Avoid writing lockfiles when reading workspace metadata by AlexWaygood · Pull Request #21821 · astral-sh/uv

AlexWaygood · 2026-09-18T12:19:10Z

Summary

Reading workspace metadata currently creates or updates lockfiles even when no environment synchronization was requested. Since ty queries this metadata, uv check --isolated can unexpectedly write uv.lock, including when invoked by ty-pre-commit.

Make metadata queries reuse an up-to-date lockfile or resolve dependencies in memory without writing the result. Only --sync permits lockfile writes. --locked requires an up-to-date lockfile, while --frozen uses the existing lockfile even if outdated; neither permits writes, including with --sync. The same default applies to script metadata. The now-redundant --dry-run option is removed.

uv check also forwards enabled frozen and locked settings to the ty subprocess through the existing UV_FROZEN and UV_LOCKED variables. Disabled settings are removed from that subprocess's environment, so the metadata queries ty launches honor --no-frozen and --no-locked even when those environment variables were inherited.

Test coverage

The existing isolated and frozen uv check tests already assert the relevant lockfile and environment invariants, so this PR adapts those tests to exercise the newer metadata integration. They now use the existing workspace_check helper, which selects ty 0.0.80, instead of ty 0.0.17. The fixture index is supplied through UV_INDEX so that the metadata subprocess launched by ty inherits it.

Two of the adapted --no-sync snapshots now contain a uv-metadata warning instead of reporting success. These fixtures intentionally leave dependencies uninstalled, so newer ty reports that module ownership and editable source paths are unavailable. The assertions that the lockfile and environment remain unchanged are retained.

The frozen test also changes the declared dependency to an unavailable version after creating the lockfile, verifying that the metadata query actually uses the frozen resolution. The isolated test checks that --no-frozen --no-locked overrides inherited UV_FROZEN and UV_LOCKED settings.

A new integration test exercises uv workspace metadata directly. It checks that a missing lockfile is not created and a stale lockfile remains unchanged while the returned metadata reflects updated requirements. It also covers explicit synchronization and locked/frozen behavior.

Fixes astral-sh/ty-pre-commit#31.

astral-sh-bot · 2026-09-18T12:43:17Z

uv test inventory changes

This PR changes the tests when compared with the main base revision.

Added tests: 2
Removed tests: 0
Changed suites: 1

uv::workspace: +2 / -0

Added:

uv::workspace::workspace_metadata::workspace_metadata_lockfile
uv::workspace::workspace_metadata::workspace_metadata_script_lockfile

Removed: none

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.12.16` → `0.12.17` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/51) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217) [Compare Source](astral-sh/uv@0.12.16...0.12.17) Released on 2026-09-18. ##### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ##### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ##### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ##### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ##### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/58 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.12.16` → `0.12.17` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217) [Compare Source](astral-sh/uv@0.12.16...0.12.17) Released on 2026-09-18. ##### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ##### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ##### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ##### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ##### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/47 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [uv](https://github.com/astral-sh/uv) | tools | patch | `0.12.13` → `0.12.17` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217) [Compare Source](astral-sh/uv@0.12.16...0.12.17) Released on 2026-09-18. ##### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ##### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ##### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ##### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ##### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216) [Compare Source](astral-sh/uv@0.12.15...0.12.16) Released on 2026-09-17. ##### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ##### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ##### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ##### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active version pins ([#21742](astral-sh/uv#21742)) - Handle malformed index URLs without panicking when credentials are configured ([#21784](astral-sh/uv#21784)) - Report a configuration error instead of panicking for proxy URLs without a host ([#21781](astral-sh/uv#21781)) - Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#21783](astral-sh/uv#21783)) ### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215) [Compare Source](astral-sh/uv@0.12.14...0.12.15) Released on 2026-09-15. This release fixes a regression in 0.12.14 that lead to rejecting valid installation commands such as using `uv pip install --system` in `python:*` docker images or when using `uv pip install --target .`. ([#21699](astral-sh/uv#21699)) ##### Performance - Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#21675](astral-sh/uv#21675)) ##### Bug fixes - Revert "Reject symlinked wheel installation destinations" ([#21699](astral-sh/uv#21699)) ### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214) [Compare Source](astral-sh/uv@0.12.13...0.12.14) Released on 2026-09-15. Package-operation errors now use uv's standard diagnostics, with consistent hints and compact, labeled cause chains. ([#17110](astral-sh/uv#17110), [#21599](astral-sh/uv#21599), [#21603](astral-sh/uv#21603)) Package-operation exit codes now reflect the underlying cause: expected failures return 1, while recognized operational and internal failures return 2. ([#17110](astral-sh/uv#17110)) ##### Enhancements - Resume interrupted downloads with HTTP Range requests when supported ([#21570](astral-sh/uv#21570)) - Show underlying causes and hints in user warnings ([#21565](astral-sh/uv#21565)) - Show resolver hints for failed `uv tool upgrade` operations ([#21566](astral-sh/uv#21566)) ##### Preview features - Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#21618](astral-sh/uv#21618)) ##### Performance - Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#21619](astral-sh/uv#21619)) - Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#21593](astral-sh/uv#21593)) - Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#21621](astral-sh/uv#21621)) ##### Bug fixes - Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#21672](astral-sh/uv#21672)) - Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#21625](astral-sh/uv#21625)) - Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#21639](astral-sh/uv#21639)) - Redact credentials and signatures from missing-path-segment URL errors ([#21616](astral-sh/uv#21616)) - Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#21640](astral-sh/uv#21640)) - Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#21559](astral-sh/uv#21559)) - Suppress managed-Python fallback warnings under `--quiet` ([#21565](astral-sh/uv#21565)) - Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#21566](astral-sh/uv#21566)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/632

