Python: Bump uv from 0.11.17 to 0.11.21 in /python

[dependabot]

Bumps uv from 0.11.17 to 0.11.21.

Release notes

Sourced from uv's releases.

0.11.21

Release Notes

Released on 2026-06-11.

Python

• Add CPython 3.13.14 and 3.14.6 (#19787)

Preview features

• Add environment.root to uv workspace metadata --sync (#19760)
• Allow uv upgrade to update a single dependency constraint (#19738)
• Compute and pass uv workspace metadata payload in ty check (#19763)
• Make packaged applications the default for uv init (#17841)

Performance

• Add parallel discovery of Python versions for uv python list (#18684)
• Avoid normalizing source distribution names twice (#19784)

Bug fixes

• Improve cache robustness and pruning behavior
  • Allow CI cache pruning without an sdist bucket (#19802)
  • Avoid overflow when reading malformed cache entries (#19799)
  • Preserve cached Python downloads during cache pruning (#19795)
  • Reject running inside the cache (#19659)
• Fix Python discovery and version request edge cases
  • Avoid panics for Unicode Python version requests (#19797)
  • Fix handling of non-critical errors in uv python list with path requests (#19774)
  • Fix stop-discovery-at regression (#19769)
• Harden parsing and validation for package metadata, requirements, markers, URLs, and conflict sets
  • Allow trailing commas in version specifiers (#19806)
  • Avoid panics for invalid UTF-8 URL credentials (#19800)
  • Avoid panics for malformed source distribution filenames (#19776)
  • Avoid panics for trailing extra separators (#19779)
  • Avoid stack overflow for recursive requirements path aliases (#19777)
  • Ignore reversed string compatible-release markers (#19782)
  • Reject duplicate entries in conflict sets (#19801)
  • Reject malformed hash options in requirements files (#19783)
  • Reject source distribution filenames without a separator (#19803)
  • Use UTF-8 lengths for requirement errors (#19781)
  • Use UTF-8 lengths for trailing marker errors (#19796)
  • Use byte offsets when peeking over requirements (#19780)
  • Validate GraalPy ABI suffixes (#19805)
• Improve wheel entry-point error handling and virtual environment activation quoting
  • Propagate errors when reading wheel entry points (#19794)
  • Quote virtual environment activation paths with shell metacharacters (#19798)

... (truncated)

Changelog

Sourced from uv's changelog.

0.11.21

Released on 2026-06-11.

Python

• Add CPython 3.13.14 and 3.14.6 (#19787)

Preview features

• Add environment.root to uv workspace metadata --sync (#19760)
• Allow uv upgrade to update a single dependency constraint (#19738)
• Compute and pass uv workspace metadata payload in ty check (#19763)
• Make packaged applications the default for uv init (#17841)

Performance

• Add parallel discovery of Python versions for uv python list (#18684)
• Avoid normalizing source distribution names twice (#19784)

Bug fixes

• Improve cache robustness and pruning behavior
  • Allow CI cache pruning without an sdist bucket (#19802)
  • Avoid overflow when reading malformed cache entries (#19799)
  • Preserve cached Python downloads during cache pruning (#19795)
  • Reject running inside the cache (#19659)
• Fix Python discovery and version request edge cases
  • Avoid panics for Unicode Python version requests (#19797)
  • Fix handling of non-critical errors in uv python list with path requests (#19774)
  • Fix stop-discovery-at regression (#19769)
• Harden parsing and validation for package metadata, requirements, markers, URLs, and conflict sets
  • Allow trailing commas in version specifiers (#19806)
  • Avoid panics for invalid UTF-8 URL credentials (#19800)
  • Avoid panics for malformed source distribution filenames (#19776)
  • Avoid panics for trailing extra separators (#19779)
  • Avoid stack overflow for recursive requirements path aliases (#19777)
  • Ignore reversed string compatible-release markers (#19782)
  • Reject duplicate entries in conflict sets (#19801)
  • Reject malformed hash options in requirements files (#19783)
  • Reject source distribution filenames without a separator (#19803)
  • Use UTF-8 lengths for requirement errors (#19781)
  • Use UTF-8 lengths for trailing marker errors (#19796)
  • Use byte offsets when peeking over requirements (#19780)
  • Validate GraalPy ABI suffixes (#19805)
• Improve wheel entry-point error handling and virtual environment activation quoting
  • Propagate errors when reading wheel entry points (#19794)
  • Quote virtual environment activation paths with shell metacharacters (#19798)

0.11.20

... (truncated)

Commits

• 5aa65dd Bump version to 0.11.21 (#19810)
• 453ab98 Fix musllinux tag priority (#19804)
• 1764c77 Validate GraalPy ABI suffixes (#19805)
• 1379b7d Compute and pass uv workspace metadata payload in ty check (#19763)
• bd6d289 Preserve cached Python downloads during cache pruning (#19795)
• 143c12f Propagate errors when reading wheel entry points (#19794)
• b2d8307 Allow trailing commas in version specifiers (#19806)
• d5c8a5f Quote virtual environment activation paths with shell metacharacters (#19798)
• 48c4357 Avoid overflow when reading malformed cache entries (#19799)
• 6353b24 Allow CI cache pruning without an sdist bucket (#19802)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Evan Mattson (moonbox3)]

Copilot: fix the CI/CD failures

[Copilot]

Copilot: fix the CI/CD failures

Fixed in f05bf64 by aligning python/packages/lab/pyproject.toml with the root uv bump and refreshing python/uv.lock, which resolves the failing uv sync --all-packages --all-extras --dev CI setup step.

[Evan Mattson (moonbox3)]

Copilot resolve the merge conflicts in this pull request

[Copilot]

Copilot resolve the merge conflicts in this pull request

Resolved in 39480ec.

[dependabot]

A newer version of uv exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.