Accepting request 1313007 from devel:languages:python

- update to 0.9.5 (bsc#1252399, CVE-2025-62518)
  This release contains an upgrade to astral-tokio-tar, which addresses
  a vulnerability in tar extraction on malformed archives with
  mismatching size information between the ustar header and PAX
  extensions. While the astral-tokio-tar advisory has been graded as
  "high" due its potential broader impact, the specific impact to uv is
  low due to a lack of novel attacker capability. Specifically, uv only
  processes tar archives from source distributions, which already
  possess the capability for full arbitrary code execution by design,
  meaning that an attacker gains no additional capabilities through
  astral-tokio-tar.
  Regardless, we take the hypothetical risk of parser differentials very
  seriously. Out of an abundance of caution, we have assigned this
  upgrade an advisory:
  https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
  * Security
    * Upgrade astral-tokio-tar to 0.5.6 to address a parsing
      differential (#16387)
  * Enhancements
    * Add required environment marker example to hint (#16244)
    * Fix typo in MissingTopLevel warning (#16351)
    * Improve 403 Forbidden error message to indicate package may not
      exist (#16353)
    * Add a hint on uv pip install failure if the --system flag is
      used to select an externally managed interpreter (#16318)
  * Bug fixes
    * Fix backtick escaping for PowerShell (#16307)
  * Documentation
    * Document metadata consistency expectation (#15683)
    * Remove outdated aarch64 musl note (#16385)

OBS-URL: https://build.opensuse.org/request/show/1313007
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-uv?expand=0&rev=58

python-uv-0.9.5.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9fd1dd030b37b51dcf79b582ea77a911eeb4015a00669bd3047d3b6adea37ba8
+size 4752059

python-uv.changes

@@ -1,8 +1,616 @@
 -------------------------------------------------------------------
-Mon Aug 11 09:19:24 UTC 2025 - Nico Krapp <nico.krapp@suse.com>
+Wed Oct 22 05:48:12 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
 