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `uv` Command: `mise upgrade --bump --local uv` <details> <summary>Version changelog (uv)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Automated mise tool upgrades from local config. mise-managed tools: - `action-validator` - `actionlint` - `editorconfig-checker` - `ghalint` - `lychee` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint editorconfig-checker ghalint lychee pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (3 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `4.0.1` → `4.0.2` | `4.0.1` → `4.0.2` | | `rumdl` | `0.2.73` → `0.2.74` | `0.2.73` → `0.2.74` | | `uv` | `0.12.15` → `0.12.17` | `0.12.15` → `0.12.17` | </details> <details> <summary>Release notes (3 tools)</summary> <details> <summary>editorconfig-checker: `4.0.1` → `4.0.2` (editorconfig-checker/editorconfig-checker)</summary> ### v4.0.2 ## [4.0.2](editorconfig-checker/editorconfig-checker@v4.0.1...v4.0.2) (2026-09-16) ### Bug Fixes * **encoding:** detect 7-bit content with control characters as ASCII ([#629](editorconfig-checker/editorconfig-checker#629)) ([289dc53](editorconfig-checker/editorconfig-checker@289dc53)), closes [#627](editorconfig-checker/editorconfig-checker#627) * keep the file's existing line ending when adding a final newline ([#622](editorconfig-checker/editorconfig-checker#622)) ([cea460f](editorconfig-checker/editorconfig-checker@cea460f)) </details> <details> <summary>rumdl: `0.2.73` → `0.2.74` (rvben/rumdl)</summary> ### v0.2.74 ### Added - **code-block-tools**: add explicit rumdl, oxfmt, djlint, and shuck modes ([77f0e55](rvben/rumdl@77f0e55)) ### Fixed - **MD092**: allow scoped suppression of documented conflicts ([6f9a6cb](rvben/rumdl@6f9a6cb)) - **MD032**: keep parent list items open after nested lists ([952c507](rvben/rumdl@952c507)) - **MD026**: delete a setext heading's trailing punctuation where it stands ([7f0981c](rvben/rumdl@7f0981c)) - **parser**: keep link reference definitions out of a setext heading ([80fdfc3](rvben/rumdl@80fdfc3)) - **parser**: read the whole paragraph as a setext heading ([5d7b046](rvben/rumdl@5d7b046)) - **parser**: lint the headings a short or quoted setext underline makes ([e183924](rvben/rumdl@e183924)) - **parser**: keep a container open below a block written inside it ([e2c13b7](rvben/rumdl@e2c13b7)) - **parser**: read an empty list item under a paragraph as its text ([68a04ae](rvben/rumdl@68a04ae)) - **MD013**: write one space at a soft break after a trailing space ([6388794](rvben/rumdl@6388794)) - **MD013**: keep a whole-line display math expression on its own line ([cc518ab](rvben/rumdl@cc518ab)) - **MD013**: read no math span through a code span ([f069246](rvben/rumdl@f069246)) - **MD013**: keep a definition-list marker written on its o… (truncated) </details> <details> <summary>uv: `0.12.15` → `0.12.17` (astral-sh/uv)</summary> ### 0.12.16 ## Release Notes Released on 2026-09-17. ### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](astral-sh/uv#21741)) ### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](astral-sh/uv#21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](astral-sh/uv#21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](astral-sh/uv#21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](astral-sh/uv#21779)) ### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](astral-sh/uv#21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](astral-sh/uv#21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](astral-sh/uv#21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](astral-sh/uv#21744)) ### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](astral-sh/uv#21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](astral-sh/uv#21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](astral-sh/uv#20631)) - Use the bundled `uv_build` backend only when its version matches active versi… (truncated) ### 0.12.17 ## Release Notes Released on 2026-09-18. ### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](astral-sh/uv#21780)) ### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](astral-sh/uv#21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](astral-sh/uv#20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](astral-sh/uv#21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](astral-sh/uv#21821)) ### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](astral-sh/uv#21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](astral-sh/uv#21810)) ### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](astral-sh/uv#21825)) ### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](astral-sh/uv#21817)) ## Install uv 0.12.17 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.17/uv-installer.ps1 | iex" ``` ## Download uv 0.12.17 | File | Platform | Checksum | |--------|----------|----------| | [uv-aarch64-apple-darwin.tar.gz](https://rele… (truncated) </details> </details> Modified files: - `.mise.toml` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Avoid writing lockfiles when reading workspace metadata

