Skip to content

Build(deps): Bump uv from 0.13.6 to 0.13.7 - #1102

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/uv-0.13.6
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/uv-0.13.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 31, 2026 •

Copy link
Copy Markdown
Contributor

Bumps uv from 0.13.6 to 0.13.7.

Release notes

Sourced from uv's releases.

0.13.7

Release Notes

Released on 2026-11-03.

Preview features

  • Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
  • Report aliased OSV records as a single vulnerability in uv audit (#22990)

Bug fixes

  • Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
  • Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
  • Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
  • Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
  • Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
  • Allow uv remove with an empty inline tool.uv.sources table (#23012)

Documentation

  • Correct the cache-keys inline table example (#22984)

Install uv 0.13.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.ps1 | iex"

Download uv 0.13.7

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
uv-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.13.7

Released on 2026-11-03.

Preview features

  • Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
  • Report aliased OSV records as a single vulnerability in uv audit (#22990)

Bug fixes

  • Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
  • Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
  • Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
  • Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
  • Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
  • Allow uv remove with an empty inline tool.uv.sources table (#23012)

Documentation

  • Correct the cache-keys inline table example (#22984)
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 31, 2026
pengfei-threemoonslab added a commit that referenced this pull request Nov 6, 2026
… sigstore 4.5.1

Supersedes Dependabot #1104 (python-dependencies group) and #1102 (uv),
and #1091 (release-seal recompile). #1104 could not install (hash
mismatch) and its rewrite dropped PyPy markers and wrote extras-qualified
pydantic pins; #1102 bumped uv without recompiling the locks.

uv 0.13.6 is pinned in release-publish.in and every lock is recompiled
with it via scripts/update_locks.py. hatchling 1.33.0 (release-build.txt,
release-seal.in) and sigstore 4.5.1 (release-seal.in, release-publish.in)
move as Dependabot proposed. sigstore 4.5.1 drops its pyasn1 and
pyOpenSSL dependencies, so both leave every closure. Markers are
preserved and no extras-qualified pin appears.
pengfei-threemoonslab added a commit that referenced this pull request Nov 6, 2026
… sigstore 4.5.1 (#1107)

Supersedes Dependabot #1104 (python-dependencies group) and #1102 (uv),
and #1091 (release-seal recompile). #1104 could not install (hash
mismatch) and its rewrite dropped PyPy markers and wrote extras-qualified
pydantic pins; #1102 bumped uv without recompiling the locks.

uv 0.13.6 is pinned in release-publish.in and every lock is recompiled
with it via scripts/update_locks.py. hatchling 1.33.0 (release-build.txt,
release-seal.in) and sigstore 4.5.1 (release-seal.in, release-publish.in)
move as Dependabot proposed. sigstore 4.5.1 drops its pyasn1 and
pyOpenSSL dependencies, so both leave every closure. Markers are
preserved and no extras-qualified pin appears.
Bumps [uv](https://github.com/astral-sh/uv) from 0.13.6 to 0.13.7.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.13.6...0.13.7)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.13.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Build(deps): Bump uv from 0.13.1 to 0.13.6 Build(deps): Bump uv from 0.13.6 to 0.13.7 Nov 6, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/uv-0.13.6 branch from f4b811e to 9d975ad Compare November 6, 2026 04:45
@dependabot @github

dependabot Bot commented on behalf of github Nov 6, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1109.

@dependabot dependabot Bot closed this Nov 6, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/uv-0.13.6 branch November 6, 2026 04:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants