Mateusz-Grzelinski/actionlint-py (https://github.com/Mateusz-Grzelinski/actionlint-py)
### [`v1.7.3.17`](https://redirect.github.com/Mateusz-Grzelinski/actionlint-py/compare/v1.7.2.16...v1.7.3.17)
[Compare Source](https://redirect.github.com/Mateusz-Grzelinski/actionlint-py/compare/v1.7.2.16...v1.7.3.17)
### [`v1.7.2.16`](https://redirect.github.com/Mateusz-Grzelinski/actionlint-py/compare/v1.7.1.15...v1.7.2.16)
[Compare Source](https://redirect.github.com/Mateusz-Grzelinski/actionlint-py/compare/v1.7.1.15...v1.7.2.16)
PyCQA/bandit (https://github.com/PyCQA/bandit)
### [`v1.7.10`](https://redirect.github.com/PyCQA/bandit/releases/tag/1.7.10)
[Compare Source](https://redirect.github.com/PyCQA/bandit/compare/1.7.9...1.7.10)
#### What's Changed
- Bump docker/build-push-action from 5.4.0 to 6.0.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1147](https://redirect.github.com/PyCQA/bandit/pull/1147)
- Suggested small refactors in assignments by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1150](https://redirect.github.com/PyCQA/bandit/pull/1150)
- Performance improvement in blacklist function by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1148](https://redirect.github.com/PyCQA/bandit/pull/1148)
- Add test for usage of FTP_TLS by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1149](https://redirect.github.com/PyCQA/bandit/pull/1149)
- New check: B113: TrojanSource - Bidirectional control characters by [@Lucas-C](https://redirect.github.com/Lucas-C) in [https://github.com/PyCQA/bandit/pull/757](https://redirect.github.com/PyCQA/bandit/pull/757)
- Bump docker/build-push-action from 6.0.0 to 6.1.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1152](https://redirect.github.com/PyCQA/bandit/pull/1152)
- feat(plugins): add support for `httpx` in `B113` by [@mkniewallner](https://redirect.github.com/mkniewallner) in [https://github.com/PyCQA/bandit/pull/1060](https://redirect.github.com/PyCQA/bandit/pull/1060)
- Nit: remove unused variable by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1153](https://redirect.github.com/PyCQA/bandit/pull/1153)
- Add recent releases to version choice in bug report by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1151](https://redirect.github.com/PyCQA/bandit/pull/1151)
- Bump docker/build-push-action from 6.1.0 to 6.2.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1155](https://redirect.github.com/PyCQA/bandit/pull/1155)
- Bump docker/build-push-action from 6.2.0 to 6.3.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1157](https://redirect.github.com/PyCQA/bandit/pull/1157)
- Bump docker/setup-buildx-action from 3.3.0 to 3.4.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1156](https://redirect.github.com/PyCQA/bandit/pull/1156)
- Bump docker/setup-buildx-action from 3.4.0 to 3.5.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1158](https://redirect.github.com/PyCQA/bandit/pull/1158)
- Bump docker/login-action from 3.2.0 to 3.3.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1159](https://redirect.github.com/PyCQA/bandit/pull/1159)
- Bump docker/build-push-action from 6.3.0 to 6.5.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1160](https://redirect.github.com/PyCQA/bandit/pull/1160)
- Bump docker/setup-buildx-action from 3.5.0 to 3.6.1 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1163](https://redirect.github.com/PyCQA/bandit/pull/1163)
- Bump docker/build-push-action from 6.5.0 to 6.6.1 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1166](https://redirect.github.com/PyCQA/bandit/pull/1166)
- Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1165](https://redirect.github.com/PyCQA/bandit/pull/1165)
- Bump docker/build-push-action from 6.6.1 to 6.7.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1168](https://redirect.github.com/PyCQA/bandit/pull/1168)
- Use consistent file naming of docs by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1170](https://redirect.github.com/PyCQA/bandit/pull/1170)
- Pytorch Load / Save Plugin by [@lukehinds](https://redirect.github.com/lukehinds) in [https://github.com/PyCQA/bandit/pull/1114](https://redirect.github.com/PyCQA/bandit/pull/1114)
#### New Contributors
- [@Lucas-C](https://redirect.github.com/Lucas-C) made their first contribution in [https://github.com/PyCQA/bandit/pull/757](https://redirect.github.com/PyCQA/bandit/pull/757)
**Full Changelog**: https://github.com/PyCQA/bandit/compare/1.7.9...1.7.10
astral-sh/uv (uv)
### [`v0.4.18`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0418)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.17...0.4.18)
##### Enhancements
- Allow multiple source entries for each package in `tool.uv.sources` ([#7745](https://redirect.github.com/astral-sh/uv/pull/7745))
- Add `.gitignore` file to `uv build` output directory ([#7835](https://redirect.github.com/astral-sh/uv/pull/7835))
- Disable jemalloc on FreeBSD ([#7780](https://redirect.github.com/astral-sh/uv/pull/7780))
- Respect `PAGER` env var when paging in `uv help` command ([#5511](https://redirect.github.com/astral-sh/uv/pull/5511))
- Support `uv run -m foo` to run a module ([#7754](https://redirect.github.com/astral-sh/uv/pull/7754))
- Use a top-level output directory for `uv build` in workspaces ([#7813](https://redirect.github.com/astral-sh/uv/pull/7813))
- Update `uv init --package` command to match project name ([#7670](https://redirect.github.com/astral-sh/uv/pull/7670))
- Add a custom suggestion for `uv add dotenv` ([#7799](https://redirect.github.com/astral-sh/uv/pull/7799))
- Add detailed errors for `tool.uv.sources` deserialization failures ([#7823](https://redirect.github.com/astral-sh/uv/pull/7823))
- Improve error message copy for failed builds ([#7849](https://redirect.github.com/astral-sh/uv/pull/7849))
- Use `serde-untagged` to improve some untagged enum error messages ([#7822](https://redirect.github.com/astral-sh/uv/pull/7822))
- Use build failure hints for `dotenv` errors, rather than in `uv add` ([#7825](https://redirect.github.com/astral-sh/uv/pull/7825))
##### Configuration
- Add `UV_NO_SYNC` environment variable ([#7752](https://redirect.github.com/astral-sh/uv/pull/7752))
##### Bug fixes
- Accept `git+` prefix in `tool.uv.sources` ([#7847](https://redirect.github.com/astral-sh/uv/pull/7847))
- Allow spaces in path requirements ([#7767](https://redirect.github.com/astral-sh/uv/pull/7767))
- Avoid reusing cached downloaded binaries with `--no-binary` ([#7772](https://redirect.github.com/astral-sh/uv/pull/7772))
- Correctly trims values during wheel WHEEL file parsing ([#7770](https://redirect.github.com/astral-sh/uv/pull/7770))
- Fix `uv tree --invert` for platform dependencies ([#7808](https://redirect.github.com/astral-sh/uv/pull/7808))
- Fix encoding mismatch between python child process and uv ([#7757](https://redirect.github.com/astral-sh/uv/pull/7757))
- Reject self-dependencies in `uv add` ([#7766](https://redirect.github.com/astral-sh/uv/pull/7766))
- Respect `tool.uv.environments` for legacy virtual workspace roots ([#7824](https://redirect.github.com/astral-sh/uv/pull/7824))
- Retain empty extras on workspace members ([#7762](https://redirect.github.com/astral-sh/uv/pull/7762))
- Use file stem when parsing cached wheel names ([#7773](https://redirect.github.com/astral-sh/uv/pull/7773))
##### Rust API
- Make `FlatDistributions` public ([#7833](https://redirect.github.com/astral-sh/uv/pull/7833))
##### Documentation
- Fix table of contents sizing ([#7751](https://redirect.github.com/astral-sh/uv/pull/7751))
- GitLab Integration documentation ([#6857](https://redirect.github.com/astral-sh/uv/pull/6857))
- Update documentation to setup-uv@v3 ([#7807](https://redirect.github.com/astral-sh/uv/pull/7807))
- Use `uv publish` instead of twine in docs ([#7837](https://redirect.github.com/astral-sh/uv/pull/7837))
- Fix typo in `projects.md` ([#7784](https://redirect.github.com/astral-sh/uv/pull/7784))
### [`v0.4.17`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0417)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.16...0.4.17)
##### Enhancements
- Add `uv build --all` to build all packages in a workspace ([#7724](https://redirect.github.com/astral-sh/uv/pull/7724))
- Add support for `uv init --script` ([#7565](https://redirect.github.com/astral-sh/uv/pull/7565))
- Add support for upgrading build environment for installed tools (`uv tool upgrade --python`) ([#7605](https://redirect.github.com/astral-sh/uv/pull/7605))
- Initialize a Git repository in `uv init` ([#5476](https://redirect.github.com/astral-sh/uv/pull/5476))
- Respect `--quiet` flag in `uv build` ([#7674](https://redirect.github.com/astral-sh/uv/pull/7674))
- Add context message before listing available tools in `uvx` ([#7641](https://redirect.github.com/astral-sh/uv/pull/7641))
##### Bug fixes
- Don't create Python bytecode files during interpreter discovery ([#7707](https://redirect.github.com/astral-sh/uv/pull/7707))
- Escape glob patterns in workspace member discovery ([#7709](https://redirect.github.com/astral-sh/uv/pull/7709))
- Avoid prefetching source distributions with unbounded lower-bound ranges ([#7683](https://redirect.github.com/astral-sh/uv/pull/7683))
##### Documentation
- Add `uv build` and `uv publish` to features overview ([#7716](https://redirect.github.com/astral-sh/uv/pull/7716))
- Add documentation on cache versioning ([#7693](https://redirect.github.com/astral-sh/uv/pull/7693))
- Spell out the names of the Docker images for easier copy-paste ([#7706](https://redirect.github.com/astral-sh/uv/pull/7706))
- Document uv-with-Jupyter workflows ([#7625](https://redirect.github.com/astral-sh/uv/pull/7625))
- Note that `uv lock --upgrade-package` retains locked versions ([#7694](https://redirect.github.com/astral-sh/uv/pull/7694))
### [`v0.4.16`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0416)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.15...0.4.16)
##### Enhancements
- Add `uv publish` ([#7475](https://redirect.github.com/astral-sh/uv/pull/7475))
