Content-address wheel archives with directory hashes by charliermarsh · Pull Request #19693 · astral-sh/uv

charliermarsh · 2026-06-05T19:10:39Z

Summary

Prior to this change, extracted wheels were persisted in archive-v0 under randomly generated IDs. As a result, we might store the same wheel multiple times when reached through different cache entries.

We now compute a deterministic directory hash while extracting ZIP wheels and use a 24-character, lowercase base-36 encoding as the archive ID. The hash reuses uv_extract::dirhash::DirhashTree, includes normalized relative paths, file contents, and empty directories, and ignores ZIP entry order and other archive metadata. Executable permissions are preserved during installation but are intentionally not part of the archive identity.

Both streaming and seekable extraction hash file contents while writing them through the shared blake3_copy helper. Seekable extraction preserves its existing Rayon per-entry parallelism without adding a hash thread pool, scoped worker threads, or a global buffer semaphore. Computing a hash of each file also enables us to deduplicate large files in #19694.

Behavior is entirely gated behind the content-addressed-cache preview feature, so it's opt-in for now.

Benchmarks

Measured on a 32-core Linux/x86-64 host using uv's optimized profiling profile. Local runs install from a wheel path; remote runs serve the same wheel over loopback HTTP. Every sample uses a fresh cache and installation target, verifies identical installed contents and executable permissions, and counterbalances binary execution order. Values are medians over 12 samples for typing-extensions and NumPy and six samples for PyTorch; the final column compares this simplified implementation with the previous PR implementation.

Source	Wheel	Main	Previous implementation	This PR	Change vs. previous
Local	typing-extensions	96 ms	96 ms	96 ms	−0.3%
Local	NumPy	351 ms	393 ms	359 ms	−8.5%
Local	PyTorch	4.23 s	4.63 s	4.52 s	−2.3%
Remote	typing-extensions	102 ms	102 ms	101 ms	−0.3%
Remote	NumPy	731 ms	752 ms	737 ms	−2.0%
Remote	PyTorch	8.82 s	9.15 s	8.99 s	−1.7%

The Linux NumPy wheel is 15.95 MiB and the PyTorch wheel is 502.21 MiB, so their absolute timings are not directly comparable with the earlier Apple Silicon benchmarks.

codspeed · 2026-06-05T19:34:22Z

Merging this PR will not alter performance

✅ 31 untouched benchmarks
⏩ 6 skipped benchmarks¹

_{Comparing charlie/dirhash-archives (96be5e2) with main (a61e5c9)}

6 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

astral-sh-bot · 2026-06-05T22:15:12Z

uv test inventory changes

This PR changes the tests when compared with the main base revision.

Added tests: 5
Removed tests: 1
Changed suites: 3

uv-extract: +4 / -0

Added:

uv-extract::archive_path::tests::archive_member_path_normalizes_safe_paths
uv-extract::archive_path::tests::archive_member_path_rejects_paths_outside_root
uv-extract::dirhash::archive::tests::digest_path_uses_normalized_archive_path
uv-extract::dirhash::archive::tests::directory_digest_uses_shared_dirhash_scheme

Removed: none

uv::build: +1 / -0

Added:

uv::build::cache_prune::prune_stale_revision_content_addressed_cache

Removed: none

uv::it: +0 / -1

Added: none

Removed:

uv::it::auth::bazel_helper_invalid_bearer_token

charliermarsh · 2026-06-22T19:36:00Z

Tagging in...

@woodruffw to review dirhash
@EliteTK to review security (can DM findings)
@zanieb for overall vision

charliermarsh · 2026-06-26T16:57:26Z

+    /// identifies the persisted directory contents.
+    pub fn from_digest(digest: String) -> Self {
+        Self(digest)
+    }


It's hard to do a From here due to circular crate dependencies.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.12.6` → `0.12.7` | --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.7`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0127) Released on 2026-08-27. ##### Python - Replace managed Python installations when upgrading to a newer build of the same version ([#21323](astral-sh/uv#21323)) ##### Enhancements - Support Linux `s390x`, `ppc64le`, and `loongarch64` targets for cross-platform dependency resolution ([#21313](astral-sh/uv#21313)) - Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via `UV_AZURE_ENDPOINT_URL` ([#21318](astral-sh/uv#21318)) ##### Preview features - Use content-based directory hashes to deduplicate extracted wheels in the cache with the `content-addressed-cache` preview feature ([#19693](astral-sh/uv#19693)) ##### Bug fixes - Reject source archives with hash mismatches before persisting their extracted contents to the cache ([#21248](astral-sh/uv#21248)) ##### Other changes - remove pyx specific features ([#21182](astral-sh/uv#21182), [#21183](astral-sh/uv#21183), [#21184](astral-sh/uv#21184), [#21185](astral-sh/uv#21185), [#21186](astral-sh/uv#21186)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/44 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [uv](https://github.com/astral-sh/uv) | tools | patch | `0.12.6` → `0.12.7` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.12.7`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0127) [Compare Source](astral-sh/uv@0.12.6...0.12.7) Released on 2026-08-27. ##### Python - Replace managed Python installations when upgrading to a newer build of the same version ([#21323](astral-sh/uv#21323)) ##### Enhancements - Support Linux `s390x`, `ppc64le`, and `loongarch64` targets for cross-platform dependency resolution ([#21313](astral-sh/uv#21313)) - Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via `UV_AZURE_ENDPOINT_URL` ([#21318](astral-sh/uv#21318)) ##### Preview features - Use content-based directory hashes to deduplicate extracted wheels in the cache with the `content-addressed-cache` preview feature ([#19693](astral-sh/uv#19693)) ##### Bug fixes - Reject source archives with hash mismatches before persisting their extracted contents to the cache ([#21248](astral-sh/uv#21248)) ##### Other changes - remove pyx specific features ([#21182](astral-sh/uv#21182), [#21183](astral-sh/uv#21183), [#21184](astral-sh/uv#21184), [#21185](astral-sh/uv#21185), [#21186](astral-sh/uv#21186)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://forgejo.hayden.moe/hayden/phoebe/pulls/379

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (6 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `3.11.1` → `3.11.2` | `3.11.1` → `3.11.2` | | `prek` | `0.4.14` → `0.5.0` | `0.4.14` → `0.5.0` | | `rumdl` | `0.2.60` → `0.2.62` | `0.2.60` → `0.2.62` | | `shfmt` | `3.13.1` → `3.14.0` | `3.13.1` → `3.14.0` | | `tombi` | `1.4.1` → `1.5.0` | `1.4.1` → `1.5.0` | | `uv` | `0.12.5` → `0.12.7` | `0.12.5` → `0.12.7` | </details> <details> <summary>Release notes (6 tools)</summary> <details> <summary>editorconfig-checker: `3.11.1` → `3.11.2` (editorconfig-checker/editorconfig-checker)</summary> ### v3.11.2 ## editorconfig-checker v3.11.2 (2026-08-25T21:11:31Z) Welcome to this new release of editorconfig-checker! ## Changelog ### Others * b0a550a82df22ed8bbc48156d3d6fa9bf20c975c: upgrade go to v1.27 to mitigate #613 (@klaernie) ## Thanks! Those were the changes on v3.11.2! </details> <details> <summary>prek: `0.4.14` → `0.5.0` (j178/prek)</summary> ### v0.5.0 ## Release Notes Released on 2026-08-27. ### Highlights #### Choose where hook toolchains come from `language_version` now accepts a source `preference` alongside the version `request`, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use `managed` (the default) or `system` to choose which source prek tries first while still allowing fallback and downloads. Use `only-managed` or `only-system` to require one source. For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek: ```yaml repos: - repo: local hooks: - id: ruff name: ruff language: python entry: ruff check additional_dependencies: [ruff] language_version: request: "3.12" preference: only-managed ``` With `only-managed`, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from `PATH`, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment. Existing scalar values such as `language_version: "3.12"` continue to work. See [toolchain management and `language_version`](https://prek.j178.dev/0.5.0/languages/#toolchain-management-and-language_version) for the full source-selection behavior. ([#2613](j178/prek#2613)) ### Breaking changes The breaking changes in this release are mostly small cleanups, and most users should not be affected. - Group names can no longer start with `@`. This prefix is now reserved for special group selectors such as the new `@ungrouped` selector. ([#2617](j178/prek#2617)) - `PREK_MAX_CONCURRENCY` has been removed. Use `PREK_CONCURRENT_HOOKS` and `PREK_CONCURRENT_BATCHES` to control hook and per-hook batch concurrency separately. ([#2620](j178/prek#2620)) - The top-level `prek init-template-dir` command… (truncated) </details> <details> <summary>rumdl: `0.2.60` → `0.2.62` (rvben/rumdl)</summary> ### v0.2.61 ### Added - **cli**: add `--stdin-batch` for NUL-framed multi-document linting and `--stdin-batch-closed-world` for supplied-document-only link resolution ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.61-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.61-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.61-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.61-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.61-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-apple-darwin.tar.gz.sha256) | | [rumdl-v0.2.61-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-apple-darwin.tar.gz) | macOS ARM64 (Apple Silicon) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-a… (truncated) ### v0.2.62 ### Added - **flavor**: add support for Markdown with Gherkin (MDG) ([db62377](rvben/rumdl@db62377)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.62-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.62-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.62-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.62-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.62-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-apple-darwin.tar.gz.sha256) | | [rumdl-v0.2.62-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarch64-apple-darwin.tar.gz) | macOS ARM64 (Apple Silicon) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarc… (truncated) </details> <details> <summary>shfmt: `3.13.1` → `3.14.0` (mvdan/sh)</summary> ### v3.14.0 This release drops support for Go 1.25 and includes many enhancements, particularly in the interpreter, which implements more shell features and fixes many divergences from Bash. - **cmd/shfmt** - Add `--detect` to find shell files by executable bit or shebang - #944 - **syntax** - Add `Preorder`, an iterator over all nodes, complementing `Walk` - Add `encoding.TextUnmarshaler` implementations for each operator type - Support `${ foo;}` and `${|foo;}` inside double quotes - #1368 - Support array elements in `{varname}` redirects, like `exec {fds[3]}>&-` - #719 - Backslashes inside backquotes within double quotes escape double quotes - #1083 - Allow pound signs in associative array keys like `${args[cmd,#]}` - #1285 - Don't treat `#` as the start of a comment inside `[[ ]]` tests - #1326 - Don't join `then` or `do` with a semicolon when heredocs are pending - #1047 - Print a space after `!` in arithmetic expressions, avoiding history expansion - #987 - Space nested closing parentheses like the opening ones - #876 - Make `SplitBraces` reject malformed sequences and skip backslash escapes - #1330 - Zsh: support the `${=name}`, `${~name}`, and `${^name}` prefixes - #1238 - Zsh: support the `;|` case terminator and leading parentheses for globs - #1293, #1279 - Zsh: parse subscript flag arguments as patterns, and allow `[` globs in arrays - #1278, #1322 - **syntax/typedjson** - Encode operators as their syntax form, such as `">>"`, rather than integers - #1321 - Return errors rather than panicking on malformed input - **interp** - Add `BashOpts` to set Bash options like `shopt` - #962 - Add `AccessHandler` to control file access checks, used by `-r` and `cd` - #1318 - Add `HandlerContext.LastExitStatus`, and provide a `HandlerContext` to stat handlers - Implement the `help` and `times` builtins, as well as `$-` - #1398 - Implement the `;&` and `;;&` case terminators - #1391 - Implemen… (truncated) </details> <details> <summary>tombi: `1.4.1` → `1.5.0` (tombi-toml/tombi)</summary> ### v1.5.0  ## What's Changed Tombi v1.5.0 is a major performance and architecture release. We redesigned the parser and AST around a compact, source-backed syntax tape, replacing the previous red-green syntax tree. The new architecture is optimized for Tombi’s lossless, long-lived editor and LSP workloads: it improves memory locality and reduces allocation and pointer-chasing overhead while preserving comments, punctuation, incomplete syntax, and diagnostics. The AST and document-tree interfaces are now also separated from their syntax-backed implementations. We also optimized hot paths throughout the parser, JSON Schema processing, linter, formatter, and stdin-based CLI workflows. In our Apple M2 Max benchmarks, long ASCII comment lexing was approximately 2.3× faster, selected JSON parsing workloads improved by up to 84%, and repository-wide lint time decreased from approximately 355 ms to 81 ms. ### 🚨 Breaking Changes * perf(parser): replace syntax tree with compact tape by @ya7010 in tombi-toml/tombi#2140 ### 🐝 Bug Fixes * fix(lsp): preserve composite schema metadata by @ya7010 in tombi-toml/tombi#2139 ### 🛠️ Other Changes * Improve minimal-change guidance for agents by @ya7010 in tombi-toml/tombi#2137 * perf(parser): accelerate long comment scanning by @ya7010 in tombi-toml/tombi#2141 * perf: speed up lint and format by @ya7010 in tombi-toml/tombi#2142 * perf: reduce stdin runtime overhead by @ya7010 in tombi-toml/tombi#2143 * perf(json): accelerate long string parsing by @ya7010 in tombi-toml/tombi#2145 * perf(json): optimize lexer and parser hot paths by @ya7010 in tombi-toml/tombi#2146 **Full Changelog**: https://github.com/tombi-toml/tomb… (truncated) </details> <details> <summary>uv: `0.12.5` → `0.12.7` (astral-sh/uv)</summary> ### 0.12.6 ## Release Notes Released on 2026-08-25. ### Python - Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 [#21295](astral-sh/uv#21295)) ### Enhancements - Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links ([#21261](astral-sh/uv#21261)) - Limit warnings about unbounded `uv_build` requirements to source-distribution builds ([#21078](astral-sh/uv#21078)) - Display byte counts below 1 KiB without a fractional part ([#21237](astral-sh/uv#21237)) ### Preview features - Add `uv workspace metadata --sync --exact` to remove packages outside the selected resolution ([#21117](astral-sh/uv#21117)) - Add the `artifact-hash-filtering` preview feature to make `uv pip compile --generate-hashes` honor `--only-binary` and `--no-binary` ([#21235](astral-sh/uv#21235)) - Respect package-specific `exclude-newer` cutoffs when `uv check` selects its `ty` executable ([#21227](astral-sh/uv#21227)) - Preserve virtual-environment hints from `tar-codec` source-distribution errors when the base interpreter is outside a `bin` directory ([#21146](astral-sh/uv#21146)) ### Performance - Enable profile-guided optimization for Linux x86-64 release binaries ([#21001](astral-sh/uv#21001)) - Enable profile-guided optimization for Windows x86-64 release binaries ([#21003](astral-sh/uv#21003)) - Enable profile-guided optimization for macOS ARM64 release binaries ([#21002](astral-sh/uv#21002)) - Enable profile-guided optimization for Linux ARM64 release binaries ([#21004](astral-sh/uv#21004)) - Speed up syncing projects with many activated conflict items by reusing their encoded representation ([#21148](https://github.com/astral-sh/uv/pull/21148))… (truncated) ### 0.12.7 ## Release Notes Released on 2026-08-27. ### Python - Replace managed Python installations when upgrading to a newer build of the same version ([#21323](astral-sh/uv#21323)) ### Enhancements - Support Linux `s390x`, `ppc64le`, and `loongarch64` targets for cross-platform dependency resolution ([#21313](astral-sh/uv#21313)) - Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via `UV_AZURE_ENDPOINT_URL` ([#21318](astral-sh/uv#21318)) ### Preview features - Use content-based directory hashes to deduplicate extracted wheels in the cache with the `content-addressed-cache` preview feature ([#19693](astral-sh/uv#19693)) ### Bug fixes - Reject source archives with hash mismatches before persisting their extracted contents to the cache ([#21248](astral-sh/uv#21248)) ### Other changes - remove pyx specific features ([#21182](astral-sh/uv#21182), [#21183](astral-sh/uv#21183), [#21184](astral-sh/uv#21184), [#21185](astral-sh/uv#21185), [#21186](astral-sh/uv#21186)) ## Install uv 0.12.7 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.ps1 | iex" ``` ## Download uv 0.12.7 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.5` → `0.12.7` | `0.12.5` → `0.12.7` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.5` → `0.12.7` (astral-sh/uv)</summary> ### 0.12.6 ## Release Notes Released on 2026-08-25. ### Python - Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 [#21295](astral-sh/uv#21295)) ### Enhancements - Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links ([#21261](astral-sh/uv#21261)) - Limit