build(deps-dev): bump uv from 0.11.15 to 0.12.1 - #68
Open
dependabot[bot] wants to merge 6 commits into
Open
Conversation
dependabot
Bot
added
dependencies
Bumps [uv](https://github.com/astral-sh/uv) from 0.11.15 to 0.12.1. - [Release notes](https://github.com/astral-sh/uv/releases) - [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md) - [Commits](astral-sh/uv@0.11.15...0.12.1) --- updated-dependencies: - dependency-name: uv dependency-version: 0.12.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/uv/uv-0.12.0
branch
from
August 5, 2026 00:35
37d0893 to
2c45459
Compare
Dependabot updated `pyproject.toml` and `uv.lock`. Three sites still
carried 0.11.15:
requirements-validation.lock
tests/test_validation_dependency_lock.py EXPECTED_VALIDATION_TOOLS
scripts/validate_release_python.py EXPECTED_TOOL_VERSIONS
The last one asserts the INSTALLED tool version rather than the locked one,
which is why it is the one that gets missed.
Both lock files were regenerated with uv **0.12.1 itself**, not the local
0.11.15, because `validation_lock_reproducible` and
`runtime_lock_reproducible` byte-compare the committed file against what
the installed uv emits -- so regenerating with the old binary would produce
a lock that passes here and fails in CI.
Checked rather than assumed: the export format did not change across the
bump. `requirements-runtime.lock` hashes identically before and after
regeneration under 0.12.1, so the only real diff is the uv pin inside the
validation lock.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ng the error
TWO defects, and the second is why the first was hard to read.
1. A SEVENTH uv pin site. `.github/workflows/ui.yml` hard-codes the expected
version twice, in a regex and in the message it throws:
$uvVersion -notmatch '^uv 0\.11\.15(?:\s|$)'
throw "Expected the exact lock-pinned uv 0.11.15 build."
Neither Dependabot nor a grep of the Python pin sites reaches it, so
`Native Windows desktop validation` failed while every other check passed.
2. The failure receipt masked it. `Upload sanitized native smoke failure
receipt` runs `if: failure()` and takes its path from
`DUMBMONEY_NATIVE_SMOKE_FAILURE_GLOB`, which is not set until line 131 --
after the bootstrap step that failed at line 76. So the receipt step died
with:
##[error]Input required and not supplied: path
That error lands LAST, which is what `gh run view --log-failed` shows
first. The visible failure was a missing input on the diagnostic step,
not the version mismatch that actually stopped the job.
Guarded on the variable, so an early failure now reports itself instead of
being overwritten by the machinery meant to explain it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
An EIGHTH pin site, and it only surfaced after the other seven were done:
tests/test_release_build_trust.py
assertIn("$uvVersion -notmatch '^uv 0\.11\.15(?:\s|$)'", job)
The test's purpose is 'the native workflow bootstraps THE lock-pinned uv'.
It was checking against a literal typed here, which is a different and
weaker claim -- it passes whenever this file and the workflow agree, even
if both have drifted from the lock they are supposed to enforce.
Now it reads the version out of `requirements-validation.lock`, so:
- bumping uv no longer requires editing this file at all
- the assertion catches the drift it exists to catch: workflow disagreeing
with the lock, in either direction
- the throw message is asserted too, not just the regex, since that string
also carries the version and was equally able to rot
Mutation-checked, because the test was written after the code and so proved
nothing on its own. Changing the workflow's message to `uv 0.12.2` while the
lock says `0.12.1` fails exactly this test at the new assertion; restoring
it returns 14 passed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps uv from 0.11.15 to 0.12.1.
Release notes
Sourced from uv's releases.
... (truncated)
Changelog
Sourced from uv's changelog.
... (truncated)
Commits
329541aBump version to 0.12.1 (#20867)a68f64bfix ost-simple-sts.json (#20866)a531d91Generate README files for issue context branches (#20862)3a9573cAdd--frozentouv runhook invocation (#20865)2a805bdRelocate script (#20864)d709d47Honor direct sources shared across workspace dependencies (#20847)a51d7dbRebase promoted pull requests in uv (#20861)ec8ad5bHonor direct URL constraints when validating metadata-free locks (#20796)1ac4b3eAllow commands run in workspace members to use root dependency groups (#20840)139f2cfRemove stale Node 20 action TODOs (#20843)