Bump the python-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the python-dependencies group with 2 updates in the / directory: uv and pip.

Updates uv from 0.11.33 to 0.12.5

Release notes

Sourced from uv's releases.

0.12.5

Release Notes

Released on 2026-08-14.

Python

• Add CPython 3.10.21, 3.11.16, and 3.12.14 (#21138)
• Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (#21134)

Enhancements

• Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (#21130)

Preview features

• Allow --index and --default-index to select configured package indexes by name with the index-by-name preview feature (#17455)
• Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (#21131)
• Fall back to logical file sizes when using cache-physical-space on filesystems that do not support physical-space accounting (#21133)

Bug fixes

• Resolve relative package index paths in PEP 723 scripts against the script directory (#21097)

Install uv 0.12.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.ps1 | iex"

Download uv 0.12.5

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.5

Released on 2026-08-14.

Python

• Add CPython 3.10.21, 3.11.16, and 3.12.14 (#21138)
• Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (#21134)

Enhancements

• Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (#21130)

Preview features

• Allow --index and --default-index to select configured package indexes by name with the index-by-name preview feature (#17455)
• Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (#21131)
• Fall back to logical file sizes when using cache-physical-space on filesystems that do not support physical-space accounting (#21133)

Bug fixes

• Resolve relative package index paths in PEP 723 scripts against the script directory (#21097)

0.12.4

Released on 2026-08-13.

Enhancements

• Prefer post-quantum key exchange and enable opt-in TLS diagnostics (#21054)
• Accept whitespace before versions in noncompliant wildcard comparisons such as Requires-Python: >= 3.5.* (#21012)
• Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content (#20944)
• Omit source-span carets from diagnostics for empty PEP 508 requirements (#21094)

Preview features

• Add uv check --no-install-project and respect UV_NO_INSTALL_PROJECT to install dependencies without building or installing the project (#21085)
• Make the ty subprocess invoked by uv check honor uv's color and progress settings, including quiet mode (#21086)

Performance

• Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges (#20804)
• Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly (#21041)

Bug fixes

• Use windowed pythonw.exe launchers for virtual environments created from managed Python minor-version links (#19235)
• Allow uv lock to proceed when .venv is an unusable project environment (#21068)
• Respect fork-strategy when ordering forks created from environments or existing lockfile resolution-markers (#21000)
• Preserve consecutive wildcard Python minor-version exclusions such as !=3.11.*, !=3.12.* in uv.lock (#21045)

... (truncated)

Commits

• 210d1f6 Bump version to 0.12.5 (#21140)
• 802a916 Sync latest Python releases: 3.10.21, 3.11.16, 3.12.14 (#21138)
• a6904bb Order equal-priority Python installations by key (#21134)
• 728a70d Improve automated fixes for related bug manifestations (#21102)
• b82b038 Include hashes in cyclonedx exports (#21131)
• 8011778 Simplify editable requirement errors and hints (#21130)
• dca33f5 Fall back to logical cache accounting on unsupported filesystems (#21133)
• 3a76e49 Get rid of Lock::with_manifest, make Lock::from_resolution take the manif...
• 7e6caa4 Support referencing indexes by name via --index and --default-index (#17455)
• 298dda4 Fix relative indexes in PEP 723 scripts (#21097)
• Additional commits viewable in compare view

Updates pip from 26.1.2 to 26.2.1

Changelog

Sourced from pip's changelog.

26.2.1 (2026-08-04)

Bug Fixes

• Reallow keyring installed in a (non-activated) virtual environment to be be used via the import provider method while installing build dependencies. ([#14227](https://github.com/pypa/pip/issues/14227) <https://github.com/pypa/pip/issues/14227>_)

26.2 (2026-07-29)

Deprecations and Removals

• Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use --refresh-package. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

• Drop support for detecting legacy, non-:pep:405, virtualenv (< 20) environments. ([#14062](https://github.com/pypa/pip/issues/14062) <https://github.com/pypa/pip/issues/14062>_)

• Constraints files, including PIP_CONSTRAINT, no longer affect isolated build environments. Use --build-constraint or the PIP_BUILD_CONSTRAINT environment variable to constrain build dependencies instead.

  The --use-feature=build-constraint flag is now always enabled and has no effect. ([#14094](https://github.com/pypa/pip/issues/14094) <https://github.com/pypa/pip/issues/14094>_)

Features

• Declare support for Python 3.15 ([#14208](https://github.com/pypa/pip/issues/14208) <https://github.com/pypa/pip/issues/14208>_)

• Support self-referential extras officially. pip has supported this by accident since version 21.2. ([#11296](https://github.com/pypa/pip/issues/11296) <https://github.com/pypa/pip/issues/11296>_)

• Add --only-deps flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with --no-deps, -r, --group, or --requirements-from-script. ([#11440](https://github.com/pypa/pip/issues/11440) <https://github.com/pypa/pip/issues/11440>_)

• Cache simple responses in accordance to their Cache-Control header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use --refresh-package <package>. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

• Add --no-require-hashes to disable automatic enablement of --require-hashes when encountering a requirement with hashes. ([#14169](https://github.com/pypa/pip/issues/14169) <https://github.com/pypa/pip/issues/14169>_)

• Honor --only-final when sourcing requirements with -r pylock.toml. ([#13950](https://github.com/pypa/pip/issues/13950) <https://github.com/pypa/pip/issues/13950>_)

• Add support for pylock.toml upload-time field, so --uploaded-prior-to works with -r pylock.toml. ([#14168](https://github.com/pypa/pip/issues/14168) <https://github.com/pypa/pip/issues/14168>_)

• Better error messages in case of conflicts with requirements from -r pylock.toml. ([#13963](https://github.com/pypa/pip/issues/13963) <https://github.com/pypa/pip/issues/13963>_)

• Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via --use-feature=venv-isolation and will be enabled by default in a future release.

  Note that the feature has limited compatibility with --use-feature=inprocess-build-deps.

... (truncated)

Commits

• 634a6ec Bump for release
• ae2eb4f Revert build dependency installer isolation for legacy build environment (#14...
• 6236392 Merge pull request #14213 from pypa/release/26.2
• da4b2cc Bump for development
• 4b6ae5c Bump for release
• 50b6d3c Update AUTHORS.txt
• dbddfbd Tweak news entries for pip 26.2 (#14212)
• 6576b75 Merge pull request #14165 from sbidoul/refactor-pylock-hanling-sbi
• 0090e00 Address a variety of typos detected in code review
• e12ddd9 Add support for --uploaded-prior-to with -r pylock.toml
• Additional commits viewable in compare view

[edmorley]

Cancelling review for now, since we'll want to wait for the 26.2.1 regression fix for pypa/pip#14227

[edmorley]

@dependabot rebase