imcompiling/agon
1
0
Fork 0
Code Issues 17 Pull Requests 4 Actions Packages Activity

Update ghcr.io/astral-sh/uv Docker tag to v0.8.11 #106

Merged
imcompiling merged 1 commits from renovate/ghcr.io-astral-sh-uv-0.x into main 2025-08-20 10:27:41 -04:00
Conversation 2 Commits 1 Files Changed 1
+1 -1
renovate-bot commented 2025-08-03 00:01:06 -04:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Type Update Change
ghcr.io/astral-sh/uv final patch 0.8.3 -> 0.8.11

Release Notes

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.8.11

Compare Source

Python
  • Add Python 3.14.0rc2
  • Update Pyodide to 0.28.1
Enhancements
  • Add Debian 13 trixie to published Docker images (#​15269)
  • Add extra-build-dependencies hint for any missing module on build failure (#​15252)
  • Make 'v' prefix cyan in overlap warnings (#​15259)
Bug fixes
  • Fix missing uv version in extended Docker image tags (#​15263)
  • Persist cache info when re-installing cached wheels (#​15274)
Rust API
  • Allow passing custom reqwest clients to RegistryClient (#​15281)

v0.8.10

Compare Source

Python
  • Add support for installing Pyodide versions (#​14518)
Enhancements
  • Allow Python requests with missing segments, e.g., just aarch64 (#​14399)
Preview
  • Move warnings for conflicting modules into preview (#​15253)

v0.8.9

Compare Source

Enhancements
  • Add --reinstall flag to uv python upgrade (#​15194)
Bug fixes
  • Include build settings in cache key for registry source distribution lookups (#​15225)
  • Avoid creating bin links on uv python upgrade if they don't already exist (#​15192)
  • Respect system proxies on macOS and Windows (#​15221)
Documentation

v0.8.8

Compare Source

Bug fixes
  • Fix find_uv_bin compatibility with Python <3.10 (#​15177)

v0.8.7

Compare Source

Python
  • On Mac/Linux, libtcl, libtk, and _tkinter are built as separate shared objects, which fixes matplotlib's tkagg backend (the default on Linux), Pillow's PIL.ImageTk library, and other extension modules that need to use libtcl/libtk directly.
  • Tix is no longer provided on Linux. This is a deprecated Tk extension that appears to have been previously broken.

See the python-build-standalone release notes for details.

Enhancements
  • Do not update uv.lock when using --isolated (#​15154)
  • Add support for --prefix and --with installations in find_uv_bin (#​14184)
  • Add support for discovering base prefix installations in find_uv_bin (#​14181)
  • Improve error messages in find_uv_bin (#​14182)
  • Warn when two packages write to the same module (#​13437)
Preview features
  • Add support for package-level conflicts in workspaces (#​14906)
Configuration
  • Add UV_DEV and UV_NO_DEV environment variables (for --dev and --no-dev) (#​15010)
Bug fixes
  • Fix regression where --require-hashes applied to build dependencies in uv pip install (#​15153)
  • Ignore GraalPy devtags (#​15013)
  • Include all site packages directories in ephemeral environment overlays (#​15121)
  • Search in the user scheme scripts directory last in find_uv_bin (#​14191)
Documentation
  • Add missing periods (.) to list elements in Features docs page (#​15138)

v0.8.6

Compare Source

This release contains hardening measures to address differentials in behavior between uv and Python's built-in ZIP parser (CVE-2025-54368).

Prior to this release, attackers could construct ZIP files that would be extracted differently by pip, uv, and other tools. As a result, ZIPs could be constructed that would be considered harmless by (e.g.) scanners, but contain a malicious payload when extracted by uv. As of v0.8.6, uv now applies additional checks to reject such ZIPs.

Thanks to a triage effort with the Python Security Response Team and PyPI maintainers, we were able to determine that these differentials were not exploited via PyPI during the time they were present. The PyPI team has also implemented similar checks and now guards against these parsing differentials on upload.

Although the practical risk of exploitation is low, we take the hypothetical risk of parser differentials very seriously. Out of an abundance of caution, we have assigned this advisory a CVE identifier and have given it a "moderate" severity suggestion.

These changes have been validated against the top 15,000 PyPI packages; however, it's plausible that a non-malicious ZIP could be falsely rejected with this additional hardening. As an escape hatch, users who do encounter breaking changes can enable UV_INSECURE_NO_ZIP_VALIDATION to restore the previous behavior. If you encounter such a rejection, please file an issue in uv and to the upstream package.

For additional information, please refer to the following blog posts:

Security
  • Harden ZIP streaming to reject repeated entries and other malformed ZIP files (#​15136)
Python
  • Add CPython 3.13.6
Configuration
  • Add support for per-project build-time environment variables (#​15095)
Bug fixes
  • Avoid invalid simplification with conflict markers (#​15041)
  • Respect UV_HTTP_RETRIES in uv publish (#​15106)
  • Support UV_NO_EDITABLE where --no-editable is supported (#​15107)
  • Upgrade cargo-dist to add UV_INSTALLER_URL to PowerShell installer (#​15114)
  • Upgrade h2 again to avoid too_many_internal_resets errors (#​15111)
  • Consider pythonw when copying entry points in uv run (#​15134)
Documentation
  • Ensure symlink warning is shown (#​15126)

v0.8.5

Compare Source

Enhancements
  • Enable uv run with a GitHub Gist (#​15058)
  • Improve HTTP response caching log messages (#​15067)
  • Show wheel tag hints in install plan (#​15066)
  • Support installing additional executables in uv tool install (#​14014)
Preview features
  • Enable extra build dependencies to 'match runtime' versions (#​15036)
  • Remove duplicate extra-build-dependencies warnings for uv pip (#​15088)
  • Use "option" instead of "setting" in pylock warning (#​15089)
  • Respect extra build requires when reading from wheel cache (#​15030)
  • Preserve lowered extra build dependencies (#​15038)
Bug fixes
  • Add Python versions to markers implied from wheels (#​14913)
  • Ensure consistent indentation when adding dependencies (#​14991)
  • Fix handling of python-preference = system when managed interpreters are on the PATH (#​15059)
  • Fix symlink preservation in virtual environment creation (#​14933)
  • Gracefully handle entrypoint permission errors (#​15026)
  • Include wheel hashes from local Simple indexes (#​14993)
  • Prefer system Python installations over managed ones when --system is used (#​15061)
  • Remove retry wrapper when matching on error kind (#​14996)
  • Revert h2 upgrade (#​15079)
Documentation
  • Improve visibility of copy and line separator in dark mode (#​14987)

