Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
docker/build-push-action	action	minor	v6.15.0 -> v6.16.0
docker/login-action	action	minor	v3.3.0 -> v3.4.0
ghcr.io/astral-sh/uv	final	patch	0.6.3 -> 0.6.17
sigstore/cosign-installer	action	patch	v3.8.1 -> v3.8.2
starlette (changelog)	dependency-groups	minor	>=0.45.3,<0.46 -> >=0.46.2,<0.47
structlog (changelog)	project.dependencies	minor	<25.1.1,>=25.1.0 -> <25.3.1,>=25.3.0

---

Release Notes

docker/build-push-action (docker/build-push-action)

v6.16.0

Compare Source

docker/login-action (docker/login-action)

v3.4.0

Compare Source

• Bump @​actions/core from 1.10.1 to 1.11.1 in https://github.com/docker/login-action/pull/791
• Bump @​aws-sdk/client-ecr to 3.766.0 in https://github.com/docker/login-action/pull/789 https://github.com/docker/login-action/pull/856
• Bump @​aws-sdk/client-ecr-public to 3.758.0 in https://github.com/docker/login-action/pull/789 https://github.com/docker/login-action/pull/856
• Bump @​docker/actions-toolkit from 0.35.0 to 0.57.0 in https://github.com/docker/login-action/pull/801 https://github.com/docker/login-action/pull/806 https://github.com/docker/login-action/pull/858
• Bump cross-spawn from 7.0.3 to 7.0.6 in https://github.com/docker/login-action/pull/814
• Bump https-proxy-agent from 7.0.5 to 7.0.6 in https://github.com/docker/login-action/pull/823
• Bump path-to-regexp from 6.2.2 to 6.3.0 in https://github.com/docker/login-action/pull/777

Full Changelog: docker/login-action@v3.3.0...v3.4.0

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.6.17

Compare Source

Preview features

• Add PyTorch v2.7.0 to GPU backend (#​13072)

Bug fixes

• Avoid panic for invalid Python versions (#​13077)
• Block scripts from overwriting python (#​13051)
• Check distribution names to handle invalid redirects (#​12917)
• Check for mismatched package and distribution names on resolver thread (#​13088)
• Fix panic with invalid last character in PEP 508 name (#​13105)
• Reject requires-python even if not listed on the index page (#​13086)

v0.6.16

Compare Source

Bug fixes

• Revert "Properly handle authentication for 302 redirect URLs" (#​13041)

v0.6.15

Compare Source

This release includes preliminary support for the pylock.toml file format, as standardized in PEP 751. pylock.toml is an alternative resolution output format intended to replace requirements.txt (e.g., in the context of uv pip compile, whereby a "locked" requirements.txt file is generated from a set of input requirements). pylock.toml is standardized and tool-agnostic, such that in the future, pylock.toml files generated by uv could be installed by other tools, and vice versa.

As of this release, pylock.toml is supported in the following commands:

• To export a uv.lock to the pylock.toml format, run: uv export -o pylock.toml
• To generate a pylock.toml file from a set of requirements, run: uv pip compile -o pylock.toml -r requirements.in
• To install from a pylock.toml file, run: uv pip sync pylock.toml or uv pip install -r pylock.toml

Enhancements

• Add PEP 751 support to uv pip compile (#​13019)
• Add uv export support for PEP 751 (#​12955)
• Accept requirements.txt (verbatim) as a format on the CLI (#​12957)
• Add UV_NO_EDITABLE environment variable to set --no-editable on all invocations (#​12773)
• Add pylock.toml to uv pip install and uv pip sync (#​12992)
• Add a brief sleep before sending SIGINT to child processes (#​13018)
• Add upload time to uv.lock (#​12968)
• Allow updating Git sources by name (#​12897)
• Cache which git in uv init (#​12893)
• Enable --dry-run with --locked / --frozen for uv sync (#​12778)
• Infer output type in uv export (#​12958)
• Make uv init resilient against broken git (#​12895)
• Respect build constraints for uv run --with dependencies (#​12882)
• Split UV_INDEX on all whitespace (#​12820)
• Support build constraints in uv tool and PEP723 scripts. (#​12842)
• Use suffix from uvx binary when searching for uv binary (#​12923)
• Update version formatting to use cyan color (#​12943)
• Add debug logs for version file search (#​12951)
• Fix SourceNotAllowed error message during Python discovery (#​13012)
• Obfuscate password in credentials debug messages (#​12944)
• Obfuscate possible tokens in URL logs (#​12969)
• Validate that PEP 751 entries don't include multiple sources (#​12993)

