Bump the "infrastructure" group with 1 update across multiple ecosystems

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the infrastructure group with 1 update: astral-sh/uv.

Updates astral-sh/uv from 0.12.22 to 0.12.24

Release notes

Sourced from astral-sh/uv's releases.

0.12.24

Release Notes

Released on 2026-10-08.

Enhancements

• Remove orphaned temporary build environments with uv cache prune (#22171)
• Accept PEP 508 marker operators directly before grouped expressions (#22309)
• Reject malformed requirements-file options instead of partially parsing or ignoring them (#22317)
• Show underlying filesystem and registry errors when managed Python uninstallation fails (#22362)
• Identify the invalid source URL in Python mirror errors (#22364)

Preview features

• Display preferred advisory IDs in uv audit reports, prioritizing PYSEC, GHSA, then CVE identifiers (#22292)

Configuration

• Support custom installation mirrors for GraalPy (#22269)
• Support custom installation mirrors for Pyodide (#22271)
• Allow UV_NO_CACHE=false to override no-cache = true in configuration (#22324)
• Report more precise error locations for invalid trusted-host ports and preview-feature list entries (#22144)

Performance

• Speed up later commands after creating an environment by warming its interpreter cache (#21304)
• Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (#22246)
• Enforce resource limits when parsing package indexes and --find-links pages with astral-html (#22203)
• Reduce standalone uv-build executable size by 7.5% by omitting unused Zstandard support (#22242)
• Reduce uv's binary size by about 232 KB by simplifying configuration deserialization (#22144)
• Reduce Python download error formatting code size by sharing its formatter (#22141)

Bug fixes

• Verify supplied hashes even when hash presence is disabled with --no-require-hashes or require-hashes = false (#22369)
• Honor exact managed Python patch pins when creating script environments instead of following patch upgrades (#22360)
• Prevent dependency overrides and constraints from activating optional dependencies when their extras are not selected (#22237)
• Exclude optional dependencies from exports when their extras are activated only in incompatible environments (#22234)
• Give explicit uv publish --trusted-publishing values precedence over configuration (#22279)
• Allow UV_OFFLINE=false to override offline = true in configuration (#22283)
• Allow UV_SYSTEM_CERTS=false to override system-certs = true in configuration (#22291)
• Allow uv auth login over IPv6 loopback addresses (#22306)
• Resolve GitHub dependencies whose Git references contain # or % characters (#22281)
• Recognize existing Pyodide interpreters as satisfying Pyodide Python requests (#22322)
• Preserve JSON output from uv version and uv self version with a single --quiet flag (#22280)
• Preserve trailing spaces and tabs in passwords returned by subprocess keyrings (#22284)
• Restore wheel incompatibility hints when WHEEL metadata contains multiple expanded Tag: rows (#22235)
• Preserve Windows wheel-script rename errors unless a cross-drive copy fallback applies (#22302)
• Prevent workspace-cache assertion failures after modifying a project at the workspace root (#22236)

... (truncated)

Changelog

Sourced from astral-sh/uv's changelog.

0.12.24

Released on 2026-10-08.

Enhancements

• Remove orphaned temporary build environments with uv cache prune (#22171)
• Accept PEP 508 marker operators directly before grouped expressions (#22309)
• Reject malformed requirements-file options instead of partially parsing or ignoring them (#22317)
• Show underlying filesystem and registry errors when managed Python uninstallation fails (#22362)
• Identify the invalid source URL in Python mirror errors (#22364)

Preview features

• Display preferred advisory IDs in uv audit reports, prioritizing PYSEC, GHSA, then CVE identifiers (#22292)

Configuration

• Support custom installation mirrors for GraalPy (#22269)
• Support custom installation mirrors for Pyodide (#22271)
• Allow UV_NO_CACHE=false to override no-cache = true in configuration (#22324)
• Report more precise error locations for invalid trusted-host ports and preview-feature list entries (#22144)

Performance

• Speed up later commands after creating an environment by warming its interpreter cache (#21304)
• Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (#22246)
• Enforce resource limits when parsing package indexes and --find-links pages with astral-html (#22203)
• Reduce standalone uv-build executable size by 7.5% by omitting unused Zstandard support (#22242)
• Reduce uv's binary size by about 232 KB by simplifying configuration deserialization (#22144)
• Reduce Python download error formatting code size by sharing its formatter (#22141)

Bug fixes

• Verify supplied hashes even when hash presence is disabled with --no-require-hashes or require-hashes = false (#22369)
• Honor exact managed Python patch pins when creating script environments instead of following patch upgrades (#22360)
• Prevent dependency overrides and constraints from activating optional dependencies when their extras are not selected (#22237)
• Exclude optional dependencies from exports when their extras are activated only in incompatible environments (#22234)
• Give explicit uv publish --trusted-publishing values precedence over configuration (#22279)
• Allow UV_OFFLINE=false to override offline = true in configuration (#22283)
• Allow UV_SYSTEM_CERTS=false to override system-certs = true in configuration (#22291)
• Allow uv auth login over IPv6 loopback addresses (#22306)
• Resolve GitHub dependencies whose Git references contain # or % characters (#22281)
• Recognize existing Pyodide interpreters as satisfying Pyodide Python requests (#22322)
• Preserve JSON output from uv version and uv self version with a single --quiet flag (#22280)
• Preserve trailing spaces and tabs in passwords returned by subprocess keyrings (#22284)
• Restore wheel incompatibility hints when WHEEL metadata contains multiple expanded Tag: rows (#22235)
• Preserve Windows wheel-script rename errors unless a cross-drive copy fallback applies (#22302)
• Prevent workspace-cache assertion failures after modifying a project at the workspace root (#22236)
• Hide the ignored --keyring-provider option from uv auth help (#19520)

