[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps astral-sh/uv from 0.13.5 to 0.13.7.

Release notes

Sourced from astral-sh/uv's releases.

0.13.7

Release Notes

Released on 2026-11-03.

Preview features

• Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
• Report aliased OSV records as a single vulnerability in uv audit (#22990)

Bug fixes

• Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
• Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
• Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
• Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
• Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
• Allow uv remove with an empty inline tool.uv.sources table (#23012)

Documentation

• Correct the cache-keys inline table example (#22984)

Install uv 0.13.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.ps1 | iex"

Download uv 0.13.7

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum

... (truncated)

Changelog

Sourced from astral-sh/uv's changelog.

0.13.7

Released on 2026-11-03.

Preview features

• Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
• Report aliased OSV records as a single vulnerability in uv audit (#22990)

Bug fixes

• Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
• Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
• Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
• Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
• Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
• Allow uv remove with an empty inline tool.uv.sources table (#23012)

Documentation

• Correct the cache-keys inline table example (#22984)

0.13.6

Released on 2026-10-26.

Enhancements

• Accept an empty UV_RUN_RECURSION_DEPTH as zero and report invalid values consistently (#22814)
• Explain how to add project metadata when uv init finds a pyproject.toml without a [project] table (#22916)

Python

• Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 (#22938)

Preview features

• Detect NVIDIA GPU capabilities when selecting compatible wheel variants with wheel-variants (#22690)
• Nest each module's owners in an object in uv workspace metadata output (#22638)
• Report the unsupported properties required by an incompatible wheel variant (#22719)

Performance

• Reduce peak memory use when resolving large workspaces (#22860, #22863, #22864, #22866, #22870)
• Reduce peak memory use when locking or upgrading large projects (#22833, #22834)
• Speed up redirected output from uv export and uv pip compile (#22840)
• Reuse cached or active environments when running PEP 723 scripts without dependencies (#21458)
• Reduce parsing overhead for build dependency and build backend settings (#22848, #22871, #22879, #22884)
• Reduce parsing overhead for project sources and workspace references (#22880, #22883)
• Reduce parsing overhead for cache, exclusion, cutoff, and preview settings (#22876, #22877, #22878, #22887)

... (truncated)

Commits

• 316c827 Bump version to 0.13.7 (#23068)
• 917b4c3 Update Rust crate tokio-rustls to v0.26.6 (#23048)
• baec6ce Update conda-incubator/setup-miniconda action to v4.1.0 (#23032)
• da8bbd3 Update fedora Docker tag to v46 (#23033)
• 3db723c Update Rust crate cargo-util to v0.2.32 (#23045)
• 28c0c65 Update Rust crate uuid to v1.27.0 (#23052)
• 7716878 Update Rust crate insta to v1.49.0 (#23051)
• 3be10e3 Update dependency @​openai/codex to v0.160.0 (#23050)
• 8eb756a Update CodSpeedHQ/action action to v5.4.0 (#23049)
• 632df30 Update Rust crate spdx to v0.13.6 (#23047)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: image. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.