-- Add CVE-2025-54368.patch to fix CVE-2025-54368 (bsc#1247829)
-- bump vendored dependency slab to 0.4.11 to fix CVE-2025-55159 (bsc#1248005)
+- update to 0.9.5 (bsc#1252399, CVE-2025-62518)
+  This release contains an upgrade to astral-tokio-tar, which addresses
+  a vulnerability in tar extraction on malformed archives with
+  mismatching size information between the ustar header and PAX
+  extensions. While the astral-tokio-tar advisory has been graded as
+  "high" due its potential broader impact, the specific impact to uv is
+  low due to a lack of novel attacker capability. Specifically, uv only
+  processes tar archives from source distributions, which already
+  possess the capability for full arbitrary code execution by design,
+  meaning that an attacker gains no additional capabilities through
+  astral-tokio-tar.
+
+  Regardless, we take the hypothetical risk of parser differentials very
+  seriously. Out of an abundance of caution, we have assigned this
+  upgrade an advisory:
+  https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
+
+  * Security
+    * Upgrade astral-tokio-tar to 0.5.6 to address a parsing
+      differential (#16387)
+  * Enhancements
+    * Add required environment marker example to hint (#16244)
+    * Fix typo in MissingTopLevel warning (#16351)
+    * Improve 403 Forbidden error message to indicate package may not
+      exist (#16353)
+    * Add a hint on uv pip install failure if the --system flag is
+      used to select an externally managed interpreter (#16318)
+  * Bug fixes
+    * Fix backtick escaping for PowerShell (#16307)
+  * Documentation
+    * Document metadata consistency expectation (#15683)
+    * Remove outdated aarch64 musl note (#16385)
+
+-------------------------------------------------------------------
+Sun Oct 19 22:01:08 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.9.4 
+ * Enhancements
+  * Add CUDA 13.0 support 
+  * Add auto-detection for Intel GPU on Windows 
+  * Implement display of RFC 9457 HTTP error contexts 
+ * Bug fixes
+  * Avoid obfuscating pyx tokens in uv auth token output 
+
+-------------------------------------------------------------------
+Thu Oct 16 22:24:47 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.9.3
+ * Enhancements
+  * Obfuscate secret token values in logs
+ * Bug fixes
+ * Fix workspace with relative pathing
+
+-------------------------------------------------------------------
+Fri Oct 10 21:02:22 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.9.2
+ * Enhancements
+  * Log Python choice in uv init 
+  * Fix pylock.toml config conflict error messages 
+  * Avoid inferring check URLs for pyx in uv publish 
+  * Add uv tool list --show-python 
+ * Configuration
+  * 
+  * Add UV_UPLOAD_HTTP_TIMEOUT and respect UV_HTTP_TIMEOUT in uploads 
+  * Support UV_WORKING_DIRECTORY for setting --directory 
+ * Bug fixes
+  * Allow missing Scripts directory 
+  * Fix handling of Python requests with pre-releases in ranges 
+  * Preserve comments on version bump 
+  * Retry all HTTP/2 errors 
+  * Treat deleted Windows registry keys as equivalent to missing ones 
+  * Ignore pre-release Python versions when a patch version is requested 
+ * Documentation
+  * Document why uv discards upper bounds on requires-python 
+  * Document uv version environment variables were added in 
+  * Add missing "added in" to new environment variables in reference 
+
+-------------------------------------------------------------------
+Wed Oct  8 17:16:36 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.9.0:
+ * Enhancements
+  * Don't warn when a dependency is constrained by another dependency 
+ * Bug fixes
+  * Fix uv python upgrade / install output when there is a no-op for one request 
+  * Surface pinned-version hint when uv tool upgrade can’t move the tool 
+  * Ban pre-release versions in uv python upgrade requests 
+  * Fix uv python upgrade replacement of installed binaries on pre-release to stable 
+ * Documentation
+  * Update uv pip compile args in layout.md 
+
+-------------------------------------------------------------------
+Tue Oct  7 12:04:24 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.24 
+ * Enhancements
+  * Add UV_SKIP_WHEEL_FILENAME_CHECK to allow installing invalid wheels
+  * Emit a message on cache clean and prune when lock is held
+  * Add --force flag for uv cache prune
+ * Documentation
+  * Document transparent x86_64 emulation on aarch64
+  * Document why we ban URLs from index dependencies
+  * Fix rendering of _CONDA_ROOT in reference
+  * Fix example of bumping beta version without patch bump
+ * Bug fixes
+  * Avoid rejecting already-installed URL distributions with --no-sources
+  * Confirm that the directory name is a valid Python install key during managed check
+  * Ignore origin when comparing installed tools
+  * Make cache control lookups robust to username
+  * Re-order lock validation checks by severity 
+  * Remove tracking of inferred dependency conflicts
+  * Respect --no-color on the CLI
+  * Deduplicate marker-specific dependencies in uv pip tree output
+
+-------------------------------------------------------------------
+Mon Sep 29 08:05:11 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
+
+- Remove uv-bash-completion, uv-fish-completion and uv-zsh-completion
+  packages as recommendations in the base package.
+  bsc#1249637
+
+-------------------------------------------------------------------
+Thu Sep 25 13:48:30 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update 0.8.22
+ * Security
+  * Upgrade astral-tokio-tar to 0.5.5 which hardens tar archive extraction 
+ * Preview features
+  * Add support for S3 request signing 
+  * Allow upgrading pre-release versions of the same minor Python version 
+ * Enhancements
+  * Refresh lockfile when --refresh is provided 
+  * Add --force flag for uv cache clean 
+  * Improve resolution errors with proxied packages 
+ * Bug fixes
+  * Hide freethreaded+debug Python downloads in uv python list 
+  * Retain the cache lock and temporary caches during uv run and uvx 
+ * Documentation
+  * Add package level conflicts to the conflicting dependencies docs 
+  * Document pyodide support 
+  * Document support for free-threaded and debug Python versions 
+  * Expand the contribution docs on issue selection 
+  * Tweak title for viewing version in project guide 
+
+-------------------------------------------------------------------
+Mon Sep 22 15:21:28 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.19 
+* Bug fixes
+ * Make uv cache clean parallel process safe
+ * Fix implied platform_machine marker for win_arm64 platform tag
+
+-------------------------------------------------------------------
+Thu Sep 18 09:47:19 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- upate to 0.8.18
+ * Enhancements
+  * Add PyG packages to torch backend 
+  * Add handling for unnamed conda environments in base environment detection 
+  * Allow selection of debug build interpreters 
