@dd88a4a)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.71-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://git… (truncated) </details> <details> <summary>uv: `0.12.12` → `0.12.13` (astral-sh/uv)</summary> ### 0.12.13 ## Release Notes Released on 2026-09-10. ### Python - Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431)) ### Enhancements - Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563)) ### Preview features - Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555)) ### Performance - Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279)) ### Bug fixes - Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713)) - Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563)) ## Install uv 0.12.13 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex" ``` ## Download uv 0.12.13 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [uv](https://github.com/astral-sh/uv) | tools | patch | `0.12.12` → `0.12.13` | --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.12.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01213) [Compare Source](astral-sh/uv@0.12.12...0.12.13) Released on 2026-09-10. ##### Python - Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431)) ##### Enhancements - Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563)) ##### Preview features - Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555)) ##### Performance - Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279)) ##### Bug fixes - Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713)) - Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/563

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (5 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `pinact` | `4.1.1` → `5.0.0` | `4.1.1` → `5.0.0` | | `prek` | `0.5.2` → `0.5.3` | `0.5.2` → `0.5.3` | | `rumdl` | `0.2.70` → `0.2.73` | `0.2.70` → `0.2.73` | | `tombi` | `1.5.4` → `1.5.5` | `1.5.4` → `1.5.5` | | `uv` | `0.12.12` → `0.12.13` | `0.12.12` → `0.12.13` | </details> <details> <summary>Release notes (5 tools)</summary> <details> <summary>pinact: `4.1.1` → `5.0.0` (suzuki-shunsuke/pinact)</summary> ### v5.0.0 suzuki-shunsuke/pinact@v4.1.1...v5.0.0 [Upgrade Guide](https://github.com/suzuki-shunsuke/pinact/blob/v5.0.0/docs/upgrade_guide/v5.md) ## 🤖 pinact is now AI friendly v5 is about coding agents. An agent that is asked about pinact, or that hits a pinact error in CI, has until now had to answer from its training data, from the source code, or from whichever version of the website it happened to land on. v5 gives it three things so that it answers from the pinact that is actually installed: #1708 An Agent Skill #1708 `pinact docs`: the documentation, embedded in the binary #1705 `pinact json-schema`: the JSON Schema of the configuration file, embedded in the binary ### An Agent Skill ```sh gh skill install suzuki-shunsuke/pinact pinact ``` The skill carries no documentation of its own, deliberately. It is installed separately from the binary, so anything copied into it would go stale, and an agent would confidently describe a flag or an error code of a version that isn't the one on the machine. Instead the skill tells the agent to run `pinact docs list` and `pinact docs show <name>` before answering, so the answer always comes from the installed pinact and the skill and the binary can never disagree about a version. It adds only the few things an agent gets wrong unless it is told: that `pinact run` edits files and `--check` is the way to look without touching them, that `--update` changes which version a workflow uses, and that the exit codes 1 and 2 are findings rather than pinact failing. ### `pinact docs` ```console $ pinact docs list # the name and the description of every document, as JSON $ pinact docs show config # one document $ pinact docs show codes/005 ``` The documents are embedded in the binary, so there is nothing to fetch. An agent doesn't need network access to read them, doesn't have to guess which branch or tag of the repository to read, and cannot land on the documentation of a versi… (truncated) </details> <details> <summary>prek: `0.5.2` → `0.5.3` (j178/prek)</summary> ### v0.5.3 ## Release Notes Released on 2026-09-13. ### Enhancements - Add PEP 740 attestations for PyPI releases ([#2705](j178/prek#2705)) - Add a `check-jsonc` builtin hook ([#2682](j178/prek#2682)) - Allow disabling automatic uv installation ([#2702](j178/prek#2702)) ### Bug fixes - Fix Julia additional dependency specifiers ([#2703](j178/prek#2703)) - Update `granit-parser` to fix YAML flow indentation ([#2707](j178/prek#2707)) ### Contributors - @clbarnes - @j178 - @tisonkun ## Install prek 0.5.3 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.ps1 | iex" ``` ### Install prebuilt binaries via Homebrew ```sh brew install prek ``` ## Download prek 0.5.3 | File | Platform | Checksum | |--------|----------|----------| | [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-apple-darwin.tar.gz.sha256) | | [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-apple-darwin.tar.gz.sha256) | | [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-pc-windows-msvc.zip.sha256) | | [prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/downloa… (truncated) </details> <details> <summary>rumdl: `0.2.70` → `0.2.73` (rvben/rumdl)</summary> ### v0.2.71 ### Fixed - **MD034**: do not report the tail of a schemed URI as a bare email ([a8df862](rvben/rumdl@a8df862)) - **lsp**: write the mailto scheme when converting a bare email to a link ([600e229](rvben/rumdl@600e229)) - **config**: measure suggestion distance in characters, not bytes ([eabdf80](rvben/rumdl@eabdf80)) - **MD034**: emit a link, not an autolink, when fixing bare URLs in MDX ([98a6255](rvben/rumdl@98a6255)) - **config**: suggestion panics on multibyte characters ([dd88a4a](rvben/rumdl@dd88a4a)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.71-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.71/rumdl-v0.2.71-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://git… (truncated) ### v0.2.72 ### Added - **MD090**: add rule flagging horizontal rules directly before headings ([09dcae5](rvben/rumdl@09dcae5)) ### Fixed - **MD013**: end a sentence after a closing marker run of any shape ([e63206c](rvben/rumdl@e63206c)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.72-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.72-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.72-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.72-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.72-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.72/rumdl-v0.2.72-x86_64-apple-darwin.tar.gz.sha256) | | [rumdl-v0.2.72-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/… (truncated) ### v0.2.73 ### Fixed - **MD022,MD031,MD032,MD058**: count a comment-only line as a blank line ([b394e30](rvben/rumdl@b394e30)) - **MD057**: stop requiring index.md for directory links in filesystem mode ([c04ae4e](rvben/rumdl@c04ae4e)) - **MD051**: validate fragments in repository-absolute cross-file links ([ead5f39](rvben/rumdl@ead5f39)) - **parser**: stop reading headings inside blocks whose body is not Markdown ([59958b1](rvben/rumdl@59958b1)) - **MD077**: carry a code block's interior indentation when reindenting its fence ([00c578d](rvben/rumdl@00c578d)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.73-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.73-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.73-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.73-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.73/rumdl-v0.2.73-aarch64-unknown-linux-musl.tar.gz) | L… (truncated) </details> <details> <summary>tombi: `1.5.4` → `1.5.5` (tombi-toml/tombi)</summary> ### v1.5.5  ## What's Changed ### 🛠️ Other Changes * fix(lsp): stop logging empty workspace diagnostics by @ya7010 in tombi-toml/tombi#2177 * fix(vscode): persist status bar item visibility by @ya7010 in tombi-toml/tombi#2178 * fix(lsp): skip workspace diagnostics when lsp.diagnostic is disabled by @ya7010 in tombi-toml/tombi#2179 **Full Changelog**: tombi-toml/tombi@v1.5.4...v1.5.5 </details> <details> <summary>uv: `0.12.12` → `0.12.13` (astral-sh/uv)</summary> ### 0.12.13 ## Release Notes Released on 2026-09-10. ### Python - Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431)) ### Enhancements - Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563)) ### Preview features - Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555)) ### Performance - Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279)) ### Bug fixes - Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713)) - Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563)) ## Install uv 0.12.13 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex" ``` ## Download uv 0.12.13 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.12` → `0.12.13` | `0.12.12` → `0.12.13` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.12` → `0.12.13` (astral-sh/uv)</summary> ### 0.12.13 ## Release Notes Released on 2026-09-10. ### Python - Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431)) ### Enhancements - Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563)) ### Preview features - Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555)) ### Performance - Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279)) ### Bug fixes - Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713)) - Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563)) ## Install uv 0.12.13 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex" ``` ## Download uv 0.12.13 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.12.12` → `0.12.15` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/51) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215) [Compare Source](astral-sh/uv@0.12.14...0.12.15) Released on 2026-09-15. This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using `uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#21699](astral-sh/uv#21699)) ##### Performance - Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#21675](astral-sh/uv#21675)) ##### Bug fixes - Revert "Reject symlinked wheel installation destinations" ([#21699](astral-sh/uv#21699)) ### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214) [Compare Source](astral-sh/uv@0.12.13...0.12.14) Released on 2026-09-15. Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#17110](astral-sh/uv#17110), [#21599](astral-sh/uv#21599), [#21603](astral-sh/uv#21603)) Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#17110](astral-sh/uv#17110)) ##### Enhancements - Resume interrupted downloads with HTTP Range requests when supported ([#21570](astral-sh/uv#21570)) - Show underlying causes and hints in user warnings ([#21565](astral-sh/uv#21565)) - Show resolver hints for failed `uv tool upgrade` operations ([#21566](astral-sh/uv#21566)) ##### Preview features - Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#21618](astral-sh/uv#21618)) ##### Performance - Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#21619](astral-sh/uv#21619)) - Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#21593](astral-sh/uv#21593)) - Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#21621](astral-sh/uv#21621)) ##### Bug fixes - Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#21672](astral-sh/uv#21672)) - Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#21625](astral-sh/uv#21625)) - Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#21639](astral-sh/uv#21639)) - Redact credentials and signatures from missing-path-segment URL errors ([#21616](astral-sh/uv#21616)) - Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#21640](astral-sh/uv#21640)) - Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#21559](astral-sh/uv#21559)) - Suppress managed-Python fallback warnings under `--quiet` ([#21565](astral-sh/uv#21565)) - Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#21566](astral-sh/uv#21566)) ### [`v0.12.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01213) [Compare Source](astral-sh/uv@0.12.12...0.12.13) Released on 2026-09-10. ##### Python - Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431)) ##### Enhancements - Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563)) ##### Preview features - Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555)) ##### Performance - Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279)) ##### Bug fixes - Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713)) - Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/55 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.12.12` → `0.12.15` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215) [Compare Source](astral-sh/uv@0.12.14...0.12.15) Released on 2026-09-15. This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using `uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#21699](astral-sh/uv#21699)) ##### Performance - Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#21675](astral-sh/uv#21675)) ##### Bug fixes - Revert "Reject symlinked wheel installation destinations" ([#21699](astral-sh/uv#21699)) ### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214) [Compare Source](astral-sh/uv@0.12.13...0.12.14) Released on 2026-09-15. Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#17110](astral-sh/uv#17110), [#21599](astral-sh/uv#21599), [#21603](astral-sh/uv#21603)) Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#17110](astral-sh/uv#17110)) ##### Enhancements - Resume interrupted downloads with HTTP Range requests when supported ([#21570](astral-sh/uv#21570)) - Show underlying causes and hints in user warnings ([#21565](astral-sh/uv#21565)) - Show resolver hints for failed `uv tool upgrade` operations ([#21566](astral-sh/uv#21566)) ##### Preview features - Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#21618](astral-sh/uv#21618)) ##### Performance - Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#21619](astral-sh/uv#21619)) - Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#21593](astral-sh/uv#21593)) - Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#21621](astral-sh/uv#21621)) ##### Bug fixes - Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#21672](astral-sh/uv#21672)) - Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#21625](astral-sh/uv#21625)) - Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#21639](astral-sh/uv#21639)) - Redact credentials and signatures from missing-path-segment URL errors ([#21616](astral-sh/uv#21616)) - Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#21640](astral-sh/uv#21640)) - Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#21559](astral-sh/uv#21559)) - Suppress managed-Python fallback warnings under `--quiet` ([#21565](astral-sh/uv#21565)) - Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#21566](astral-sh/uv#21566)) ### [`v0.12.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01213) [Compare Source](astral-sh/uv@0.12.12...0.12.13) Released on 2026-09-10. ##### Python - Add GraalPy 3.13.0 ([#21431](astral-sh/uv#21431)) ##### Enhancements - Verify hashes when downloading PEP 658 metadata sidecars ([#21563](astral-sh/uv#21563)) ##### Preview features - Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](astral-sh/uv#21555)) ##### Performance - Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](astral-sh/uv#21279)) ##### Bug fixes - Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](astral-sh/uv#18713)) - Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](astral-sh/uv#21563)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/44 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

zanieb temporarily deployed to uv-test-registries March 25, 2026 14:46 — with GitHub Actions Inactive

zanieb force-pushed the zb/fix-trampoline branch 2 times, most recently from b081f1e to eccf045 Compare March 25, 2026 15:00

zanieb deployed to uv-test-registries March 25, 2026 15:07 — with GitHub Actions Active

zanieb mentioned this pull request Mar 25, 2026

Add docker integration test for Windows NanoServer entrypoint installation #18712

Merged

zanieb force-pushed the claude/add-docker-integration-test-fswQu branch from 68090b1 to 57adc03 Compare August 4, 2026 14:25

zanieb force-pushed the zb/fix-trampoline branch from eccf045 to 0cf346c Compare August 4, 2026 14:25

zanieb had a problem deploying to automations August 4, 2026 14:26 — with GitHub Actions Error

Base automatically changed from claude/add-docker-integration-test-fswQu to main August 4, 2026 14:33

zanieb added a commit that referenced this pull request Aug 4, 2026

Add docker integration test for Windows NanoServer entrypoint install…

c6e19ef

…ation (#18712) Reproduces #18663 Requires #18713 Co-authored-by: Claude <noreply@anthropic.com>

zanieb force-pushed the zb/fix-trampoline branch from 0cf346c to 0e0fd76 Compare August 4, 2026 14:37

zanieb temporarily deployed to automations August 4, 2026 14:39 — with GitHub Actions Inactive

astral-automations-bot Bot mentioned this pull request Aug 4, 2026

Rocky Linux 8 system test exhausts job timeout during DNF setup astral-sh/uv-dev#534

Open

This was referenced Aug 4, 2026

Revert Windows NanoServer integration test #20940

Closed

Revert Windows NanoServer integration test #20961

Merged

zanieb commented Aug 5, 2026

View reviewed changes

Comment thread crates/uv-trampoline-builder/src/lib.rs Outdated

zanieb commented Aug 5, 2026

View reviewed changes

Comment thread crates/uv-trampoline-builder/src/lib.rs Outdated

zanieb commented Aug 5, 2026

View reviewed changes

Comment thread crates/uv-trampoline-builder/src/lib.rs

zanieb mentioned this pull request Aug 5, 2026

uv tries to open recently written trampoline executable for exclusive access, flagged by AV #20955

Closed

woodruffw self-requested a review August 5, 2026 15:39

zaniebot mentioned this pull request Aug 5, 2026

Replace editpe with a goblin-backed PE resource editor astral-sh/uv-dev#556

Draft

zanieb added 7 commits September 10, 2026 08:58

Use editpe for trampoline resource edits

1b70799

Safely inspect malformed Windows trampoline executables

9a8a957

Limit PE editing dependencies to Windows targets

b0c1cd7

Run installed entrypoints in the NanoServer regression test

86a8963

Use fixed editpe fork for all Windows trampolines

f58a273

Refine trampoline resource writer imports and docs

d723768

Use upstream editpe 0.2.4

1c56df7

Keep the Windows resource reader comments

b8d9bcf

zanieb had a problem deploying to automations September 10, 2026 14:14 — with GitHub Actions Error

zanieb marked this pull request as ready for review September 10, 2026 14:14

zanieb added the area:windows Specific to the Windows platform label Sep 10, 2026

zanieb added 2 commits September 10, 2026 09:15

Test PE resource edits against Windows

3afca3c

Exercise aligned resource-directory sizes

af8373c

zanieb had a problem deploying to automations September 10, 2026 14:18 — with GitHub Actions Error

Test empty PE resources separately from Win32 updates

9986ffc

zanieb temporarily deployed to automations September 10, 2026 14:24 — with GitHub Actions Inactive

woodruffw approved these changes Sep 10, 2026

View reviewed changes

zanieb merged commit 63e28b6 into main Sep 10, 2026
148 checks passed

zanieb deleted the zb/fix-trampoline branch September 10, 2026 15:39

astral-automations-bot Bot mentioned this pull request Sep 10, 2026

Windows NanoServer CI needs recovery when the Docker daemon fails to start astral-sh/uv-dev#1330

Open

BrewTestBot mentioned this pull request Sep 10, 2026

uv 0.12.13 Homebrew/homebrew-core#304208

Merged

ghappforreleaseplease Bot mentioned this pull request Sep 11, 2026

chore(mise): upgrade uv jylenhof/github-actions-resources#93

Merged

This was referenced Sep 11, 2026

chore(mise): upgrade uv jylenhof/gh-action-pulse#222

Merged

chore(mise): upgrade local tools jylenhof/mise-update-tool#79

Merged

This was referenced Sep 14, 2026

chore(mise): upgrade local tools jylenhof/mise-en-place-resources#66

Merged

chore(mise): upgrade uv jylenhof/mise-en-place-tips#95

Merged

scottames-github-bot Bot mentioned this pull request Sep 16, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1065

Merged

1 task

Navigation Menu

Use `editpe` for trampoline resource edits - #18713

Use `editpe` for trampoline resource edits#18713
zanieb merged 12 commits into
mainfrom
zb/fix-trampoline

zanieb commented Mar 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

woodruffw commented Aug 5, 2026 •

edited

Loading

Uh oh!

astral-sh-bot Bot commented Sep 10, 2026

Uh oh!

woodruffw Sep 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

zanieb commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

woodruffw commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

astral-sh-bot Bot commented Sep 10, 2026

uv test inventory changes

Uh oh!

woodruffw Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

zanieb commented Mar 25, 2026 •

edited

Loading

woodruffw commented Aug 5, 2026 •

edited

Loading