chore(deps): update uv to v0.12.16

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
uv	patch	0.12.15 → 0.12.16

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

astral-sh/uv (uv)

v0.12.16

Compare Source

Released on 2026-09-17.

Python

• Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#​21741)

Enhancements

• Verify downloaded wheels and source distributions against hashes supplied by package indexes (#​21562)
• Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#​21467)
• Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#​21766)
• Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#​21779)

Preview features

• Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#​21163)
• Honor configured and command-line index settings, including credentials, in uv upgrade (#​21776)
• Allow uv check to run in projects that are not managed by uv and outside workspaces (#​21777)
• Respect --python and UV_PYTHON when selecting the Python version for uv check (#​21744)

Bug fixes

• Redact Azure shared access signatures from displayed and logged URLs (#​21755)
• Check archive sizes from pylock.toml before reusing cached distributions (#​21609)
• Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#​20631)
• Use the bundled uv_build backend only when its version matches active version pins (#​21742)
• Handle malformed index URLs without panicking when credentials are configured (#​21784)
• Report a configuration error instead of panicking for proxy URLs without a host (#​21781)
• Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#​21783)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/uv:0.12.16

📦 Image Reference ghcr.io/uniget-org/tools/uv:0.12.16

digest	sha256:a94371e08ad276339ff3c9fd7825d16544ea0f0026491b2a54d1887c7efbf3ed
vulnerabilities
platform	linux/amd64
size	23 MB
packages	527

rsa 0.9.10 (cargo) pkg:cargo/rsa@0.9.10 Affected range >=0.0.0-0 Fixed version Not Fixed CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N EPSS Score 0.610% EPSS Percentile 48th percentile Description Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. Patches No patch is yet available. The crypto-bigint migration (RustCrypto/RSA#394) did not close this. Tracking is RustCrypto/RSA#626 (padding still not constant-time). Implicit rejection work is in RustCrypto/RSA#680; default-path blinding is in RustCrypto/RSA#702. Still affected as of 2026-09-12: rsa 0.9.10 (latest stable) and rsa 0.10.0-rc.18 (latest). patched = [] is intentional. Workarounds Avoid using the rsa crate in settings where attackers can observe timing, for example over the network. Local use on a non-compromised computer is fine. References This vulnerability was discovered as part of the "Marvin Attack", which revealed several implementations of RSA including OpenSSL had not properly mitigated timing sidechannel attacks.

event-listener 5.4.1 (cargo) pkg:cargo/event-listener@5.4.1 Affected range >=5.1.0 <5.4.2 Fixed version 5.4.2 Description Affected versions of event-listener unconditionally implement Send and Sync for StackSlot<'_, T>, the stack-allocated listener type created by the listener! macro. This allows a !Send tag type set via Event::with_tag to be moved to another thread and accessed via StackSlot::wait, causing a data race in safe code.

proc-macro-error2 2.0.1 (cargo) pkg:cargo/proc-macro-error2@2.0.1 Affected range >=0.0.0-0 Fixed version Not Fixed Description The author of proc-macro-error2 has confirmed that the crate is no longer maintained and recommends that users migrate away from it. proc-macro-error2 was originally created as a maintained fork of proc-macro-error (see RUSTSEC-2024-0370). Both the original crate and this fork are now unmaintained. Possible Alternative(s) manyhow proc-macro2-diagnostics

h2 0.4.15 (cargo) pkg:cargo/h2@0.4.15 Affected range <0.4.16 Fixed version 0.4.16 Description The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows. Low severity. Patched in v0.4.16.

memmap2 0.9.10 (cargo) pkg:cargo/memmap2@0.9.10 Affected range <0.9.11 Fixed version 0.9.11 Description Affected versionf of memmap2 did not perform enough validation on the offset and len parameters of Mmap::[unchecked_]advise_range(), MmapMut::[unchecked_]advise_ranage() and MmapMut::flush[_async]_range(). This can cause undefined behavior due to invalid values being passed to pointer::offset() and pointer::add() when passing an out-of-bounds range to any of the affected functions. The flaw was corrected in commit [cee7cf0] and released in version 0.9.11. The invalid pointer is not dereferenced, but it is passed to the madvise and msync syscalls and their Windows equivalents. [cee7cf0] RazrFalcon/memmap2-rs@cee7cf0

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/35308242740.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/35308242740.