Preview features

• Build backend: Add reference docs and schema (#​12803)

Bug fixes

• Align supported config-settings with example in docs (#​12947)
• Ensure virtual environment is compatible with interpreter on sync (#​12884)
• Fix PythonDownloadRequest parsing for partial keys (#​12925)
• Fix pre-release exclusive comparison operator in uv-pep440 (#​12836)
• Forward additional signals to the child process in uv run (#​13017)
• Omit PEP 751 version for source trees (#​13030)
• Patch CC and CCX entries in sysconfig for cross-compiled aarch64 Python distributions (#​12239)
• Properly handle authentication for HTTP 302 redirect URLs (#​12920)
• Set 4MB stack size for all threads, introduce UV_STACK_SIZE (#​12839)
• Show PyPy downloads during uv python list (#​12915)
• Add subdirectory to Direct URL for local directories (#​12971)
• Prefer stable releases over pre-releases in uv python install (#​12194)
• Write requested Python variant to pin file in uv init (#​12870)

Documentation

• Fix CLI reference with code block (#​12807)
• Fix lockfile note (#​12793)
• Fix typo in a reference (#​12858)
• Improve docs for uv python list --only-downloads and --only-installed (#​12916)
• Update note on lack of musl distributions to ARM-only (#​12825)
• Add section on shebangs for scripts (#​11553)
• Display aliases for long and short args in the CLI reference (#​12824)
• Fix highlight line in explicit index documentation (#​12887)
• Add explicit source (matching PyTorch guide) (#​12844)
• Fix link to issue (#​12823)
• Fix grammatical error in FastAPI guide (#​12908)
• Add --locked to uv sync in GitHub Actions guide (#​12819)
• Improve formatting for "all" default-groups setting documentation (#​12963)
• Replace --frozen with --locked in Docker integration guide (#​12818)

v0.6.14

Compare Source

Python versions

The following Python versions have been added:

• CPython 3.13.3
• CPython 3.12.10
• CPython 3.11.12
• CPython 3.10.17
• CPython 3.9.22

See the python-build-standalone release notes for more details.

Enhancements

• Add uv-build and uv_build aliases to uv init --build-backend (#​12776)
• Emit dedicated error message for Conda environment.yml files (#​12669)

Preview features

• Build backend: Check module dir exists for sdist build (#​12779)
• Build backend: Fix sdist with long directories (#​12764)

Performance

• Avoid querying GitHub on repeated install invocations (#​12767)

Bug fixes

• Error when tool.uv.sources is set in system-level configuration file (#​12757)
• Split workspace members onto their own lines in uv init (#​12756)

Documentation

• Add lockfile note about PEP 751 (#​12732)
• Extend the reference documentation for uv pip sync (#​12683)
• Fix mismatched pip interface header / nav titles (#​12640)

v0.6.13

Compare Source

Enhancements

• Add --show-version to uv python find (#​12376)
• Remove --no-config warning from uv pip compile and uv pip sync (#​12642)
• Skip repeated directories in PATH when searching for Python interpreters (#​12367)
• Unset SCRIPT_PATH in relocatable activation script (#​12672)
• Add UV_PYTHON_DOWNLOADS_JSON_URL to set custom managed python sources (#​10939)
• Reject pyproject.toml files in uv pip compile -o (#​12673)
• Respect the --offline flag for Git operations (#​12619)

Bug fixes

• Warn instead of error if CRC appears to be missing (#​12722)
• Avoid infinite loop in uv export with conflicts (#​12726)

Rust API

• Update MSRV to 1.84 (#​12670)

v0.6.12

Compare Source

Enhancements

• Report the queried executable path in uv python list (#​12628)
• Improve archive unpack error messages (#​12627)

Bug fixes

• Respect authenticate when using explicit = true (#​12631)
• Normalize extra and group names in uv add and uv remove (#​12586)
• Enforce CRC-32 checks when unpacking archives (#​12623)
• Fix parsing of python-platform in settings files (#​12592)

Documentation

• Add note about uv build to package = false (#​12608)
• Add index fallback note to authenticate = always documentation (#​12498)
• Fix invalid 'kind' reference in flat index docs (#​12583)

v0.6.11

Compare Source

Enhancements

• Add dependents ("via ..." comments) in uv export command (#​12350)
• Bump least-recent non-EOL macOS version to 13.0 (#​12518)
• Support --find-links-style "flat" indexes in [[tool.uv.index]] (#​12407)
• Distinguish between -q and -qq (#​12300)

Configuration

• Support UV_PROJECT environment to set project directory. (#​12327)

Performance

• Use a boxed slice for various requirement types (#​12514)

Bug fixes

• Add a newline after metadata when initializing scripts with other metadata blocks (#​12501)
• Avoid writing empty requires-python to script blocks (#​12517)
• Respect build constraints in uv sync (#​12502)
• Respect transitive dependencies in uv tree --only-group (#​12560)

v0.6.10

Compare Source

Enhancements

• Add uv sync --check flag (#​12342)
• Add support for Python version requests in uv python list (#​12375)
• Support .env files in uv tool run (#​12386)
• Support python find --script (#​11891)

Preview features

• Check all compatible torch indexes when --torch-backend is enabled (#​12385)

Performance

• Use a boxed slice for extras and groups (#​12391)
• Use small string for index name type (#​12355)

Bug fixes

• Allow virtual packages with --no-build (#​12314)
• Ignore --find-links entries for pinned indexes (#​12396)
• Omit wheels from lockfile based on --exclude-newer (#​12299)
• Retain end-of-line comment position when adding dependency (#​12360)
• Omit fragment when querying for wheels in Simple HTML API (#​12384)
• Error on missing argument in requirements.txt (#​12354)
• Support modules with different casing in build backend (#​12240)
• Add authentication policy support for pip commands (#​12470)

v0.6.9

Compare Source

Enhancements

• Use keyring --mode creds when authenticate = "always" (#​12316)
• Fail with specific error message when no password is present and authenticate = "always" (#​12313)

Bug fixes

• Add boolish value parser for UV_MANAGED_PYTHON flags (#​12345)
• Make deserialization non-fatal when assessing source tree revisions (#​12319)
• Use resolver-returned wheel over alternate cached wheel (#​12301)

Documentation

• Add experimental --torch-backend to the PyTorch guide (#​12317)
• Fix #keyring-provider references in alternative index docs (#​12315)
• Fix --directory path in examples (#​12165)

Preview changes

• Automatically infer the PyTorch index via --torch-backend=auto (#​12070)

v0.6.8

Compare Source

Enhancements

• Add support for enabling all groups by default with default-groups = "all" (#​12289)
• Add simpler --managed-python and --no-managed-python flags for toggling Python preferences (#​12246)

Performance

• Avoid allocations for default cache keys (#​12063)

Bug fixes

• Allow local version mismatches when validating lockfile (#​12285)
• Allow owned string when deserializing requires-python (#​12278)
• Make cache errors non-fatal in Planner::build (#​12281)

v0.6.7

Compare Source

Python

• Add CPython 3.14.0a6
• Fix regression where extension modules would use wrong CXX compiler on Linux
• Enable FTS3 enhanced query syntax for SQLite

See the python-build-standalone release notes for more details.

Enhancements

• Add support for -c constraints in uv add (#​12209)
• Add support for --global default version in uv python pin (#​12115)
• Always reinstall local source trees passed to uv pip install (#​12176)
• Render token claims on publish permission error (#​12135)
• Add pip-compatible --group flag to uv pip install and uv pip compile (#​11686)

Preview features

• Avoid creating duplicate directory entries in built wheels (#​12206)
• Allow overriding module names for editable builds (#​12137)

Performance

• Avoid replicating core-metadata field on File struct (#​12159)

Bug fixes

• Add src to default cache keys (#​12062)
• Discard insufficient fork markers (#​10682)
• Ensure python pin --global creates parent directories if missing (#​12180)
• Fix GraalPy abi tag parsing and discovery (#​12154)
• Remove extraneous script packages in uv sync --script (#​12158)
• Remove redundant activate.bat output (#​12160)
• Avoid subsequent index hint when no versions are available on the first index (#​9332)
• Error on lockfiles with incoherent wheel versions (#​12235)

