chore(deps): update all non-breaking dependencies

[rafaels-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change	Pending
astral-sh/uv	uses-with	patch	0.12.9 → 0.12.12	0.12.13
github/codeql-action	action	minor	v4.37.9 → v4.38.0

---

Release Notes

astral-sh/uv (astral-sh/uv)

v0.12.12

Compare Source

Released on 2026-09-09.

The executables in our macOS and Windows release archives and uv and uv_build wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

• Exclude distributions uploaded after the exclude-newer cutoff from lockfiles and generated requirement hashes (#​21539)

v0.12.11

Compare Source

Released on 2026-09-08.

Preview features

• Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#​20146)
• Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#​21462)

Performance

• Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#​21478)
• Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#​21468)
• Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#​21500)
• Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#​21499)
• Avoid transitive dependency checks and unnecessary resolution when uv pip install --no-deps finds the requested packages already installed (#​21523)

Bug fixes

• Verify source archives against hashes recorded in uv.lock before reading their metadata or running their build backends (#​21223)
• Verify supplied hashes for registry requirements pinned with === under both --verify-hashes and --require-hashes (#​21543)
• Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided (#​21544)
• Support PowerShell virtual environment activation from UNC paths, including WSL paths (#​19159)
• Trim surrounding whitespace from entries in .python-version and .python-versions files (#​21529)
• Suppress VIRTUAL_ENV mismatch warnings for uv add --no-sync, uv remove --no-sync, and uv add --frozen (#​21496)
• Warn and continue when uv python list cannot query an interpreter (#​21498)

Documentation

• Restore TOML syntax highlighting for exclude-newer examples (#​21534)

v0.12.10

Compare Source

Released on 2026-09-04.

Enhancements

• Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#​21423)

Preview features

• Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#​21455)
• Show terminal dependency cycles in uv tree --invert output (#​21404)

Performance

• Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#​21399)
• Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#​21389)

Bug fixes

• Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#​21454)
• Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#​19571)
• Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#​21450)
• Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#​21395)
• Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#​21453)

github/codeql-action (github/codeql-action)

v4.38.0

Compare Source

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
• Update default CodeQL bundle version to 2.27.0. #​4129

---

Configuration

📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.