30c2a62

AlexWaygood deployed to automations September 18, 2026 12:19 — with GitHub Actions Active

AlexWaygood marked this pull request as ready for review September 18, 2026 12:26

AlexWaygood requested review from MichaReiser and zsol September 18, 2026 12:26

konstin added enhancement New feature or improvement to existing functionality preview Experimental behavior labels Sep 18, 2026

zsol approved these changes Sep 18, 2026

View reviewed changes

Comment thread crates/uv-cli/src/lib.rs Outdated

Comment thread crates/uv-cli/src/lib.rs Outdated

Comment thread crates/uv/src/commands/project/check/ty.rs Outdated

Comment thread crates/uv/tests/workspace/workspace_metadata.rs Outdated

Simplify workspace metadata lockfile handling

ff1f919

AlexWaygood deployed to automations September 18, 2026 14:27 — with GitHub Actions Active

AlexWaygood enabled auto-merge (squash) September 18, 2026 14:28

AlexWaygood merged commit a17ed60 into main Sep 18, 2026
59 checks passed

AlexWaygood deleted the alex/workspace-metadata-no-lockfile-writes branch September 18, 2026 14:33

astral-automations-bot Bot mentioned this pull request Sep 18, 2026

uv publish no longer retries 5xx upload responses astral-sh/uv-dev#1970

Open

BrewTestBot mentioned this pull request Sep 18, 2026

uv 0.12.17 Homebrew/homebrew-core#312078

Merged

saidsef mentioned this pull request Sep 20, 2026

chore(deps): review astral-sh/uv 0.12.13 → 0.12.17 (#447) saidsef/mcp-github-pr-issue-analyser#450

Closed

5 tasks done

scottames-github-bot Bot mentioned this pull request Sep 23, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1074

Merged

1 task

Navigation Menu

Repository navigation

Avoid writing lockfiles when reading workspace metadata - #21821

Avoid writing lockfiles when reading workspace metadata#21821
AlexWaygood merged 2 commits into
mainfrom
alex/workspace-metadata-no-lockfile-writes

AlexWaygood commented Sep 18, 2026 •

edited

Loading

Uh oh!

astral-sh-bot Bot commented Sep 18, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

AlexWaygood commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test coverage

Uh oh!

astral-sh-bot Bot commented Sep 18, 2026

uv test inventory changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

AlexWaygood commented Sep 18, 2026 •

edited

Loading