Skip to content

Python: Bump uv from 0.11.3 to 0.11.6 in /python/packages/lab - #5469

Merged
Evan Mattson (moonbox3) merged 3 commits into
mainfrom
dependabot/pip/python/packages/lab/uv-0.11.6
Apr 28, 2026
Merged

Python: Bump uv from 0.11.3 to 0.11.6 in /python/packages/lab#5469
Evan Mattson (moonbox3) merged 3 commits into
mainfrom
dependabot/pip/python/packages/lab/uv-0.11.6

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubApr 24, 2026

Copy link
Copy Markdown
Contributor

Bumps uv from 0.11.3 to 0.11.6.

Release notes

Sourced from uv's releases.

0.11.6

Release Notes

Released on 2026-04-09.

This release resolves a low severity security advisory in which wheels with malformed RECORD entries could delete arbitrary files on uninstall. See GHSA-pjjw-68hj-v9mw for details.

Bug fixes

  • Do not remove files outside the venv on uninstall (#18942)
  • Validate and heal wheel RECORD during installation (#18943)
  • Avoid uv cache clean errors due to Win32 path normalization (#18856)

Install uv 0.11.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.6/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.6/uv-installer.ps1 | iex"

Download uv 0.11.6

FilePlatformChecksum
uv-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
uv-x86_64-apple-darwin.tar.gzIntel macOSchecksum
uv-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
uv-i686-pc-windows-msvc.zipx86 Windowschecksum
uv-x86_64-pc-windows-msvc.zipx64 Windowschecksum
uv-aarch64-unknown-linux-gnu.tar.gzARM64 Linuxchecksum
uv-i686-unknown-linux-gnu.tar.gzx86 Linuxchecksum
uv-powerpc64le-unknown-linux-gnu.tar.gzPPC64LE Linuxchecksum
uv-riscv64gc-unknown-linux-gnu.tar.gzRISCV Linuxchecksum
uv-s390x-unknown-linux-gnu.tar.gzS390x Linuxchecksum
uv-x86_64-unknown-linux-gnu.tar.gzx64 Linuxchecksum
uv-armv7-unknown-linux-gnueabihf.tar.gzARMv7 Linuxchecksum
uv-aarch64-unknown-linux-musl.tar.gzARM64 MUSL Linuxchecksum
uv-i686-unknown-linux-musl.tar.gzx86 MUSL Linuxchecksum
uv-riscv64gc-unknown-linux-musl.tar.gzRISCV MUSL Linuxchecksum
uv-x86_64-unknown-linux-musl.tar.gzx64 MUSL Linuxchecksum
uv-arm-unknown-linux-musleabihf.tar.gzARMv6 MUSL Linux (Hardfloat)checksum
uv-armv7-unknown-linux-musleabihf.tar.gzARMv7 MUSL Linuxchecksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.11.6

Released on 2026-04-09.

This release resolves a low severity security advisory in which wheels with malformed RECORD entries could delete arbitrary files on uninstall. See GHSA-pjjw-68hj-v9mw for details.

Bug fixes

  • Do not remove files outside the venv on uninstall (#18942)
  • Validate and heal wheel RECORD during installation (#18943)
  • Avoid uv cache clean errors due to Win32 path normalization (#18856)

0.11.5

Released on 2026-04-08.

Python

  • Add CPython 3.13.13, 3.14.4, and 3.15.0a8 (#18908)

Enhancements

  • Fix build_system.requires error message (#18911)
  • Remove trailing path separators in path normalization (#18915)
  • Improve error messages for unsupported or invalid TLS certificates (#18924)

Preview features

  • Add exclude-newer to [[tool.uv.index]] (#18839)
  • uv audit: add context/warnings for ignored vulnerabilities (#18905)

Bug fixes

  • Normalize persisted fork markers before lock equality checks (#18612)
  • Clear junction properly when uninstalling Python versions on Windows (#18815)
  • Report error cleanly instead of panicking on TLS certificate error (#18904)

Documentation

  • Remove the legacy PIP_COMPATIBILITY.md redirect file (#18928)
  • Fix uv init example-bare --bare examples (#18822, #18925)

0.11.4

Released on 2026-04-07.

