chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.10.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/astral-sh/uv	final	minor	0.9.18 → 0.10.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.10.0

Compare Source

Since we released uv 0.9.0 in October of 2025, we've accumulated various changes that improve correctness and user experience, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution. We expect most users to be able to upgrade without making changes.

This release also includes the stabilization of preview features. Python upgrades are now stable, including the uv python upgrade command, uv python install --upgrade, and automatically upgrading Python patch versions in virtual environments when a new version is installed. The add-bounds and extra-build-dependencies settings are now stable. Finally, the uv workspace dir and uv workspace list utilities for writing scripts against workspace members are now stable.

Breaking changes

• Require --clear to remove existing virtual environments in uv venv (#​17757)

  Previously, uv venv would prompt for confirmation before removing an existing virtual environment in interactive contexts, and remove it without confirmation in non-interactive contexts. Now, uv venv requires the --clear flag to remove an existing virtual environment. A warning for this change was added in uv 0.8.

  You can opt out of this behavior by passing the --clear flag or setting UV_VENV_CLEAR=1.

• Error if multiple indexes include default = true (#​17011)

  Previously, uv would silently accept multiple indexes with default = true and use the first one. Now, uv will error if multiple indexes are marked as the default.

  You cannot opt out of this behavior. Remove default = true from all but one index.

• Error when an explicit index is unnamed (#​17777)

  Explicit indexes can only be used via the [tool.uv.sources] table, which requires referencing the index by name. Previously, uv would silently accept unnamed explicit indexes, which could never be referenced. Now, uv will error if an explicit index does not have a name.

  You cannot opt out of this behavior. Add a name to the explicit index or remove the entry.

• Install alternative Python executables using their implementation name (#​17756, #​17760)

  Previously, uv python install would install PyPy, GraalPy, and Pyodide executables with names like python3.10 into the bin directory. Now, these executables will be named using their implementation name, e.g., pypy3.10, graalpy3.10, and pyodide3.12, to avoid conflicting with CPython installations.

  You cannot opt out of this behavior.

• Respect global Python version pins in uv tool run and uv tool install (#​14112)

  Previously, uv tool run and uv tool install did not respect the global Python version pin (set via uv python pin --global). Now, these commands will use the global Python version when no explicit version is requested.

  For uv tool install, if the tool is already installed, the Python version will not change unless --reinstall or --python is provided. If the tool was previously installed with an explicit --python flag, the global pin will not override it.

  You can opt out of this behavior by providing an explicit --python flag.

• Remove Debian Bookworm, Alpine 3.21, and Python 3.8 Docker images (#​17755)

  The Debian Bookworm and Alpine 3.21 images were replaced by Debian Trixie and Alpine 3.22 as defaults in uv 0.9. These older images are now removed. Python 3.8 images are also removed, as Python 3.8 is no longer supported in the Trixie or Alpine base images.

  The following image tags are no longer published:

  • uv:bookworm, uv:bookworm-slim
  • uv:alpine3.21
  • uv:python3.8-*

  Use uv:debian or uv:trixie instead of uv:bookworm, uv:alpine or uv:alpine3.22 instead of uv:alpine3.21, and a newer Python version instead of uv:python3.8-*.

• Drop PPC64 (big endian) builds (#​17626)

  uv no longer provides pre-built binaries for PPC64 (big endian). This platform appears to be largely unused and is only supported on a single manylinux version. PPC64LE (little endian) builds are unaffected.

  Building uv from source is still supported for this platform.

• Skip generating activate.csh for relocatable virtual environments (#​17759)

  Previously, uv venv --relocatable would generate an activate.csh script that contained hardcoded paths, making it incompatible with relocation. Now, the activate.csh script is not generated for relocatable virtual environments.

  You cannot opt out of this behavior.

• Require username when multiple credentials match a URL (#​16983)

  When using uv auth login to store credentials, you can register multiple username and password combinations for the same host. Previously, when uv needed to authenticate and multiple credentials matched the URL (e.g., when retrieving a token with uv auth token), uv would pick the first match. Now, uv will error instead.

  You cannot opt out of this behavior. Include the username in the request, e.g., uv auth token --username foo example.com.

• Avoid invalidating the lockfile versions after an exclude-newer change (#​17721)

  Previously, changing the exclude-newer setting would cause package versions to be upgraded, ignoring the lockfile entirely. Now, uv will only change package versions if they are no longer within the exclude-newer range.

  You can restore the previous behavior by using --upgrade or --upgrade-package to opt-in to package version changes.

• Upgrade uv format to Ruff 0.15.0 (#​17838)

  uv format now uses Ruff 0.15.0, which uses the 2026 style guide. See the blog post for details.

  The formatting of code is likely to change. You can opt out of this behavior by requesting an older Ruff version, e.g., uv format --version 0.14.14.

• Update uv crate test features to use test- as a prefix (#​17860)

  This change only affects redistributors of uv. The Cargo features used to gate test dependencies, e.g., pypi, have been renamed with a test- prefix for clarity, e.g., test-pypi.