v0.8.4

Compare Source

Enhancements
  • Improve styling of warning cause chains (#​14934)
  • Extend wheel filtering to Android tags (#​14977)
  • Perform wheel lockfile filtering based on platform and OS intersection (#​14976)
  • Clarify messaging when a new resolution needs to be performed (#​14938)
Preview features
  • Add support for extending package's build dependencies with extra-build-dependencies (#​14735)
  • Split preview mode into separate feature flags (#​14823)
Configuration
  • Add support for package specific exclude-newer dates via exclude-newer-package (#​14489)
Bug fixes
  • Avoid invalidating lockfile when path or workspace dependencies define explicit indexes (#​14876)
  • Copy entrypoints that have a shebang that differs in python vs python3 (#​14970)
  • Fix incorrect file permissions in wheel packages (#​14930)
  • Update validation for environments and required-environments in uv.toml (#​14905)
Documentation
  • Show uv_build in projects documentation (#​14968)
  • Add UV_ prefix to installer environment variables (#​14964)
  • Un-hide uv from --build-backend options (#​14939)
  • Update documentation for preview flags (#​14902)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.8.3` -> `0.8.11` | --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.8.11`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0811) [Compare Source](https://github.com/astral-sh/uv/compare/0.8.10...0.8.11) ##### Python - Add Python 3.14.0rc2 - Update Pyodide to 0.28.1 ##### Enhancements - Add Debian 13 trixie to published Docker images ([#&#8203;15269](https://github.com/astral-sh/uv/pull/15269)) - Add `extra-build-dependencies` hint for any missing module on build failure ([#&#8203;15252](https://github.com/astral-sh/uv/pull/15252)) - Make 'v' prefix cyan in overlap warnings ([#&#8203;15259](https://github.com/astral-sh/uv/pull/15259)) ##### Bug fixes - Fix missing uv version in extended Docker image tags ([#&#8203;15263](https://github.com/astral-sh/uv/pull/15263)) - Persist cache info when re-installing cached wheels ([#&#8203;15274](https://github.com/astral-sh/uv/pull/15274)) ##### Rust API - Allow passing custom `reqwest` clients to `RegistryClient` ([#&#8203;15281](https://github.com/astral-sh/uv/pull/15281)) ### [`v0.8.10`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0810) [Compare Source](https://github.com/astral-sh/uv/compare/0.8.9...0.8.10) ##### Python - Add support for installing Pyodide versions ([#&#8203;14518](https://github.com/astral-sh/uv/pull/14518)) ##### Enhancements - Allow Python requests with missing segments, e.g., just `aarch64` ([#&#8203;14399](https://github.com/astral-sh/uv/pull/14399)) ##### Preview - Move warnings for conflicting modules into preview ([#&#8203;15253](https://github.com/astral-sh/uv/pull/15253)) ### [`v0.8.9`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#089) [Compare Source](https://github.com/astral-sh/uv/compare/0.8.8...0.8.9) ##### Enhancements - Add `--reinstall` flag to `uv python upgrade` ([#&#8203;15194](https://github.com/astral-sh/uv/pull/15194)) ##### Bug fixes - Include build settings in cache key for registry source distribution lookups ([#&#8203;15225](https://github.com/astral-sh/uv/pull/15225)) - Avoid creating bin links on `uv python upgrade` if they don't already exist ([#&#8203;15192](https://github.com/astral-sh/uv/pull/15192)) - Respect system proxies on macOS and Windows ([#&#8203;15221](https://github.com/astral-sh/uv/pull/15221)) ##### Documentation - Add the 3.14 classifier ([#&#8203;15187](https://github.com/astral-sh/uv/pull/15187)) ### [`v0.8.8`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#088) [Compare Source](https://github.com/astral-sh/uv/compare/0.8.7...0.8.8) ##### Bug fixes - Fix `find_uv_bin` compatibility with Python <3.10 ([#&#8203;15177](https://github.com/astral-sh/uv/pull/15177)) ### [`v0.8.7`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#087) [Compare Source](https://github.com/astral-sh/uv/compare/0.8.6...0.8.7) ##### Python - On Mac/Linux, libtcl, libtk, and \_tkinter are built as separate shared objects, which fixes matplotlib's `tkagg` backend (the default on Linux), Pillow's `PIL.ImageTk` library, and other extension modules that need to use libtcl/libtk directly. - Tix is no longer provided on Linux. This is a deprecated Tk extension that appears to have been previously broken. See the [`python-build-standalone` release notes](https://github.com/astral-sh/python-build-standalone/releases/tag/20250808) for details. ##### Enhancements - Do not update `uv.lock` when using `--isolated` ([#&#8203;15154](https://github.com/astral-sh/uv/pull/15154)) - Add support for `--prefix` and `--with` installations in `find_uv_bin` ([#&#8203;14184](https://github.com/astral-sh/uv/pull/14184)) - Add support for discovering base prefix installations in `find_uv_bin` ([#&#8203;14181](https://github.com/astral-sh/uv/pull/14181)) - Improve error messages in `find_uv_bin` ([#&#8203;14182](https://github.com/astral-sh/uv/pull/14182)) - Warn when two packages write to the same module ([#&#8203;13437](https://github.com/astral-sh/uv/pull/13437)) ##### Preview features - Add support for `package`-level conflicts in workspaces ([#&#8203;14906](https://github.com/astral-sh/uv/pull/14906)) ##### Configuration - Add `UV_DEV` and `UV_NO_DEV` environment variables (for `--dev` and `--no-dev`) ([#&#8203;15010](https://github.com/astral-sh/uv/pull/15010)) ##### Bug fixes - Fix regression where `--require-hashes` applied to build dependencies in `uv pip install` ([#&#8203;15153](https://github.com/astral-sh/uv/pull/15153)) - Ignore GraalPy devtags ([#&#8203;15013](https://github.com/astral-sh/uv/pull/15013)) - Include all site packages directories in ephemeral environment overlays ([#&#8203;15121](https://github.com/astral-sh/uv/pull/15121)) - Search in the user scheme scripts directory last in `find_uv_bin` ([#&#8203;14191](https://github.com/astral-sh/uv/pull/14191)) ##### Documentation - Add missing periods (`.`) to list elements in `Features` docs page ([#&#8203;15138](https://github.com/astral-sh/uv/pull/15138)) ### [`v0.8.6`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#086) [Compare Source](https://github.com/astral-sh/uv/compare/0.8.5...0.8.6) This release contains hardening measures to address differentials in behavior between uv and Python's built-in ZIP parser ([CVE-2025-54368](https://github.com/astral-sh/uv/security/advisories/GHSA-8qf3-x8v5-2pj8)). Prior to this release, attackers could construct ZIP files that would be extracted differently by pip, uv, and other tools. As a result, ZIPs could be constructed that would be considered harmless by (e.g.) scanners, but contain a malicious payload when extracted by uv. As of v0.8.6, uv now applies additional checks to reject such ZIPs. Thanks to a triage effort with the [Python Security Response Team](https://devguide.python.org/developer-workflow/psrt/) and PyPI maintainers, we were able to determine that these differentials **were not exploited** via PyPI during the time they were present. The PyPI