This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [jiff](https://redirect.github.com/BurntSushi/jiff) |
workspace.dependencies | patch | `0.2.22` → `0.2.23` |
---
### Release Notes
<details>
<summary>BurntSushi/jiff (jiff)</summary>
###
[`v0.2.23`](https://redirect.github.com/BurntSushi/jiff/blob/HEAD/CHANGELOG.md#0223-2026-03-03)
[Compare
Source](https://redirect.github.com/BurntSushi/jiff/compare/0.2.22...0.2.23)
\===================
This release updates Jiff's bundled copy of the \[IANA Time Zone
Database]
to `2026a`. See the [`2026a` release announcement] for more details.
[`2026a` release announcement]:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
These are not managed by Renovate.
I wrote a script to do this, which I may commit separately. I used an
LLM to review each changelog for relevant changes as well as each diff
for malicious content.
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [reflink-copy](https://redirect.github.com/cargo-bins/reflink-copy) |
workspace.dependencies | patch | `0.1.28` → `0.1.29` |
---
### Release Notes
<details>
<summary>cargo-bins/reflink-copy (reflink-copy)</summary>
###
[`v0.1.29`](https://redirect.github.com/cargo-bins/reflink-copy/blob/HEAD/CHANGELOG.md#0129---2026-03-04)
[Compare
Source](https://redirect.github.com/cargo-bins/reflink-copy/compare/v0.1.28...v0.1.29)
##### Fixed
- exclude sparc/sparc64 from linux reflink path
([#​164](https://redirect.github.com/cargo-bins/reflink-copy/pull/164))
##### Other
- Bump actions/checkout from 5 to 6
([#​148](https://redirect.github.com/cargo-bins/reflink-copy/pull/148))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42Ni40IiwidXBkYXRlZEluVmVyIjoiNDMuNjYuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
## Summary
Introduce a global preview state to reduce the amount of churn required
when adding a preview feature.
This PR also introduces a testing feature to `uv_preview` enabled for
dev builds (builds which are used for running tests among other things).
This exposes `uv_preview::test::with_features` which can be used from
other crates' unit tests to override the preview state for the duration
of a scope. `uv_preview::init` continues to exist and work in this mode
since running the integration test suite in workspace mode pulls in the
dev feature (whereas doing it in package mode, does not, IDFK).
When doing a debug or release build, the testing feature is not enabled.
The PR is based on and closes#17844.
As an example, I've converted the build backend to using global preview
as it was a place which did unit tests which needed to set the preview
state.
## Test Plan
Verification that things continue to work and that the testing feature
does not enable for debug or release builds but does enable for tests
was done manually and by running the test suite.
Additional tests were added.
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
This switches us to OSV's batch query API for vulnerability ID lookups,
which can then be used to concurrently fetch the actual full finding
responses.
In my local testing, this yields significant speedups: from 23s on main
(before this PR) with a small project (~70 deps) to 950ms with this PR.
~~WIP, I want to think through this approach a little more.~~
See #18119
## Test Plan
Added new unit tests.
---------
Signed-off-by: William Woodruff <william@astral.sh>
## Summary
This adds some initial output/report formatting for `uv audit`.
This is an initial blush, any feedback to align this with
rendering/formatting idioms elsewhere would be greatly appreciated!
Atop #18119.
## Test Plan
None yet.
---------
Signed-off-by: William Woodruff <william@astral.sh>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [windows-version](https://redirect.github.com/microsoft/windows-rs) |
workspace.dependencies | patch | `0.1.6` → `0.1.7` |
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
## Summary
In https://github.com/astral-sh/uv/pull/18324, sys-info-rs was dropped
in favor of a more native reimplementation to provide OsType and
OsRelease.
This PR adjusts two areas for windows to match closely previous
behavior:
1. OsType should be `Windows` rather than `Windows_NT`
https://github.com/astral-sh/uv/pull/18324#discussion_r2902257834 as
seen in
https://github.com/FillZpp/sys-info-rs/blob/60ecf1470a5b7c90242f429934a3bacb6023ec4d/c/windows.c#L12.
This also matches the output of `platform.system()` in CPython.
2. OsRelease previously used `GetVersionEx` in sys-info-rs. Looking
closely, this was used primarily in
`crates/uv-python/src/interpreter.rs` and not in linehaul as linehaul
uses `platform.release()`. The problem with `GetVersionEx` is that it
returns often the wrong version due to legacy reasons (e.g. may be stuck
returning `6.2.9200`). The current implementation only returns the build
number from the registry which is prone to problems across windows older
variants. The implementation should use `RtlGetVersion` system call
which returns the current major, minor, build in the same way as
reported by `sys.getwindowsversion()` in CPython. In order to strike
balance, this switches the implementation to use four octects
`{major}.{minor}.{build}.{revision}` as recent windows versioning relies
on major, build and revision where as older versions rely on major,
minor and service pack. A windows-version crate by the same author as
windows-rs was added as it includes the correct system calls for the
windows versions.
