Bump uv from 0.11.19 to 0.11.28 in the python-dependencies group across 1 directory

[dependabot]

Bumps the python-dependencies group with 1 update in the / directory: uv.

Updates uv from 0.11.19 to 0.11.28

Release notes

Sourced from uv's releases.

0.11.28

Release Notes

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

• Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

• Improve trace logs for unexpected error chains (#20220)
• Move lockfile update guidance to a hint (#20219)
• Preserve indentation for multiline error causes (#20156)
• Render user errors with their cause chains (#20217)
• Route final command errors through the printer to respect -q and -qq (#20163)
• Use standard rendering for uv build errors (#20159)
• Use standard rendering for tool requirement errors (#20160)

Performance

• Only compile bytecode for installed distributions in uv pip install (#19914)
• Avoid allocating URL-safe Git revisions (#20194)
• Avoid allocating canonical Python request strings (#20193)
• Avoid allocating custom Astral mirror URLs (#20204)
• Avoid allocating expanded compatibility tags (#20190)
• Avoid allocating shell strings that need no escaping (#20196)
• Avoid allocating static ABI descriptions (#20201)
• Avoid allocating static Windows executable names (#20200)
• Avoid allocating static dependency table names (#20199)
• Avoid allocating static platform triple components (#20195)
• Avoid allocating static resolver report labels (#20198)
• Avoid allocating static unavailable-version messages (#20197)
• Avoid allocating unchanged Python download architectures (#20202)
• Avoid allocating unchanged paths during case normalization (#20203)
• Avoid allocations when expanding group conflicts (#20211)
• Avoid allocations when formatting requirements (#20206)
• Avoid cloning credential lookup services (#20210)
• Avoid cloning dry-run distributions (#20209)
• Avoid cloning owned dependency metadata (#20212)
• Avoid redundant direct URL clones (#20207)
• Create metadata version errors lazily (#20205)
• Optimize expanded tag compatibility checks (#20171)
• Optimize parsing of single-digit three-part versions (#20118)

... (truncated)

Changelog

Sourced from uv's changelog.

0.11.28

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

• Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

• Improve trace logs for unexpected error chains (#20220)
• Move lockfile update guidance to a hint (#20219)
• Preserve indentation for multiline error causes (#20156)
• Render user errors with their cause chains (#20217)
• Route final command errors through the printer to respect -q and -qq (#20163)
• Use standard rendering for uv build errors (#20159)
• Use standard rendering for tool requirement errors (#20160)

Performance

• Only compile bytecode for installed distributions in uv pip install (#19914)
• Avoid allocating URL-safe Git revisions (#20194)
• Avoid allocating canonical Python request strings (#20193)
• Avoid allocating custom Astral mirror URLs (#20204)
• Avoid allocating expanded compatibility tags (#20190)
• Avoid allocating shell strings that need no escaping (#20196)
• Avoid allocating static ABI descriptions (#20201)
• Avoid allocating static Windows executable names (#20200)
• Avoid allocating static dependency table names (#20199)
• Avoid allocating static platform triple components (#20195)
• Avoid allocating static resolver report labels (#20198)
• Avoid allocating static unavailable-version messages (#20197)
• Avoid allocating unchanged Python download architectures (#20202)
• Avoid allocating unchanged paths during case normalization (#20203)
• Avoid allocations when expanding group conflicts (#20211)
• Avoid allocations when formatting requirements (#20206)
• Avoid cloning credential lookup services (#20210)
• Avoid cloning dry-run distributions (#20209)
• Avoid cloning owned dependency metadata (#20212)
• Avoid redundant direct URL clones (#20207)
• Create metadata version errors lazily (#20205)
• Optimize expanded tag compatibility checks (#20171)
• Optimize parsing of single-digit three-part versions (#20118)

... (truncated)

Commits

• ebf0f43 Bump version to 0.11.28 (#20226)
• dee7a10 fix(uv): uv tree fails on dependency-group-only pyproject.tomls (#19975) (#20...
• 95e2f57 Improve trace logs for debugging the error chain (#20220)
• 4fab9d3 Use standard rendering for tool requirement errors (#20160)
• f436bb3 Move canonical and Git URL clones to callers (#20221)
• 6dc1dad Move lockfile update guidance to a hint (#20219)
• 83158f4 Render user errors with their cause chains (#20217)
• 3cfcabe Route final command errors through the printer (#20163)
• da1613b Model final command errors explicitly (#20188)
• 0ea325e Document the bytecode compilation timeout override (#20189)
• Additional commits viewable in compare view

[edmorley]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[edmorley]

@dependabot recreate