Stabilizations

• uv python upgrade and uv python install --upgrade (#​17766)

  When installing Python versions, an intermediary directory without the patch version attached will be created, and virtual environments will be transparently upgraded to new patch versions.

  See the Python version documentation for more details.

• uv add --bounds and the add-bounds configuration option (#​17660)

  This does not come with any behavior changes. You will no longer see an experimental warning when using uv add --bounds or add-bounds in configuration.

• uv workspace list and uv workspace dir (#​17768)

  This does not come with any behavior changes. You will no longer see an experimental warning when using these commands.

• extra-build-dependencies (#​17767)

  This does not come with any behavior changes. You will no longer see an experimental warning when using extra-build-dependencies in configuration.

Enhancements

• Improve ABI tag error message phrasing (#​17878)
• Introduce a 10s connect timeout (#​17733)
• Allow using pyx.dev as a target in uv auth commands despite PYX_API_URL differing (#​17856)

Bug fixes

• Support all CPython ABI tag suffixes properly (#​17817)
• Add support for detecting PowerShell on Linux and macOS (#​17870)
• Retry timeout errors for streams (#​17875)

v0.9.30

Compare Source

Released on 2026-02-04.

Python

• Add CPython 3.14.3 and 3.13.12 (#​17849)

Enhancements

• Allow comma-separated values for --extra option (#​17525)
• Check all files during a dry-run publish instead of stopping at the first failure (#​17785)
• Clarify UV_HTTP_TIMEOUT error message (#​17493)

Preview features

• Use relocatable virtual environments by default (#​17770)

Bug fixes

• Fix deadlock on token refresh in uv publish when using pyx (#​17832)
• Ignore global Python pins when incompatible with project (#​15473)

v0.9.29

Compare Source

Released on 2026-02-03.

Python

• Update to Pyodide 0.29.3 (#​17730)

Enhancements

• Add wheel-tag-style aliases for manylinux platform names (#​17750)
• Hint on uv version --bump dev similar to pre-release bumps (#​17796)
• Improve display of RFC 9457 Problem Detail responses in uv publish server errors (#​17787)
• Improve the wording of publish errors during dry-run (#​17782)
• Set backoff to 10 retries (#​17816)
• Add properties to synthentic and project roots in Cyclone DX exports (#​17820)
• Identify the invidividual clients in uv publish trace logs (#​17784)

Preview features

• Remove special casing for base and default conda environment names (#​17758)

Bug fixes

• Fix PYTHONHOME inheritance when spawning different Python versions (#​17821)
• Fix wheel rejections on freethreading+debug builds (#​17812)
• Pad with zeros during comparisons in EqualStar and NotEqualStar operators (#​17751)
• Reject unknown field names in conflict declarations (#​17727)
• Fix panics in system-configuration in sandboxes (#​17829)

Documentation

• Update pip pre-release compatibility information (#​17788)

Security

• Hide a subset of environment variable values in --help (#​17745)

v0.9.28

Compare Source

Released on 2026-01-29.

Python

• Update CPython to use OpenSSL 3.5.5 which includes fixes for high severity CVEs (python-build-standalone#960)

Enhancements

• Add support for Pyodide interpreter on Windows (#​17658)
• Warn if multiple indexes include default = true (#​17713)
• Skip uploads when validation reports 'Already uploaded' (#​17412)

Configuration

• Add a reflink alias for the "clone" link mode (#​17724)

Bug fixes

• Ensure uv.exe exits when uvw.exe or uvx.exe is killed (#​17500)

v0.9.27

Compare Source

Released on 2026-01-26.

Python

• Upgrade Pyodide to 0.29.2 (#​17652)
• Upgrade to GraalPy 25.0.2 (#​17634)

Enhancements

• Add -t shortform for --target to uv pip subcommands (#​17501)
• Add support for ROCm 7.0 and 7.1 accelerator backends (#​17681)
• Further improve free-threading ABI incompatibility errors (#​17491)
• Implement uv pip freeze --exclude flag (#​17045)
• Improve warnings for --system and --no-system in uv venv (#​17647)
• Make uv pip compile attempt to download a specified --python-version if it can. (#​17249)
• Support Trusted Publishing with pyx (#​17438)
• Fix JSON schema for exclude-newer-package (#​17665)

Preview features

• Better detection for conflicting packages (#​17623)
• Upgrade based on outdated build versions in uv python upgrade (#​17653)

Bug fixes

• Change chocolatey system test to ensure uv uses the right python (#​17533)
• Fix infinite loop when SSL_CERT_FILE is a directory (#​17503)

Documentation

• Add cargo-xwin to the CONTRIBUTING guide (#​17507)
• Fix typo in the documentation of UV_PUBLISH_INDEX (#​17672)
• Move MSRV to platform support section (#​17534)
• Update the testing instructions in the CONTRIBUTING guide (#​17528)
• Use --locked to install cargo-xwin in guide (#​17530)
• Warn about PyPy being unmaintained (#​17643)
• docs: Correct gitlab-ci.yml to .gitlab-ci.yml (#​17682)

Other changes

• Update MSRV to 1.91 (#​17677)

v0.9.26

Compare Source

Released on 2026-01-15.