Rust API

• Update BaseClientBuild to accept custom proxies (#​12232)

Documentation

• Make testpypi index explicit in example snippet (#​12148)
• Reverse and format the archived changelogs (#​12099)
• Use consistent commas around i.e. and e.g. (#​12157)
• Fix typos in MRE docs (#​12198)
• Fix double space typo (#​12171)

v0.6.6

Compare Source

Python

• Add support for dynamic musl Python distributions on x86-64 Linux (#​12121)
• Allow the experimental JIT to be enabled at runtime on Python 3.13 and 3.14 on Linux
• Upgrade the build toolchain to LLVM 20, improving performance

See the python-build-standalone release notes for more details.

Enhancements

• Add --marker flag to uv add (#​12012)
• Allow overriding module name for uv build backend (#​11884)
• Sync latest Python releases (#​12120)
• Use 'Upload' instead of 'Download' in publish reporter (#​12029)
• Add [index].authenticate allowing authentication to be required on an index (#​11896)
• Add support for Windows legacy scripts in uv tool run (#​12079)
• Propagate conflicting dependency groups when using include-group (#​12005)
• Show ambiguous requirements when uv add failed (#​12106)

Performance

• Cache workspace discovery (#​12096)
• Insert dependencies into fork state prior to fetching metadata (#​12057)
• Remove some allocations from uv-auth (#​12077)

Bug fixes

• Avoid considering PATH updated when the export is commented in the shellrc (#​12043)
• Fix uv publish retry on network failures (#​12041)
• Use a sized stream in uv publish to comply with WSGI PyPI server constraints (#​12111)
• Fix uv python install --reinstall when the version was not previously installed (#​12124)

Preview features

• Fix uv_build invocation (#​12058)

Documentation

• Quote versions string in python-versions.md (#​12112)
• Fix tool concept page headings (#​12053)
• Update the [index].authenticate docs (#​12102)
• Update versioning policy (#​11666)

v0.6.5

Compare Source

Enhancements

• Allow --constraints and --overrides in uvx (#​10207)
• Allow overrides in satisfies check for uv tool run (#​11994)
• Allow users to set package = true on tool.uv.sources (#​12014)
• Add support for Windows legacy scripts via uv run (#​11888)
• Return error when running uvx with a .py script (#​11623)
• Warn user on use of uvx run (#​11992)

Configuration

• Add NO_BUILD and NO_BUILD_PACKAGE environment variables (#​11968)

Performance

• Allow overrides in all satisfies checks (#​11995)
• Respect markers on constraints when validating current environment (#​11976)

Bug fixes

• Compare major-minor specifiers when filtering interpreters (#​11952)
• Fix system site packages detection default (#​11956)
• Invalidate lockfile when empty dependency groups are added or removed (#​12010)
• Remove prepended sys.path (#​11954)
• Fix PyPy Python version label (#​11965)
• Fix error message suggesting --user instead of --username (#​11947)

Preview

• Move the uv build backend into a separate, minimal uv_build package (#​11446)

v0.6.4

Compare Source

Enhancements

• Upgrade pypy3.10 to v7.3.19 (#​11814)
• Allow configuring log verbosity from the CLI (i.e., -vvv) (#​11758)
• Warn when duplicate index names found in single file (#​11824)

Bug fixes

• Always store registry index on resolution packages (#​11815)
• Avoid error on relative paths in uv tool uninstall (#​11889)
• Avoid silently dropping errors in directory enumeration (#​11890)
• Disable interactive git terminal prompts during fetches (#​11744)
• Discover Windows registry (PEP 514) Python versions across 32/64-bit (#​11801)
• Don't panic on Ctrl-C in confirm prompt (#​11706)
• Fix non-directory in workspace on Windows (#​11833)
• Make interpreter caching robust to OS upgrades (#​11875)
• Respect include-system-site-packages in layered environments (#​11873)
• Suggest uv tool update-shell in PowerShell (#​11846)
• Update code page to 65001 before setting environment variables in virtual environments (#​11831)
• Use hash instead of full wheel name in wheels bucket (#​11738)
• Fix version string truncation while generating cache_key (#​11830)
• Explicitly handle ctrl-c in confirmation prompt instead of using a signal handler (#​11897)