Enhancements

  • Add support for --upgrade-group (#18266)
  • Merge repeated archive URL hashes by version ID (#18841)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump uv from 0.11.3 to 0.11.6 in /python/packages/lab
3c2049f
Bumps [uv](https://github.com/astral-sh/uv) from 0.11.3 to 0.11.6.
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.11.3...0.11.6)
---
updated-dependencies:
- dependency-name: uv
dependency-version: 0.11.6
dependency-type: direct:development
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies python Usage: [Issues, PRs], Target: Python labels Apr 24, 2026
@github-actionsgithub-actionsBot changed the title Bump uv from 0.11.3 to 0.11.6 in /python/packages/labPython: Bump uv from 0.11.3 to 0.11.6 in /python/packages/labApr 24, 2026
@moonbox3

Evan Mattson (moonbox3) commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

Copilot fix the failing CI/CD checks

@moonbox3
Fix CI: update uv from 0.11.3 to 0.11.6 in python/pyproject.toml and …
87a2eea
…regenerate uv.lock
Agent-Logs-Url: https://github.com/microsoft/agent-framework/sessions/a1a7c648-b26f-44e7-bace-d56ed8489053
Co-authored-by: moonbox3 <35585003+moonbox3@users.noreply.github.com>

CopilotAI commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

Copilot fix the failing CI/CD checks

The CI failures were caused by a version mismatch: the dependabot PR bumped uv to 0.11.6 in python/packages/lab/pyproject.toml but left the root python/pyproject.toml at 0.11.3, making the workspace dependencies unsatisfiable.

Fixed in commit 87a2eea by:

  1. Updating python/pyproject.toml to use uv==0.11.6
  2. Regenerating python/uv.lock to consistently reflect uv==0.11.6 across all packages

@moonbox3

Evan Mattson (moonbox3) commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

Copilot fix the failing code quality checks in CI/CD

@moonbox3
Fix code quality CI: update uv-pre-commit rev from 0.11.3 to 0.11.6 i…
6738a81
…n .pre-commit-config.yaml
Agent-Logs-Url: https://github.com/microsoft/agent-framework/sessions/cdfdd211-9f1e-4570-bc7c-86fd15240e91
Co-authored-by: moonbox3 <35585003+moonbox3@users.noreply.github.com>

CopilotAI commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

Copilot fix the failing code quality checks in CI/CD

The code quality failure was in the Pre-commit Hooks job: the uv-lock hook in python/.pre-commit-config.yaml was configured with rev: 0.10.10, so it ran uv lock using uv 0.10.10 against our uv 0.11.6-generated lock file, producing a different resolution (different package versions). Since the hook modified files, it exited with code 1.

Fixed in commit 6738a81 by updating the uv-pre-commitrev from 0.10.10 to 0.11.6 to match the workspace uv version.

@moonbox3
Evan Mattson (moonbox3) added this pull request to the merge queueApr 28, 2026
Merged via the queue into main with commit 35a0b51Apr 28, 2026
44 checks passed
@dependabot
dependabotBot deleted the dependabot/pip/python/packages/lab/uv-0.11.6 branch April 28, 2026 07:41
This was referenced Apr 29, 2026
Closed
Merged
Closed
Merged
Closed
Closed
Closed
This was referenced Jun 5, 2026
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Open
Open
Closed
This was referenced Jun 12, 2026
Closed
Closed
This was referenced Jun 17, 2026
Closed
Closed
Closed
This was referenced Jun 24, 2026
Closed
Open
Closed
Closed
Closed
This was referenced Jul 1, 2026
Closed
Closed
Closed
Closed
This was referenced Jul 10, 2026
Closed
Open
Closed
@dependabotdependabotBot mentioned this pull request Jul 26, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eavanvalkenburgEduard van Valkenburg (eavanvalkenburg)eavanvalkenburg approved these changes
@moonbox3Evan Mattson (moonbox3)moonbox3 approved these changes

Assignees

No one assigned

Labels

pythonUsage: [Issues, PRs], Target: Python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@moonbox3@eavanvalkenburg