+  * Improve uv init defaults for native build backend cache keys 
+  * Error when pyproject.toml target does not exist for dependency groups 
+  * Infer check URL from publish URL when known 
+  * Support Gitlab CI/CD as a trusted publisher 
+  * Add GraalPy 25.0.0 with support for Python 3.12 
+  * Add --no-clear to uv venv to disable removal prompts 
+  * Add conflict detection between --only-group and --extra flags 
+  * Allow [project] to be missing from a pyproject.toml 
+  * Always treat conda environments named base and root as base environments 
+  * Improve log message when direct build for uv_build is skipped 
+  * Log when the cache is disabled 
+  * Show pyx organization name after authenticating 
+  * Use _CONDA_ROOT to detect Conda base environments 
+  * Include blake2b hash in uv publish upload form 
+  * Fix misleading debug message when removing environments in uv sync 
+ * Deprecations
+  * Deprecate tool.uv.dev-dependencies 
+ * Preview features
+  * Propagate preview flag to client for native-auth feature 
+  * Store native credentials for realms with the https scheme stripped 
+  * Use the root index URL when retrieving credentials from the native store 
+ * Bug fixes
+  * Fix uv sync --no-sources not switching from editable to registry installations 
+  * Avoid display of an empty string when a path is the working directory 
+  * Allow cached environment reuse with @latest 
+  * Allow escaping spaces in --env-file handling 
+  * Avoid ANSI codes in debug! messages 
+  * Improve BSD tag construction 
+  * Include SHA when listing lockfile changes 
+  * Invert the logic for determining if a path is a base conda environment 
+  * Load credentials for explicit members when lowering 
+  * Re-add triton as a torch backend package 
+  * Respect UV_INSECURE_NO_ZIP_VALIDATION=1 in duplicate header errors 
+ * Documentation
+  * Add GitHub Actions to PyPI trusted publishing example 
+  * Add Coiled integration documentation 
+  * Add verbose output to the getting help section 
+  * Document NO_PROXY support 
+  * Document cache-keys for native build backends 
+  * Add documentation for dependency group requires-python 
+
+-------------------------------------------------------------------
+Fri Sep 12 09:13:31 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
+
+- Update python-uv requirement for completion packages
+
+-------------------------------------------------------------------
+Thu Sep 12 05:39:40 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
+
+- Completion packages renamed as uv-bash-completion instead of having
+  one per flavor. bsc#1249345
+- Add uv-bash-completion, uv-fish-completion and uv-zsh-completion
+  packages as recommendations in the base package.
+
+-------------------------------------------------------------------
+Thu Sep 11 12:04:28 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to  0.8.17
+ * Enhancements
+  * Improve error message for HTTP validation in auth services 
+  * Respect PYX_API_URL when suggesting uv auth login on 401 
+  * Add pyx as a supported PyTorch index URL 
+ * Bug fixes
+  * Avoid initiating login flow for invalid API keys 
+  * Do not search for a password for requests with a token attached already 
+  * Filter pre-release Python versions in uv init --script 
+
+-------------------------------------------------------------------
+Wed Sep 10 11:03:40 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.16
+ * Enhancements
+  * Allow --editable to override editable = false annotations 
+  * Allow editable = false for workspace sources 
+  * Show a dedicated error for virtual environments in source trees on build 
+  * Support Android platform tags 
+  * Support iOS platform tags 
+  * Support scripts with inline metadata in --with-requirements and --requirements 
+ * Preview features
+  * Support --no-project in uv format 
+  * Allow uv format in unmanaged projects 
+ * Bug fixes
+  * Avoid erroring when match-runtime target is optional 
+  * Ban empty usernames and passwords in uv auth 
+  * Error early for parent path in build backend 
+  * Retry on IO errors during HTTP/2 streaming 
+  * Support recursive requirements and constraints inclusion 
+  * Use token store credentials for uv publish 
+  * Fix virtual environment activation script compatibility with latest nushell 
+  * Skip Python interpreters that cannot be queried with permission errors 
+ * Documentation
+  * Clarify that uv auth commands take a URL 
+  * Improve the CLI help for options that accept requirements files 
+  * Adds example for caching for managed Python downloads in Docker builds 
+
+-------------------------------------------------------------------
+Thu Sep  4 11:03:52 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.15
+ * Enhancements
+  * Add uv auth commands for credential management 
+  * Add pyx support to uv auth commands 
+  * Add uv tree --show-sizes to show package sizes 
+  * Add --python-platform riscv64-unknown-linux 
+  * Add --python-platform to uv run and uv tool 
+  * Add uv publish --dry-run 
+  * Add zstandard support for wheels 
+  * Allow registries to pre-provide core metadata 
+  * Retry streaming Python and binary download errors 
+ * Bug fixes
+  * Fix settings rendering for extra-build-dependencies 
+  * Skip non-existent directories in bytecode compilation 
+ * Error messages
+  * Add error trace to invalid package format 
+
+-------------------------------------------------------------------
+Tue Sep  2 14:56:39 UTC 2025 - Nico Krapp <nico.krapp@suse.com>
+
+- Update vendor tarball to fix CVE-2025-58160 (bsc#1249011) 
+
+-------------------------------------------------------------------
+Thu Aug 28 22:10:39 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.14
+ * Enhancements
+  * Add --python-platform to uv pip check 
+  * Add an environment variable for UV_ISOLATED 
+  * Add logging to the uv build backend 
+  * Allow more trailing null bytes in zip files 
+  * Allow pinning managed Python versions to specific build versions 
+  * Cache PyTorch wheels by default 
+  * Reject already-installed wheels that don't match the target platform 
+  * Add --no-install-local option to uv sync, uv add and uv export 
+  * Include cycle error message in uv pip CLI 
+ * Preview features
+  * Fix format of {version} on uv format failure 
+  * Lock during installs in uv format to prevent races 
+  * Respect --project in uv format 
+  * Run uv format in the project root 
+ * Configuration
+  * Add file-to-CLI overrides for build isolation configuration 
+  * Add file-to-CLI overrides for reinstall configuration 
+ * Performance
+  * Cache WHEEL and METADATA reads in installed distributions 
+ * Bug fixes
+  * Avoid erroring when creating venv in current working directory 
+  * Avoid introducing unnecessary system dependency on CUDA 
+  * Clear discovered site packages when creating virtual environment 
+  * Read index credentials from the environment during uv publish checks 
+  * Refuse to remove non-virtual environments in uv venv 
+  * Stop setting CLICOLOR_FORCE=1 when calling build backends 
+  * Support file or directory removal for Windows symlinks 
+ * Documentation
+  * Fix GitHub guide highlight lines 
+  * Move Resolver to new Internals section in the Reference 
+  * Split the "Authentication" page into sections 
+  * Update uninstall docs to mention uvw.exe needs to be removed 
+
+-------------------------------------------------------------------
+Fri Aug 22 13:54:55 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.13
+ * Enhancements
+  * Add --no-install-* arguments to uv add 
+  * Initialize Git prior to reading author in uv init 
+  * Add CUDA 129 to available torch backends 
+  * Update Pyodide to 0.28.2 
+ * Preview features
+  * Add an experimental uv format command 
+  * Allow version specifiers in extra-build-dependencies if match-runtime is explicitly false 
+ * Bug fixes
+  * Add triton to torch-backend manifest 
+  * Avoid panicking when resolver returns stale distributions 
+  * Fix uv_build wheel hashes 
+  * Treat --upgrade-package on the command-line as overriding upgrade = false in configuration 
+
+-------------------------------------------------------------------
+Wed Aug 20 09:03:55 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.12
+ * Enhancements
+  * Add an aarch64-pc-windows-msvc target for python-platform 
+  * Add fallback parent process detection to uv tool update-shell 
+  * Install non-build-isolation packages in a second phase 
+  * Add hint when virtual environments are included in source distributions 
+  * Add Docker images derived from buildpack-deps:trixie, debian:trixie-slim, alpine:3.22 
+ * Bug fixes
+  * Reject already-installed wheels built with outdated settings 
+  * Skip interpreters that are not found on query 
+  * Handle dotted package names in script path resolution 
+  * Reject match-runtime = true for dynamic packages 
+ * Documentation
+  * Document improvements to build-isolation setups 
+  * Fix reference documentation recommendation to use uv cache clean instead of clear 
+
+-------------------------------------------------------------------
+Fri Aug 15 17:37:36 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.11
+ * Enhancements
+  * Add extra-build-dependencies hint for any missing module on build failure 
+  * Make 'v' prefix cyan in overlap warnings 
+ * Bug fixes
+  * Fix missing uv version in extended Docker image tags 
+  * Persist cache info when re-installing cached wheels 
+ * Rust API
+  *Allow passing custom reqwest clients to RegistryClient
+
+-------------------------------------------------------------------
+Thu Aug 14 09:13:47 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.10 
+ * Enhancements
+  * Allow Python requests with missing segments, e.g., just aarch64 
+ * Preview
+  * Move warnings for conflicting modules into preview 
+
+-------------------------------------------------------------------
+Tue Aug 12 09:30:49 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.9
+ * Enhancements
+  * Add --reinstall flag to uv python upgrade 
+ * Bug fixes
+  * Include build settings in cache key for registry source distribution lookups 
+  * Avoid creating bin links on uv python upgrade if they don't already exist 
+  * Respect system proxies on macOS and Windows 
+ * Documentation
+  * Add the 3.14 classifier 
+
+-------------------------------------------------------------------
+Sat Aug  9 10:32:25 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.8
+ - long changelog at https://github.com/astral-sh/uv/blob/main/CHANGELOG.mode
+ - fixed CVE-2025-54368 - boo#1247829 
+
+-------------------------------------------------------------------
+Wed Aug  6 12:36:01 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.5
+ * Enhancements
+  * Enable uv run with a GitHub Gist 
+  * Improve HTTP response caching log messages 
+  * Show wheel tag hints in install plan 
+  * Support installing additional executables in uv tool install 
+ * Preview features
+  * Enable extra build dependencies to 'match runtime' versions 
+  * Remove duplicate extra-build-dependencies warnings for uv pip 
+  * Use "option" instead of "setting" in pylock warning 
+  * Respect extra build requires when reading from wheel cache 
+  * Preserve lowered extra build dependencies 
+ * Bug fixes
+  * Add Python versions to markers implied from wheels 
+  * Ensure consistent indentation when adding dependencies 
+  * Fix handling of python-preference = system when managed interpreters are on the PATH 
+  * Fix symlink preservation in virtual environment creation 
+  * Gracefully handle entrypoint permission errors 
+  * Include wheel hashes from local Simple indexes 
+  * Prefer system Python installations over managed ones when --system is used 
+  * Remove retry wrapper when matching on error kind 
+  * Revert h2 upgrade 
+ * Documentation
+  * Improve visibility of copy and line separator in dark mode 
+
+-------------------------------------------------------------------
+Thu Jul 31 15:49:55 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.4
+ * Enhancements
+  * Improve styling of warning cause chains 
+  * Extend wheel filtering to Android tags 
+  * Perform wheel lockfile filtering based on platform and OS intersection 
+  * Clarify messaging when a new resolution needs to be performed 
+ * Preview features
+  * Add support for extending package's build dependencies with extra-build-dependencies 
+  * Split preview mode into separate feature flags 
+ * Configuration
+  * Add support for package specific exclude-newer dates via exclude-newer-package 
+ * Bug fixes
+  * Avoid invalidating lockfile when path or workspace dependencies define explicit indexes 
+  * Copy entrypoints that have a shebang that differs in python vs python3 
+  * Fix incorrect file permissions in wheel packages 
+  * Update validation for environments and required-environments in uv.toml 
+ * Documentation
+  * Show uv_build in projects documentation 
+  * Add UV_ prefix to installer environment variables 
+  * Un-hide uv from --build-backend options 
+  * Update documentation for preview flags 
+
+-------------------------------------------------------------------
+Sun Jul 27 20:33:23 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.3:
+ * Enhancements
+  * Allow non-standard entrypoint names in uv_build 
+  * Publish riscv64 wheels to PyPI 
+ * Bug fixes
+  * Avoid writing redacted credentials to tool receipt 
+  * Respect --with versions over base environment versions 
+  * Respect credentials from all defined indexes 
+  * Fix missed stabilization of removal of registry entry during Python uninstall 
+  * Improve concurrency safety of Python downloads into cache 
+ * Documentation
+  * Fix typos in uv_build reference documentation 
+  * Move the "Cargo" install method further down in docs 
+
+-------------------------------------------------------------------
