You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The executables in our macOS and Windows release archives and uv and uv_build wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.
Bug fixes
Exclude distributions uploaded after the exclude-newer cutoff from lockfiles and generated requirement hashes (#21539)
Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#20146)
Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#21462)
Performance
Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#21478)
Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#21468)
Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#21500)
Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#21499)
Avoid transitive dependency checks and unnecessary resolution when uv pip install --no-deps finds the requested packages already installed (#21523)
Bug fixes
Verify source archives against hashes recorded in uv.lock before reading their metadata or running their build backends (#21223)
Verify supplied hashes for registry requirements pinned with === under both --verify-hashes and --require-hashes (#21543)
Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided (#21544)
Support PowerShell virtual environment activation from UNC paths, including WSL paths (#19159)
Trim surrounding whitespace from entries in .python-version and .python-versions files (#21529)
Suppress VIRTUAL_ENV mismatch warnings for uv add --no-sync, uv remove --no-sync, and uv add --frozen (#21496)
Warn and continue when uv python list cannot query an interpreter (#21498)
Documentation
Restore TOML syntax highlighting for exclude-newer examples (#21534)
Configuration
📅 Schedule: (in timezone Europe/Amsterdam)
Branch creation
At any time (no schedule defined)
Automerge
At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
If you want to rebase/retry this PR, check this box
Note: the PR description/title still reference 0.12.10 → 0.12.11 (the changelog for that intermediate release), but Renovate has since synced the branch forward to 0.12.12 — the actual diff in the branch bumps straight to 0.12.12 with a matching digest. That's expected Renovate behavior (the PR body isn't always regenerated to match the latest sync) and not a problem with the change itself.
Findings:
Tag and digest are updated together and stay consistent (digest is pinned, not left stale against a moved tag) — correct.
No other files changed; this doesn't touch application code, so none of the CLAUDE.md review gates (Pydantic response models, capability gating, provider architecture, etc.) apply here.
This is a base-image-only change (build stage, not the final runtime stage), so risk is limited to the uv sync/build steps in the Dockerfile succeeding with the new uv version — CI's Docker build will validate that.
No test coverage concerns — this isn't API surface, so the "e2e + contract coverage" gate in CLAUDE.md doesn't apply.
I couldn't run docker build/CI locally in this sandbox to independently verify the new digest pulls successfully; that's covered by the repo's CI pipeline, which should be checked before merge.
No blocking issues. Safe to merge once CI (including the Docker build) passes.
renovate-bot-cbcoutinhoBot
changed the title
chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.11
chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.12
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.12.10→0.12.12Release Notes
astral-sh/uv (ghcr.io/astral-sh/uv)
v0.12.12Compare Source
Released on 2026-09-09.
The executables in our macOS and Windows release archives and
uvanduv_buildwheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.Bug fixes
exclude-newercutoff from lockfiles and generated requirement hashes (#21539)v0.12.11Compare Source
Released on 2026-09-08.
Preview features
pylock.tomlfiles to ensure they conform to PEP 751 (#20146)pylock.tomlartifact hash tables are empty, which will be rejected in a future uv release (#21462)Performance
uv pip install --no-depsfinds the requested packages already installed (#21523)Bug fixes
uv.lockbefore reading their metadata or running their build backends (#21223)===under both--verify-hashesand--require-hashes(#21543).python-versionand.python-versionsfiles (#21529)VIRTUAL_ENVmismatch warnings foruv add --no-sync,uv remove --no-sync, anduv add --frozen(#21496)uv python listcannot query an interpreter (#21498)Documentation
exclude-newerexamples (#21534)Configuration
📅 Schedule: (in timezone Europe/Amsterdam)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.