Performance

• Avoid cloning to string when creating cache path (#​11772)
• Avoid redundant clones in version containment check (#​11767)
• Avoid string allocation when enumerating tool names (#​11910)
• Avoid using owned String for package name constructors (#​11768)
• Avoid using owned String in deserializers (#​11764)
• Migrate to zlib-rs (again) (#​11894)
• Remove unnecessary clones when adding package names (#​11771)
• Skip unquote allocation for non-quoted strings (#​11813)
• Use SmallString for filenames and URLs (#​11765)
• Use a Boxed slice for version specifiers (#​11766)
• Use matches over contains for extra value parsing (#​11770)

Documentation

• Avoid fallback to PyPI in mixed CPU/CUDA example (#​11115)
• Docs: Clarify that setting cache-keys overrides defaults (#​11895)
• Document our MSRV policy (#​11898)
• Fix reference to macOS cache path (#​11845)
• Fix typo in no_default_groups documentation and changelog (#​11928)
• Update the "Locking and syncing" page (#​11647)
• Update alternative indexes documentation to use new interface (#​10826)

sigstore/cosign-installer (sigstore/cosign-installer)

v3.8.2

Compare Source

What's Changed

• install cosign v2 from main in https://github.com/sigstore/cosign-installer/pull/186

Full Changelog: sigstore/cosign-installer@v3...v3.8.2

encode/starlette (starlette)

v0.46.2: Version 0.46.2

Compare Source

What's Changed

• Use correct index on backwards compatible logic in TemplateResponse by @​alex-oleshkevich in https://github.com/encode/starlette/pull/2909
• Prevents reraising of exception from BaseHTTPMiddleware by @​ramannanda9 in https://github.com/encode/starlette/pull/2911

New Contributors

• @​ahryniv made their first contribution in https://github.com/encode/starlette/pull/2913
• @​ramannanda9 made their first contribution in https://github.com/encode/starlette/pull/2911

Full Changelog: Kludex/starlette@0.46.1...0.46.2

v0.46.1: Version 0.46.1

Compare Source

Fixed

• Allow relative directory path when follow_symlinks=True #​2896.

---

Full Changelog: Kludex/starlette@0.46.0...0.46.1

v0.46.0: Version 0.46.0

Compare Source

Added

• GZipMiddleware: Make sure Vary header is always added if a response can be compressed #​2865.

Fixed

• Raise exception from background task on BaseHTTPMiddleware #​2812.
• GZipMiddleware: Don't compress on server sent events #​2871.

Changed

• MultiPartParser: Rename max_file_size to spool_max_size #​2780.

Deprecated

• Add deprecated warning to TestClient(timeout=...) #​2840.

New Contributors

• @​musicinmybrain made their first contribution in https://github.com/encode/starlette/pull/2855
• @​WilliamDEdwards made their first contribution in https://github.com/encode/starlette/pull/2870
• @​mattmess1221 made their first contribution in https://github.com/encode/starlette/pull/2865

Full Changelog: Kludex/starlette@0.45.3...0.46.0

hynek/structlog (structlog)

v25.3.0

Compare Source

Fixed

• structlog.processors.TimeStamper now again uses timestamps using UTC for custom format strings when utc=True.
  #​713

v25.2.0

Compare Source

Added

• structlog.tracebacks.Stack now includes an exc_notes field reflecting the notes attached to the exception.
  #​684

Changed

• structlog.stdlib.BoundLogger's binding-related methods now also return Self.
  #​694

• structlog.processors.TimeStamper now produces internally timezone-aware datetime objects.
  Default output hasn't changed, but you can now use %z in your fmt string.
  #​709

Fixed

• Expose structlog.dev.RichTracebackFormatter for imports.
  #​699
• Expose structlog.processors.LogfmtRenderer for imports.
  #​701

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[qlty-cloud-legacy]

Code Climate has analyzed commit 43fd016 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (100% is the threshold).

This pull request will bring the total coverage in the repository to 100.0% (0.0% change).

View more on Code Climate.