- Add a `--project` argument to run a command from a project directory ([#7603](https://redirect.github.com/astral-sh/uv/pull/7603))
- Display Python implementation when creating environments ([#7652](https://redirect.github.com/astral-sh/uv/pull/7652))
- Implement trusted publishing for `uv publish` ([#7548](https://redirect.github.com/astral-sh/uv/pull/7548))
- Respect lockfile preferences for `--with` requirements ([#7627](https://redirect.github.com/astral-sh/uv/pull/7627))
- Unhide the `--directory` option ([#7653](https://redirect.github.com/astral-sh/uv/pull/7653))
- Allow requesting free-threaded Python interpreters ([#7431](https://redirect.github.com/astral-sh/uv/pull/7431))
- Show a dedicated PubGrub hint for `--unsafe-best-match` ([#7645](https://redirect.github.com/astral-sh/uv/pull/7645))
- Add resolver error checking for conflicting distributions ([#7595](https://redirect.github.com/astral-sh/uv/pull/7595))
##### Bug fixes
- Avoid adding double-newlines for CRLF ([#7640](https://redirect.github.com/astral-sh/uv/pull/7640))
- Avoid retaining forks when `requires-python` range changes ([#7624](https://redirect.github.com/astral-sh/uv/pull/7624))
- Determine if pre-release Python downloads should be allowed using the version specifiers ([#7638](https://redirect.github.com/astral-sh/uv/pull/7638))
- Fix `link-mode=clone` for directories on Linux ([#7620](https://redirect.github.com/astral-sh/uv/pull/7620))
- Improve Python executable name discovery when using alternative implementations ([#7649](https://redirect.github.com/astral-sh/uv/pull/7649))
- Require opt-in to use alternative Python implementations ([#7650](https://redirect.github.com/astral-sh/uv/pull/7650))
- Use the first pre-release discovered when only pre-release Python versions are available ([#7666](https://redirect.github.com/astral-sh/uv/pull/7666))
##### Documentation
- Document environment variable that disables printing of virtual environment name in prompt ([#7648](https://redirect.github.com/astral-sh/uv/pull/7648))
- Remove double whitespaces from the code ([#7623](https://redirect.github.com/astral-sh/uv/pull/7623))
- Use anchorlinks rather than permalinks ([#7626](https://redirect.github.com/astral-sh/uv/pull/7626))
##### Preview features
- Add build backend scaffolding ([#7662](https://redirect.github.com/astral-sh/uv/pull/7662))
### [`v0.4.15`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0415)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.14...0.4.15)
##### Bug fixes
- Revert "Treat invalid platform as more compatible than invalid Python ([#7556](https://redirect.github.com/astral-sh/uv/issues/7556))" ([#7608](https://redirect.github.com/astral-sh/uv/pull/7608))
##### Documentation
- Add the execution policy to powershell installs for single versions ([#7602](https://redirect.github.com/astral-sh/uv/pull/7602))
### [`v0.4.14`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0414)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.13...0.4.14)
##### Breaking
- Move uvx shell completion to `uvx --generate-shell-completion` ([#7511](https://redirect.github.com/astral-sh/uv/pull/7511))
##### Enhancements
- Adjust messaging for frozen hint on resolution failure during `uv add` ([#7597](https://redirect.github.com/astral-sh/uv/pull/7597))
- Provide resolution hints in case of possible local name conflicts ([#7505](https://redirect.github.com/astral-sh/uv/pull/7505))
- Improve Docker image release tagging order and display on `ghcr.io` ([#7568](https://redirect.github.com/astral-sh/uv/pull/7568))
- Improve deserialization error messages ([#7598](https://redirect.github.com/astral-sh/uv/pull/7598))
##### Bug fixes
- Allow system environments during project environment validity check ([#7585](https://redirect.github.com/astral-sh/uv/pull/7585))
- Avoid validating workspace members when `--no-sources` is provided ([#7599](https://redirect.github.com/astral-sh/uv/pull/7599))
- Fix handling of `sys.base_prefix` collision in interpreter identity check during tool installs ([#7596](https://redirect.github.com/astral-sh/uv/pull/7596))
- Make `uv cache prune` robust to unreadable rkyv entries ([#7561](https://redirect.github.com/astral-sh/uv/pull/7561))
- Revert "Remove duplicate warning for settings discovery errors ([#7384](https://redirect.github.com/astral-sh/uv/issues/7384))" ([#7594](https://redirect.github.com/astral-sh/uv/pull/7594))
##### Documentation
- Fix `-` to `_` in packaged applications document ([#7571](https://redirect.github.com/astral-sh/uv/pull/7571))
### [`v0.4.13`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0413)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.12...0.4.13)
##### Enhancements
- Add `socks` support ([#7503](https://redirect.github.com/astral-sh/uv/pull/7503))
- Avoid warning about bad Python interpreter links for empty project environment directories ([#7527](https://redirect.github.com/astral-sh/uv/pull/7527))
- Improve invalid environment warning messages ([#7544](https://redirect.github.com/astral-sh/uv/pull/7544))
- Use more verbose spelling of "virtualenv" during creation ([#7523](https://redirect.github.com/astral-sh/uv/pull/7523))
- Do not use a user-facing warning for "Waiting to acquire lock..." message ([#7502](https://redirect.github.com/astral-sh/uv/pull/7502))
##### Performance
- Use a single buffer for hints on resolver errors ([#7497](https://redirect.github.com/astral-sh/uv/pull/7497))
##### Bug fixes
- Allow Python pre-releases to be used if they are first on the `PATH` ([#7470](https://redirect.github.com/astral-sh/uv/pull/7470))
- Avoid deleting the project environment directory if it is not a virtual environment ([#7522](https://redirect.github.com/astral-sh/uv/pull/7522))
- Do not error if the `CACHEDIR.TAG` file exists but cannot be written to ([#7550](https://redirect.github.com/astral-sh/uv/pull/7550))
- Treat invalid platform as more compatible than invalid Python ([#7556](https://redirect.github.com/astral-sh/uv/pull/7556))
- Use portable paths when serializing sources ([#7504](https://redirect.github.com/astral-sh/uv/pull/7504))
- Compute resolver hints using the final reduced derivation tree ([#7546](https://redirect.github.com/astral-sh/uv/pull/7546))
- Bump the wheel and sdist cache versions ([#7560](https://redirect.github.com/astral-sh/uv/pull/7560))
- Heal cache entries with missing source distributions ([#7559](https://redirect.github.com/astral-sh/uv/pull/7559))
##### Rust libraries
- Bump minimum supported Rust version from 1.80 -> 1.81
##### Documentation
- Add `UV_LINK_MODE` to Docker caching example ([#7510](https://redirect.github.com/astral-sh/uv/pull/7510))
- Clarify behavior of of overrides in CLI reference ([#7537](https://redirect.github.com/astral-sh/uv/pull/7537))
### [`v0.4.12`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0412)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.11...0.4.12)
##### Enhancements
- Allow users to provide pre-defined metadata for resolution ([#7442](https://redirect.github.com/astral-sh/uv/pull/7442))
- Invalidate existing tool environments on Python interpreter mismatch ([#7451](https://redirect.github.com/astral-sh/uv/pull/7451))
##### Bug fixes
- Avoid fatal error when searching for egg-info with missing directory ([#7498](https://redirect.github.com/astral-sh/uv/pull/7498))
##### Documentation
- Add note on cache growth for self-hosted GitHub runners ([#5757](https://redirect.github.com/astral-sh/uv/pull/5757))
### [`v0.4.11`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0411)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.10...0.4.11)
##### Enhancements
- Add `--no-editable` support to `uv sync` and `uv export` ([#7371](https://redirect.github.com/astral-sh/uv/pull/7371))
- Add support for `--only-dev` to `uv sync` and `uv export` ([#7367](https://redirect.github.com/astral-sh/uv/pull/7367))
- Add support for remaining pip-supported file extensions ([#7387](https://redirect.github.com/astral-sh/uv/pull/7387))
- Generate shell completion for `uvx` ([#7388](https://redirect.github.com/astral-sh/uv/pull/7388))
- Include `uv export` command in `requirements.txt` output ([#7374](https://redirect.github.com/astral-sh/uv/pull/7374))
- Prune unzipped source distributions in `uv cache prune --ci` ([#7446](https://redirect.github.com/astral-sh/uv/pull/7446))
- Warn when trying to `uv sync` a package without build configuration ([#7420](https://redirect.github.com/astral-sh/uv/pull/7420))
- Support requests for pre-releases in the `--python` option ([#7335](https://redirect.github.com/astral-sh/uv/pull/7335))
##### Bug fixes
- Avoid erroneous version warning for `.dist-info` directories ([#7444](https://redirect.github.com/astral-sh/uv/pull/7444))
- Avoid removing seed packages for `uv venv --seed` environments ([#7410](https://redirect.github.com/astral-sh/uv/pull/7410))
- Avoid unnecessary progress bar initializations ([#7412](https://redirect.github.com/astral-sh/uv/pull/7412))
- Error when `tool.uv.sources` contains duplicate package names ([#7383](https://redirect.github.com/astral-sh/uv/pull/7383))
- Include `--branch` et al when resolving unnamed URLs in `uv add` ([#7447](https://redirect.github.com/astral-sh/uv/pull/7447))
- Include `dev-dependencies` in `--no-sources` invocations ([#7408](https://redirect.github.com/astral-sh/uv/pull/7408))
- Include the parent interpreter in Python discovery when `--system` is used ([#7440](https://redirect.github.com/astral-sh/uv/pull/7440))
- Respect `--no-sources` in PEP 723 scripts ([#7409](https://redirect.github.com/astral-sh/uv/pull/7409))
- Respect `pyproject.toml` credentials from user-provided requirements ([#7474](https://redirect.github.com/astral-sh/uv/pull/7474))
- Use consistent PyPI cache bucket ([#7443](https://redirect.github.com/astral-sh/uv/pull/7443))
- Use unambiguous relative paths in `uv export` ([#7378](https://redirect.github.com/astral-sh/uv/pull/7378))
##### Documentation
- Add documentation on platform-specific dependencies ([#7411](https://redirect.github.com/astral-sh/uv/pull/7411))
- Add documentation for passing installer options on Linux ([#6839](https://redirect.github.com/astral-sh/uv/pull/6839))
- Separate project data from configuration settings ([#7053](https://redirect.github.com/astral-sh/uv/pull/7053))
##### Error messages
- Hint at missing `project.name` ([#6803](https://redirect.github.com/astral-sh/uv/pull/6803))
- Surface dedicated `project.name` error for workspaces ([#7399](https://redirect.github.com/astral-sh/uv/pull/7399))
- Remove duplicate warning for settings discovery errors ([#7384](https://redirect.github.com/astral-sh/uv/pull/7384))
### [`v0.4.10`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0410)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.9...0.4.10)
##### Enhancements
- Allow `uv tool upgrade --all` to continue on individual upgrade failure ([#7333](https://redirect.github.com/astral-sh/uv/pull/7333))
- Support globs as cache keys in `tool.uv.cache-keys` ([#7268](https://redirect.github.com/astral-sh/uv/pull/7268))
- Add Python package (`__main__.py`) support to `uv run` ([#7281](https://redirect.github.com/astral-sh/uv/pull/7281))
- Add zip application support to `uv run` ([#7289](https://redirect.github.com/astral-sh/uv/pull/7289))
- Add `--token` option to `self update` command ([#7279](https://redirect.github.com/astral-sh/uv/pull/7279))
##### Performance
- Use `globwalk` for `cache-keys` matching ([#7337](https://redirect.github.com/astral-sh/uv/pull/7337))
##### Bug fixes
- Always treat archive-like requirements as local files ([#7364](https://redirect.github.com/astral-sh/uv/pull/7364))
- Apply `--no-install` options when constructing resolution ([#7277](https://redirect.github.com/astral-sh/uv/pull/7277))
- Avoid clobbering existing `py.typed` files contents in `uv init` ([#7338](https://redirect.github.com/astral-sh/uv/pull/7338))
- Avoid enforcing platform compatibility when validating lockfile ([#7305](https://redirect.github.com/astral-sh/uv/pull/7305))
- Avoid installing transitive dev dependencies ([#7318](https://redirect.github.com/astral-sh/uv/pull/7318))
- Avoid selecting prerelease Python installations without opt-in ([#7300](https://redirect.github.com/astral-sh/uv/pull/7300))
- Fix PPC64 page size in binary builds. ([#7298](https://redirect.github.com/astral-sh/uv/pull/7298))
- Include pre-release Python versions in `uv python list` ([#7290](https://redirect.github.com/astral-sh/uv/pull/7290))
- Make version ID optional for source builds ([#7362](https://redirect.github.com/astral-sh/uv/pull/7362))
- Support relative paths in `uv add --script` ([#7301](https://redirect.github.com/astral-sh/uv/pull/7301))
##### Documentation
- Fix documentation typos for `uv build --build-constraint` flag ([#7330](https://redirect.github.com/astral-sh/uv/pull/7330))
- Fix grammatical error in CLI docs ([#7353](https://redirect.github.com/astral-sh/uv/pull/7353))
##### Error messages
- Add dedicated lock errors for wheel-only distributions ([#7307](https://redirect.github.com/astral-sh/uv/pull/7307))
- Avoid treating `.whl` sources as source distributions ([#7303](https://redirect.github.com/astral-sh/uv/pull/7303))
- Clarify Python requirement source for script incompatibilities ([#7339](https://redirect.github.com/astral-sh/uv/pull/7339))
### [`v0.4.9`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#049)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.8...0.4.9)
##### Enhancements
- Add support for managed Python 3.13 ([#7263](https://redirect.github.com/astral-sh/uv/pull/7263))
- Upgrade managed CPython versions to latest patch releases ([#7263](https://redirect.github.com/astral-sh/uv/pull/7263))
- Allow setting a target version for `uv self update` ([#7252](https://redirect.github.com/astral-sh/uv/pull/7252))
- Create `py.typed` files during `uv init --lib` ([#7232](https://redirect.github.com/astral-sh/uv/pull/7232))
- Add a dedicated error for packages that fail due to `distutils` deprecation ([#7239](https://redirect.github.com/astral-sh/uv/pull/7239))
- Improve error message when requested Python version is unsupported ([#7269](https://redirect.github.com/astral-sh/uv/pull/7269))
- Add `uv run --no-sync` (https://redirect.github.com/astral-sh/uv/pull/7192)-sh/uv/pull/7192\))
##### Bug fixes
- Avoid updating `pyproject.toml` offsets on non-add edits ([#7262](https://redirect.github.com/astral-sh/uv/pull/7262))
- Invalidate cache when `--config-settings` change ([#7139](https://redirect.github.com/astral-sh/uv/pull/7139))
- Remove workspace root for single-member workspace with `uv export` ([#7254](https://redirect.github.com/astral-sh/uv/pull/7254))
### [`v0.4.8`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#048)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.7...0.4.8)
##### Enhancements
- Add support for dynamic cache keys ([#7136](https://redirect.github.com/astral-sh/uv/pull/7136))
- Allow `.dist-info` names with dashes for post releases ([#7208](https://redirect.github.com/astral-sh/uv/pull/7208))
- Use type hints in code from `uv init` ([#7225](https://redirect.github.com/astral-sh/uv/pull/7225))
- Treat `.tgz` the same as `.tar.gz` ([#7201](https://redirect.github.com/astral-sh/uv/pull/7201))
- Direct users towards `uv venv` to create a virtual environment ([#7188](https://redirect.github.com/astral-sh/uv/pull/7188))
- Improve error message for uv init already init-ed ([#7198](https://redirect.github.com/astral-sh/uv/pull/7198))
##### Performance
- Avoid batch prefetching for un-optimized registries ([#7226](https://redirect.github.com/astral-sh/uv/pull/7226))
- Avoid iteration for singleton selections ([#7195](https://redirect.github.com/astral-sh/uv/pull/7195))
##### Bug fixes
- Avoid extra newlines in debug logging for source builds ([#7174](https://redirect.github.com/astral-sh/uv/pull/7174))
- Prune unreachable packages from `--universal` output ([#7209](https://redirect.github.com/astral-sh/uv/pull/7209))
- Respect exclusion when collecting workspace members ([#7175](https://redirect.github.com/astral-sh/uv/pull/7175))
- Use path file instead of `sitecustomize.py` ([#7161](https://redirect.github.com/astral-sh/uv/pull/7161))
- Replace incorrect `--source` and `--binary` flags with correct `--sdist` and `--wheel` flags in `uv build` ([#7156](https://redirect.github.com/astral-sh/uv/pull/7156))
##### Documentation
- Document support for `UV_INSTALL_DIR` ([#7107](https://redirect.github.com/astral-sh/uv/pull/7107))
- List all supported sdist formats ([#7168](https://redirect.github.com/astral-sh/uv/pull/7168))
### [`v0.4.7`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#047)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.6...0.4.7)
##### Enhancements
- Add `--no-emit-project` and friends to `uv export` ([#7110](https://redirect.github.com/astral-sh/uv/pull/7110))
- Add `--output-file` to `uv export` ([#7109](https://redirect.github.com/astral-sh/uv/pull/7109))
- Prune unused source distributions from the cache in `uv cache prune` ([#7112](https://redirect.github.com/astral-sh/uv/pull/7112))
- Take intersection of constraint and requirements hashes ([#7108](https://redirect.github.com/astral-sh/uv/pull/7108))
##### Performance
- Skip metadata fetch for `--no-deps` and `pip sync` ([#7127](https://redirect.github.com/astral-sh/uv/pull/7127))
##### Bug fixes
- Avoid panicking when encountering an invalid Python version during `uv python list` ([#7131](https://redirect.github.com/astral-sh/uv/pull/7131))
- Write trailing newline to `.python-version` files ([#7140](https://redirect.github.com/astral-sh/uv/pull/7140))
### [`v0.4.6`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#046)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.5...0.4.6)
##### Enhancements
- Accept `--build-constraint` in `uv build` ([#7085](https://redirect.github.com/astral-sh/uv/pull/7085))
- Add `--require-hashes` and `--verify-hashes` to `uv build` ([#7094](https://redirect.github.com/astral-sh/uv/pull/7094))
- Add `--show-version-specifiers` to `uv tool list` ([#7050](https://redirect.github.com/astral-sh/uv/pull/7050))
- Respect hashes in constraints files ([#7093](https://redirect.github.com/astral-sh/uv/pull/7093))
- Upgrade installer scripts ([#7092](https://redirect.github.com/astral-sh/uv/pull/7092))
- Allow specifying multiple packages in `uv tool upgrade` and `uninstall` ([#7037](https://redirect.github.com/astral-sh/uv/pull/7037))
- Sort by implementation in `uv python list` ([#6918](https://redirect.github.com/astral-sh/uv/pull/6918))
##### Bug fixes
- Invalidate lockfile when member versions change ([#7102](https://redirect.github.com/astral-sh/uv/pull/7102))
- Strip fragments from direct source URLs in lockfile ([#7061](https://redirect.github.com/astral-sh/uv/pull/7061))
- Support `--no-build` and `--no-binary` in `uv sync` et al ([#7100](https://redirect.github.com/astral-sh/uv/pull/7100))
- Use distribution hash over registry hash ([#7060](https://redirect.github.com/astral-sh/uv/pull/7060))
- Fix inverted log message ([#7063](https://redirect.github.com/astral-sh/uv/pull/7063))
- Adjust Docker `ENTRYPOINT` and `CMD` for inherited images ([#7054](https://redirect.github.com/astral-sh/uv/pull/7054))
##### Documentation
- Add winget to installers ([#7088](https://redirect.github.com/astral-sh/uv/pull/7088))
- Document how to disable path modifications during install ([#7090](https://redirect.github.com/astral-sh/uv/pull/7090))
- Document how to manually update locked package version ([#7083](https://redirect.github.com/astral-sh/uv/pull/7083))
- Document official `setup-uv` action ([#7056](https://redirect.github.com/astral-sh/uv/pull/7056))
- Update docs on `.python-version` file ([#7051](https://redirect.github.com/astral-sh/uv/pull/7051))
### [`v0.4.5`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#045)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.4...0.4.5)
##### Enhancements
- Implement `uv build` ([#6895](https://redirect.github.com/astral-sh/uv/pull/6895))
- Add `--package` support to `uv build` ([#6990](https://redirect.github.com/astral-sh/uv/pull/6990))
- Prune unreachable packages from lockfile ([#6959](https://redirect.github.com/astral-sh/uv/pull/6959))
- Prune unreachable wheels from lockfile ([#6961](https://redirect.github.com/astral-sh/uv/pull/6961))
- Show build output by default in `uv build` ([#6912](https://redirect.github.com/astral-sh/uv/pull/6912))
- Support `uv build --wheel` from source distributions ([#6898](https://redirect.github.com/astral-sh/uv/pull/6898))
- Use the root project name for the project virtual environment prompt ([#7021](https://redirect.github.com/astral-sh/uv/pull/7021))
##### Bug fixes
- Fix handling of inline optional dependencies in `uv add` ([#7023](https://redirect.github.com/astral-sh/uv/pull/7023))
- Reflect exit code in `uv tool run` and `uv run` ([#6994](https://redirect.github.com/astral-sh/uv/pull/6994))
- Revert `pyproject.toml` modifications on Ctrl-C ([#7024](https://redirect.github.com/astral-sh/uv/pull/7024))
- Rollback `pyproject.toml` changes on all errors ([#7022](https://redirect.github.com/astral-sh/uv/pull/7022))
- Use correct ordering semantics for narrowing upper-bounded Python requirements ([#7031](https://redirect.github.com/astral-sh/uv/pull/7031))
- Fix segfault in Windows trampolines ([#6955](https://redirect.github.com/astral-sh/uv/pull/6955))
- Remove unused `__future__.annotations` import in `_virtualenv.py` ([#6996](https://redirect.github.com/astral-sh/uv/pull/6996))
##### Documentation
- Add documentation for `uv build` ([#6991](https://redirect.github.com/astral-sh/uv/pull/6991))
- Add note to `extra` and `all-extras` in `uv sync` help ([#7013](https://redirect.github.com/astral-sh/uv/pull/7013))
- Add project docs for `project.scripts` ([#7010](https://redirect.github.com/astral-sh/uv/pull/7010))
- Fix available Docker image tag rendering and shorten list ([#7017](https://redirect.github.com/astral-sh/uv/pull/7017))
- Touchup to the project environment config section ([#7038](https://redirect.github.com/astral-sh/uv/pull/7038))
- Clarify precedence of `uv.toml` ([#6986](https://redirect.github.com/astral-sh/uv/pull/6986))
- Fix available Docker tags for `-slim` variants ([#7041](https://redirect.github.com/astral-sh/uv/pull/7041))
### [`v0.4.4`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#044)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.3...0.4.4)
##### Enhancements
- Allow customizing the project environment path with `UV_PROJECT_ENVIRONMENT` ([#6834](https://redirect.github.com/astral-sh/uv/pull/6834))
- Warn when `VIRTUAL_ENV` is set but will not be respected in project commands ([#6864](https://redirect.github.com/astral-sh/uv/pull/6864))
- Add `--no-hashes` to `uv export` ([#6954](https://redirect.github.com/astral-sh/uv/pull/6954))
- Make HTTP headers title case for backward compatibility ([#6887](https://redirect.github.com/astral-sh/uv/pull/6887))
- Pin `.python-version` in `uv init` ([#6869](https://redirect.github.com/astral-sh/uv/pull/6869))
- Support `file://` URLs for `UV_PYTHON_INSTALL_MIRROR` ([#6950](https://redirect.github.com/astral-sh/uv/pull/6950))
- Introduce more docker tags for uv ([#6053](https://redirect.github.com/astral-sh/uv/pull/6053))
##### Bug fixes
- Avoid canonicalizing the cache directory ([#6949](https://redirect.github.com/astral-sh/uv/pull/6949))
- Show all PyPy versions in `uv python list --all-versions` ([#6917](https://redirect.github.com/astral-sh/uv/pull/6917))
- Avoid incorrect `requires-python` marker simplifications ([#6268](https://redirect.github.com/astral-sh/uv/pull/6268))
##### Documentation
- Add documentation for `UV_PROJECT_ENVIRONMENT` ([#6987](https://redirect.github.com/astral-sh/uv/pull/6987))
- Add optional dependencies section to the lockfile document ([#6982](https://redirect.github.com/astral-sh/uv/pull/6982))
- Document use of the `file://` scheme in Python installation mirrors ([#6984](https://redirect.github.com/astral-sh/uv/pull/6984))
- Fix outdated references to the help menu documentation in the first steps page ([#6980](https://redirect.github.com/astral-sh/uv/pull/6980))
- Show env option in CLI reference documentation ([#6863](https://redirect.github.com/astral-sh/uv/pull/6863))
- Add bind mount example to `docker.md` ([#6921](https://redirect.github.com/astral-sh/uv/pull/6921))
### [`v0.4.3`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#043)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.2...0.4.3)
##### Enhancements
- Show build backend output when `--verbose` is provided ([#6903](https://redirect.github.com/astral-sh/uv/pull/6903))
- Allow `uv sync --frozen --package` without copying member `pyproject.toml` ([#6943](https://redirect.github.com/astral-sh/uv/pull/6943))
##### Bug fixes
- Avoid panic with missing temporary directory ([#6929](https://redirect.github.com/astral-sh/uv/pull/6929))
- Avoid updating incorrect dependencies for sorted `uv add` ([#6939](https://redirect.github.com/astral-sh/uv/pull/6939))
- Use lower-bound semantics for all Python compatibility comparisons ([#6882](https://redirect.github.com/astral-sh/uv/pull/6882))
### [`v0.4.2`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#042)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.1...0.4.2)
##### Enhancements
- Adding support for `.pyc` files in `uv run` ([#6886](https://redirect.github.com/astral-sh/uv/pull/6886))
- Treat missing `top_level.txt` as non-fatal ([#6881](https://redirect.github.com/astral-sh/uv/pull/6881))
##### Bug fixes
- Fix `is_disjoint` check for supported environments ([#6902](https://redirect.github.com/astral-sh/uv/pull/6902))
- Remove dangling archives in `uv cache clean ${package}` ([#6915](https://redirect.github.com/astral-sh/uv/pull/6915))
- Error when discovered Python is incompatible with `--isolated` workspace ([#6885](https://redirect.github.com/astral-sh/uv/pull/6885))
- Warn when discovered Python is incompatible with PEP 723 script ([#6884](https://redirect.github.com/astral-sh/uv/pull/6884))
### [`v0.4.1`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0418)
[Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.0...0.4.1)
##### Enhancements
- Allow multiple source entries for each package in `tool.uv.sources` ([#7745](https://redirect.github.com/astral-sh/uv/pull/7745))
- Add `.gitignore` file to `uv build` output directory ([#7835](https://redirect.github.com/astral-sh/uv/pull/7835))
- Disable jemalloc on FreeBSD ([#7780](https://redirect.github.com/astral-sh/uv/pull/7780))
- Respect `PAGER` env var when paging in `uv help` command ([#5511](https://redirect.github.com/astral-sh/uv/pull/5511))
- Support `uv run -m foo` to run a module ([#7754](https://redirect.github.com/astral-sh/uv/pull/7754))
- Use a top-level output directory for `uv build` in workspaces ([#7813](https://redirect.github.com/astral-sh/uv/pull/7813))
- Update `uv init --package` command to match project name ([#7670](https://redirect.github.com/astral-sh/uv/pull/7670))
- Add a custom suggestion for `uv add dotenv` ([#7799](https://redirect.github.com/astral-sh/uv/pull/7799))
- Add detailed errors for `tool.uv.sources` deserialization failures ([#7823](https://redirect.github.com/astral-sh/uv/pull/7823))
- Improve error message copy for failed builds ([#7849](https://redirect.github.com/astral-sh/uv/pull/7849))
- Use `serde-untagged` to improve some untagged enum error messages ([#7822](https://redirect.github.com/astral-sh/uv/pull/7822))
- Use build failure hints for `dotenv` errors, rather than in `uv add` ([#7825](https://redirect.github.com/astral-sh/uv/pull/7825))
##### Configuration
- Add `UV_NO_SYNC` environment variable ([#7752](https://redirect.github.com/astral-sh/uv/pull/7752))
##### Bug fixes
- Accept `git+` prefix in `tool.uv.sources` ([#7847](https://redirect.github.com/astral-sh/uv/pull/7847))
- Allow spaces in path requirements ([#7767](https://redirect.github.com/astral-sh/uv/pull/7767))
- Avoid reusing cached downloaded binaries with `--no-binary` ([#7772](https://redirect.github.com/astral-sh/uv/pull/7772))
- Correctly trims values during wheel WHEEL file parsing ([#7770](https://redirect.github.com/astral-sh/uv/pull/7770))
- Fix `uv tree --invert` for platform dependencies ([#7808](https://redirect.github.com/astral-sh/uv/pull/7808))
- Fix encoding mismatch between python child process and uv ([#7757](https://redirect.github.com/astral-sh/uv/pull/7757))
- Reject self-dependencies in `uv add` ([#7766](https://redirect.github.com/astral-sh/uv/pull/7766))
- Respect `tool.uv.environments` for legacy virtual workspace roots ([#7824](https://redirect.github.com/astral-sh/uv/pull/7824))
- Retain empty extras on workspace members ([#7762](https://redirect.github.com/astral-sh/uv/pull/7762))
- Use file stem when parsing cached wheel names ([#7773](https://redirect.github.com/astral-sh/uv/pull/7773))
##### Rust API
- Make `FlatDistributions` public ([#7833](https://redirect.github.com/astral-sh/uv/pull/7833))
##### Documentation
- Fix table of contents sizing ([#7751](https://redirect.github.com/astral-sh/uv/pull/7751))
- GitLab Integration documentation ([#6857](https://redirect.github.com/astral-sh/uv/pull/6857))
- Update documentation to setup-uv@v3 ([#7807](https://redirect.github.com/astral-sh/uv/pull/7807))
- Use `uv publish` instead of twine in docs ([#7837](https://redirect.github.com/astral-sh/uv/pull/7837))
- Fix typo in `projects.md` ([#7784](https://redirect.github.com/astral-sh/uv/pull/7784))
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
[ ] If you want to rebase/retry this PR, check this box
This PR contains the following updates:
v1.7.1.15
->v1.7.3.17
1.7.9
->1.7.10
0.4.0
->0.4.18
Release Notes
Mateusz-Grzelinski/actionlint-py (https://github.com/Mateusz-Grzelinski/actionlint-py)
### [`v1.7.3.17`](https://redirect.github.com/Mateusz-Grzelinski/actionlint-py/compare/v1.7.2.16...v1.7.3.17) [Compare Source](https://redirect.github.com/Mateusz-Grzelinski/actionlint-py/compare/v1.7.2.16...v1.7.3.17) ### [`v1.7.2.16`](https://redirect.github.com/Mateusz-Grzelinski/actionlint-py/compare/v1.7.1.15...v1.7.2.16) [Compare Source](https://redirect.github.com/Mateusz-Grzelinski/actionlint-py/compare/v1.7.1.15...v1.7.2.16)PyCQA/bandit (https://github.com/PyCQA/bandit)
### [`v1.7.10`](https://redirect.github.com/PyCQA/bandit/releases/tag/1.7.10) [Compare Source](https://redirect.github.com/PyCQA/bandit/compare/1.7.9...1.7.10) #### What's Changed - Bump docker/build-push-action from 5.4.0 to 6.0.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1147](https://redirect.github.com/PyCQA/bandit/pull/1147) - Suggested small refactors in assignments by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1150](https://redirect.github.com/PyCQA/bandit/pull/1150) - Performance improvement in blacklist function by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1148](https://redirect.github.com/PyCQA/bandit/pull/1148) - Add test for usage of FTP_TLS by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1149](https://redirect.github.com/PyCQA/bandit/pull/1149) - New check: B113: TrojanSource - Bidirectional control characters by [@Lucas-C](https://redirect.github.com/Lucas-C) in [https://github.com/PyCQA/bandit/pull/757](https://redirect.github.com/PyCQA/bandit/pull/757) - Bump docker/build-push-action from 6.0.0 to 6.1.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1152](https://redirect.github.com/PyCQA/bandit/pull/1152) - feat(plugins): add support for `httpx` in `B113` by [@mkniewallner](https://redirect.github.com/mkniewallner) in [https://github.com/PyCQA/bandit/pull/1060](https://redirect.github.com/PyCQA/bandit/pull/1060) - Nit: remove unused variable by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1153](https://redirect.github.com/PyCQA/bandit/pull/1153) - Add recent releases to version choice in bug report by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1151](https://redirect.github.com/PyCQA/bandit/pull/1151) - Bump docker/build-push-action from 6.1.0 to 6.2.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1155](https://redirect.github.com/PyCQA/bandit/pull/1155) - Bump docker/build-push-action from 6.2.0 to 6.3.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1157](https://redirect.github.com/PyCQA/bandit/pull/1157) - Bump docker/setup-buildx-action from 3.3.0 to 3.4.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1156](https://redirect.github.com/PyCQA/bandit/pull/1156) - Bump docker/setup-buildx-action from 3.4.0 to 3.5.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1158](https://redirect.github.com/PyCQA/bandit/pull/1158) - Bump docker/login-action from 3.2.0 to 3.3.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1159](https://redirect.github.com/PyCQA/bandit/pull/1159) - Bump docker/build-push-action from 6.3.0 to 6.5.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1160](https://redirect.github.com/PyCQA/bandit/pull/1160) - Bump docker/setup-buildx-action from 3.5.0 to 3.6.1 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1163](https://redirect.github.com/PyCQA/bandit/pull/1163) - Bump docker/build-push-action from 6.5.0 to 6.6.1 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1166](https://redirect.github.com/PyCQA/bandit/pull/1166) - Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1165](https://redirect.github.com/PyCQA/bandit/pull/1165) - Bump docker/build-push-action from 6.6.1 to 6.7.0 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/PyCQA/bandit/pull/1168](https://redirect.github.com/PyCQA/bandit/pull/1168) - Use consistent file naming of docs by [@ericwb](https://redirect.github.com/ericwb) in [https://github.com/PyCQA/bandit/pull/1170](https://redirect.github.com/PyCQA/bandit/pull/1170) - Pytorch Load / Save Plugin by [@lukehinds](https://redirect.github.com/lukehinds) in [https://github.com/PyCQA/bandit/pull/1114](https://redirect.github.com/PyCQA/bandit/pull/1114) #### New Contributors - [@Lucas-C](https://redirect.github.com/Lucas-C) made their first contribution in [https://github.com/PyCQA/bandit/pull/757](https://redirect.github.com/PyCQA/bandit/pull/757) **Full Changelog**: https://github.com/PyCQA/bandit/compare/1.7.9...1.7.10astral-sh/uv (uv)
### [`v0.4.18`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0418) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.17...0.4.18) ##### Enhancements - Allow multiple source entries for each package in `tool.uv.sources` ([#7745](https://redirect.github.com/astral-sh/uv/pull/7745)) - Add `.gitignore` file to `uv build` output directory ([#7835](https://redirect.github.com/astral-sh/uv/pull/7835)) - Disable jemalloc on FreeBSD ([#7780](https://redirect.github.com/astral-sh/uv/pull/7780)) - Respect `PAGER` env var when paging in `uv help` command ([#5511](https://redirect.github.com/astral-sh/uv/pull/5511)) - Support `uv run -m foo` to run a module ([#7754](https://redirect.github.com/astral-sh/uv/pull/7754)) - Use a top-level output directory for `uv build` in workspaces ([#7813](https://redirect.github.com/astral-sh/uv/pull/7813)) - Update `uv init --package` command to match project name ([#7670](https://redirect.github.com/astral-sh/uv/pull/7670)) - Add a custom suggestion for `uv add dotenv` ([#7799](https://redirect.github.com/astral-sh/uv/pull/7799)) - Add detailed errors for `tool.uv.sources` deserialization failures ([#7823](https://redirect.github.com/astral-sh/uv/pull/7823)) - Improve error message copy for failed builds ([#7849](https://redirect.github.com/astral-sh/uv/pull/7849)) - Use `serde-untagged` to improve some untagged enum error messages ([#7822](https://redirect.github.com/astral-sh/uv/pull/7822)) - Use build failure hints for `dotenv` errors, rather than in `uv add` ([#7825](https://redirect.github.com/astral-sh/uv/pull/7825)) ##### Configuration - Add `UV_NO_SYNC` environment variable ([#7752](https://redirect.github.com/astral-sh/uv/pull/7752)) ##### Bug fixes - Accept `git+` prefix in `tool.uv.sources` ([#7847](https://redirect.github.com/astral-sh/uv/pull/7847)) - Allow spaces in path requirements ([#7767](https://redirect.github.com/astral-sh/uv/pull/7767)) - Avoid reusing cached downloaded binaries with `--no-binary` ([#7772](https://redirect.github.com/astral-sh/uv/pull/7772)) - Correctly trims values during wheel WHEEL file parsing ([#7770](https://redirect.github.com/astral-sh/uv/pull/7770)) - Fix `uv tree --invert` for platform dependencies ([#7808](https://redirect.github.com/astral-sh/uv/pull/7808)) - Fix encoding mismatch between python child process and uv ([#7757](https://redirect.github.com/astral-sh/uv/pull/7757)) - Reject self-dependencies in `uv add` ([#7766](https://redirect.github.com/astral-sh/uv/pull/7766)) - Respect `tool.uv.environments` for legacy virtual workspace roots ([#7824](https://redirect.github.com/astral-sh/uv/pull/7824)) - Retain empty extras on workspace members ([#7762](https://redirect.github.com/astral-sh/uv/pull/7762)) - Use file stem when parsing cached wheel names ([#7773](https://redirect.github.com/astral-sh/uv/pull/7773)) ##### Rust API - Make `FlatDistributions` public ([#7833](https://redirect.github.com/astral-sh/uv/pull/7833)) ##### Documentation - Fix table of contents sizing ([#7751](https://redirect.github.com/astral-sh/uv/pull/7751)) - GitLab Integration documentation ([#6857](https://redirect.github.com/astral-sh/uv/pull/6857)) - Update documentation to setup-uv@v3 ([#7807](https://redirect.github.com/astral-sh/uv/pull/7807)) - Use `uv publish` instead of twine in docs ([#7837](https://redirect.github.com/astral-sh/uv/pull/7837)) - Fix typo in `projects.md` ([#7784](https://redirect.github.com/astral-sh/uv/pull/7784)) ### [`v0.4.17`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0417) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.16...0.4.17) ##### Enhancements - Add `uv build --all` to build all packages in a workspace ([#7724](https://redirect.github.com/astral-sh/uv/pull/7724)) - Add support for `uv init --script` ([#7565](https://redirect.github.com/astral-sh/uv/pull/7565)) - Add support for upgrading build environment for installed tools (`uv tool upgrade --python`) ([#7605](https://redirect.github.com/astral-sh/uv/pull/7605)) - Initialize a Git repository in `uv init` ([#5476](https://redirect.github.com/astral-sh/uv/pull/5476)) - Respect `--quiet` flag in `uv build` ([#7674](https://redirect.github.com/astral-sh/uv/pull/7674)) - Add context message before listing available tools in `uvx` ([#7641](https://redirect.github.com/astral-sh/uv/pull/7641)) ##### Bug fixes - Don't create Python bytecode files during interpreter discovery ([#7707](https://redirect.github.com/astral-sh/uv/pull/7707)) - Escape glob patterns in workspace member discovery ([#7709](https://redirect.github.com/astral-sh/uv/pull/7709)) - Avoid prefetching source distributions with unbounded lower-bound ranges ([#7683](https://redirect.github.com/astral-sh/uv/pull/7683)) ##### Documentation - Add `uv build` and `uv publish` to features overview ([#7716](https://redirect.github.com/astral-sh/uv/pull/7716)) - Add documentation on cache versioning ([#7693](https://redirect.github.com/astral-sh/uv/pull/7693)) - Spell out the names of the Docker images for easier copy-paste ([#7706](https://redirect.github.com/astral-sh/uv/pull/7706)) - Document uv-with-Jupyter workflows ([#7625](https://redirect.github.com/astral-sh/uv/pull/7625)) - Note that `uv lock --upgrade-package` retains locked versions ([#7694](https://redirect.github.com/astral-sh/uv/pull/7694)) ### [`v0.4.16`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0416) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.15...0.4.16) ##### Enhancements - Add `uv publish` ([#7475](https://redirect.github.com/astral-sh/uv/pull/7475)) - Add a `--project` argument to run a command from a project directory ([#7603](https://redirect.github.com/astral-sh/uv/pull/7603)) - Display Python implementation when creating environments ([#7652](https://redirect.github.com/astral-sh/uv/pull/7652)) - Implement trusted publishing for `uv publish` ([#7548](https://redirect.github.com/astral-sh/uv/pull/7548)) - Respect lockfile preferences for `--with` requirements ([#7627](https://redirect.github.com/astral-sh/uv/pull/7627)) - Unhide the `--directory` option ([#7653](https://redirect.github.com/astral-sh/uv/pull/7653)) - Allow requesting free-threaded Python interpreters ([#7431](https://redirect.github.com/astral-sh/uv/pull/7431)) - Show a dedicated PubGrub hint for `--unsafe-best-match` ([#7645](https://redirect.github.com/astral-sh/uv/pull/7645)) - Add resolver error checking for conflicting distributions ([#7595](https://redirect.github.com/astral-sh/uv/pull/7595)) ##### Bug fixes - Avoid adding double-newlines for CRLF ([#7640](https://redirect.github.com/astral-sh/uv/pull/7640)) - Avoid retaining forks when `requires-python` range changes ([#7624](https://redirect.github.com/astral-sh/uv/pull/7624)) - Determine if pre-release Python downloads should be allowed using the version specifiers ([#7638](https://redirect.github.com/astral-sh/uv/pull/7638)) - Fix `link-mode=clone` for directories on Linux ([#7620](https://redirect.github.com/astral-sh/uv/pull/7620)) - Improve Python executable name discovery when using alternative implementations ([#7649](https://redirect.github.com/astral-sh/uv/pull/7649)) - Require opt-in to use alternative Python implementations ([#7650](https://redirect.github.com/astral-sh/uv/pull/7650)) - Use the first pre-release discovered when only pre-release Python versions are available ([#7666](https://redirect.github.com/astral-sh/uv/pull/7666)) ##### Documentation - Document environment variable that disables printing of virtual environment name in prompt ([#7648](https://redirect.github.com/astral-sh/uv/pull/7648)) - Remove double whitespaces from the code ([#7623](https://redirect.github.com/astral-sh/uv/pull/7623)) - Use anchorlinks rather than permalinks ([#7626](https://redirect.github.com/astral-sh/uv/pull/7626)) ##### Preview features - Add build backend scaffolding ([#7662](https://redirect.github.com/astral-sh/uv/pull/7662)) ### [`v0.4.15`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0415) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.14...0.4.15) ##### Bug fixes - Revert "Treat invalid platform as more compatible than invalid Python ([#7556](https://redirect.github.com/astral-sh/uv/issues/7556))" ([#7608](https://redirect.github.com/astral-sh/uv/pull/7608)) ##### Documentation - Add the execution policy to powershell installs for single versions ([#7602](https://redirect.github.com/astral-sh/uv/pull/7602)) ### [`v0.4.14`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0414) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.13...0.4.14) ##### Breaking - Move uvx shell completion to `uvx --generate-shell-completion` ([#7511](https://redirect.github.com/astral-sh/uv/pull/7511)) ##### Enhancements - Adjust messaging for frozen hint on resolution failure during `uv add` ([#7597](https://redirect.github.com/astral-sh/uv/pull/7597)) - Provide resolution hints in case of possible local name conflicts ([#7505](https://redirect.github.com/astral-sh/uv/pull/7505)) - Improve Docker image release tagging order and display on `ghcr.io` ([#7568](https://redirect.github.com/astral-sh/uv/pull/7568)) - Improve deserialization error messages ([#7598](https://redirect.github.com/astral-sh/uv/pull/7598)) ##### Bug fixes - Allow system environments during project environment validity check ([#7585](https://redirect.github.com/astral-sh/uv/pull/7585)) - Avoid validating workspace members when `--no-sources` is provided ([#7599](https://redirect.github.com/astral-sh/uv/pull/7599)) - Fix handling of `sys.base_prefix` collision in interpreter identity check during tool installs ([#7596](https://redirect.github.com/astral-sh/uv/pull/7596)) - Make `uv cache prune` robust to unreadable rkyv entries ([#7561](https://redirect.github.com/astral-sh/uv/pull/7561)) - Revert "Remove duplicate warning for settings discovery errors ([#7384](https://redirect.github.com/astral-sh/uv/issues/7384))" ([#7594](https://redirect.github.com/astral-sh/uv/pull/7594)) ##### Documentation - Fix `-` to `_` in packaged applications document ([#7571](https://redirect.github.com/astral-sh/uv/pull/7571)) ### [`v0.4.13`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0413) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.12...0.4.13) ##### Enhancements - Add `socks` support ([#7503](https://redirect.github.com/astral-sh/uv/pull/7503)) - Avoid warning about bad Python interpreter links for empty project environment directories ([#7527](https://redirect.github.com/astral-sh/uv/pull/7527)) - Improve invalid environment warning messages ([#7544](https://redirect.github.com/astral-sh/uv/pull/7544)) - Use more verbose spelling of "virtualenv" during creation ([#7523](https://redirect.github.com/astral-sh/uv/pull/7523)) - Do not use a user-facing warning for "Waiting to acquire lock..." message ([#7502](https://redirect.github.com/astral-sh/uv/pull/7502)) ##### Performance - Use a single buffer for hints on resolver errors ([#7497](https://redirect.github.com/astral-sh/uv/pull/7497)) ##### Bug fixes - Allow Python pre-releases to be used if they are first on the `PATH` ([#7470](https://redirect.github.com/astral-sh/uv/pull/7470)) - Avoid deleting the project environment directory if it is not a virtual environment ([#7522](https://redirect.github.com/astral-sh/uv/pull/7522)) - Do not error if the `CACHEDIR.TAG` file exists but cannot be written to ([#7550](https://redirect.github.com/astral-sh/uv/pull/7550)) - Treat invalid platform as more compatible than invalid Python ([#7556](https://redirect.github.com/astral-sh/uv/pull/7556)) - Use portable paths when serializing sources ([#7504](https://redirect.github.com/astral-sh/uv/pull/7504)) - Compute resolver hints using the final reduced derivation tree ([#7546](https://redirect.github.com/astral-sh/uv/pull/7546)) - Bump the wheel and sdist cache versions ([#7560](https://redirect.github.com/astral-sh/uv/pull/7560)) - Heal cache entries with missing source distributions ([#7559](https://redirect.github.com/astral-sh/uv/pull/7559)) ##### Rust libraries - Bump minimum supported Rust version from 1.80 -> 1.81 ##### Documentation - Add `UV_LINK_MODE` to Docker caching example ([#7510](https://redirect.github.com/astral-sh/uv/pull/7510)) - Clarify behavior of of overrides in CLI reference ([#7537](https://redirect.github.com/astral-sh/uv/pull/7537)) ### [`v0.4.12`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0412) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.11...0.4.12) ##### Enhancements - Allow users to provide pre-defined metadata for resolution ([#7442](https://redirect.github.com/astral-sh/uv/pull/7442)) - Invalidate existing tool environments on Python interpreter mismatch ([#7451](https://redirect.github.com/astral-sh/uv/pull/7451)) ##### Bug fixes - Avoid fatal error when searching for egg-info with missing directory ([#7498](https://redirect.github.com/astral-sh/uv/pull/7498)) ##### Documentation - Add note on cache growth for self-hosted GitHub runners ([#5757](https://redirect.github.com/astral-sh/uv/pull/5757)) ### [`v0.4.11`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0411) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.10...0.4.11) ##### Enhancements - Add `--no-editable` support to `uv sync` and `uv export` ([#7371](https://redirect.github.com/astral-sh/uv/pull/7371)) - Add support for `--only-dev` to `uv sync` and `uv export` ([#7367](https://redirect.github.com/astral-sh/uv/pull/7367)) - Add support for remaining pip-supported file extensions ([#7387](https://redirect.github.com/astral-sh/uv/pull/7387)) - Generate shell completion for `uvx` ([#7388](https://redirect.github.com/astral-sh/uv/pull/7388)) - Include `uv export` command in `requirements.txt` output ([#7374](https://redirect.github.com/astral-sh/uv/pull/7374)) - Prune unzipped source distributions in `uv cache prune --ci` ([#7446](https://redirect.github.com/astral-sh/uv/pull/7446)) - Warn when trying to `uv sync` a package without build configuration ([#7420](https://redirect.github.com/astral-sh/uv/pull/7420)) - Support requests for pre-releases in the `--python` option ([#7335](https://redirect.github.com/astral-sh/uv/pull/7335)) ##### Bug fixes - Avoid erroneous version warning for `.dist-info` directories ([#7444](https://redirect.github.com/astral-sh/uv/pull/7444)) - Avoid removing seed packages for `uv venv --seed` environments ([#7410](https://redirect.github.com/astral-sh/uv/pull/7410)) - Avoid unnecessary progress bar initializations ([#7412](https://redirect.github.com/astral-sh/uv/pull/7412)) - Error when `tool.uv.sources` contains duplicate package names ([#7383](https://redirect.github.com/astral-sh/uv/pull/7383)) - Include `--branch` et al when resolving unnamed URLs in `uv add` ([#7447](https://redirect.github.com/astral-sh/uv/pull/7447)) - Include `dev-dependencies` in `--no-sources` invocations ([#7408](https://redirect.github.com/astral-sh/uv/pull/7408)) - Include the parent interpreter in Python discovery when `--system` is used ([#7440](https://redirect.github.com/astral-sh/uv/pull/7440)) - Respect `--no-sources` in PEP 723 scripts ([#7409](https://redirect.github.com/astral-sh/uv/pull/7409)) - Respect `pyproject.toml` credentials from user-provided requirements ([#7474](https://redirect.github.com/astral-sh/uv/pull/7474)) - Use consistent PyPI cache bucket ([#7443](https://redirect.github.com/astral-sh/uv/pull/7443)) - Use unambiguous relative paths in `uv export` ([#7378](https://redirect.github.com/astral-sh/uv/pull/7378)) ##### Documentation - Add documentation on platform-specific dependencies ([#7411](https://redirect.github.com/astral-sh/uv/pull/7411)) - Add documentation for passing installer options on Linux ([#6839](https://redirect.github.com/astral-sh/uv/pull/6839)) - Separate project data from configuration settings ([#7053](https://redirect.github.com/astral-sh/uv/pull/7053)) ##### Error messages - Hint at missing `project.name` ([#6803](https://redirect.github.com/astral-sh/uv/pull/6803)) - Surface dedicated `project.name` error for workspaces ([#7399](https://redirect.github.com/astral-sh/uv/pull/7399)) - Remove duplicate warning for settings discovery errors ([#7384](https://redirect.github.com/astral-sh/uv/pull/7384)) ### [`v0.4.10`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0410) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.9...0.4.10) ##### Enhancements - Allow `uv tool upgrade --all` to continue on individual upgrade failure ([#7333](https://redirect.github.com/astral-sh/uv/pull/7333)) - Support globs as cache keys in `tool.uv.cache-keys` ([#7268](https://redirect.github.com/astral-sh/uv/pull/7268)) - Add Python package (`__main__.py`) support to `uv run` ([#7281](https://redirect.github.com/astral-sh/uv/pull/7281)) - Add zip application support to `uv run` ([#7289](https://redirect.github.com/astral-sh/uv/pull/7289)) - Add `--token` option to `self update` command ([#7279](https://redirect.github.com/astral-sh/uv/pull/7279)) ##### Performance - Use `globwalk` for `cache-keys` matching ([#7337](https://redirect.github.com/astral-sh/uv/pull/7337)) ##### Bug fixes - Always treat archive-like requirements as local files ([#7364](https://redirect.github.com/astral-sh/uv/pull/7364)) - Apply `--no-install` options when constructing resolution ([#7277](https://redirect.github.com/astral-sh/uv/pull/7277)) - Avoid clobbering existing `py.typed` files contents in `uv init` ([#7338](https://redirect.github.com/astral-sh/uv/pull/7338)) - Avoid enforcing platform compatibility when validating lockfile ([#7305](https://redirect.github.com/astral-sh/uv/pull/7305)) - Avoid installing transitive dev dependencies ([#7318](https://redirect.github.com/astral-sh/uv/pull/7318)) - Avoid selecting prerelease Python installations without opt-in ([#7300](https://redirect.github.com/astral-sh/uv/pull/7300)) - Fix PPC64 page size in binary builds. ([#7298](https://redirect.github.com/astral-sh/uv/pull/7298)) - Include pre-release Python versions in `uv python list` ([#7290](https://redirect.github.com/astral-sh/uv/pull/7290)) - Make version ID optional for source builds ([#7362](https://redirect.github.com/astral-sh/uv/pull/7362)) - Support relative paths in `uv add --script` ([#7301](https://redirect.github.com/astral-sh/uv/pull/7301)) ##### Documentation - Fix documentation typos for `uv build --build-constraint` flag ([#7330](https://redirect.github.com/astral-sh/uv/pull/7330)) - Fix grammatical error in CLI docs ([#7353](https://redirect.github.com/astral-sh/uv/pull/7353)) ##### Error messages - Add dedicated lock errors for wheel-only distributions ([#7307](https://redirect.github.com/astral-sh/uv/pull/7307)) - Avoid treating `.whl` sources as source distributions ([#7303](https://redirect.github.com/astral-sh/uv/pull/7303)) - Clarify Python requirement source for script incompatibilities ([#7339](https://redirect.github.com/astral-sh/uv/pull/7339)) ### [`v0.4.9`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#049) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.8...0.4.9) ##### Enhancements - Add support for managed Python 3.13 ([#7263](https://redirect.github.com/astral-sh/uv/pull/7263)) - Upgrade managed CPython versions to latest patch releases ([#7263](https://redirect.github.com/astral-sh/uv/pull/7263)) - Allow setting a target version for `uv self update` ([#7252](https://redirect.github.com/astral-sh/uv/pull/7252)) - Create `py.typed` files during `uv init --lib` ([#7232](https://redirect.github.com/astral-sh/uv/pull/7232)) - Add a dedicated error for packages that fail due to `distutils` deprecation ([#7239](https://redirect.github.com/astral-sh/uv/pull/7239)) - Improve error message when requested Python version is unsupported ([#7269](https://redirect.github.com/astral-sh/uv/pull/7269)) - Add `uv run --no-sync` (https://redirect.github.com/astral-sh/uv/pull/7192)-sh/uv/pull/7192\)) ##### Bug fixes - Avoid updating `pyproject.toml` offsets on non-add edits ([#7262](https://redirect.github.com/astral-sh/uv/pull/7262)) - Invalidate cache when `--config-settings` change ([#7139](https://redirect.github.com/astral-sh/uv/pull/7139)) - Remove workspace root for single-member workspace with `uv export` ([#7254](https://redirect.github.com/astral-sh/uv/pull/7254)) ### [`v0.4.8`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#048) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.7...0.4.8) ##### Enhancements - Add support for dynamic cache keys ([#7136](https://redirect.github.com/astral-sh/uv/pull/7136)) - Allow `.dist-info` names with dashes for post releases ([#7208](https://redirect.github.com/astral-sh/uv/pull/7208)) - Use type hints in code from `uv init` ([#7225](https://redirect.github.com/astral-sh/uv/pull/7225)) - Treat `.tgz` the same as `.tar.gz` ([#7201](https://redirect.github.com/astral-sh/uv/pull/7201)) - Direct users towards `uv venv` to create a virtual environment ([#7188](https://redirect.github.com/astral-sh/uv/pull/7188)) - Improve error message for uv init already init-ed ([#7198](https://redirect.github.com/astral-sh/uv/pull/7198)) ##### Performance - Avoid batch prefetching for un-optimized registries ([#7226](https://redirect.github.com/astral-sh/uv/pull/7226)) - Avoid iteration for singleton selections ([#7195](https://redirect.github.com/astral-sh/uv/pull/7195)) ##### Bug fixes - Avoid extra newlines in debug logging for source builds ([#7174](https://redirect.github.com/astral-sh/uv/pull/7174)) - Prune unreachable packages from `--universal` output ([#7209](https://redirect.github.com/astral-sh/uv/pull/7209)) - Respect exclusion when collecting workspace members ([#7175](https://redirect.github.com/astral-sh/uv/pull/7175)) - Use path file instead of `sitecustomize.py` ([#7161](https://redirect.github.com/astral-sh/uv/pull/7161)) - Replace incorrect `--source` and `--binary` flags with correct `--sdist` and `--wheel` flags in `uv build` ([#7156](https://redirect.github.com/astral-sh/uv/pull/7156)) ##### Documentation - Document support for `UV_INSTALL_DIR` ([#7107](https://redirect.github.com/astral-sh/uv/pull/7107)) - List all supported sdist formats ([#7168](https://redirect.github.com/astral-sh/uv/pull/7168)) ### [`v0.4.7`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#047) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.6...0.4.7) ##### Enhancements - Add `--no-emit-project` and friends to `uv export` ([#7110](https://redirect.github.com/astral-sh/uv/pull/7110)) - Add `--output-file` to `uv export` ([#7109](https://redirect.github.com/astral-sh/uv/pull/7109)) - Prune unused source distributions from the cache in `uv cache prune` ([#7112](https://redirect.github.com/astral-sh/uv/pull/7112)) - Take intersection of constraint and requirements hashes ([#7108](https://redirect.github.com/astral-sh/uv/pull/7108)) ##### Performance - Skip metadata fetch for `--no-deps` and `pip sync` ([#7127](https://redirect.github.com/astral-sh/uv/pull/7127)) ##### Bug fixes - Avoid panicking when encountering an invalid Python version during `uv python list` ([#7131](https://redirect.github.com/astral-sh/uv/pull/7131)) - Write trailing newline to `.python-version` files ([#7140](https://redirect.github.com/astral-sh/uv/pull/7140)) ### [`v0.4.6`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#046) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.5...0.4.6) ##### Enhancements - Accept `--build-constraint` in `uv build` ([#7085](https://redirect.github.com/astral-sh/uv/pull/7085)) - Add `--require-hashes` and `--verify-hashes` to `uv build` ([#7094](https://redirect.github.com/astral-sh/uv/pull/7094)) - Add `--show-version-specifiers` to `uv tool list` ([#7050](https://redirect.github.com/astral-sh/uv/pull/7050)) - Respect hashes in constraints files ([#7093](https://redirect.github.com/astral-sh/uv/pull/7093)) - Upgrade installer scripts ([#7092](https://redirect.github.com/astral-sh/uv/pull/7092)) - Allow specifying multiple packages in `uv tool upgrade` and `uninstall` ([#7037](https://redirect.github.com/astral-sh/uv/pull/7037)) - Sort by implementation in `uv python list` ([#6918](https://redirect.github.com/astral-sh/uv/pull/6918)) ##### Bug fixes - Invalidate lockfile when member versions change ([#7102](https://redirect.github.com/astral-sh/uv/pull/7102)) - Strip fragments from direct source URLs in lockfile ([#7061](https://redirect.github.com/astral-sh/uv/pull/7061)) - Support `--no-build` and `--no-binary` in `uv sync` et al ([#7100](https://redirect.github.com/astral-sh/uv/pull/7100)) - Use distribution hash over registry hash ([#7060](https://redirect.github.com/astral-sh/uv/pull/7060)) - Fix inverted log message ([#7063](https://redirect.github.com/astral-sh/uv/pull/7063)) - Adjust Docker `ENTRYPOINT` and `CMD` for inherited images ([#7054](https://redirect.github.com/astral-sh/uv/pull/7054)) ##### Documentation - Add winget to installers ([#7088](https://redirect.github.com/astral-sh/uv/pull/7088)) - Document how to disable path modifications during install ([#7090](https://redirect.github.com/astral-sh/uv/pull/7090)) - Document how to manually update locked package version ([#7083](https://redirect.github.com/astral-sh/uv/pull/7083)) - Document official `setup-uv` action ([#7056](https://redirect.github.com/astral-sh/uv/pull/7056)) - Update docs on `.python-version` file ([#7051](https://redirect.github.com/astral-sh/uv/pull/7051)) ### [`v0.4.5`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#045) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.4...0.4.5) ##### Enhancements - Implement `uv build` ([#6895](https://redirect.github.com/astral-sh/uv/pull/6895)) - Add `--package` support to `uv build` ([#6990](https://redirect.github.com/astral-sh/uv/pull/6990)) - Prune unreachable packages from lockfile ([#6959](https://redirect.github.com/astral-sh/uv/pull/6959)) - Prune unreachable wheels from lockfile ([#6961](https://redirect.github.com/astral-sh/uv/pull/6961)) - Show build output by default in `uv build` ([#6912](https://redirect.github.com/astral-sh/uv/pull/6912)) - Support `uv build --wheel` from source distributions ([#6898](https://redirect.github.com/astral-sh/uv/pull/6898)) - Use the root project name for the project virtual environment prompt ([#7021](https://redirect.github.com/astral-sh/uv/pull/7021)) ##### Bug fixes - Fix handling of inline optional dependencies in `uv add` ([#7023](https://redirect.github.com/astral-sh/uv/pull/7023)) - Reflect exit code in `uv tool run` and `uv run` ([#6994](https://redirect.github.com/astral-sh/uv/pull/6994)) - Revert `pyproject.toml` modifications on Ctrl-C ([#7024](https://redirect.github.com/astral-sh/uv/pull/7024)) - Rollback `pyproject.toml` changes on all errors ([#7022](https://redirect.github.com/astral-sh/uv/pull/7022)) - Use correct ordering semantics for narrowing upper-bounded Python requirements ([#7031](https://redirect.github.com/astral-sh/uv/pull/7031)) - Fix segfault in Windows trampolines ([#6955](https://redirect.github.com/astral-sh/uv/pull/6955)) - Remove unused `__future__.annotations` import in `_virtualenv.py` ([#6996](https://redirect.github.com/astral-sh/uv/pull/6996)) ##### Documentation - Add documentation for `uv build` ([#6991](https://redirect.github.com/astral-sh/uv/pull/6991)) - Add note to `extra` and `all-extras` in `uv sync` help ([#7013](https://redirect.github.com/astral-sh/uv/pull/7013)) - Add project docs for `project.scripts` ([#7010](https://redirect.github.com/astral-sh/uv/pull/7010)) - Fix available Docker image tag rendering and shorten list ([#7017](https://redirect.github.com/astral-sh/uv/pull/7017)) - Touchup to the project environment config section ([#7038](https://redirect.github.com/astral-sh/uv/pull/7038)) - Clarify precedence of `uv.toml` ([#6986](https://redirect.github.com/astral-sh/uv/pull/6986)) - Fix available Docker tags for `-slim` variants ([#7041](https://redirect.github.com/astral-sh/uv/pull/7041)) ### [`v0.4.4`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#044) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.3...0.4.4) ##### Enhancements - Allow customizing the project environment path with `UV_PROJECT_ENVIRONMENT` ([#6834](https://redirect.github.com/astral-sh/uv/pull/6834)) - Warn when `VIRTUAL_ENV` is set but will not be respected in project commands ([#6864](https://redirect.github.com/astral-sh/uv/pull/6864)) - Add `--no-hashes` to `uv export` ([#6954](https://redirect.github.com/astral-sh/uv/pull/6954)) - Make HTTP headers title case for backward compatibility ([#6887](https://redirect.github.com/astral-sh/uv/pull/6887)) - Pin `.python-version` in `uv init` ([#6869](https://redirect.github.com/astral-sh/uv/pull/6869)) - Support `file://` URLs for `UV_PYTHON_INSTALL_MIRROR` ([#6950](https://redirect.github.com/astral-sh/uv/pull/6950)) - Introduce more docker tags for uv ([#6053](https://redirect.github.com/astral-sh/uv/pull/6053)) ##### Bug fixes - Avoid canonicalizing the cache directory ([#6949](https://redirect.github.com/astral-sh/uv/pull/6949)) - Show all PyPy versions in `uv python list --all-versions` ([#6917](https://redirect.github.com/astral-sh/uv/pull/6917)) - Avoid incorrect `requires-python` marker simplifications ([#6268](https://redirect.github.com/astral-sh/uv/pull/6268)) ##### Documentation - Add documentation for `UV_PROJECT_ENVIRONMENT` ([#6987](https://redirect.github.com/astral-sh/uv/pull/6987)) - Add optional dependencies section to the lockfile document ([#6982](https://redirect.github.com/astral-sh/uv/pull/6982)) - Document use of the `file://` scheme in Python installation mirrors ([#6984](https://redirect.github.com/astral-sh/uv/pull/6984)) - Fix outdated references to the help menu documentation in the first steps page ([#6980](https://redirect.github.com/astral-sh/uv/pull/6980)) - Show env option in CLI reference documentation ([#6863](https://redirect.github.com/astral-sh/uv/pull/6863)) - Add bind mount example to `docker.md` ([#6921](https://redirect.github.com/astral-sh/uv/pull/6921)) ### [`v0.4.3`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#043) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.2...0.4.3) ##### Enhancements - Show build backend output when `--verbose` is provided ([#6903](https://redirect.github.com/astral-sh/uv/pull/6903)) - Allow `uv sync --frozen --package` without copying member `pyproject.toml` ([#6943](https://redirect.github.com/astral-sh/uv/pull/6943)) ##### Bug fixes - Avoid panic with missing temporary directory ([#6929](https://redirect.github.com/astral-sh/uv/pull/6929)) - Avoid updating incorrect dependencies for sorted `uv add` ([#6939](https://redirect.github.com/astral-sh/uv/pull/6939)) - Use lower-bound semantics for all Python compatibility comparisons ([#6882](https://redirect.github.com/astral-sh/uv/pull/6882)) ### [`v0.4.2`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#042) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.1...0.4.2) ##### Enhancements - Adding support for `.pyc` files in `uv run` ([#6886](https://redirect.github.com/astral-sh/uv/pull/6886)) - Treat missing `top_level.txt` as non-fatal ([#6881](https://redirect.github.com/astral-sh/uv/pull/6881)) ##### Bug fixes - Fix `is_disjoint` check for supported environments ([#6902](https://redirect.github.com/astral-sh/uv/pull/6902)) - Remove dangling archives in `uv cache clean ${package}` ([#6915](https://redirect.github.com/astral-sh/uv/pull/6915)) - Error when discovered Python is incompatible with `--isolated` workspace ([#6885](https://redirect.github.com/astral-sh/uv/pull/6885)) - Warn when discovered Python is incompatible with PEP 723 script ([#6884](https://redirect.github.com/astral-sh/uv/pull/6884)) ### [`v0.4.1`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0418) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.4.0...0.4.1) ##### Enhancements - Allow multiple source entries for each package in `tool.uv.sources` ([#7745](https://redirect.github.com/astral-sh/uv/pull/7745)) - Add `.gitignore` file to `uv build` output directory ([#7835](https://redirect.github.com/astral-sh/uv/pull/7835)) - Disable jemalloc on FreeBSD ([#7780](https://redirect.github.com/astral-sh/uv/pull/7780)) - Respect `PAGER` env var when paging in `uv help` command ([#5511](https://redirect.github.com/astral-sh/uv/pull/5511)) - Support `uv run -m foo` to run a module ([#7754](https://redirect.github.com/astral-sh/uv/pull/7754)) - Use a top-level output directory for `uv build` in workspaces ([#7813](https://redirect.github.com/astral-sh/uv/pull/7813)) - Update `uv init --package` command to match project name ([#7670](https://redirect.github.com/astral-sh/uv/pull/7670)) - Add a custom suggestion for `uv add dotenv` ([#7799](https://redirect.github.com/astral-sh/uv/pull/7799)) - Add detailed errors for `tool.uv.sources` deserialization failures ([#7823](https://redirect.github.com/astral-sh/uv/pull/7823)) - Improve error message copy for failed builds ([#7849](https://redirect.github.com/astral-sh/uv/pull/7849)) - Use `serde-untagged` to improve some untagged enum error messages ([#7822](https://redirect.github.com/astral-sh/uv/pull/7822)) - Use build failure hints for `dotenv` errors, rather than in `uv add` ([#7825](https://redirect.github.com/astral-sh/uv/pull/7825)) ##### Configuration - Add `UV_NO_SYNC` environment variable ([#7752](https://redirect.github.com/astral-sh/uv/pull/7752)) ##### Bug fixes - Accept `git+` prefix in `tool.uv.sources` ([#7847](https://redirect.github.com/astral-sh/uv/pull/7847)) - Allow spaces in path requirements ([#7767](https://redirect.github.com/astral-sh/uv/pull/7767)) - Avoid reusing cached downloaded binaries with `--no-binary` ([#7772](https://redirect.github.com/astral-sh/uv/pull/7772)) - Correctly trims values during wheel WHEEL file parsing ([#7770](https://redirect.github.com/astral-sh/uv/pull/7770)) - Fix `uv tree --invert` for platform dependencies ([#7808](https://redirect.github.com/astral-sh/uv/pull/7808)) - Fix encoding mismatch between python child process and uv ([#7757](https://redirect.github.com/astral-sh/uv/pull/7757)) - Reject self-dependencies in `uv add` ([#7766](https://redirect.github.com/astral-sh/uv/pull/7766)) - Respect `tool.uv.environments` for legacy virtual workspace roots ([#7824](https://redirect.github.com/astral-sh/uv/pull/7824)) - Retain empty extras on workspace members ([#7762](https://redirect.github.com/astral-sh/uv/pull/7762)) - Use file stem when parsing cached wheel names ([#7773](https://redirect.github.com/astral-sh/uv/pull/7773)) ##### Rust API - Make `FlatDistributions` public ([#7833](https://redirect.github.com/astral-sh/uv/pull/7833)) ##### Documentation - Fix table of contents sizing ([#7751](https://redirect.github.com/astral-sh/uv/pull/7751)) - GitLab Integration documentation ([#6857](https://redirect.github.com/astral-sh/uv/pull/6857)) - Update documentation to setup-uv@v3 ([#7807](https://redirect.github.com/astral-sh/uv/pull/7807)) - Use `uv publish` instead of twine in docs ([#7837](https://redirect.github.com/astral-sh/uv/pull/7837)) - Fix typo in `projects.md` ([#7784](https://redirect.github.com/astral-sh/uv/pull/7784))Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.