[dependabot]

Updates the requirements on uv-build to permit the latest version.

Release notes

Sourced from uv-build's releases.

0.12.18

Release Notes

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

• Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
• Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
• Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

• Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

• Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#21918)

Bug fixes

• Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)
• Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
• Use configured dependency-metadata when checking whether installed requirements are satisfied (#21843)
• Reject archive entries that normalize to absolute Windows paths (#21923)
• Recognize distribution filenames and archive extensions when URL fragments contain ? (#21920)
• Generate correctly lowercased platform tags for BSD and Haiku releases (#21853)
• Avoid rebuilding a Windows relative path into an absolute form (#21923)

Install uv 0.12.18

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.ps1 | iex"

Download uv 0.12.18

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

• Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
• Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
• Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

• Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

• Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#21918)

Bug fixes

• Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)
• Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
• Use configured dependency-metadata when checking whether installed requirements are satisfied (#21843)
• Reject archive entries that normalize to absolute Windows paths (#21923)
• Recognize distribution filenames and archive extensions when URL fragments contain ? (#21920)
• Generate correctly lowercased platform tags for BSD and Haiku releases (#21853)
• Avoid rebuilding a Windows relative path into an absolute form (#21923)

0.12.17

Released on 2026-09-18.

Enhancements

• Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#21780)

Preview features

• Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#21651)
• Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#20746)
• Keep uv workspace metadata read-only unless --sync is provided (#21821)
• Apply uv check lock modes when retrieving workspace metadata (#21821)

Performance

• Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#21650)
• Reduce resolver allocations when deduplicating package and distribution requests (#21810)

... (truncated)

Commits

• 01cb90c Hush some PEP 440 version warnings when dry-running Docker pushes (#21929)
• 9937fa2 Check remote wheel metadata prefetch ranges (#21919)
• 0f03963 Skip loading Python download metadata when listing installed interpreters (#2...
• 6d1b266 filter severity: labels in pr promotion automation (#21926)
• d269839 Bump version to 0.12.18 (#21924)
• 6716964 Avoid rebuilding a path into an absolute form (#21923)
• 4dd39e8 Use uncompressed editable wheels (#21918)
• 0c8da51 Add JSON output for uv pip install and uv pip sync (#21893)
• 0714322 Fix fragment boundaries in UrlString::base_str (#21920)
• 8460ef5 Share URL userinfo redaction (#21912)
• Additional commits viewable in compare view

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.