team has also implemented similar checks and now guards against these parsing differentials on upload. Although the practical risk of exploitation is low, we take the *hypothetical* risk of parser differentials very seriously. Out of an abundance of caution, we have assigned this advisory a CVE identifier and have given it a "moderate" severity suggestion. These changes have been validated against the top 15,000 PyPI packages; however, it's plausible that a non-malicious ZIP could be falsely rejected with this additional hardening. As an escape hatch, users who do encounter breaking changes can enable `UV_INSECURE_NO_ZIP_VALIDATION` to restore the previous behavior. If you encounter such a rejection, please file an issue in uv and to the upstream package. For additional information, please refer to the following blog posts: - [Astral: uv security advisory: ZIP payload obfuscation](https://astral.sh/blog/uv-security-advisory-cve-2025-54368) - [PyPI: Preventing ZIP parser confusion attacks on Python package installers](https://blog.pypi.org/posts/2025-08-07-wheel-archive-confusion-attacks/) ##### Security - Harden ZIP streaming to reject repeated entries and other malformed ZIP files ([#&#8203;15136](https://github.com/astral-sh/uv/pull/15136)) ##### Python - Add CPython 3.13.6 ##### Configuration - Add support for per-project build-time environment variables ([#&#8203;15095](https://github.com/astral-sh/uv/pull/15095)) ##### Bug fixes - Avoid invalid simplification with conflict markers ([#&#8203;15041](https://github.com/astral-sh/uv/pull/15041)) - Respect `UV_HTTP_RETRIES` in `uv publish` ([#&#8203;15106](https://github.com/astral-sh/uv/pull/15106)) - Support `UV_NO_EDITABLE` where `--no-editable` is supported ([#&#8203;15107](https://github.com/astral-sh/uv/pull/15107)) - Upgrade `cargo-dist` to add `UV_INSTALLER_URL` to PowerShell installer ([#&#8203;15114](https://github.com/astral-sh/uv/pull/15114)) - Upgrade `h2` again to avoid `too_many_internal_resets` errors ([#&#8203;15111](https://github.com/astral-sh/uv/pull/15111)) - Consider `pythonw` when copying entry points in uv run ([#&#8203;15134](https://github.com/astral-sh/uv/pull/15134)) ##### Documentation - Ensure symlink warning is shown ([#&#8203;15126](https://github.com/astral-sh/uv/pull/15126)) ### [`v0.8.5`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#085) [Compare Source](https://github.com/astral-sh/uv/compare/0.8.4...0.8.5) ##### Enhancements - Enable `uv run` with a GitHub Gist ([#&#8203;15058](https://github.com/astral-sh/uv/pull/15058)) - Improve HTTP response caching log messages ([#&#8203;15067](https://github.com/astral-sh/uv/pull/15067)) - Show wheel tag hints in install plan ([#&#8203;15066](https://github.com/astral-sh/uv/pull/15066)) - Support installing additional executables in `uv tool install` ([#&#8203;14014](https://github.com/astral-sh/uv/pull/14014)) ##### Preview features - Enable extra build dependencies to 'match runtime' versions ([#&#8203;15036](https://github.com/astral-sh/uv/pull/15036)) - Remove duplicate `extra-build-dependencies` warnings for `uv pip` ([#&#8203;15088](https://github.com/astral-sh/uv/pull/15088)) - Use "option" instead of "setting" in `pylock` warning ([#&#8203;15089](https://github.com/astral-sh/uv/pull/15089)) - Respect extra build requires when reading from wheel cache ([#&#8203;15030](https://github.com/astral-sh/uv/pull/15030)) - Preserve lowered extra build dependencies ([#&#8203;15038](https://github.com/astral-sh/uv/pull/15038)) ##### Bug fixes - Add Python versions to markers implied from wheels ([#&#8203;14913](https://github.com/astral-sh/uv/pull/14913)) - Ensure consistent indentation when adding dependencies ([#&#8203;14991](https://github.com/astral-sh/uv/pull/14991)) - Fix handling of `python-preference = system` when managed interpreters are on the PATH ([#&#8203;15059](https://github.com/astral-sh/uv/pull/15059)) - Fix symlink preservation in virtual environment creation ([#&#8203;14933](https://github.com/astral-sh/uv/pull/14933)) - Gracefully handle entrypoint permission errors ([#&#8203;15026](https://github.com/astral-sh/uv/pull/15026)) - Include wheel hashes from local Simple indexes ([#&#8203;14993](https://github.com/astral-sh/uv/pull/14993)) - Prefer system Python installations over managed ones when `--system` is used ([#&#8203;15061](https://github.com/astral-sh/uv/pull/15061)) - Remove retry wrapper when matching on error kind ([#&#8203;14996](https://github.com/astral-sh/uv/pull/14996)) - Revert `h2` upgrade ([#&#8203;15079](https://github.com/astral-sh/uv/pull/15079)) ##### Documentation - Improve visibility of copy and line separator in dark mode ([#&#8203;14987](https://github.com/astral-sh/uv/pull/14987)) ### [`v0.8.4`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#084) [Compare Source](https://github.com/astral-sh/uv/compare/0.8.3...0.8.4) ##### Enhancements - Improve styling of warning cause chains ([#&#8203;14934](https://github.com/astral-sh/uv/pull/14934)) - Extend wheel filtering to Android tags ([#&#8203;14977](https://github.com/astral-sh/uv/pull/14977)) - Perform wheel lockfile filtering based on platform and OS intersection ([#&#8203;14976](https://github.com/astral-sh/uv/pull/14976)) - Clarify messaging when a new resolution needs to be performed ([#&#8203;14938](https://github.com/astral-sh/uv/pull/14938)) ##### Preview features - Add support for extending package's build dependencies with `extra-build-dependencies` ([#&#8203;14735](https://github.com/astral-sh/uv/pull/14735)) - Split preview mode into separate feature flags ([#&#8203;14823](https://github.com/astral-sh/uv/pull/14823)) ##### Configuration - Add support for package specific `exclude-newer` dates via `exclude-newer-package` ([#&#8203;14489](https://github.com/astral-sh/uv/pull/14489)) ##### Bug fixes - Avoid invalidating lockfile when path or workspace dependencies define explicit indexes ([#&#8203;14876](https://github.com/astral-sh/uv/pull/14876)) - Copy entrypoints that have a shebang that differs in `python` vs `python3` ([#&#8203;14970](https://github.com/astral-sh/uv/pull/14970)) - Fix incorrect file permissions in wheel packages ([#&#8203;14930](https://github.com/astral-sh/uv/pull/14930)) - Update validation for `environments` and `required-environments` in `uv.toml` ([#&#8203;14905](https://github.com/astral-sh/uv/pull/14905)) ##### Documentation - Show `uv_build` in projects documentation ([#&#8203;14968](https://github.com/astral-sh/uv/pull/14968)) - Add `UV_` prefix to installer environment variables ([#&#8203;14964](https://github.com/astral-sh/uv/pull/14964)) - Un-hide `uv` from `--build-backend` options ([#&#8203;14939](https://github.com/astral-sh/uv/pull/14939)) - Update documentation for preview flags ([#&#8203;14902](https://github.com/astral-sh/uv/pull/14902)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
renovate-bot added 1 commit 2025-08-03 00:01:06 -04:00
Update ghcr.io/astral-sh/uv Docker tag to v0.8.4 fe20466d28
renovate-bot commented 2025-08-03 00:01:06 -04:00
Author
Collaborator
Copy Link
Copy Source

