chore(deps): update bump-dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
alpine (source)		minor	3.22 → 3.24
docker-buildx		minor	v0.35.0 → v0.36.1
docker-compose		minor	v5.3.1 → v5.5.0
ghcr.io/libops/cap		digest	c9d6a6c → e365ea3
ghcr.io/libops/lightsout		digest	4d38ac3 → 21ba52b
go	uses-with	minor	1.26.x → 1.27.x
google (source)	required_provider	minor	7.45.0 → 7.46.0
linode (source)	required_provider	minor	4.3.0 → 4.4.0
python (source)		minor	3.11-slim → 3.14-slim
sitectl-archivesspace		patch	v2.1.1 → v2.1.2
sitectl-drupal		minor	v1.5.0 → v1.6.2
sitectl-isle		minor	v1.6.0 → v1.7.3
sitectl-ojs		patch	v1.4.0 → v1.4.1
sitectl-omeka-classic		patch	v1.4.0 → v1.4.1
sitectl-omeka-s		patch	v1.4.0 → v1.4.1
sitectl-wp		patch	v2.1.0 → v2.1.1
uv (source, changelog)		minor	0.11.29 → 0.12.6
zensical (changelog)		patch	0.0.50 → 0.0.57

---

Release Notes

docker/buildx (docker-buildx)

v0.36.1

Compare Source

Welcome to the v0.36.1 release of buildx!

Please try out the release binaries and report any issues at
https://github.com/docker/buildx/issues.

Contributors

• CrazyMax

Notable Changes

• Add BUILDX_NO_DEFAULT_OCI_ARTIFACT as alternative to oci-artifact=false when users have not set it explicitly. #​3991

Dependency Changes

• github.com/moby/buildkit v0.32.0 -> v0.32.2

Previous release can be found at v0.36.0

v0.36.0

Compare Source

Welcome to the v0.36.0 release of buildx!

Please try out the release binaries and report any issues at
https://github.com/docker/buildx/issues.

Contributors

• CrazyMax
• Tõnis Tiigi
• Sebastiaan van Stijn
• MohammadHasan Akbari
• Matt Van Horn
• amarkdotdev
• Areeb Ahmed
• Guillaume Lours
• Paweł Gronowski
• Pierre Gimalac
• s3onghyun

Notables Changes

• Default source policy can now validate the authenticity of BuildKit release images when creating docker-container builder with docker buildx create command. #​3961
• Bake command now supports overriding declared secret sources. #​3962
• Broken builder instances are now correctly handled on removal. #​3934
• Bake now supports resolving files relative to the bake file location instead of the current working directory with BUILDX_BAKE_FILE_RELATIVE_PATHS=true. #​3935
• Source policies now support new array.flatten builtin and OPA template strings. #​3913
• Imagetools commands now do extra validation of the descriptor inputs from files. #​3933
• Windows release binaries are now code-signed, matching the signing coverage already provided for macOS release artifacts. #​3978
• Compose compatibility has been updated to v2.13.0. #​3929
• Fix source policy support on Windows when loading local files inside policy. #​3944
• Fix Kubernetes driver random load balancer support. #​3861
• Fix Kubernetes driver builds hanging indefinitely when the remote exec stream ends. #​3966
• Fix iidfile for containerd-backed Docker driver. #​3952
• Fix authority pseudo-header when using remote driver. #​3928
• Fix possible FD leak when using source policies. #​3943

Dependency Changes

• github.com/Microsoft/go-winio v0.6.2 -> ad3df93
• github.com/ProtonMail/go-crypto v1.3.0 -> v1.4.1
• github.com/aws/aws-sdk-go-v2 v1.42.0 -> v1.43.0
• github.com/aws/aws-sdk-go-v2/config v1.32.24 -> v1.32.31
• github.com/aws/aws-sdk-go-v2/credentials v1.19.23 -> v1.19.30
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 -> v1.18.31
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 -> v1.4.31
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 -> v2.7.31
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 -> v1.4.32
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 -> v1.13.13
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 -> v1.13.31
• github.com/aws/aws-sdk-go-v2/service/signin v1.1.5 -> v1.5.0
• github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 -> v1.33.0
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 -> v1.38.0
• github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 -> v1.45.0
• github.com/aws/smithy-go v1.27.2 -> v1.27.4
• github.com/compose-spec/compose-go/v2 v2.10.2 -> v2.13.0
• github.com/containerd/containerd/api v1.10.0 -> v1.11.1
• github.com/containerd/containerd/v2 v2.2.4 -> v2.3.3
• github.com/containerd/ttrpc v1.2.8 -> v1.2.9
• github.com/docker/cli v29.5.3 -> v29.6.2
• github.com/go-openapi/errors v0.22.7 -> v0.22.8
• github.com/go-openapi/loads v0.23.3 -> v0.24.0
• github.com/go-openapi/runtime v0.32.3 -> v0.32.4
• github.com/go-openapi/spec v0.22.5 -> v0.22.6
• github.com/go-openapi/strfmt v0.26.3 -> v0.26.4
• github.com/go-openapi/swag v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/cmdutils v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/conv v0.26.0 -> v0.27.0
• github.com/go-openapi/swag/fileutils v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/jsonname v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/jsonutils v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/loading v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/mangling v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/netutils v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/stringutils v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/typeutils v0.26.0 -> v0.27.0
• github.com/go-openapi/swag/yamlutils v0.26.0 -> v0.26.1
• github.com/go-openapi/validate v0.25.3 -> v0.26.0
• github.com/google/go-containerregistry v0.21.6 -> v0.21.7
• github.com/klauspost/compress v1.18.6 -> v1.19.1
• github.com/lestrrat-go/httprc/v3 v3.0.1 -> v3.0.2
• github.com/lestrrat-go/jwx/v3 v3.0.11 -> v3.0.13
• github.com/moby/buildkit v0.31.0 -> v0.32.0
• github.com/moby/go-archive v0.2.0 -> v0.2.1
• github.com/moby/moby/api v1.54.2 -> v1.55.0
• github.com/moby/moby/client v0.4.1 -> v0.5.0
• github.com/moby/policy-helpers d5411a9 -> 856be88
• github.com/moby/sys/user v0.4.0 -> v0.4.1
• github.com/open-policy-agent/opa v1.10.1 -> v1.14.1
• github.com/segmentio/asm v1.2.0 -> v1.2.1
• github.com/sigstore/rekor v1.5.2 -> v1.5.3
• github.com/sigstore/rekor-tiles/v2 5d098a2 -> v2.3.0
• github.com/sigstore/sigstore-go v1.2.1 -> v1.2.2
• github.com/tonistiigi/fsutil 0257b33 -> 6d9dc2e
• github.com/valyala/fastjson v1.6.4 -> v1.6.7
• github.com/vektah/gqlparser/v2 v2.5.30 -> v2.5.32
• golang.org/x/crypto v0.52.0 -> v0.54.0
• golang.org/x/mod v0.36.0 -> v0.38.0
• golang.org/x/net v0.55.0 -> v0.57.0
• golang.org/x/sync v0.20.0 -> v0.22.0
• golang.org/x/sys v0.45.0 -> v0.47.0
• golang.org/x/term v0.43.0 -> v0.45.0
• golang.org/x/text v0.37.0 -> v0.40.0
• golang.org/x/tools v0.45.0 -> v0.47.0
• google.golang.org/grpc v1.81.1 -> v1.82.1
• google.golang.org/protobuf v1.36.11 -> f2248ac
• k8s.io/api v0.35.4 -> v0.36.0
• k8s.io/apimachinery v0.35.4 -> v0.36.0
• k8s.io/client-go v0.35.4 -> v0.36.0
• k8s.io/kube-openapi 589584f -> 5883c5e
• k8s.io/streaming v0.36.0 new
• k8s.io/utils bc988d5 -> 28399d8
• sigs.k8s.io/structured-merge-diff/v6 v6.3.0 -> v6.3.2

Previous release can be found at v0.35.0

docker/compose (docker-compose)

v5.5.0

Compare Source

What's Changed

ℹ️ This release overhauls image digest reconciliation to prevent unnecessary container recreation.
Existing containers may be recreated the first time you run compose up after upgrading, as image digests are re-evaluated using the new logic.

compose pull now honors pull_policy refresh windows (daily, weekly, every_N).

