Update all non-major dependencies #294
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
Diff Coverage: Not applicable. There was no coverage data reported for the files in this diff. Total Coverage: This PR will not change total coverage. 🛟 Help
|
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
c44fbaf to
c6badaa
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
8b57af6 to
fa7e907
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
fa7e907 to
cac5e32
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3.4.0->v3.5.00.8.4->0.8.11Release Notes
docker/login-action (docker/login-action)
v3.5.0Compare Source
Full Changelog: docker/login-action@v3.4.0...v3.5.0
astral-sh/uv (ghcr.io/astral-sh/uv)
v0.8.11Compare Source
Python
Enhancements
extra-build-dependencieshint for any missing module on build failure (#15252)Bug fixes
Rust API
reqwestclients toRegistryClient(#15281)v0.8.10Compare Source
Python
Enhancements
aarch64(#14399)Preview
v0.8.9Compare Source
Enhancements
--reinstallflag touv python upgrade(#15194)Bug fixes
uv python upgradeif they don't already exist (#15192)Documentation
v0.8.8Compare Source
Bug fixes
find_uv_bincompatibility with Python <3.10 (#15177)v0.8.7Compare Source
Python
tkaggbackend (the default on Linux), Pillow'sPIL.ImageTklibrary, and other extension modules that need to use libtcl/libtk directly.See the
python-build-standalonerelease notes for details.Enhancements
uv.lockwhen using--isolated(#15154)--prefixand--withinstallations infind_uv_bin(#14184)find_uv_bin(#14181)find_uv_bin(#14182)Preview features
package-level conflicts in workspaces (#14906)Configuration
UV_DEVandUV_NO_DEVenvironment variables (for--devand--no-dev) (#15010)Bug fixes
--require-hashesapplied to build dependencies inuv pip install(#15153)find_uv_bin(#14191)Documentation
.) to list elements inFeaturesdocs page (#15138)v0.8.6Compare Source
This release contains hardening measures to address differentials in behavior between uv and Python's built-in ZIP parser (CVE-2025-54368).
Prior to this release, attackers could construct ZIP files that would be extracted differently by pip, uv, and other tools. As a result, ZIPs could be constructed that would be considered harmless by (e.g.) scanners, but contain a malicious payload when extracted by uv. As of v0.8.6, uv now applies additional checks to reject such ZIPs.
Thanks to a triage effort with the Python Security Response Team and PyPI maintainers, we were able to determine that these differentials were not exploited via PyPI during the time they were present. The PyPI team has also implemented similar checks and now guards against these parsing differentials on upload.
Although the practical risk of exploitation is low, we take the hypothetical risk of parser differentials very seriously. Out of an abundance of caution, we have assigned this advisory a CVE identifier and have given it a "moderate" severity suggestion.
These changes have been validated against the top 15,000 PyPI packages; however, it's plausible that a non-malicious ZIP could be falsely rejected with this additional hardening. As an escape hatch, users who do encounter breaking changes can enable
UV_INSECURE_NO_ZIP_VALIDATIONto restore the previous behavior. If you encounter such a rejection, please file an issue in uv and to the upstream package.For additional information, please refer to the following blog posts:
Security
Python
Configuration
Bug fixes
UV_HTTP_RETRIESinuv publish(#15106)UV_NO_EDITABLEwhere--no-editableis supported (#15107)cargo-distto addUV_INSTALLER_URLto PowerShell installer (#15114)h2again to avoidtoo_many_internal_resetserrors (#15111)pythonwwhen copying entry points in uv run (#15134)Documentation
v0.8.5Compare Source
Enhancements
uv runwith a GitHub Gist (#15058)uv tool install(#14014)Preview features
extra-build-dependencieswarnings foruv pip(#15088)pylockwarning (#15089)Bug fixes
python-preference = systemwhen managed interpreters are on the PATH (#15059)--systemis used (#15061)h2upgrade (#15079)Documentation
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.