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

### Branch automerge failure This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
renovate-bot force-pushed renovate/ghcr.io-astral-sh-uv-0.x from fe20466d28 to 34a4ef7d6d 2025-08-10 00:00:43 -04:00 Compare
renovate-bot changed title from Update ghcr.io/astral-sh/uv Docker tag to v0.8.4 to Update ghcr.io/astral-sh/uv Docker tag to v0.8.8 2025-08-10 00:00:45 -04:00
renovate-bot force-pushed renovate/ghcr.io-astral-sh-uv-0.x from 34a4ef7d6d to ea1f1a5b3d 2025-08-17 00:00:37 -04:00 Compare
renovate-bot changed title from Update ghcr.io/astral-sh/uv Docker tag to v0.8.8 to Update ghcr.io/astral-sh/uv Docker tag to v0.8.11 2025-08-17 00:00:40 -04:00
imcompiling merged commit 2229a383c5 into main 2025-08-20 10:27:41 -04:00
imcompiling deleted branch renovate/ghcr.io-astral-sh-uv-0.x 2025-08-20 10:27:41 -04:00
Sign in to join this conversation.
Reviewers
No Reviewers
imcompiling
Labels
Clear labels
bug
Something isn't working
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
renovate-bot imcompiling
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: imcompiling/agon#106