Home Original page

chore(deps-dev): Update uv requirement from 0.7.13 to 0.7.16 by dependabot[bot] · Pull Request #922 · CycloneDX/cyclonedx-python

Updates the requirements on uv to permit the latest version.

Release notes

Sourced from uv's releases.

0.7.16

Release Notes

Python

  • Add Python 3.14.0b3

See the python-build-standalone release notes for more details.

Enhancements

  • Include path or URL when failing to convert in lockfile (#14292)
  • Warn when ~= is used as a Python version specifier without a patch version (#14008)

Preview features

  • Ensure preview default Python installs are upgradeable (#14261)

Performance

  • Share workspace cache between lock and sync operations (#14321)

Bug fixes

  • Allow local indexes to reference remote files (#14294)
  • Avoid rendering desugared prefix matches in error messages (#14195)
  • Avoid using path URL for workspace Git dependencies in requirements.txt (#14288)
  • Normalize index URLs to remove trailing slash (#14245)
  • Respect URL-encoded credentials in redirect location (#14315)
  • Lock the source tree when running setuptools, to protect concurrent builds (#14174)

Documentation

  • Note that GCP Artifact Registry download URLs must have /simple component (#14251)

Install uv 0.7.16

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.7.16/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.7.16/uv-installer.ps1 | iex"

Download uv 0.7.16

... (truncated)

Changelog

Sourced from uv's changelog.

0.7.16

Python

  • Add Python 3.14.0b3

See the python-build-standalone release notes for more details.

Enhancements

  • Include path or URL when failing to convert in lockfile (#14292)
  • Warn when ~= is used as a Python version specifier without a patch version (#14008)

Preview features

  • Ensure preview default Python installs are upgradeable (#14261)

Performance

  • Share workspace cache between lock and sync operations (#14321)

Bug fixes

  • Allow local indexes to reference remote files (#14294)
  • Avoid rendering desugared prefix matches in error messages (#14195)
  • Avoid using path URL for workspace Git dependencies in requirements.txt (#14288)
  • Normalize index URLs to remove trailing slash (#14245)
  • Respect URL-encoded credentials in redirect location (#14315)
  • Lock the source tree when running setuptools, to protect concurrent builds (#14174)

Documentation

  • Note that GCP Artifact Registry download URLs must have /simple component (#14251)

0.7.15

Enhancements

  • Consistently use Ordering::Relaxed for standalone atomic use cases (#14190)
  • Warn on ambiguous relative paths for --index (#14152)
  • Skip GitHub fast path when rate-limited (#13033)
  • Preserve newlines in schema.json descriptions (#13693)

Bug fixes

  • Add check for using minor version link when creating a venv on Windows (#14252)
  • Strip query parameters when parsing source URL (#14224)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)