warnings about unbounded `uv_build` requirements to source-distribution builds ([#21078](astral-sh/uv#21078)) - Display byte counts below 1 KiB without a fractional part ([#21237](astral-sh/uv#21237)) ### Preview features - Add `uv workspace metadata --sync --exact` to remove packages outside the selected resolution ([#21117](astral-sh/uv#21117)) - Add the `artifact-hash-filtering` preview feature to make `uv pip compile --generate-hashes` honor `--only-binary` and `--no-binary` ([#21235](astral-sh/uv#21235)) - Respect package-specific `exclude-newer` cutoffs when `uv check` selects its `ty` executable ([#21227](astral-sh/uv#21227)) - Preserve virtual-environment hints from `tar-codec` source-distribution errors when the base interpreter is outside a `bin` directory ([#21146](astral-sh/uv#21146)) ### Performance - Enable profile-guided optimization for Linux x86-64 release binaries ([#21001](astral-sh/uv#21001)) - Enable profile-guided optimization for Windows x86-64 release binaries ([#21003](astral-sh/uv#21003)) - Enable profile-guided optimization for macOS ARM64 release binaries ([#21002](astral-sh/uv#21002)) - Enable profile-guided optimization for Linux ARM64 release binaries ([#21004](astral-sh/uv#21004)) - Speed up syncing projects with many activated conflict items by reusing their encoded representation ([#21148](https://github.com/astral-sh/uv/pull/21148))… (truncated) ### 0.12.7 ## Release Notes Released on 2026-08-27. ### Python - Replace managed Python installations when upgrading to a newer build of the same version ([#21323](astral-sh/uv#21323)) ### Enhancements - Support Linux `s390x`, `ppc64le`, and `loongarch64` targets for cross-platform dependency resolution ([#21313](astral-sh/uv#21313)) - Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via `UV_AZURE_ENDPOINT_URL` ([#21318](astral-sh/uv#21318)) ### Preview features - Use content-based directory hashes to deduplicate extracted wheels in the cache with the `content-addressed-cache` preview feature ([#19693](astral-sh/uv#19693)) ### Bug fixes - Reject source archives with hash mismatches before persisting their extracted contents to the cache ([#21248](astral-sh/uv#21248)) ### Other changes - remove pyx specific features ([#21182](astral-sh/uv#21182), [#21183](astral-sh/uv#21183), [#21184](astral-sh/uv#21184), [#21185](astral-sh/uv#21185), [#21186](astral-sh/uv#21186)) ## Install uv 0.12.7 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.ps1 | iex" ``` ## Download uv 0.12.7 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.5` → `0.12.7` | `0.12.5` → `0.12.7` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.5` → `0.12.7` (astral-sh/uv)</summary> ### 0.12.6 ## Release Notes Released on 2026-08-25. ### Python - Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 [#21295](astral-sh/uv#21295)) ### Enhancements - Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links ([#21261](astral-sh/uv#21261)) - Limit warnings about unbounded `uv_build` requirements to source-distribution builds ([#21078](astral-sh/uv#21078)) - Display byte counts below 1 KiB without a fractional part ([#21237](astral-sh/uv#21237)) ### Preview features - Add `uv workspace metadata --sync --exact` to remove packages outside the selected resolution ([#21117](astral-sh/uv#21117)) - Add the `artifact-hash-filtering` preview feature to make `uv pip compile --generate-hashes` honor `--only-binary` and `--no-binary` ([#21235](astral-sh/uv#21235)) - Respect package-specific `exclude-newer` cutoffs when `uv check` selects its `ty` executable ([#21227](astral-sh/uv#21227)) - Preserve virtual-environment hints from `tar-codec` source-distribution errors when the base interpreter is outside a `bin` directory ([#21146](astral-sh/uv#21146)) ### Performance - Enable profile-guided optimization for Linux x86-64 release binaries ([#21001](astral-sh/uv#21001)) - Enable profile-guided optimization for Windows x86-64 release binaries ([#21003](astral-sh/uv#21003)) - Enable profile-guided optimization for macOS ARM64 release binaries ([#21002](astral-sh/uv#21002)) - Enable profile-guided optimization for Linux ARM64 release binaries ([#21004](astral-sh/uv#21004)) - Speed up syncing projects with many activated conflict items by reusing their encoded representation ([#21148](https://github.com/astral-sh/uv/pull/21148))… (truncated) ### 0.12.7 ## Release Notes Released on 2026-08-27. ### Python - Replace managed Python installations when upgrading to a newer build of the same version ([#21323](astral-sh/uv#21323)) ### Enhancements - Support Linux `s390x`, `ppc64le`, and `loongarch64` targets for cross-platform dependency resolution ([#21313](astral-sh/uv#21313)) - Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via `UV_AZURE_ENDPOINT_URL` ([#21318](astral-sh/uv#21318)) ### Preview features - Use content-based directory hashes to deduplicate extracted wheels in the cache with the `content-addressed-cache` preview feature ([#19693](astral-sh/uv#19693)) ### Bug fixes - Reject source archives with hash mismatches before persisting their extracted contents to the cache ([#21248](astral-sh/uv#21248)) ### Other changes - remove pyx specific features ([#21182](astral-sh/uv#21182), [#21183](astral-sh/uv#21183), [#21184](astral-sh/uv#21184), [#21185](astral-sh/uv#21185), [#21186](astral-sh/uv#21186)) ## Install uv 0.12.7 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.ps1 | iex" ``` ## Download uv 0.12.7 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0… (truncated) </details> </details> Modified files: - `.mise.toml`