✨ Improvements

• New image digest reconciliation process by @​glours & @​ndeloof #​14011 #​14041

🐛 Fixes

• Fix(bridge): skip pulling default image references for build-only ser… by @​ericwyles in #​14010
• Fix(watch): stop pruning every dangling image of the project by @​glours in #​14012
• Fix(config): resolve service environment when computing --hash by @​glours in #​14002
• Fix(watch): skip unreadable directories instead of failing the watch by @​Endika in #​13992
• Fix: ignore one-off container events in up monitor by @​brano-osif in #​14038
• Fix(bridge): validate arguments of bridge subcommands by @​glours in #​14003
• Fix(images): tolerate containers whose image record is gone by @​ndeloof in #​14028

🔧 Internal

• Test: Set stop_signal to SIGTERM in nginx-based services by @​ricardobranco777 in #​13881
• Chore: inline needlessly extracted single-use helpers by @​ndeloof in #​14048
• Add ENGINE column driven by label by @​nicksieger in #​13959

⚙️ Dependencies

• Build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 by @​dependabot[bot] in #​13999
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by @​dependabot[bot] in #​14009
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.5 by @​dependabot[bot] in #​14019
• Build(deps): bump github.com/moby/buildkit from 0.32.1 to 0.32.2 by @​dependabot[bot] in #​14033
• Build(deps): bump github.com/docker/buildx from 0.36.0 to 0.36.1 by @​dependabot[bot] in #​14034
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.15.0 to 1.16.0 in the docker-actions group by @​dependabot[bot] in #​14035
• Build(deps): bump github.com/moby/go-archive from 0.3.2 to 0.3.3 by @​dependabot[bot] in #​14043
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.5 to 4.37.6 by @​dependabot[bot] in #​14022
• Build(deps): bump github.com/docker/cli from 29.6.2+incompatible to 29.7.2+incompatible by @​dependabot[bot] in #​14042
• Build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @​dependabot[bot] in #​14008
• Bump golang to version 1.26.6 by @​glours in #​14045

New Contributors

• @​ericwyles made their first contribution in #​14010
• @​Endika made their first contribution in #​13992
• @​brano-osif made their first contribution in #​14038

Full Changelog: docker/compose@v5.4.0...v5.5.0

v5.4.0

Compare Source

What's Changed

ℹ️ This release introduces a new way to reconcile resources such as volumes and networks

✨ Improvements

• Feat(reconcile): model volume recreation in the plan by @​ndeloof in #​13962
• Feat(reconcile): model network lifecycle in the plan by @​ndeloof in #​13966

🐛 Fixes

• Fix(reconcile): preserve zero-replica services during hashing by @​junhaoliao in #​13931
• Fix(config): warn when service selection is silently ignored by @​glours in #​13950
• Fix(build): use platform image-manifest digest, not attested index by @​glours in #​13949
• Fix(oci): honor --insecure-registry when up re-loads the model by @​ptrdom in #​13894
• Fix(config): pin type:image volume sources and pre_start hook images by @​glours in #​13956
• Tolerate missing env file on more runtime commands by @​maxproske in #​13603
• Resolve pre_start hook images alongside service images by @​ndeloof in #​13937
• Fix(cp): return non-nil Content from dry-run CopyFromContainer by @​glours in #​13982
• Fix(config): apply config flags to --services/--volumes/--networks/--models/--hash by @​glours in #​13979
• Fix: tolerate missing env file on scale, watch and shell completion by @​glours in #​13973

🔧 Internal

• README: remove Go Report Card badge by @​thaJeztah in #​13926
• Docs: adopt AGENTS.md standard, symlink CLAUDE.md to it by @​glours in #​13871
• Dockerfile: update golang image to alpine 3.23 by @​thaJeztah in #​13921
• Docs: require dated AI_AGENT_DISCLOSURE.md, drop committed copy by @​glours in #​13976
• CI: publish images to Docker Hub using OIDC by @​glours in #​13994