+Wed Jul 23 17:58:13 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.2
+
+ * Configuration
+   * Add UV_INIT_BUILD_BACKEND 
+ * Rust API
+   * Expose tls_built_in_root_certs for client 
+ * Enhancements
+   * Add derivation chains for dependency errors 
+   * Add support for HF_TOKEN 
+   * Allow --config-settings-package to apply configuration settings at the package level 
+   * Create (e.g.) python3.13t executables in uv venv 
+   * Disallow writing symlinks outside the source distribution target directory 
+   * Elide traceback when python -m uv in interrupted with Ctrl-C on Windows 
+   * Match --bounds formatting for uv_build bounds in uv init 
+   * Support extras and dependency_groups markers in PEP 508 grammar 
+   * Support extras and dependency_groups markers on uv pip install and uv pip sync 
+   * Add hint to use uv self version when uv version cannot find a project 
+   * Improve error reporting when removing Python versions from the Windows registry 
+   * Make warnings about masked [tool.uv] fields more precise 
+ * Preview features
+   * Emit JSON output in uv sync with --quiet 
+ * Bug fixes
+   * Avoid reading files in the environment bin that are not entrypoints 
+   * Avoid removing empty directories when constructing virtual environments 
+   * Preserve index URL priority order when writing to pyproject.toml 
+   * Allow removal of virtual environments with missing interpreters 
+   * Apply Cache-Control overrides to response, not request headers 
+   * Copy entry points into ephemeral environments to ensure layers are respected 
+   * Workaround Jupyter Lab application directory discovery in ephemeral environments 
+   * Enforce requires-python in pylock.toml 
+   * Fix kebab casing of README variants in build backend 
+   * Improve concurrency resilience of removing Python versions from the Windows registry 
+   * Retry HTTP requests on invalid data errors 
+   * Update virtual environment removal to delete pyvenv.cfg last 
+   * Error on unknown fields in dependency-metadata 
+
+-------------------------------------------------------------------
+Fri Jul 18 18:14:03 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.8.0
+ * Breaking changes
+   * Install Python executables into a directory on the PATH
+   * Prompt before removing an existing directory in uv venv
+   * Validate that discovered interpreters meet the Python preferences
+   * Install dependencies without build systems when they are path sources
+   * Install dependencies without build systems when they are workspace members
+   * Bump --python-platform linux to manylinux_2_28
+   * Remove uv version fallback
+   * Require --global for removal of the global Python pin
+   * Support conflicting editable settings across groups
+   * Make uv_build the default build backend in uv init
+   * Set default UV_TOOL_BIN_DIR on Docker images
+   * Update --check to return an exit code of 1
+   * Use an ephemeral environment for uv run --with invocations
+   * Restructure the uv venv command output and exit codes
+   * Default to --workspace when adding subdirectories
+   * Add missing validations for disallowed uv.toml fields
+ * Configuration
+   * Add support for toggling Python bin and registry install options via env vars 
+   * Add UV_COMPILE_BYTECODE_TIMEOUT environment variable 
+   * Allow users to override index cache-control headers 
+   * Add UV_LIBC to override libc selection in multi-libc environment 
+ * Bug fixes
+   * Fix --all-arches when paired with --only-downloads 
+   * Skip Windows Python interpreters that return a broken MSIX package code 
+   * Warn on invalid uv.toml when provided via direct path 
+   * Improve async signal safety in Windows exception handler 
+ * Documentation
+   * Mention the revision in the lockfile versioning doc 
+   * Move "Conflicting dependencies" to the "Resolution" page 
+   * Rename "Dependency specifiers" section to exclude PEP 508 reference 
+   * Suggest uv cache clean prior to --reinstall 
+ * Preview features
+   * Make preview Python registration on Windows non-fatal 
+   * Update preview installation of Python executables to be non-fatal 
+   * Add uv python update-shell 
+
+-------------------------------------------------------------------
+Tue Jul 15 08:11:49 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.7.21
+ * Enhancements
+   * Add --python-platform to uv sync 
+   * Support pre-releases in uv version --bump 
+   * Add -w shorthand for --with 
+   * Add an exception handler on Windows to display information on crash 
+   * Add hint when Python downloads are disabled 
+   * Add UV_HTTP_RETRIES to customize retry counts 
+   * Follow leaf symlinks matched by globs in cache-key 
+   * Support parent path components (..) in globs in cache-key 
+   * Improve cache-key performance 
+ * Preview features
+   * Add uv sync --output-format json 
+ * Bug fixes
+   * Do not re-resolve with a new Python version in uv tool if it is incompatible with --python 
+ * Documentation
+   * Document how to nest dependency groups with include-group 
+   * Fix repeated word in Pyodide doc 
+   * Update CONTRIBUTING.md with instructions to format Markdown files via Docker 
+   * Fix version number for setup-python 
+
+-------------------------------------------------------------------
+Sun Jul 13 13:50:02 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.7.20
+ * Enhancements
+   * Add --workspace flag to uv add 
+   * Add auto-detection for Intel GPUs 
+   * Drop trailing arguments when writing shebangs 
+   * Add debug message when skipping Python downloads 
+   * Add support for declaring multiple modules in namespace packages 
+ * Bug fixes
+   * Revert normalization of trailing slashes on index URLs 
+   * Fix forced resolution with all extras in uv version 
+   * Fix handling of pre-releases in preferences 
+   * Remove transparent variants in uv-extract to enable retries 
+ * Rust API
+   * Add method to get packages involved in a NoSolutionError 
+   * Make ErrorTree for NoSolutionError public 
+ * Documentation
+   * Finish incomplete sentence in pip migration guide 
+   * Remove cache-dependency-glob examples for setup-uv 
+   * Remove uv pip sync suggestion with pyproject.toml 
+   * Update documentation for GitHub to use setup-uv@v6 
+
+-------------------------------------------------------------------
+Sat Jul  5 00:05:00 UTC 2025 - Ondřej Súkup <mimi.vx@gmail.com>
+
+- update to 0.7.19
+ * The uv build backend is now stable, and considered ready for production use.
+ * Enhancements
+   * Ignore Python patch version for --universal pip compile
+   * Update the tilde version specifier warning to include more context
+   * Clarify behavior and hint on tool install when no executables are available
+ * Bug fixes
+   * Make project and interpreter lock acquisition non-fatal
+   * Includes sys.prefix in cached environment keys to avoid --with collisions across projects 
+ * Documentation
+   * Add a migration guide from pip to uv projects 
 