## Test Plan
Tested manually on both Windows desktop (10, 11) and Windows Server
(2016).
In a warm cache situation, e.g. with `uv run`, toml parsing is by far
our slowest operation. These kinda hacky spans help debugging that. It
would be better if `toml::from_str` would be instrumented itself, but
this way we can add paths in the relevant places.
## Summary
This provides the scaffolding (CLI and initial `uv-audit` crate) for a
`uv audit` subcommand.
Closes#9189.
Tracking:
- [x] Core CLI scaffolding (this PR)
- [x] #18185
- [x] Audit core (probably a new `uv-audit` crate): #18124
- [ ] Bulk dependency audits with OSV
- [ ] Result presentation
- [ ] #18193
Things that also need to be done with the MVP:
- [ ] We should not audit workspace members by default (by definition,
they don't exist on indices and therefore don't have meaningful results
from vulnerability services).
- [ ] I need to ensure groups/etc. are being filtered by correctly,
right now we audit every single package in the lockfile unconditionally.
## Test Plan
Unit and integration tests commensurate with the new functionality.
---------
Signed-off-by: William Woodruff <william@astral.sh>
uv 0.10 can use direct builds for uv_build with `<0.10`, there were no
breaking changes.
This PR also revamps the direct build detection to be more sensitive and
improves the errors messages.
---------
Co-authored-by: Aria Desires <aria.desires@gmail.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [resvg](https://redirect.github.com/linebender/resvg) | dependencies |
minor | `0.46.0` → `0.47.0` |
---
### Release Notes
<details>
<summary>linebender/resvg (resvg)</summary>
###
[`v0.47.0`](https://redirect.github.com/linebender/resvg/blob/HEAD/CHANGELOG.md#0470-2026-02-05)
[Compare
Source](https://redirect.github.com/linebender/resvg/compare/v0.46.0...v0.47.0)
This release has an MSRV of 1.87.0 for `usvg` and `resvg` and the C API.
##### Added
- Focal radius (`fr`) supported for Radial Gradients.
([#​1014](https://redirect.github.com/linebender/resvg/issues/1014)
by [@​wmedrano](https://redirect.github.com/wmedrano))
- Support for variable fonts based on font-variation-settings CSS
property.
([#​997](https://redirect.github.com/linebender/resvg/issues/997)
by [@​oetiker](https://redirect.github.com/oetiker))
##### Changed
- `tiny-skia` has a major version bump from 0.11 to 0.12.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
|
[target-lexicon](https://redirect.github.com/bytecodealliance/target-lexicon)
| workspace.dependencies | patch | `0.13.4` → `0.13.5` |
---
### Release Notes
<details>
<summary>bytecodealliance/target-lexicon (target-lexicon)</summary>
###
[`v0.13.5`](https://redirect.github.com/bytecodealliance/target-lexicon/compare/v0.13.4...v0.13.5)
[Compare
Source](https://redirect.github.com/bytecodealliance/target-lexicon/compare/v0.13.4...v0.13.5)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:
| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [syn](https://redirect.github.com/dtolnay/syn) |
workspace.dependencies | patch | `2.0.114` → `2.0.116` | `2.0.117` |
---
### Release Notes
<details>
<summary>dtolnay/syn (syn)</summary>
###
[`v2.0.116`](https://redirect.github.com/dtolnay/syn/releases/tag/2.0.116)
[Compare
Source](https://redirect.github.com/dtolnay/syn/compare/2.0.115...2.0.116)
- Optimize parse\_fn\_arg\_or\_variadic for less lookahead on erroneous
receiver
([#​1968](https://redirect.github.com/dtolnay/syn/issues/1968))
###
[`v2.0.115`](https://redirect.github.com/dtolnay/syn/releases/tag/2.0.115)
[Compare
Source](https://redirect.github.com/dtolnay/syn/compare/2.0.114...2.0.115)
- Enable GenericArgument::Constraint parsing in non-full mode
([#​1966](https://redirect.github.com/dtolnay/syn/issues/1966))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on
Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/astral-sh/uv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYnVpbGQ6c2tpcC1kb2NrZXIiLCJidWlsZDpza2lwLXJlbGVhc2UiLCJpbnRlcm5hbCJdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate[bot]