Skip to content

chore(deps): update dependency uv_build to >=0.11.2,<0.12.0#643

Open
renovate-bot-cbcoutinho[bot] wants to merge 1 commit intomasterfrom
renovate/uv_build-0.x
Open

chore(deps): update dependency uv_build to >=0.11.2,<0.12.0#643
renovate-bot-cbcoutinho[bot] wants to merge 1 commit intomasterfrom
renovate/uv_build-0.x

Conversation

@renovate-bot-cbcoutinho
Copy link
Copy Markdown
Contributor

@renovate-bot-cbcoutinho renovate-bot-cbcoutinho bot commented Mar 23, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
uv_build (source, changelog) >=0.10.0,<0.11.0 → >=0.11.2,<0.12.0 age adoption passing confidence

Release Notes

astral-sh/uv (uv_build)

v0.11.2

Compare Source

Released on 2026-03-26.

Enhancements
  • Add a dedicated Windows PE editing error (#​18710)
  • Make uv self update fetch the manifest from the mirror first (#​18679)
  • Use uv reqwest client for self update (#​17982)
  • Show uv self update success and failure messages with --quiet (#​18645)
Preview features
  • Evaluate extras and groups when determining auditable packages (#​18511)
Bug fixes
  • Skip redundant project configuration parsing for uv run (#​17890)

v0.11.1

Compare Source

Released on 2026-03-24.

Bug fixes
  • Add missing hash verification for riscv64gc-unknown-linux-musl (#​18686)
  • Fallback to direct download when direct URL streaming is unsupported (#​18688)
  • Revert treating 'Dynamic' values as case-insensitive (#​18692)
  • Remove torchdata from list of packages to source from the PyTorch index (#​18703)
  • Special-case == Python version request ranges (#​9697)
Documentation
  • Cover --python <dir> in "Using arbitrary Python environments" (#​6457)
  • Fix version annotations for PS_MODULE_PATH and UV_WORKING_DIR (#​18691)

v0.11.0

Compare Source

Released on 2026-03-23.

Breaking changes

This release includes changes to the networking stack used by uv. While we think that breakage will be rare, it is possible that these changes will result in the rejection of certificates previously trusted by uv so we have marked the change as breaking out of an abundance of caution.

The changes are largely driven by the upgrade of reqwest, which powers uv's HTTP clients, to v0.13 which included some breaking changes to TLS certificate verification.

The following changes are included:

  • rustls-platform-verifier is used instead of rustls-native-certs and webpki for certificate verification

    This change should have no effect unless you are using the native-tls option to enable reading system certificates.

    rustls-platform-verifier delegates to the system for certificate validation (e.g., Security.framework on macOS) instead of eagerly loading certificates from the system and verifying them via webpki. The effects of this change will vary based on the operating system. In general, uv's certificate validation should now be more consistent with browsers and other native applications. However, this is the most likely cause of breaking changes in this release. Some previously failing certificate chains may succeed, and some previously accepted certificate chains may fail. In either case, we expect the validation to be more correct and welcome reports of regressions.

    In particular, because more responsibility for validating the certificate is transferred to your system's security library, some features like CA constraints or revocation of certificates via OCSP and CRLs may now be used.

    This change should improve performance when using system certificate on macOS, as uv no longer needs to load all certificates from the keychain at startup.

  • aws-lc is used instead of ring for a cryptography backend

    There should not be breaking changes from this change. We expect this to expand support for certificate signature algorithms.

  • --native-tls is deprecated in favor of a new --system-certs flag

    The --native-tls flag is still usable and has identical behavior to --system-certs.

    This change was made to reduce confusion about the TLS implementation uv uses. uv always uses rustls not native-tls.

  • Building uv on x86-64 and i686 Windows requires NASM

    NASM is required by aws-lc. If not found on the system, a prebuilt blob provided by aws-lc-sys will be used.

    If you are not building uv from source, this change has no effect.

    See the CONTRIBUTING guide for details.

  • Empty SSL_CERT_FILE values are ignored (for consistency with SSL_CERT_DIR)

See #​18550 for details.

Python
  • Enable frame pointers for improved profiling on Linux x86-64 and aarch64

See the python-build-standalone release notes for details.

Enhancements
  • Treat 'Dynamic' values as case-insensitive (#​18669)
  • Use a dedicated error for invalid cache control headers (#​18657)
  • Enable checksum verification in the generated installer script (#​18625)
Preview features
  • Add --service-format and --service-url to uv audit (#​18571)
Performance
  • Avoid holding flat index lock across indexes (#​18659)
Bug fixes
  • Find the dynamic linker on the file system when sniffing binaries fails (#​18457)
  • Fix export of conflicting workspace members with dependencies (#​18666)
  • Respect installed settings in uv tool list --outdated (#​18586)
  • Treat paths originating as PEP 508 URLs which contain expanded variables as relative (#​18680)
  • Fix uv export for workspace member packages with conflicts (#​18635)
  • Continue to alternative authentication providers when the pyx store has no token (#​18425)
  • Use redacted URLs for log messages in cached client (#​18599)
Documentation
  • Add details on Linux versions to the platform policy (#​18574)
  • Clarify FLASH_ATTENTION_SKIP_CUDA_BUILD guidance for flash-attn installs (#​18473)
  • Split the dependency bots page into two separate pages (#​18597)
  • Split the alternative indexes page into separate pages (#​18607)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@claude
Copy link
Copy Markdown

claude bot commented Mar 23, 2026

PR Review: chore(deps): update dependency uv_build to >=0.11.0,<0.12.0

This is a straightforward Renovate-managed dependency bump for the uv_build build backend.

Summary

Change: uv_build>=0.10.0,<0.11.0 → uv_build>=0.11.0,<0.12.0 in pyproject.toml

Assessment: ✅ Approve

Code Quality: The change is minimal and correct — a single-line version constraint update in the [build-system] section.

Notable in uv 0.11.0: This is a minor (breaking-versioned) release with TLS/networking changes:

  • Switched from rustls-native-certs + webpki to rustls-platform-verifier for certificate verification
  • Switched from ring to aws-lc for the cryptography backend
  • --native-tls deprecated in favor of --system-certs

These changes affect uv's HTTP client behavior (certificate validation), not the build backend's package-building functionality. The uv_build package is only used as a build backend (PEP 517), so none of these TLS/networking changes affect how the project is built or its runtime behavior.

Risk: Very low. The build backend API has not changed, and the version bump stays within a tight <0.12.0 upper bound.

Suggestion: Verify CI passes with this change. If your CI environment uses custom/self-signed certificates and --native-tls, be aware of the deprecation, but this is unlikely to affect the build step itself.

No issues found. Safe to merge once CI is green.

🤖 Reviewed by Claude Sonnet 4.6

@renovate-bot-cbcoutinho renovate-bot-cbcoutinho bot changed the title chore(deps): update dependency uv_build to >=0.11.0,<0.12.0 chore(deps): update dependency uv_build to >=0.11.1,<0.12.0 Mar 24, 2026
@renovate-bot-cbcoutinho renovate-bot-cbcoutinho bot changed the title chore(deps): update dependency uv_build to >=0.11.1,<0.12.0 chore(deps): update dependency uv_build to >=0.11.2,<0.12.0 Mar 26, 2026
@claude
Copy link
Copy Markdown

claude bot commented Mar 26, 2026

Code Review

This is a routine Renovate dependency update bumping the uv_build build backend from >=0.10.0,<0.11.0 to >=0.11.2,<0.12.0.

Assessment: LGTM

A few things worth noting:

  • Major version bump (0.10 → 0.11): The v0.11.0 release notes flag breaking changes around TLS certificate verification — rustls-platform-verifier replaces rustls-native-certs/webpki. However, this only affects the uv tool itself used during builds, not the runtime behavior of the MCP server. Build environments are unlikely to be using custom CA chains, so this should be a non-issue in practice.

  • Lower bound set to 0.11.2: Smart choice by Renovate — this skips 0.11.0 and 0.11.1 which had bugs (hash verification missing for riscv64gc-unknown-linux-musl, streaming issues, case-sensitivity regression for Dynamic values). Starting at 0.11.2 is the right call.

  • Scope: This only affects the build system ([build-system] in pyproject.toml), not any runtime dependency. The change has zero impact on test semantics or MCP server behavior.

  • CI: Linting passed. Waiting on unit and integration test results, but no failures are expected from a build tool version bump.

Safe to merge once CI passes.

@claude
Copy link
Copy Markdown

claude bot commented Mar 27, 2026

PR Review: chore(deps) update uv_build to >=0.11.2,<0.12.0

Routine Renovate dependency update for the uv_build build backend. Minimal change (1 line).

Change: Updates uv_build from >=0.10.0,<0.11.0 to >=0.11.2,<0.12.0 in pyproject.toml.

Notable in v0.11.0 breaking changes:

  • TLS verification changes (switched to rustls-platform-verifier). Unlikely to affect a build backend.
  • --native-tls deprecated in favor of --system-certs; no impact here.

No concerns:

  • Only affects the build system table, not runtime dependencies.
  • Min version jumps from 0.10.0 to 0.11.2, intentionally skipping 0.11.0/0.11.1 since 0.11.1 fixed regressions in 0.11.0.
  • No test changes needed for a build backend bump.
  • Security improves: 0.11.0 upgrades crypto backend from ring to aws-lc.

Safe to merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants