Home Original page

chore(deps-dev): Update uv requirement from 0.8.17 to 0.8.19 by dependabot[bot] · Pull Request #973 · CycloneDX/cyclonedx-python

Updates the requirements on uv to permit the latest version.

Release notes

Sourced from uv's releases.

0.8.19

Release Notes

Released on 2025-09-19.

Python

  • Add CPython 3.14.0rc3
  • Upgrade OpenSSL to 3.5.3

See the python-build-standalone release notes for more details.

Bug fixes

  • Make uv cache clean parallel process safe (#15888)
  • Fix implied platform_machine marker for win_arm64 platform tag (#15921)

Install uv 0.8.19

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.19/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.19/uv-installer.ps1 | iex"

Download uv 0.8.19

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
uv-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
uv-powerpc64-unknown-linux-gnu.tar.gz PPC64 Linux checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum
uv-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum
uv-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz ARMv7 Linux checksum
uv-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
uv-i686-unknown-linux-musl.tar.gz x86 MUSL Linux checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.8.19

Released on 2025-09-19.

Python

  • Add CPython 3.14.0rc3
  • Upgrade OpenSSL to 3.5.3

See the python-build-standalone release notes for more details.

Bug fixes

  • Make uv cache clean parallel process safe (#15888)
  • Fix implied platform_machine marker for win_arm64 platform tag (#15921)

0.8.18

Released on 2025-09-17.

Enhancements

  • Add PyG packages to torch backend (#15911)
  • Add handling for unnamed conda environments in base environment detection (#15681)
  • Allow selection of debug build interpreters (#11520)
  • Improve uv init defaults for native build backend cache keys (#15705)
  • Error when pyproject.toml target does not exist for dependency groups (#15831)
  • Infer check URL from publish URL when known (#15886)
  • Support Gitlab CI/CD as a trusted publisher (#15583)
  • Add GraalPy 25.0.0 with support for Python 3.12 (#15900)
  • Add --no-clear to uv venv to disable removal prompts (#15795)
  • Add conflict detection between --only-group and --extra flags (#15788)
  • Allow [project] to be missing from a pyproject.toml (#14113)
  • Always treat conda environments named base and root as base environments (#15682)
  • Improve log message when direct build for uv_build is skipped (#15898)
  • Log when the cache is disabled (#15828)
  • Show pyx organization name after authenticating (#15823)
  • Use _CONDA_ROOT to detect Conda base environments (#15680)
  • Include blake2b hash in uv publish upload form (#15794)
  • Fix misleading debug message when removing environments in uv sync (#15881)

Deprecations

  • Deprecate tool.uv.dev-dependencies (#15469)
  • Revert "feat(ci): build loongarch64 binaries in CI (#15387)" (#15820)

Preview features

  • Propagate preview flag to client for native-auth feature (#15872)
  • Store native credentials for realms with the https scheme stripped (#15879)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)