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (7 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `aube` | `latest` → `latest` | `2.1.0` → `2.2.0` | | `editorconfig-checker` | `3.11.1` → `3.11.2` | `3.11.1` → `3.11.2` | | `prek` | `0.4.14` → `0.5.0` | `0.4.14` → `0.5.0` | | `rumdl` | `0.2.60` → `0.2.62` | `0.2.60` → `0.2.62` | | `shfmt` | `3.13.1` → `3.14.0` | `3.13.1` → `3.14.0` | | `tombi` | `1.4.1` → `1.5.0` | `1.4.1` → `1.5.0` | | `uv` | `0.12.5` → `0.12.7` | `0.12.5` → `0.12.7` | </details> <details> <summary>Release notes (7 tools)</summary> <details> <summary>aube: `2.1.0` → `2.2.0` (jdx/aube)</summary> ### v2.2.0 A small release that gives standalone aube a bundled package-extensions compatibility catalog and exposes its node-gyp bootstrap through the public embedding facade. ## Added - **Embeddable node-gyp bootstrap** ([#1365](aubepkg/aube#1365) by @jdx) — aube's locked, in-process node-gyp bootstrap is now available through the stable embedding facade and returns the resolved executable path. This lets embedders (e.g. mise) service aube's lazy shim command without an ambient `npm` or a separately installed `aube` binary, while aube keeps ownership of the node-gyp version, cache layout, npmrc propagation, and cross-process locking. Standalone aube's hidden `__node-gyp-bootstrap` command now routes through the same API, and binary lookup uses `is_file()` across platform names so Windows `.exe`/`.cmd` caches resolve correctly. ## Fixed - **Bundled curated package extensions** ([#1369](aubepkg/aube#1369) by @jdx) — Standalone aube now ships a bundled compatibility catalog (~161 curated rules from Yarn's `@yarnpkg/extensions@2.0.7` plus pnpm's Rust CLI additions) that repairs missing or incompatible peer/optional dependencies across common ecosystems (Angular, Nuxt, React, Vue, Gatsby, GraphQL, Webpack, Parcel, and more). The phantom rules removed upstream by pnpm are excluded. These defaults are applied at the lowest precedence — user and project `packageExtensions` always win — and are kept out of `packageExtensionsChecksum`, so catalog updates never invalidate existing lockfiles or break `--frozen-lockfile`. Set `ignoreCompatibilityDb=true` to opt out of the bundled repairs; malformed bundled entries are skipped with a `WARN_AUBE_INVALID_BUNDLED_PACKAGE_EXTENSION` warning rather than failing the install. **Full Changelog**: aubepkg/aube@v2.1.0...v2.2.0 ## 💚 Sponsor aube aube is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io),… (truncated) </details> <details> <summary>editorconfig-checker: `3.11.1` → `3.11.2` (editorconfig-checker/editorconfig-checker)</summary> ### v3.11.2 ## editorconfig-checker v3.11.2 (2026-08-25T21:11:31Z) Welcome to this new release of editorconfig-checker! ## Changelog ### Others * b0a550a82df22ed8bbc48156d3d6fa9bf20c975c: upgrade go to v1.27 to mitigate #613 (@klaernie) ## Thanks! Those were the changes on v3.11.2! </details> <details> <summary>prek: `0.4.14` → `0.5.0` (j178/prek)</summary> ### v0.5.0 ## Release Notes Released on 2026-08-27. ### Highlights #### Choose where hook toolchains come from `language_version` now accepts a source `preference` alongside the version `request`, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use `managed` (the default) or `system` to choose which source prek tries first while still allowing fallback and downloads. Use `only-managed` or `only-system` to require one source. For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek: ```yaml repos: - repo: local hooks: - id: ruff name: ruff language: python entry: ruff check additional_dependencies: [ruff] language_version: request: "3.12" preference: only-managed ``` With `only-managed`, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from `PATH`, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment. Existing scalar values such as `language_version: "3.12"` continue to work. See [toolchain management and `language_version`](https://prek.j178.dev/0.5.0/languages/#toolchain-management-and-language_version) for the full source-selection behavior. ([#2613](j178/prek#2613)) ### Breaking changes The breaking changes in this release are mostly small cleanups, and most users should not be affected. - Group names can no longer start with `@`. This prefix is now reserved for special group selectors such as the new `@ungrouped` selector. ([#2617](j178/prek#2617)) - `PREK_MAX_CONCURRENCY` has been removed. Use `PREK_CONCURRENT_HOOKS` and `PREK_CONCURRENT_BATCHES` to control hook and per-hook batch concurrency separately. ([#2620](j178/prek#2620)) - The top-level `prek init-template-dir` command… (truncated) </details> <details> <summary>rumdl: `0.2.60` → `0.2.62` (rvben/rumdl)</summary> ### v0.2.61 ### Added - **cli**: add `--stdin-batch` for NUL-framed multi-document linting and `--stdin-batch-closed-world` for supplied-document-only link resolution ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.61-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.61-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.61-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.61-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.61-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-x86_64-apple-darwin.tar.gz.sha256) | | [rumdl-v0.2.61-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-apple-darwin.tar.gz) | macOS