Update dependency uv to v0.12.17

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
uv (source, changelog)	0.12.15 → 0.12.17

---

Release Notes

astral-sh/uv (uv)

v0.12.17

Compare Source

Released on 2026-09-18.

Enhancements

• Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#​21780)

Preview features

• Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#​21651)
• Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#​20746)
• Keep uv workspace metadata read-only unless --sync is provided (#​21821)
• Apply uv check lock modes when retrieving workspace metadata (#​21821)

Performance

• Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#​21650)
• Reduce resolver allocations when deduplicating package and distribution requests (#​21810)

Bug fixes

• Prevent required-environments from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline (#​21825)

Documentation

• Clarify the 0.12.14 and 0.12.15 release notes (#​21817)

v0.12.16

Compare Source

Released on 2026-09-17.

Python

• Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#​21741)

Enhancements

• Verify downloaded wheels and source distributions against hashes supplied by package indexes (#​21562)
• Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#​21467)
• Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#​21766)
• Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#​21779)

Preview features

• Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#​21163)
• Honor configured and command-line index settings, including credentials, in uv upgrade (#​21776)
• Allow uv check to run in projects that are not managed by uv and outside workspaces (#​21777)
• Respect --python and UV_PYTHON when selecting the Python version for uv check (#​21744)

Bug fixes

• Redact Azure shared access signatures from displayed and logged URLs (#​21755)
• Check archive sizes from pylock.toml before reusing cached distributions (#​21609)
• Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#​20631)
• Use the bundled uv_build backend only when its version matches active version pins (#​21742)
• Handle malformed index URLs without panicking when credentials are configured (#​21784)
• Report a configuration error instead of panicking for proxy URLs without a host (#​21781)
• Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#​21783)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.