Merged

Conversation

This PR contains the following updates:

Package	Type	Update	Change	Pending
astral-sh/uv	uses-with	patch	`0.11.8` → `0.11.16`	`0.11.17`

Release Notes

astral-sh/uv (astral-sh/uv)

`v0.11.16`

Compare Source

Released on 2026-05-21.

Enhancements

Add support for direct archive dependencies in Git (#10072)
Adjust hint rendering (#18090)

Preview features

uv audit: specialize malformed OSV error (#19515)
Reject locked malware installations (#18936)

Configuration

Allow disabling reading the system config with UV_NO_SYSTEM_CONFIG (#19476)

Bug fixes

Allow environment variables that take a list to be empty (#19503)
Ensure that incompatible wheel hints do not leak secrets (#19504)
Reject unsafe entry points in uv-build (#19495)
Restrict delimiters in entry point parsing (#19471)
uv-netrc: fix multi-word no-space comment lines causing parse errors (#19494)

Documentation

Document and test relative exclude-newer support for uv pip (#19475)

`v0.11.15`

Compare Source

Released on 2026-05-18.

Security

Fix a TAR partial differential, see GHSA-3cv2-h65g-fgmm (#19463)
Enforce that entry points cannot escape in the scripts directory, see GHSA-4gg8-gxpx-9rph (#19464)

Enhancements

Add TOML v1.1 -> v1.0 backwards compatibility for source distributions (#18741)
Add support for Azure request signing (#19421)
Apply stricter validation to all wheel filename segments (#19364)
Reject empty strings as an invalid package name (#19435)
Use structured errors for signing authentication failures (#19422)

Preview

uv audit: Add JSON output (#19305)

Configuration

Respect required-environments in uv pip compile (#19378)

Performance

Avoid parsing JSON manifest when local Python is available (#19398)
Avoid walking nested directories in linker conflict registration (#19382)
Optimize async wheel ZIP writing (#19383)
Fix dead "already trimmed" fast-path in Version::only_release_trimmed (#19425)

Bug fixes

Apply workspace-member [tool.uv.sources] credentials under uv sync --frozen (#19423)
Skip empty directories in uv build outputs (#19437)
Fix Git submodule handling when using relative paths (#12156)
Fix line number reporting in netrc parsing (#19452)

Documentation

Move Bazel auth helper setup into integration guide (#19392)

`v0.11.14`

Compare Source

Released on 2026-05-12.

Enhancements

Add Astral mirror URL override (#19206)
Ignore top_level.txt entries in uninstall that are not valid Python identifiers (#19340)

Bug fixes

Avoid applying .env files in parent process (#19343)
Filter ANSI codes in logging output (#19311)
Fix uv tree showing extra-conditional deps for packages required without extras (#19332)
Respect build options (e.g., --no-build) during lock validation (#19366)

`v0.11.13`

Compare Source

Released on 2026-05-10.

Bug fixes

Include data files in editable builds (#19312)
Respect --require-hashes when installing from pylock.toml files (#19334)

Python

Add CPython 3.14.5

`v0.11.12`

Compare Source

Released on 2026-05-08.

Python

Add CPython 3.15.0b1

Enhancements

Add --no-editable support to uv pip install (#19306)
Require git refs in URLs to be percent-encoded (#19320)

Bug fixes

Respect --no-dev over UV_DEV=1 (#19313)
Don't suggest non-existent --no-frozen flag (#19290) (#19294)

Documentation

Fix bug from inconsistent workflow name in GHA-PyPI guide example (#19309)

`v0.11.11`

Compare Source

Released on 2026-05-06.

Bug fixes

Accept legacy ID format from pre-0.11.9 cache entries (#19301)

`v0.11.10`

Compare Source

Released on 2026-05-05.

Bug fixes

Allow pre-release Python requests with non-zero patch versions (#19286)

This release includes a special release candidate for the next Python 3.14 patch release. Python 3.14 included a new garbage collection implementation, which reduced pause times but caused significant unexpected memory pressure in production environments. In 3.14.5 and 3.15, the previous garbage collection implementation will be restored.

We would greatly appreciate if you tested the 3.14.5rc1 version included in this release. The stable version is expected to be released soon and any feedback on potential issues would be helpful to the Python development team.

For more context, see the announcement, issue, and pull request.

Issues with the new release can be reported in the uv or CPython issue trackers.

Python

Upgrade PyPy to v7.3.22
Add CPython 3.14.5rc1
On macOS, CPython statically links libpython to match Linux

Enhancements

Omit compatible release desugaring for pre-release hints (#19267)
Fix file locks on Android (#18323)

Preview

uv audit add reporting for adverse project statuses (#19128)

Bug fixes

Discover versioned Python executables when requires-python pins a version (#18700)
Fix URL prefix matching to require path boundaries (#19154)
Fix transitive Git path dependencies in lockfiles (#19269)
Handle incorrect unlock error in LockedFile::drop on Wine (#19229)
Prevent uninstalling site-packages for empty top_level.txt in .egg-info (#19114)
Use symlinks instead of junctions on Wine (#19213)
Fix floating-point environment handling on ARMv7 (#19157)
Redact credentials from remote requirements URL in offline errors (#19216)
Windows tramplolines no longer set PYTHONHOME and only set __PYVENV_LAUNCHER__ for virtual environments (#19199)

Documentation

Mark --native-tls and UV_NATIVE_TLS as deprecated (#18705)
Re-add pytorch-triton-rocm to PyTorch ROCm docs (#19241)
Tweak changelog entries for 0.11.8 (#19188)
Add 'Exporting lockfiles' to the Concepts->Projects index (#19209)
Clarify that uv init creates git files / folders in the projects guide (#19183)

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot deleted the renovate/astral-sh-uv-0.x branch

June 1, 2026 03:38