ARM64 (Apple Silicon) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.61/rumdl-v0.2.61-aarch64-a… (truncated) ### v0.2.62 ### Added - **flavor**: add support for Markdown with Gherkin (MDG) ([db62377](rvben/rumdl@db62377)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.62-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.62-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.62-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.62-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.62-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-x86_64-apple-darwin.tar.gz.sha256) | | [rumdl-v0.2.62-aarch64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarch64-apple-darwin.tar.gz) | macOS ARM64 (Apple Silicon) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.62/rumdl-v0.2.62-aarc… (truncated) </details> <details> <summary>shfmt: `3.13.1` → `3.14.0` (mvdan/sh)</summary> ### v3.14.0 This release drops support for Go 1.25 and includes many enhancements, particularly in the interpreter, which implements more shell features and fixes many divergences from Bash. - **cmd/shfmt** - Add `--detect` to find shell files by executable bit or shebang - #944 - **syntax** - Add `Preorder`, an iterator over all nodes, complementing `Walk` - Add `encoding.TextUnmarshaler` implementations for each operator type - Support `${ foo;}` and `${|foo;}` inside double quotes - #1368 - Support array elements in `{varname}` redirects, like `exec {fds[3]}>&-` - #719 - Backslashes inside backquotes within double quotes escape double quotes - #1083 - Allow pound signs in associative array keys like `${args[cmd,#]}` - #1285 - Don't treat `#` as the start of a comment inside `[[ ]]` tests - #1326 - Don't join `then` or `do` with a semicolon when heredocs are pending - #1047 - Print a space after `!` in arithmetic expressions, avoiding history expansion - #987 - Space nested closing parentheses like the opening ones - #876 - Make `SplitBraces` reject malformed sequences and skip backslash escapes - #1330 - Zsh: support the `${=name}`, `${~name}`, and `${^name}` prefixes - #1238 - Zsh: support the `;|` case terminator and leading parentheses for globs - #1293, #1279 - Zsh: parse subscript flag arguments as patterns, and allow `[` globs in arrays - #1278, #1322 - **syntax/typedjson** - Encode operators as their syntax form, such as `">>"`, rather than integers - #1321 - Return errors rather than panicking on malformed input - **interp** - Add `BashOpts` to set Bash options like `shopt` - #962 - Add `AccessHandler` to control file access checks, used by `-r` and `cd` - #1318 - Add `HandlerContext.LastExitStatus`, and provide a `HandlerContext` to stat handlers - Implement the `help` and `times` builtins, as well as `$-` - #1398 - Implement the `;&` and `;;&` case terminators - #1391 - Implemen… (truncated) </details> <details> <summary>tombi: `1.4.1` → `1.5.0` (tombi-toml/tombi)</summary> ### v1.5.0  ## What's Changed Tombi v1.5.0 is a major performance and architecture release. We redesigned the parser and AST around a compact, source-backed syntax tape, replacing the previous red-green syntax tree. The new architecture is optimized for Tombi’s lossless, long-lived editor and LSP workloads: it improves memory locality and reduces allocation and pointer-chasing overhead while preserving comments, punctuation, incomplete syntax, and diagnostics. The AST and document-tree interfaces are now also separated from their syntax-backed implementations. We also optimized hot paths throughout the parser, JSON Schema processing, linter, formatter, and stdin-based CLI workflows. In our Apple M2 Max benchmarks, long ASCII comment lexing was approximately 2.3× faster, selected JSON parsing workloads improved by up to 84%, and repository-wide lint time decreased from approximately 355 ms to 81 ms. ### 🚨 Breaking Changes * perf(parser): replace syntax tree with compact tape by @ya7010 in tombi-toml/tombi#2140 ### 🐝 Bug Fixes * fix(lsp): preserve composite schema metadata by @ya7010 in tombi-toml/tombi#2139 ### 🛠️ Other Changes * Improve minimal-change guidance for agents by @ya7010 in tombi-toml/tombi#2137 * perf(parser): accelerate long comment scanning by @ya7010 in tombi-toml/tombi#2141 * perf: speed up lint and format by @ya7010 in tombi-toml/tombi#2142 * perf: reduce stdin runtime overhead by @ya7010 in tombi-toml/tombi#2143 * perf(json): accelerate long string parsing by @ya7010 in tombi-toml/tombi#2145 * perf(json): optimize lexer and parser hot paths by @ya7010 in tombi-toml/tombi#2146 **Full Changelog**: https://github.com/tombi-toml/tomb… (truncated) </details> <details> <summary>uv: `0.12.5` → `0.12.7` (astral-sh/uv)</summary> ### 0.12.6 ## Release Notes Released on 2026-08-25. ### Python - Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 [#21295](astral-sh/uv#21295)) ### Enhancements - Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links ([#21261](astral-sh/uv#21261)) - Limit warnings about unbounded `uv_build` requirements to source-distribution builds ([#21078](astral-sh/uv#21078)) - Display byte counts below 1 KiB without a fractional part ([#21237](astral-sh/uv#21237)) ### Preview features - Add `uv workspace metadata --sync --exact` to remove packages outside the selected resolution ([#21117](astral-sh/uv#21117)) - Add the `artifact-hash-filtering` preview feature to make `uv pip compile --generate-hashes` honor `--only-binary` and `--no-binary` ([#21235](astral-sh/uv#21235)) - Respect package-specific `exclude-newer` cutoffs when `uv check` selects its `ty` executable ([#21227](astral-sh/uv#21227)) - Preserve virtual-environment hints from `tar-codec` source-distribution errors when the base interpreter is outside a `bin` directory ([#21146](astral-sh/uv#21146)) ### Performance - Enable profile-guided optimization for Linux x86-64 release binaries ([#21001](astral-sh/uv#21001)) - Enable profile-guided optimization for Windows x86-64 release binaries ([#21003](astral-sh/uv#21003)) - Enable profile-guided optimization for macOS ARM64 release binaries ([#21002](astral-sh/uv#21002)) - Enable profile-guided optimization for Linux ARM64 release binaries ([#21004](astral-sh/uv#21004)) - Speed up syncing projects with many activated conflict items by reusing their encoded representation ([#21148](https://github.com/astral-sh/uv/pull/21148))… (truncated) ### 0.12.7 ## Release Notes Released on 2026-08-27. ### Python - Replace managed Python installations when upgrading to a newer build of the same version ([#21323](astral-sh/uv#21323)) ### Enhancements - Support Linux `s390x`, `ppc64le`, and `loongarch64` targets for cross-platform dependency resolution ([#21313](astral-sh/uv#21313)) - Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via `UV_AZURE_ENDPOINT_URL` ([#21318](astral-sh/uv#21318)) ### Preview features - Use content-based directory hashes to deduplicate extracted wheels in the cache with the `content-addressed-cache` preview feature ([#19693](astral-sh/uv#19693)) ### Bug fixes - Reject source archives with hash mismatches before persisting their extracted contents to the cache ([#21248](astral-sh/uv#21248)) ### Other changes - remove pyx specific features ([#21182](astral-sh/uv#21182), [#21183](astral-sh/uv#21183), [#21184](astral-sh/uv#21184), [#21185](astral-sh/uv#21185), [#21186](astral-sh/uv#21186)) ## Install uv 0.12.7 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.ps1 | iex" ``` ## Download uv 0.12.7 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.5` → `0.12.7` | `0.12.5` → `0.12.7` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.5` → `0.12.7` (astral-sh/uv)</summary> ### 0.12.6 ## Release Notes Released on 2026-08-25. ### Python - Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 [#21295](astral-sh/uv#21295)) ### Enhancements - Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links ([#21261](astral-sh/uv#21261)) - Limit warnings about unbounded `uv_build` requirements to source-distribution builds ([#21078](astral-sh/uv#21078)) - Display byte counts below 1 KiB without a fractional part ([#21237](astral-sh/uv#21237)) ### Preview features - Add `uv workspace metadata --sync --exact` to remove packages outside the selected resolution ([#21117](astral-sh/uv#21117)) - Add the `artifact-hash-filtering` preview feature to make `uv pip compile --generate-hashes` honor `--only-binary` and `--no-binary` ([#21235](astral-sh/uv#21235)) - Respect package-specific `exclude-newer` cutoffs when `uv check` selects its `ty` executable ([#21227](astral-sh/uv#21227)) - Preserve virtual-environment hints from `tar-codec` source-distribution errors when the base interpreter is outside a `bin` directory ([#21146](astral-sh/uv#21146)) ### Performance - Enable profile-guided optimization for Linux x86-64 release binaries ([#21001](astral-sh/uv#21001)) - Enable profile-guided optimization for Windows x86-64 release binaries ([#21003](astral-sh/uv#21003)) - Enable profile-guided optimization for macOS ARM64 release binaries ([#21002](astral-sh/uv#21002)) - Enable profile-guided optimization for Linux ARM64 release binaries ([#21004](astral-sh/uv#21004)) - Speed up syncing projects with many activated conflict items by reusing their encoded representation ([#21148](https://github.com/astral-sh/uv/pull/21148))… (truncated) ### 0.12.7 ## Release Notes Released on 2026-08-27. ### Python - Replace managed Python installations when upgrading to a newer build of the same version ([#21323](astral-sh/uv#21323)) ### Enhancements - Support Linux `s390x`, `ppc64le`, and `loongarch64` targets for cross-platform dependency resolution ([#21313](astral-sh/uv#21313)) - Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via `UV_AZURE_ENDPOINT_URL` ([#21318](astral-sh/uv#21318)) ### Preview features - Use content-based directory hashes to deduplicate extracted wheels in the cache with the `content-addressed-cache` preview feature ([#19693](astral-sh/uv#19693)) ### Bug fixes - Reject source archives with hash mismatches before persisting their extracted contents to the cache ([#21248](astral-sh/uv#21248)) ### Other changes - remove pyx specific features ([#21182](astral-sh/uv#21182), [#21183](astral-sh/uv#21183), [#21184](astral-sh/uv#21184), [#21185](astral-sh/uv#21185), [#21186](astral-sh/uv#21186)) ## Install uv 0.12.7 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-installer.ps1 | iex" ``` ## Download uv 0.12.7 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.12.7/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

