chore(deps): bump the python-minor-patch group with 2 updates

[dependabot]

Bumps the python-minor-patch group with 2 updates: packaging and uv.

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates uv from 0.12.0 to 0.12.2

Release notes

Sourced from uv's releases.

0.12.2

Release Notes

Released on 2026-08-05.

Python

• Add CPython 3.15.0rc1 (#20948)
• Add CPython 3.14.7 (#20971)

Enhancements

• Ensure diagnostic hints end with a newline to prevent malformed terminal output (#20959)

Preview features

• Audit one or all installed tools with uv tool audit (#20921)
• Report physically reclaimed disk space during cache cleanup with the cache-physical-space preview feature (#20925)

Configuration

• Add UV_RUN_RLIMIT_NOFILE to set the open-file limit for commands launched by uv run (#20926)

Performance

• Speed up uv.lock parsing for wheel entries (#20881)
• Speed up uv.lock parsing for source distribution entries (#20882)
• Speed up filename extraction from distribution URLs (#20879)
• Reduce filesystem metadata lookups during bytecode compilation (#20928)
• Reuse file metadata when building source distributions (#20927)

Bug fixes

• Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions (#20963)
• Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested (#20930)

Documentation

• Separate build and publish jobs in the GitHub Actions publishing guide (#20946)
• Ensure the GitHub Actions publishing example waits for the build job to finish (#20957)
• Correct typos in the Docker integration guide (#20970)

Install uv 0.12.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.2/uv-installer.sh | sh

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.2

Released on 2026-08-05.

Python

• Add CPython 3.15.0rc1 (#20948)
• Add CPython 3.14.7 (#20971)

Enhancements

• Ensure diagnostic hints end with a newline to prevent malformed terminal output (#20959)

Preview features

• Audit one or all installed tools with uv tool audit (#20921)
• Report physically reclaimed disk space during cache cleanup with the cache-physical-space preview feature (#20925)

Configuration

• Add UV_RUN_RLIMIT_NOFILE to set the open-file limit for commands launched by uv run (#20926)

Performance

• Speed up uv.lock parsing for wheel entries (#20881)
• Speed up uv.lock parsing for source distribution entries (#20882)
• Speed up filename extraction from distribution URLs (#20879)
• Reduce filesystem metadata lookups during bytecode compilation (#20928)
• Reuse file metadata when building source distributions (#20927)

Bug fixes

• Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions (#20963)
• Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested (#20930)

Documentation

• Separate build and publish jobs in the GitHub Actions publishing guide (#20946)
• Ensure the GitHub Actions publishing example waits for the build job to finish (#20957)
• Correct typos in the Docker integration guide (#20970)

0.12.1

Released on 2026-07-31.

Enhancements

• Add package-specific pre-release policies with --prerelease-package (#20837)
• Support local HTML files as flat indexes (#20802)
• Add Xonsh virtual environment activation scripts (activate.xsh) (#19740)

... (truncated)

Commits

• 46ead60 Bump version to 0.12.2 (#20951)
• f7adc1f Cross-link to the resolution docs from sync docs (#20942)
• ce934cb Fix Windows trampoline lockfile (#20972)
• 61f2185 Sync latest Python releases (#20971)
• 5940138 Use GHA's self-repo syntax (#20966)
• a451867 Fix two typos in the Docker guide (#20970)
• 1603f07 automations: update codex versions/pins and add support for auto-updates via ...
• 092d68b Let reproduction agents update issue context directly (#20969)
• 0b2658c Update Rust crate reqsign to v0.20.3 (#20892)
• ae0997b Reject future environment variable introduction versions (#20968)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​packaging@​26.2 ⏵ 26.3	+1
	pypi/​uv@​0.12.0 ⏵ 0.12.2	+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​packaging@​26.2 ⏵ 26.3	+1
	pypi/​uv@​0.12.0 ⏵ 0.12.2	+1

View full report