 -------------------------------------------------------------------
 Wed Jul  2 10:33:55 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>

python-uv.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-uv
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2025 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -33,20 +33,18 @@
 %bcond_without libalternatives
 %{?sle15_python_module_pythons}
 Name:           python-uv
-Version:        0.7.18
+Version:        0.9.5
 Release:        0
 Summary:        A Python package installer and resolver, written in Rust
 License:        Apache-2.0 OR MIT
 URL:            https://github.com/astral-sh/uv
 Source0:        https://github.com/astral-sh/uv/archive/refs/tags/%{version}.tar.gz#/%{name}-%{version}.tar.gz
 Source1:        vendor.tar.zst
-# PATCH-FIX-UPSTREAM CVE-2025-54368.patch bsc#1247829
-Patch0:         CVE-2025-54368.patch
 BuildRequires:  %{python_module maturin}
 BuildRequires:  %{python_module pip}
 BuildRequires:  %{python_module tomli}
 BuildRequires:  alts
-BuildRequires:  cargo >= 1.86
+BuildRequires:  cargo >= 1.88
 BuildRequires:  cargo-packaging
 BuildRequires:  cmake
 BuildRequires:  fdupes
@@ -67,34 +65,37 @@ Provides:       uv = %{version}
 Requires:       alts
 Requires:       python3
 
-%package        fish-completion
+%package        -n uv-fish-completion
 Summary:        Fish Completion for %{name}
-Supplements:    (%{name} and fish)
-Requires:       %{name}
+Provides:       python-uv-fish-completion = %{version}
+Supplements:    (uv and fish)
 Requires:       fish
+Requires:       uv
 BuildArch:      noarch
 
-%description    fish-completion
+%description    -n uv-fish-completion
 Fish command-line completion support for %{name}.
 
-%package        zsh-completion
+%package        -n uv-zsh-completion
 Summary:        Zsh Completion for %{name}
-Supplements:    (%{name} and zsh)
-Requires:       %{name}
+Provides:       python-uv-zsh-completion = %{version}
+Supplements:    (uv and zsh)
+Requires:       uv
 Requires:       zsh
 BuildArch:      noarch
 
-%description    zsh-completion
+%description    -n uv-zsh-completion
 Zsh command-line completion support for %{name}.
 
-%package        bash-completion
+%package        -n uv-bash-completion
 Summary:        Bash Completion for %{name}
-Supplements:    (%{name} and bash-completion)
-Requires:       %{name}
+Provides:       python-uv-bash-completion = %{version}
+Supplements:    (uv and bash-completion)
 Requires:       bash-completion
+Requires:       uv
 BuildArch:      noarch
 
-%description    bash-completion
+%description    -n uv-bash-completion
 Bash command-line completion support for %{name}.
 
 %python_subpackages
@@ -158,12 +159,12 @@ export CARGO_PROFILE_RELEASE_STRIP=false
 %python_clone -a %{buildroot}%{_bindir}/uvx
 %python_group_libalternatives uvx
 
-%python_expand uv-%{$python_bin_suffix} --generate-shell-completion bash > %{buildroot}%{_datadir}/bash-completion/completions/uv-%{$python_bin_suffix}
-%python_expand uv-%{$python_bin_suffix} --generate-shell-completion fish > %{buildroot}%{_datadir}/fish/vendor_completions.d/uv-%{$python_bin_suffix}.fish
-%python_expand uv-%{$python_bin_suffix} --generate-shell-completion zsh  > %{buildroot}%{_datadir}/zsh/site-functions/_uv-%{$python_bin_suffix}
-%python_expand uv-%{$python_bin_suffix} tool uvx --generate-shell-completion bash > %{buildroot}%{_datadir}/bash-completion/completions/uvx-%{$python_bin_suffix}
-%python_expand uv-%{$python_bin_suffix} tool uvx --generate-shell-completion fish > %{buildroot}%{_datadir}/fish/vendor_completions.d/uvx-%{$python_bin_suffix}.fish
-%python_expand uv-%{$python_bin_suffix} tool uvx --generate-shell-completion zsh  > %{buildroot}%{_datadir}/zsh/site-functions/_uvx-%{$python_bin_suffix}
+%python_expand uv-%{$python_bin_suffix} --generate-shell-completion bash > %{buildroot}%{_datadir}/bash-completion/completions/uv
+%python_expand uv-%{$python_bin_suffix} --generate-shell-completion fish > %{buildroot}%{_datadir}/fish/vendor_completions.d/uv.fish
+%python_expand uv-%{$python_bin_suffix} --generate-shell-completion zsh  > %{buildroot}%{_datadir}/zsh/site-functions/_uv
+%python_expand uv-%{$python_bin_suffix} tool uvx --generate-shell-completion bash > %{buildroot}%{_datadir}/bash-completion/completions/uvx
+%python_expand uv-%{$python_bin_suffix} tool uvx --generate-shell-completion fish > %{buildroot}%{_datadir}/fish/vendor_completions.d/uvx.fish
+%python_expand uv-%{$python_bin_suffix} tool uvx --generate-shell-completion zsh  > %{buildroot}%{_datadir}/zsh/site-functions/_uvx
 
 %pre
 %python_libalternatives_reset_alternative uv
@@ -177,22 +178,22 @@ export CARGO_PROFILE_RELEASE_STRIP=false
 %{python_sitearch}/uv
 %{python_sitearch}/uv-%{version}.dist-info
 
-%files %{python_files bash-completion}
+%files -n uv-bash-completion
 %dir %{_datadir}/bash-completion
 %dir %{_datadir}/bash-completion/completions
-%{_datadir}/bash-completion/completions/uv-%{python_bin_suffix}
-%{_datadir}/bash-completion/completions/uvx-%{python_bin_suffix}
+%{_datadir}/bash-completion/completions/uv
+%{_datadir}/bash-completion/completions/uvx
 
-%files %{python_files fish-completion}
+%files -n uv-fish-completion
 %dir %{_datadir}/fish
 %dir %{_datadir}/fish/vendor_completions.d
-%{_datadir}/fish/vendor_completions.d/uv-%{python_bin_suffix}.fish
-%{_datadir}/fish/vendor_completions.d/uvx-%{python_bin_suffix}.fish
+%{_datadir}/fish/vendor_completions.d/uv.fish
+%{_datadir}/fish/vendor_completions.d/uvx.fish
 
-%files %{python_files zsh-completion}
+%files -n uv-zsh-completion
 %dir %{_datadir}/zsh
 %dir %{_datadir}/zsh/site-functions
-%{_datadir}/zsh/site-functions/_uv-%{python_bin_suffix}
-%{_datadir}/zsh/site-functions/_uvx-%{python_bin_suffix}
+%{_datadir}/zsh/site-functions/_uv
+%{_datadir}/zsh/site-functions/_uvx
 
 %changelog