chore(deps): update mise tools

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
trivy	tools	minor	0.72.0 → 0.73.0	0.74.0
uv	tools	patch	0.12.0 → 0.12.3	0.12.6 (+2)

---

Release Notes

aquasecurity/trivy (trivy)

v0.73.0

Compare Source

Features

• add bounded read helpers (#​10974) (35384b4)
• java: read Jenkins plugin manifest licenses (#​10939) (f065203)
• java: support user-defined Maven mirrors in trivy.yaml (#​11006) (8e5509c)
• seal: detect no-prefix packages by version suffix (#​10911) (69da733)
• vex: discover OpenVEX in generic in-toto OCI referrers (#​10986) (990d765)
• vex: native discovery of VEX documents stored as OCI artifacts (#​10932) (38d5dbd)

Bug Fixes

• conda: avoid panic on an all-operator dependency line (#​10955) (f964fa2)
• dotnet: identify deps.json root project from dependency graph (#​10954) (3c6a1a2)
• java: set per-file digest for nested JARs (#​10855) (c3c7d17)
• misconf: guard nil Healthcheck when building Dockerfile from history (#​10899) (824e2ed)
• nodejs: support pnpm workspaces with overlapping packages (#​10894) (19f2ddc)
• vex: handle 304 status code (#​10307) (e73c76d)
• vex: reject non-local VEX repository names (#​10987) (2c64b8f)
• vuln: don't skip packages covered by a driver's own advisory feed (#​10980) (86acabe)

astral-sh/uv (uv)

v0.12.3

Compare Source

Released on 2026-08-07.

Python

• Add CPython 3.13.15 (#​20997)

Preview features

• Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size (#​20992)
• Preserve JSON output from uv workspace metadata --quiet while suppressing diagnostics (#​20991)
• Reduce memory usage for large workspaces by streaming uv workspace metadata JSON output (#​20990)

Performance

• Reduce Linux startup latency by initializing the workspace cache before spawning another thread (#​20989)
• Reuse compiled workspace exclusion patterns during workspace discovery (#​20988)
• Speed up conflict-heavy resolutions by avoiding materialized range complements (#​20982)
• Avoid slow procfs reads during Python interpreter discovery on Linux (#​20987)

Documentation

• Add PEP 740 attestations to the GitHub Actions publishing example (#​20986)
• Restrict the GitHub Actions publishing example to Python version tags (#​20973)
• Correct --python-pin to --pin-python in the uv init --bare example (#​20876)

v0.12.2

Compare Source

Released on 2026-08-05.

Python

• Add CPython 3.15.0rc1 (#​20948)
• Add CPython 3.14.7 (#​20971)

Enhancements

• Ensure diagnostic hints end with a newline to prevent malformed terminal output (#​20959)

Preview features

• Audit one or all installed tools with uv tool audit (#​20921)
• Report physically reclaimed disk space during cache cleanup with the cache-physical-space preview feature (#​20925)

Configuration

• Add UV_RUN_RLIMIT_NOFILE to set the open-file limit for commands launched by uv run (#​20926)

Performance

• Speed up uv.lock parsing for wheel entries (#​20881)
• Speed up uv.lock parsing for source distribution entries (#​20882)
• Speed up filename extraction from distribution URLs (#​20879)
• Reduce filesystem metadata lookups during bytecode compilation (#​20928)
• Reuse file metadata when building source distributions (#​20927)

Bug fixes

• Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions (#​20963)
• Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested (#​20930)

Documentation

• Separate build and publish jobs in the GitHub Actions publishing guide (#​20946)
• Ensure the GitHub Actions publishing example waits for the build job to finish (#​20957)
• Correct typos in the Docker integration guide (#​20970)

v0.12.1

Compare Source

Released on 2026-07-31.

Enhancements

• Add package-specific pre-release policies with --prerelease-package (#​20837)
• Support local HTML files as flat indexes (#​20802)
• Add Xonsh virtual environment activation scripts (activate.xsh) (#​19740)
• Preserve filesystem paths passed to uv add --index when updating pyproject.toml (#​20817)

Preview features

• Add automatic fixes to uv check with --fix (#​20793)
• Avoid rejecting unchanged metadata-free lockfiles when workspace dependencies share direct sources (#​20847)
• Honor direct URL constraints when validating metadata-free lockfiles (#​20796)
• Ignore malformed PEP 723 scripts discovered during project checks (#​20784)
• Use ty's native script exclusion in uv check (#​20742)

Performance

• Parse canonical uv lockfiles directly, with a fallback for other valid TOML syntax (#​20648)
• Accelerate SHA-256 hashing on non-Windows ARM64 platforms (#​20805)

Bug fixes

• Flush shell startup file updates before uv tool update-shell and uv python update-shell exit (#​20842)
• Make workspace-root dependency groups available to commands run from workspace members (#​20840)
• Resolve --find-links paths in requirements files relative to the containing file (#​20832)
• Respect configured indexes in uv tool list --outdated (#​20770)

Documentation

• Document Astral GPU indexes in the PyTorch guide (#​20785)
• Use consistent dependency-group argument descriptions throughout the CLI documentation (#​20823)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud