Bump uv to 0.11.25

[edenhaus]

Breaking change

Proposed change

Bump uv to 0.11.25
Releases:

• https://github.com/astral-sh/uv/releases/tag/0.11.25
• https://github.com/astral-sh/uv/releases/tag/0.11.24
• https://github.com/astral-sh/uv/releases/tag/0.11.23
• https://github.com/astral-sh/uv/releases/tag/0.11.22

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New integration (thank you!)
• New feature (which adds functionality to an existing integration)
• Deprecation (breaking change to happen in the future)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code or addition of tests

Additional information

• This PR fixes or closes issue: fixes #
• This PR is related to issue:
• Link to documentation pull request:
• Link to developer documentation pull request:
• Link to frontend pull request:

Checklist

• I understand the code I am submitting and can explain how it works.
• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• I have followed the development checklist
• I have followed the perfect PR recommendations
• The code has been formatted using Ruff (ruff format homeassistant tests)
• Tests have been added to verify that the new code works.
• Any generated code has been carefully reviewed for correctness and compliance with project standards.

If user exposed functionality or configuration variables are added/changed:

• Documentation added/updated for www.home-assistant.io

If the code communicates with devices, web services, or third-party tools:

• The manifest file has all fields filled out correctly.
  Updated and included derived files by running: python3 -m script.hassfest.
• New or updated dependencies have been added to requirements_all.txt.
  Updated by running python3 -m script.gen_requirements_all.
• For the updated dependencies a diff between library versions and ideally a link to the changelog/release notes is added to the PR description.

To help with the load of incoming pull requests:

• I have reviewed two other open pull requests in this repository.

[Copilot]

Pull request overview

This PR bumps the pinned uv dependency from 0.11.21 to 0.11.25, picking up the changes across the 0.11.22–0.11.25 releases. uv is used by Home Assistant Core for package installation (see homeassistant/util/package.py), and the version is pinned across the core requirement/constraint files and consumed dynamically by the Docker images and CI workflow.

Changes:

• Update the pinned uv version from 0.11.21 to 0.11.25 in requirements.txt, pyproject.toml, and homeassistant/package_constraints.txt.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
requirements.txt	Bumps uv pin to 0.11.25; this is the source of truth that Dockerfiles and CI read dynamically.
pyproject.toml	Bumps the uv dependency pin to 0.11.25 to match.
homeassistant/package_constraints.txt	Bumps the generated uv constraint to 0.11.25 to match.

[github-actions]

Check requirements

Checked at commit c8b64f3.

⚠️ Some checks require attention — see the details below.

Package	Old	New	No Advisories	Not Yanked	Repo Public	CI Upload	Release Pipeline	Security	PR Link	Async Safe
uv	0.11.21	0.11.25	✅	✅	✅	⚠️	✅	☑️	❌	✅

📦 uv: 0.11.21 → 0.11.25

• No Advisories: ✅ No active advisories reported by PyPI for version 0.11.25.
• Not Yanked: ✅ Version 0.11.25 is a live (non-yanked) release.
• Repo Public: ✅ https://github.com/astral-sh/uv is publicly accessible.
• CI Upload: ⚠️ No PEP 740 provenance attestation present on PyPI. Upload method cannot be verified from PyPI alone.
• Release Pipeline: ✅ OIDC publishing via id-token: write, triggered by workflow_dispatch with a release-gate environment requiring 2-factor approval; no unguarded upload paths.
• Security: ☑️ Baseline scan found nothing obvious in pyproject.toml, python/uv/__init__.py, python/uv/__main__.py, python/uv/_find_uv.py. This is not a security review — only the cheap checks were run.
• PR Link: ❌ PR description should link to a changelog or compare URL on https://github.com/astral-sh/uv that mentions both 0.11.21 and 0.11.25.
• Async Safe: ✅ Sync-only library; Home Assistant integrations must wrap calls in an executor.

Generated by Check requirements (AW) · 116 AIC · ⌖ 30.7 AIC · ⊞ 29.9K · ◷