charliermarsh force-pushed the charlie/dirhash-archives branch 3 times, most recently from a0d7c44 to 688d5c2 Compare June 5, 2026 21:48

charliermarsh force-pushed the charlie/dirhash-archives branch 2 times, most recently from a177525 to 1979302 Compare June 9, 2026 19:41

charliermarsh mentioned this pull request Jun 9, 2026

Deduplicate binary payloads in the wheel cache #19694

Draft

charliermarsh force-pushed the charlie/dirhash-archives branch 4 times, most recently from e6d6edd to c57d1d1 Compare June 22, 2026 19:34

charliermarsh marked this pull request as ready for review June 22, 2026 19:34

charliermarsh added enhancement New feature or improvement to existing functionality performance preview Experimental behavior labels Jun 22, 2026

charliermarsh requested review from EliteTK, woodruffw and zanieb June 22, 2026 19:34

charliermarsh commented Jun 22, 2026

View reviewed changes

Comment thread crates/uv-extract/src/dirhash/mod.rs Outdated

This comment was marked as outdated.

Sign in to view

woodruffw reviewed Jun 22, 2026

View reviewed changes

Comment thread crates/uv-extract/src/dirhash/mod.rs Outdated

Comment thread crates/uv-extract/src/dirhash/mod.rs Outdated

Comment thread crates/uv-extract/src/dirhash/mod.rs Outdated

Comment thread crates/uv-extract/src/dirhash/mod.rs Outdated

Comment thread crates/uv-extract/src/stream.rs

charliermarsh requested a review from woodruffw June 23, 2026 18:08

EliteTK reviewed Jun 24, 2026

View reviewed changes

Comment thread crates/uv-distribution/src/distribution_database.rs Outdated

EliteTK reviewed Jun 25, 2026

View reviewed changes

Comment thread crates/uv-extract/src/stream.rs

zanieb reviewed Jun 25, 2026

View reviewed changes

Comment thread crates/uv-dispatch/src/lib.rs Outdated

charliermarsh force-pushed the charlie/dirhash-archives branch from 3064b91 to 64dd896 Compare June 25, 2026 15:54

charliermarsh commented Jun 26, 2026

View reviewed changes

charliermarsh force-pushed the charlie/dirhash-archives branch from 64dd896 to e45c7bf Compare June 26, 2026 16:59

charliermarsh force-pushed the charlie/dirhash-archives branch from 874e83c to 370cb37 Compare August 24, 2026 23:24

charliermarsh had a problem deploying to automations August 24, 2026 23:24 — with GitHub Actions Failure

Avoid duplicate archive filename validation

92d4993

charliermarsh had a problem deploying to automations August 25, 2026 04:12 — with GitHub Actions Failure

Avoid non-preview wheel extraction overhead

7217fbe

charliermarsh had a problem deploying to automations August 25, 2026 13:45 — with GitHub Actions Failure

Pin wheel extraction futures before blocking

96be5e2

charliermarsh had a problem deploying to automations August 25, 2026 14:03 — with GitHub Actions Failure

charliermarsh merged commit a3343a2 into main Aug 25, 2026
116 of 117 checks passed

charliermarsh deleted the charlie/dirhash-archives branch August 25, 2026 20:25

astral-automations-bot Bot mentioned this pull request Aug 25, 2026

uv.schema.json omits the content-addressed-cache preview feature astral-sh/uv-dev#855

Open

BrewTestBot mentioned this pull request Aug 28, 2026

uv 0.12.7 Homebrew/homebrew-core#301065

Merged

scottames-github-bot Bot mentioned this pull request Sep 1, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1045

Merged

1 task

zaniebot mentioned this pull request Sep 11, 2026

Benchmark extraction of published Python wheels astral-sh/uv-dev#1475

Draft

astral-automations-bot Bot mentioned this pull request Sep 22, 2026

Avoid rebuilding a Windows relative path into an absolute form #21923

Merged

Navigation Menu

Repository navigation

Content-address wheel archives with directory hashes - #19693

Content-address wheel archives with directory hashes#19693
charliermarsh merged 25 commits into
mainfrom
charlie/dirhash-archives

charliermarsh commented Jun 5, 2026 •

edited

Loading

Uh oh!

codspeed Bot commented Jun 5, 2026 •

edited

Loading

Uh oh!

astral-sh-bot Bot commented Jun 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

charliermarsh commented Jun 22, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

charliermarsh Jun 26, 2026

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

charliermarsh commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Benchmarks

Uh oh!

codspeed Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

astral-sh-bot Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

uv test inventory changes

Uh oh!

Uh oh!

charliermarsh commented Jun 22, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

charliermarsh Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

charliermarsh commented Jun 5, 2026 •

edited

Loading

codspeed Bot commented Jun 5, 2026 •

edited

Loading

astral-sh-bot Bot commented Jun 5, 2026 •

edited

Loading