⚙️ Dependencies

• Build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @​dependabot[bot] in #​13942
• Build(deps): bump the docker-actions group across 1 directory with 4 updates by @​dependabot[bot] in #​13941
• Build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​13943
• Build(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 by @​dependabot[bot] in #​13948
• Build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by @​dependabot[bot] in #​13927
• Build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @​dependabot[bot] in #​13928
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.13.0 to 1.14.0 in the docker-actions group by @​dependabot[bot] in #​13953
• Build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @​dependabot[bot] in #​13922
• Build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​13955
• Build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in #​13960
• Build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in the go_modules group across 1 directory by @​dependabot[bot] in #​13961
• Build(deps): bump github.com/docker/cli from 29.6.1+incompatible to 29.6.2+incompatible by @​dependabot[bot] in #​13968
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3 by @​dependabot[bot] in #​13981
• Build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​13970
• Build(deps): bump github.com/moby/buildkit from 0.31.1 to 0.31.2 by @​dependabot[bot] in #​13969
• Bump compose-go to version v2.14.0 by @​glours in #​13983
• Bump go-archive to version v0.3.0 by @​glours in #​13986
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.14.0 to 1.15.0 in the docker-actions group by @​dependabot[bot] in #​13989
• Chore(deps): bump github.com/moby/go-archive v0.3.2 by @​thaJeztah in #​13991
• Update to go1.26.5 by @​thaJeztah in #​13920
• Build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​13996
• Build(deps): bump docker/docker-agent-action/.github/workflows/review-pr.yml from 2.0.2 to 2.0.3 in the docker-actions group by @​dependabot[bot] in #​13995
• Build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​13984
• Chore(deps): github.com/docker/buildx v0.36.0, buildkit v0.32.0 by @​glours in #​13975
• Bump buildkit v0.32.1 by @​glours in #​13997

New Contributors

• @​junhaoliao made their first contribution in #​13931

Full Changelog: docker/compose@v5.3.1...v5.4.0

actions/go-versions (go)

v1.27.0: 1.27.0

Compare Source

Go 1.27.0

hashicorp/terraform-provider-google (google)

v7.46.0

Compare Source

linode/terraform-provider-linode (linode)

v4.4.0

Compare Source

What's Changed

🐛 Bug Fixes

• Fixed issue with obj bucket lifecycle_rule by @​ezilber-akamai in #​2438
• Resolve issue that causes implicit LKE cluster nested pool resize on unrelated updates in Pulumi by @​lgarber-akamai in #​2446
• Stabilize database and firewall behavior by @​lgarber-akamai in #​2451

🚀 New Features

• add group_by support to monitor alert definition by @​zliang-akamai in #​2440

💡 Improvements

• Refactor for bucket migration by @​zliang-akamai in #​2276
• Mark databases list filters as API-filterable by @​zliang-akamai in #​2442

⚙️ Repo/CI Improvements

• Replace pre-Go-1.24 tools pattern with go tool by @​zliang-akamai in #​2449
• Resolve linter failures by @​lgarber-akamai in #​2454

📖 Documentation

• Add docs to distinguish between block and nested attributes by @​yec-akamai in #​2447

Full Changelog: linode/terraform-provider-linode@v4.3.0...v4.4.0

v4.3.1

Compare Source

[!NOTE]
This release is identical to v4.4.0 due to an oversight in the release process.

What's Changed

🐛 Bug Fixes

• Fixed issue with obj bucket lifecycle_rule by @​ezilber-akamai in #​2438
• Resolve issue that causes implicit LKE cluster nested pool resize on unrelated updates in Pulumi by @​lgarber-akamai in #​2446
• Stabilize database and firewall behavior by @​lgarber-akamai in #​2451

🚀 New Features

• Add group_by support to monitor alert definition by @​zliang-akamai in #​2440

💡 Improvements

• Mark databases list filters as API-filterable by @​zliang-akamai in #​2442
• Resolve linter failures by @​lgarber-akamai in #​2454
• Refactor for bucket migration by @​zliang-akamai in #​2276

📖 Documentation

• Add docs to distinguish between block and nested attributes by @​yec-akamai in #​2447

⚙️ Repo/CI Improvements

• Replace pre-Go-1.24 tools pattern with go tool by @​zliang-akamai in #​2449

Full Changelog: linode/terraform-provider-linode@v4.3.0...v4.3.1

libops/sitectl-archivesspace (sitectl-archivesspace)

v2.1.2

Compare Source

What's Changed

• [patch] Restore current sitectl package installation by @​libops-agent in #​40

Full Changelog: libops/sitectl-archivesspace@v2.1.1...v2.1.2

libops/sitectl-drupal (sitectl-drupal)

v1.6.2

Compare Source

What's Changed

• [patch] Pin the corrected package publisher by @​libops-agent in #​57

Full Changelog: libops/sitectl-drupal@v1.6.1...v1.6.2

v1.6.1

Compare Source

What's Changed

• [patch] Restore current sitectl package installation by @​libops-agent in #​56

Full Changelog: libops/sitectl-drupal@v1.6.0...v1.6.1

v1.6.0

Compare Source

What's Changed

• [minor] crosswalk sitectl consolidation by @​joecorall in #​55

Full Changelog: libops/sitectl-drupal@v1.5.0...v1.6.0

libops/sitectl-isle (sitectl-isle)

v1.7.3

Compare Source

What's Changed

• [patch] Support IIIF Image API v2 cache warming by @​joecorall in #​88

Full Changelog: libops/sitectl-isle@v1.7.2...v1.7.3

v1.7.2

Compare Source

What's Changed

• fix(deps): update bump-dependencies by @​renovate[bot] in #​87

Full Changelog: libops/sitectl-isle@v1.7.1...v1.7.2

v1.7.1

Compare Source

What's Changed

• [patch] Install latest shared sitectl packages by @​libops-agent in #​86

Full Changelog: libops/sitectl-isle@v1.7.0...v1.7.1

v1.7.0

Compare Source

What's Changed

• Crosswalk integration and workbench execution orchestration by @​joecorall in #​85

Full Changelog: libops/sitectl-isle@v1.6.0...v1.7.0

libops/sitectl-ojs (sitectl-ojs)

v1.4.1

Compare Source

What's Changed

• [patch] Restore current sitectl package installation by @​libops-agent in #​38

Full Changelog: libops/sitectl-ojs@v1.4.0...v1.4.1

libops/sitectl-omeka-classic (sitectl-omeka-classic)

v1.4.1

Compare Source

What's Changed

• [patch] Restore current sitectl package installation by @​libops-agent in #​38

Full Changelog: libops/sitectl-omeka-classic@v1.4.0...v1.4.1

libops/sitectl-omeka-s (sitectl-omeka-s)

v1.4.1

Compare Source

What's Changed

• [patch] Restore current sitectl package installation by @​libops-agent in #​38

Full Changelog: libops/sitectl-omeka-s@v1.4.0...v1.4.1

libops/sitectl-wp (sitectl-wp)

v2.1.1

Compare Source

What's Changed

• [patch] Update dependencies and install latest sitectl by @​renovate[bot] in #​37

Full Changelog: libops/sitectl-wp@v2.1.0...v2.1.1

astral-sh/uv (uv)

v0.12.6

Compare Source

Released on 2026-08-25.

Python

• Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #​21295)

Enhancements

• Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#​21261)
• Limit warnings about unbounded uv_build requirements to source-distribution builds (#​21078)
• Display byte counts below 1 KiB without a fractional part (#​21237)

Preview features

• Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#​21117)
• Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#​21235)
• Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#​21227)
• Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#​21146)

Performance

• Enable profile-guided optimization for Linux x86-64 release binaries (#​21001)
• Enable profile-guided optimization for Windows x86-64 release binaries (#​21003)
• Enable profile-guided optimization for macOS ARM64 release binaries (#​21002)
• Enable profile-guided optimization for Linux ARM64 release binaries (#​21004)
• Speed up syncing projects with many activated conflict items by reusing their encoded representation (#​21148)

Bug fixes

• Allow explicit uv build and non-editable first-party workspace packages when no-build is enabled (#​21294)
• Reuse configured index credentials during uv tool upgrade when the tool receipt references the same index (#​21275)
• Ensure full 40-character Git commit pins resolve to the requested object instead of a SHA-named branch (#​21224)
• Prevent TLS segfaults in riscv64 musl release binaries (#​21158)
• Preserve dependencies selected by recursive extras when markers mix production and extra conditions (#​21181)
• Preserve version constraints from transitively referenced recursive extras (#​21209)
• Resolve repository-relative Git archive dependencies inside the checkout during the initial uv sync (#​21264)
• Return an error instead of panicking when a bearer token cannot be encoded as an HTTP header (#​21282)
• Do not misclassify package URLs ending in .py as local script paths (#​21144)
• Use directory creation times consistently across libc implementations for directory cache-keys entries (#​21137)
• Promote human-readable sizes to the next unit at rounding boundaries (#​21136)

Other changes

• Add Python 3.15 release-candidate Docker images (#​21293)
• Raise the minimum supported Rust version to 1.96 and update the repository toolchain to Rust 1.98 (#​21258)

v0.12.5

Compare Source

Released on 2026-08-14.

Python

• Add CPython 3.10.21, 3.11.16, and 3.12.14 (#​21138)
• Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (#​21134)

Enhancements

• Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (#​21130)

Preview features

• Allow --index and --default-index to select configured package indexes by name with the index-by-name preview feature (#​17455)
• Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (#​21131)
• Fall back to logical file sizes when using cache-physical-space on filesystems that do not support physical-space accounting (#​21133)

Bug fixes

• Resolve relative package index paths in PEP 723 scripts against the script directory (#​21097)

v0.12.4

Compare Source

Released on 2026-08-13.

Enhancements

• Prefer post-quantum key exchange and enable opt-in TLS diagnostics (#​21054)
• Accept whitespace before versions in noncompliant wildcard comparisons such as Requires-Python: >= 3.5.* (#​21012)
• Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content (#​20944)
• Omit source-span carets from diagnostics for empty PEP 508 requirements (#​21094)

Preview features

• Add uv check --no-install-project and respect UV_NO_INSTALL_PROJECT to install dependencies without building or installing the project (#​21085)
• Make the ty subprocess invoked by uv check honor uv's color and progress settings, including quiet mode (#​21086)

Performance

• Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges (#​20804)
• Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly (#​21041)

Bug fixes

• Use windowed pythonw.exe launchers for virtual environments created from managed Python minor-version links (#​19235)
• Allow uv lock to proceed when .venv is an unusable project environment (#​21068)
• Respect fork-strategy when ordering forks created from environments or existing lockfile resolution-markers (#​21000)
• Preserve consecutive wildcard Python minor-version exclusions such as !=3.11.*, !=3.12.* in uv.lock (#​21045)
• Preserve inline comments on the final item in dependency arrays when uv add updates it (#​21008)
• Recover from stale base-interpreter cache metadata when an existing virtual environment exposes a version mismatch (#​21073)
• Prevent interpreter cache reuse across different PYTHONEXECUTABLE and __PYVENV_LAUNCHER__ overrides (#​21075)
• Show standard styling, usage guidance, and line termination for invalid uv version --bump values (#​21076)

v0.12.3

Compare Source

Released on 2026-08-07.

Python

• Add CPython 3.13.15 (#​20997)

Preview features

• Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size (#​20992)
• Preserve JSON output from uv workspace metadata --quiet while suppressing diagnostics (#​20991)
• Reduce memory usage for large workspaces by streaming uv workspace metadata JSON output (#​20990)

Performance

• Reduce Linux startup latency by initializing the workspace cache before spawning another thread (#​20989)
• Reuse compiled workspace exclusion patterns during workspace discovery (#​20988)
• Speed up conflict-heavy resolutions by avoiding materialized range complements (#​20982)
• Avoid slow procfs reads during Python interpreter discovery on Linux (#​20987)

Documentation

• Add PEP 740 attestations to the GitHub Actions publishing example (#​20986)
• Restrict the GitHub Actions publishing example to Python version tags (#​20973)
• Correct --python-pin to --pin-python in the uv init --bare example (#​20876)

v0.12.2

Compare Source

Released on 2026-08-05.

Python

• Add CPython 3.15.0rc1 (#​20948)
• Add CPython 3.14.7 (#​20971)

Enhancements

• Ensure diagnostic hints end with a newline to prevent malformed terminal output (#​20959)

Preview features

• Audit one or all installed tools with uv tool audit (#​20921)
• Report physically reclaimed disk space during cache cleanup with the cache-physical-space preview feature (#​20925)

Configuration

• Add UV_RUN_RLIMIT_NOFILE to set the open-file limit for commands launched by uv run (#​20926)

Performance

• Speed up uv.lock parsing for wheel entries (#​20881)
• Speed up uv.lock parsing for source distribution entries (#​20882)
• Speed up filename extraction from distribution URLs (#​20879)
• Reduce filesystem metadata lookups during bytecode compilation (#​20928)
• Reuse file metadata when building source distributions (#​20927)

Bug fixes

• Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions (#​20963)
• Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested (#​20930)

Documentation

• Separate build and publish jobs in the GitHub Actions publishing guide (#​20946)
• Ensure the GitHub Actions publishing example waits for the build job to finish (#​20957)
• Correct typos in the Docker integration guide (#​20970)

v0.12.1

Compare Source

Released on 2026-07-31.

✂ Note

PR body was truncated to here.