Python

• Add CPython 3.15.0a5

Enhancements

• Add a hint to update uv when a managed Python download is not found (#​17461)
• Improve cache initialization failure error message (#​17469)
• Improve error message for abi3 wheels on free-threaded Python (#​17442)
• Add support for --no-sources-package (#​14910)

Preview features

• Add METADATA.json and WHEEL.json in uv build backend (#​15510)
• Add support for GCS request signing (#​17474)
• Adjust the process ulimit to the maximum allowed on startup (#​17464)

Bug fixes

• Lock to avoid concurrent refresh of pyx tokens (#​17479)

Documentation

• Add linting and formatting instructions to the CONTRIBUTING guide (#​17470)
• Avoid rendering pyproject.toml examples for more system-level settings (#​17462)

v0.9.25

Compare Source

Released on 2026-01-13.

Python

• Add CPython 3.15.0a4
• Upgrade Tcl/Tk used by CPython to 9.0

Enhancements

• Add --compile-bytecode to uv python install and uv python upgrade to compile the standard library (#​17088)
• Allow disabling exclude-newer per package (#​16854)
• Broadcast WM_SETTINGCHANGE on uv tool update-shell (#​17404)

Preview features

• Detect workspace from uv run target (#​17423)

Bug fixes

• Avoid unwrapping size for file responses (#​17434)
• Use keyring authentication when retrieving tool@latest version (#​17448)
• Use latest Pyodide version for each python version (#​17372)
• Improve trampoline file handle closing (#​17374)
• Fix error message when installing musl python on armv7 (#​17213)

v0.9.24

Compare Source

Released on 2026-01-09.

Bug fixes

• Fix handling of UV_NO_SYNC=1 uv run ... (#​17391)
• Rebuild dynamic distribution when version changes with --no-cache (#​17387)

Documentation

• Add Rust language classifier (#​17389)

v0.9.23

Compare Source

Released on 2026-01-09.

Enhancements

• Only write portable paths in RECORD files (#​17339)
• Support relative paths in UV_PYTHON_BIN_DIR and UV_TOOL_BIN_DIR (#​17367)

Preview features

• Enable uploads to S3 via pre-signed URLs (#​17349)

Configuration

• Allow setting proxy variables via global / user configuration (#​16918)
• Manually parse and reconcile Boolean environment variables (#​17321)

Bug fixes

• Avoid broken build artifacts on build failure (#​17276)
• Fix missing dependencies on synthetic root in SBOM export (#​17363)
• Recognize armv8l as an alias for armv7l in platform tag parsing (#​17384)
• Fix redaction of a URL in a middleware trace log (#​17346)

Documentation

• Add index.md suggestion to llms.txt (#​17362)
• Clarify that uv run uses inexact syncing by default (#​17366)

v0.9.22

Compare Source

Released on 2026-01-06.

Enhancements

• Use a dedicated error message when lockfile can't be found (#​17318)

Bug fixes

• Filter unusable wheels from the lockfile for more architectures (#​17317)
• Correctly count retries originating from early middleware errors (#​17274)

Documentation

• Clarify requirements file format in docs (#​17284)

v0.9.21

Compare Source

Released on 2025-12-30.

Bug fixes

• Fix regression where zstd distribution hashes were not considered valid (#​17265)

Documentation

• Fix a typo in the resolution documentation (#​17258)
• Fix a typo in python install --default documentation (#​9826)

v0.9.20

Released on 2025-12-29.

This is a re-release of 0.9.19, with internal crate versions incremented to enable publishing to crates.io.

v0.9.19

Released on 2025-12-29.

Python

• Add CPython 3.15.0a3 (#​17165)

Enhancements

• Allow uv pip compile to install missing python interpreters in cases where it would otherwise fail (#​17216)
• Avoid creating file contents with uv init --bare --script (#​17162)
• Respect --torch-backend in uv tool commands (#​17117)
• Support comma-separated values in --no-binary and --only-binary (#​17185)

Preview features

• Summarize package changes in uv sync with JSON output format (#​16981)

Performance

• Avoid two hot String allocations in deserialization (#​17221)
• Cache NVIDIA-hosted wheels by default (#​17164)

Bug fixes

• Avoid enforcing incorrect hash in mixed-hash settings (#​17157)
• Fix retry counts in cached client (#​17104)
• Respect UV_PYTHON_DOWNLOAD_MIRROR in uv python list (#​16673)
• Support remote pylock.toml files (#​17119)
• Avoid flagging proxied Git URLs as ambiguous authority (#​17234)
• Fix dropped support of - in pip constraints, overrides, and excludes (#​17188)

---

Configuration

📅 Schedule: Branch creation - "before 2am every weekday" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud