chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.9.28

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/astral-sh/uv	final	patch	0.9.18 → 0.9.28

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.9.28

Compare Source

Released on 2026-01-29.

Python

• Update CPython to use OpenSSL 3.5.5 which includes fixes for high severity CVEs (python-build-standalone#960)

Enhancements

• Add support for Pyodide interpreter on Windows (#​17658)
• Warn if multiple indexes include default = true (#​17713)
• Skip uploads when validation reports 'Already uploaded' (#​17412)

Configuration

• Add a reflink alias for the "clone" link mode (#​17724)

Bug fixes

• Ensure uv.exe exits when uvw.exe or uvx.exe is killed (#​17500)

v0.9.27

Compare Source

Released on 2026-01-26.

Python

• Upgrade Pyodide to 0.29.2 (#​17652)
• Upgrade to GraalPy 25.0.2 (#​17634)

Enhancements

• Add -t shortform for --target to uv pip subcommands (#​17501)
• Add support for ROCm 7.0 and 7.1 accelerator backends (#​17681)
• Further improve free-threading ABI incompatibility errors (#​17491)
• Implement uv pip freeze --exclude flag (#​17045)
• Improve warnings for --system and --no-system in uv venv (#​17647)
• Make uv pip compile attempt to download a specified --python-version if it can. (#​17249)
• Support Trusted Publishing with pyx (#​17438)
• Fix JSON schema for exclude-newer-package (#​17665)

Preview features

• Better detection for conflicting packages (#​17623)
• Upgrade based on outdated build versions in uv python upgrade (#​17653)

Bug fixes

• Change chocolatey system test to ensure uv uses the right python (#​17533)
• Fix infinite loop when SSL_CERT_FILE is a directory (#​17503)

Documentation

• Add cargo-xwin to the CONTRIBUTING guide (#​17507)
• Fix typo in the documentation of UV_PUBLISH_INDEX (#​17672)
• Move MSRV to platform support section (#​17534)
• Update the testing instructions in the CONTRIBUTING guide (#​17528)
• Use --locked to install cargo-xwin in guide (#​17530)
• Warn about PyPy being unmaintained (#​17643)
• docs: Correct gitlab-ci.yml to .gitlab-ci.yml (#​17682)

Other changes

• Update MSRV to 1.91 (#​17677)

v0.9.26

Compare Source

Released on 2026-01-15.

Python

• Add CPython 3.15.0a5

Enhancements

• Add a hint to update uv when a managed Python download is not found (#​17461)
• Improve cache initialization failure error message (#​17469)
• Improve error message for abi3 wheels on free-threaded Python (#​17442)
• Add support for --no-sources-package (#​14910)

Preview features

• Add METADATA.json and WHEEL.json in uv build backend (#​15510)
• Add support for GCS request signing (#​17474)
• Adjust the process ulimit to the maximum allowed on startup (#​17464)

Bug fixes

• Lock to avoid concurrent refresh of pyx tokens (#​17479)

Documentation

• Add linting and formatting instructions to the CONTRIBUTING guide (#​17470)
• Avoid rendering pyproject.toml examples for more system-level settings (#​17462)

v0.9.25

Compare Source

Released on 2026-01-13.

Python

• Add CPython 3.15.0a4
• Upgrade Tcl/Tk used by CPython to 9.0

Enhancements

• Add --compile-bytecode to uv python install and uv python upgrade to compile the standard library (#​17088)
• Allow disabling exclude-newer per package (#​16854)
• Broadcast WM_SETTINGCHANGE on uv tool update-shell (#​17404)

Preview features

• Detect workspace from uv run target (#​17423)

Bug fixes

• Avoid unwrapping size for file responses (#​17434)
• Use keyring authentication when retrieving tool@latest version (#​17448)
• Use latest Pyodide version for each python version (#​17372)
• Improve trampoline file handle closing (#​17374)
• Fix error message when installing musl python on armv7 (#​17213)

v0.9.24

Compare Source

Released on 2026-01-09.

Bug fixes

• Fix handling of UV_NO_SYNC=1 uv run ... (#​17391)
• Rebuild dynamic distribution when version changes with --no-cache (#​17387)

Documentation

• Add Rust language classifier (#​17389)

v0.9.23

Compare Source

Released on 2026-01-09.

Enhancements

• Only write portable paths in RECORD files (#​17339)
• Support relative paths in UV_PYTHON_BIN_DIR and UV_TOOL_BIN_DIR (#​17367)

Preview features

• Enable uploads to S3 via pre-signed URLs (#​17349)

Configuration

• Allow setting proxy variables via global / user configuration (#​16918)
• Manually parse and reconcile Boolean environment variables (#​17321)

Bug fixes

• Avoid broken build artifacts on build failure (#​17276)
• Fix missing dependencies on synthetic root in SBOM export (#​17363)
• Recognize armv8l as an alias for armv7l in platform tag parsing (#​17384)
• Fix redaction of a URL in a middleware trace log (#​17346)

Documentation

• Add index.md suggestion to llms.txt (#​17362)
• Clarify that uv run uses inexact syncing by default (#​17366)

v0.9.22

Compare Source

Released on 2026-01-06.

Enhancements

• Use a dedicated error message when lockfile can't be found (#​17318)

Bug fixes

• Filter unusable wheels from the lockfile for more architectures (#​17317)
• Correctly count retries originating from early middleware errors (#​17274)

Documentation

• Clarify requirements file format in docs (#​17284)

v0.9.21

Compare Source

Released on 2025-12-30.

Bug fixes

• Fix regression where zstd distribution hashes were not considered valid (#​17265)

Documentation

• Fix a typo in the resolution documentation (#​17258)
• Fix a typo in python install --default documentation (#​9826)

v0.9.20

Released on 2025-12-29.

This is a re-release of 0.9.19, with internal crate versions incremented to enable publishing to crates.io.

v0.9.19

Released on 2025-12-29.

Python

• Add CPython 3.15.0a3 (#​17165)

Enhancements

• Allow uv pip compile to install missing python interpreters in cases where it would otherwise fail (#​17216)
• Avoid creating file contents with uv init --bare --script (#​17162)
• Respect --torch-backend in uv tool commands (#​17117)
• Support comma-separated values in --no-binary and --only-binary (#​17185)

Preview features

• Summarize package changes in uv sync with JSON output format (#​16981)

Performance

• Avoid two hot String allocations in deserialization (#​17221)
• Cache NVIDIA-hosted wheels by default (#​17164)

Bug fixes

• Avoid enforcing incorrect hash in mixed-hash settings (#​17157)
• Fix retry counts in cached client (#​17104)
• Respect UV_PYTHON_DOWNLOAD_MIRROR in uv python list (#​16673)
• Support remote pylock.toml files (#​17119)
• Avoid flagging proxied Git URLs as ambiguous authority (#​17234)
• Fix dropped support of - in pip constraints, overrides, and excludes (#​17188)

---

Configuration

📅 Schedule: Branch creation - "before 2am every weekday" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud