chore(deps): bump uv from 0.12.7 to 0.12.10 in /ci in the minor-and-patch group

[dependabot]

Bumps the minor-and-patch group in /ci with 1 update: uv.

Updates uv from 0.12.7 to 0.12.10

Release notes

Sourced from uv's releases.

0.12.10

Release Notes

Released on 2026-09-04.

Enhancements

• Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#21423)

Preview features

• Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#21455)
• Show terminal dependency cycles in uv tree --invert output (#21404)

Performance

• Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#21399)
• Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#21389)

Bug fixes

• Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#21454)
• Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#19571)
• Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#21450)
• Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#21395)
• Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#21453)

Install uv 0.12.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.10/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.10/uv-installer.ps1 | iex"

Download uv 0.12.10

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.10

Released on 2026-09-04.

Enhancements

• Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#21423)

Preview features

• Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#21455)
• Show terminal dependency cycles in uv tree --invert output (#21404)

Performance

• Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#21399)
• Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#21389)

Bug fixes

• Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#21454)
• Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#19571)
• Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#21450)
• Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#21395)
• Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#21453)

0.12.9

Released on 2026-09-01.

Python

• Add CPython 3.15.0rc2 (#21413, #21415)

Enhancements

• Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
• Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

• Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

• Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
• Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
• Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
• Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
• Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

... (truncated)

Commits

• 3c979ab Bump version to 0.12.10 (#21475)
• e302ffe Fix signing dry-run secret access and manifest generation (#21474)
• 18ab295 Allow release preparation to update the lockfile (#21473)
• 944d45d Upgrade release preparation to uv 0.12.9 (#21472)
• 3e98bf5 Exercise signing for GitHub release archives (#21445)
• 802a2d2 Use Python for signed wheel assembly (#21448)
• fc5bcca Add Azure-backed release binary signing to release dry-runs (#21418)
• e90047b Add a uv-dev inject-signed-wheel-binaries command (#20622)
• a5fc364 Omit unused exclude-newer-package settings (#21455)
• 227d1db Ignore unused exclude-newer-package settings (#21454)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions