Bump the python-dependencies group with 2 updates

[dependabot]

Bumps the python-dependencies group with 2 updates: uv and pipenv.

Updates uv from 0.12.5 to 0.12.7

Release notes

Sourced from uv's releases.

0.12.7

Release Notes

Released on 2026-08-27.

Python

• Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

• Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
• Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

• Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

• Reject source archives with hash mismatches before persisting their extracted contents to the cache (#21248)

Other changes

• remove pyx specific features (#21182, #21183, #21184, #21185, #21186)

Install uv 0.12.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.ps1 | iex"

Download uv 0.12.7

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.7

Released on 2026-08-27.

Python

• Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

• Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
• Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

• Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

• Reject source archives with hash mismatches before persisting their extracted contents to the cache (#21248)

Other changes

• remove pyx specific features (#21182, #21183, #21184, #21185, #21186)

0.12.6

Released on 2026-08-25.

Python

• Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #21295)

Enhancements

• Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#21261)
• Limit warnings about unbounded uv_build requirements to source-distribution builds (#21078)
• Display byte counts below 1 KiB without a fractional part (#21237)

Preview features

• Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#21117)
• Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#21235)
• Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#21227)
• Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#21146)

Performance

• Enable profile-guided optimization for Linux x86-64 release binaries (#21001)
• Enable profile-guided optimization for Windows x86-64 release binaries (#21003)
• Enable profile-guided optimization for macOS ARM64 release binaries (#21002)

... (truncated)

Commits

• 61291a8 Bump version to 0.12.7 (#21328)
• dd217b8 de-pyx-ify malformed bearer token test (#21326)
• 306ee9c remove references to pyx in RFC 9457 handling code (#21187)
• 6186dcb remove pyx authentication (#21186)
• f61b300 remove pyx publication support (#21185)
• ba19067 remove support for pyx-specific .whl.tar.zst format (#21184)
• ad852ce fix PR labeler automation (#21325)
• 156dd51 Replace Python installations during build upgrades (#21323)
• 1a486d1 Add coverage for Python build upgrades (#21320)
• 17b195b Retry private Azure downloads with authentication (#21318)
• Additional commits viewable in compare view

Updates pipenv from 2026.7.1 to 2026.8.0

Release notes

Sourced from pipenv's releases.

Release v2026.8.0

🤖 AI-Generated Changelog

Added

• Parallel index manifest prefetching (PIPENV_PREFETCH_INDEX_MANIFESTS): New experimental feature that fetches package index manifests concurrently during lock operations, significantly reducing resolution time for large dependency sets
• PEP 691 JSON Simple API support: Native parsing of PEP 691 JSON responses from package indexes alongside existing PEP 503 HTML parsing
• Disk-based manifest cache (ParsedManifestCache): JSON-on-disk cache with TTL and atomic writes to avoid redundant index fetches across lock operations
• Pluggable resolver backend scaffolding: Foundation for swappable resolver backends, enabling future customization of dependency resolution strategies
• Per-source verify_ssl fan-out for prefetcher: Each index source now independently respects its SSL verification and certificate settings during parallel prefetch
• peek_etag stale-cache short-circuit: Resolver can now skip full manifest fetches when ETags indicate cached data is still fresh
• prefetch_index_manifests setting: New boolean configuration option to enable/disable the parallel prefetch feature
• Reject Pipfile entries with unrecognized keys, providing clearer errors on misconfiguration

Changed

• Pipfile subsystem extracted from Project: Internal refactor completing Initiative D; project.build_script and related attributes now live on project.pipfile
• Lockfile subsystem extracted from Project: Lockfile state management is now a dedicated subsystem
• unpack_url / get_http_url moved to pipenv/utils/unpack.py; legacy requirementslib.py removed
• Resolver backend selection is now stamped onto resolver requests for improved traceability
• Prior Pipfile.lock pins are fed as pip constraints on warm relock to speed up re-locking (reverted and re-landed with fixes)
• Resolver subprocess skipped entirely for empty Pipfile categories, reducing unnecessary process overhead
• Vendor pip updated to 26.2.1

Fixed

• Corrupt lockfile recovery: Fixed return path when recovering from a corrupt lockfile
• Editable VCS extras now resolve correctly with pip 26.2
• netrc login handling: Quote-only netrc credentials are now treated as empty on Python 3.10+, preventing auth failures
• Manifest cache retry on Windows: os.replace is retried on ERROR_ACCESS_DENIED with a wall-clock budget, fixing cache write failures on Windows
• Missing Pipfile hashes are now handled gracefully instead of raising an error
• Plette Pipfile attribute delegation fixed after subsystem refactor
• resolver_backend is now correctly plumbed through the venv_resolve_deps call chain
• Prerelease versions are now allowed as a fallback at final lower bounds
• Stale project.build_script call sites migrated to project.pipfile.build_script
• Test for Pipfile version warning updated after subsystem extraction
• test_lockfile_location_is_pipfile_plus_lock made OS-portable
• Fixed latest hash and virtualenv guidance in documentation/output
• Fixed first-party CodeQL reliability errors
• Deferred pip-internal imports (InstallCommand, unpack, Downloader, network imports) to improve startup performance

Security

• CodeQL reliability improvements to reduce false negatives in static analysis

---

🔗 Full Changelog: pypa/pipenv@v2026.7.1...v2026.8.0

Changelog

Sourced from pipenv's changelog.

2026.8.0 (2026-08-20)

pipenv 2026.8.0 (2026-08-20)

Features & Improvements

• Pipenv now includes scaffolding for pluggable resolver backends. The --resolver NAME CLI flag, PIPENV_RESOLVER environment variable, and [pipenv] resolver Pipfile setting are now recognized, but only pip (the default) is shipped in this release. Selecting an unknown backend will produce a clear error message. Future releases will add additional backends. #T_F.5 <https://github.com/pypa/pipenv/issues/T_F.5>_
• Add a pure-Python PEP 691 / PEP 503 simple-API client + parsed-manifest cache + parallel fetcher under pipenv/resolver/. Initiative G phase 1 ships the standalone surface; no integration yet. Phase 2 (cache-prime bridge) and Phase 3 (full backend) will wire it in. pipenv lock --clear and pipenv install --clear now invalidate this parsed-manifest cache in addition to pip's HTTP cache. #initiative-g-phase1-pep691-client <https://github.com/pypa/pipenv/issues/initiative-g-phase1-pep691-client>_
• Add [pipenv] prefetch_index_manifests opt-in setting (also PIPENV_PREFETCH_INDEX_MANIFESTS=1) that pre-fetches simple-API index pages for top-level Pipfile packages in parallel before the resolver runs. Most beneficial on cold caches or slow networks; off-by-default because warm-cache dev machines see neutral-to- slightly-slower behaviour. Initiative G phase 2. #initiative-g-phase2-prefetch-bridge <https://github.com/pypa/pipenv/issues/initiative-g-phase2-prefetch-bridge>_

Bug Fixes

• Fixed corrupt Pipfile and lockfile errors so they retain the affected path and backup location while reporting the file-specific error message.
• Allow dependency locking to fall back to a prerelease of a final lower bound, such as resolving odin~=2.11 to 2.11rc3 before the 2.11 final release is available. [#6701](https://github.com/pypa/pipenv/issues/6701) <https://github.com/pypa/pipenv/issues/6701>_
• Python-version mismatch warnings now recommend pipenv remove instead of the deprecated pipenv --rm flag. [#6704](https://github.com/pypa/pipenv/issues/6704) <https://github.com/pypa/pipenv/issues/6704>_
• Hash-lookup sessions now use pip's combined certificate trust configuration, so custom CA bundles do not discard the public roots trusted by pip. [#6711](https://github.com/pypa/pipenv/issues/6711) <https://github.com/pypa/pipenv/issues/6711>_
• PyPI hash collection now handles requests and pip network exceptions and falls back to the resolver's other hash sources. [#6712](https://github.com/pypa/pipenv/issues/6712) <https://github.com/pypa/pipenv/issues/6712>_

Vendored Libraries

• Updated the bundled pip to 26.2.
• Updated the bundled pip to 26.2.1.

Commits

• 2a37cdb Release v2026.8.0
• 2b855a4 Bumped version to 2026.8.0.
• 200082a Merge pull request #6668 from pypa/maintenance/code-cleanup-phase5-perf-2026-06
• 5cdd812 Address final Phase V review feedback
• d1248c2 Document best-effort cache cleanup
• f798b2e Address additional resolver code quality feedback
• c610fb9 Adapt truststore test to lazy imports
• 0fa2c19 Address manifest cache test review feedback
• 6c1f520 fix(tests): validate prefetch source hostnames structurally
• 1067385 fix(resolver-auth): treat quote-only netrc login as empty on Python 3.10
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.