... (truncated)

Commits

• 5411378 Bump version to 0.12.24 (#22371)
• 213e6de Clarify integration test style in agent guidance (#22372)
• 35deef2 Skip Python setup in static version and credential tests (#22370)
• bbddf2f Share requirements-file arguments across commands (#22145)
• 9a123eb Deserialize trusted hosts and preview features directly (#22144)
• 57a9256 Share archive decoding across reader types (#22143)
• 3e3374b Verify hashes even when they are not required (#22369)
• d3c092a Move installation layout operations out of Python types (#22367)
• 1be3e88 Accept PEP 508 marker operators before parentheses (#22309)
• e27def7 Retain Python download request errors directly (#22366)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[shiny-code-app]

SWEEP-PRS-D1 disposition: image qualification split to #112; not Ready yet.

This new PR arrived during the sweep. Exact head 1154119d4dddd85d8d232323ff778ef8bd0f85a3 changes only the pinned official uv image 0.12.22 → 0.12.24. Complete PR discussions/reviews/files were read; no human findings. CI is still running within the 10:15 PM ET sweep deadline.

#112 names the next executing agent’s work: settle image-verification CI and record the affected image build/smoke/DB-init/applicable downstream-helper and changed/whole-project IDE evidence required by AGENTS.md. Those local gates have not been run in this sweep. Preserve native IDE limits honestly. No image publication, publishing dispatch, tag, Client promotion, merge or train label. Supervisor routes only after qualification. Final CI observation will be on direction#48.

[shiny-code-app]

SWEEP-PRS-D1 final CI diagnosis; disposition remains split to #112, not Ready.

Run 37872170990 failed both runtime and runtime-devtools image verification at the runtime-system apt-get install: snapshot.ubuntu.com returned HTTP 503 for multiple archived packages; apt exited 100. image-verification then failed downstream. Three failed checks, no pending checks at the observed head 1154119d4dddd85d8d232323ff778ef8bd0f85a3. This is an upstream fetch outage observation, not evidence to replace the uv pin or weaken image/smoke gates.

#112 Current Status names Supervisor’s supported train rerun after snapshot availability recovers, followed by affected local image and changed/whole-project IDE qualification. AGENTS.md routes reruns through the train or Chris, so this sweep did not directly rerun or dispatch the publishing workflow. No new Director question, label or merge.

[shiny-code-app]

SWEEP-PRS-D2: #111 remains held, not Ready, at1154119d4dddd85d8d232323ff778ef8bd0f85a3. Fresh checks still show the same3 failures in run37872170990, zero pending/unfinished workflows. The retained failing-job diagnosis is snapshot.ubuntu.com HTTP503/apt exit100 in runtime and runtime-devtools; no uv regression is proved and current upstream availability is not inferred from that old observation.

The exact repository boundary is: "Agents must not dispatch publishing workflows or push tags by hand; reruns go through the merge train or the agent asks Chris." This brief expressly gives train routing to the Supervisor. Next actor: Supervisor, using the supported train rerun route; then the executing qualification agent completes affected image build/smoke, smoke-db-init, applicable downstream helpers and changed/whole-project IDE evidence on #112. No new Director choice is needed for that supported route.

No claim/worktree/source change, pin/test weakening, publishing rerun, tag, train label or merge by this pass. Local image/IDE gates are not run: supported current-head CI rerun is the outstanding delivery prerequisite, retained qualification remains #112. Keep the PR open and the follow-up active while that agent work remains.

[shiny-code-app]

ODD-112-D1: local executable qualification passed; held, not Ready at head 1154119d4dddd85d8d232323ff778ef8bd0f85a3.

Both README-default targets built locally with Docker desktop-linux 29.8.2 on arm64. Runtime and devtools smoke, database initialization plus the Launchplane health endpoint, downstream-helper tests, Hadolint, requirements-override tests, dependency-health tests, and wrapper tests passed. The runtime reports uv 0.12.24 (aarch64-unknown-linux-musl); pip-free and stable layout checks passed. Build source was Odoo 7cfd942664c9d324953eff4e07f52e459f8eb0ca. This local default-input evidence does not substitute for frozen-input amd64 CI or its dependency scans.

PyCharm evidence: Dockerfile scope returned UNKNOWN, waiting for the shared lifecycle lock. Whole-project scope then ran and returned RED, five Odoo import/manifest findings, with execution_not_proven; its owned project closed successfully and the worktree stayed clean. The findings are controllers/main.py lines 6-7 (odoo, http, request) and manifest.py line 9 (web), all byte-identical to main. I had missed the README's external Odoo source prerequisite. After configuring the documented .pth against the verified clean Odoo 19 cache at 977f36dc9a6f473b9cb32fa6f9e3db396fb4de13, the fresh whole-project assessment returned UNKNOWN due to lifecycle-lock contention before opening. Python now discovers the expected external Odoo namespace and its http.py exists, but no fresh IDE proof clears the previous findings. Retain this setup/inspection limitation on #112; do not describe the broad gate as GREEN.

Fresh CI/log inspection still shows run 37872170990, attempt 1, three failures and seven non-failing signals, no pending/unfinished workflows. Both verify jobs failed archived Ubuntu fetches with HTTP 503/apt exit 100 before uv installation; image-verification failed downstream. A fresh GET of the exact npm package returned HTTP 200 around 2:32 PM ET, which proves only that single fetch recovered. No uv regression is established. No review comments or unresolved inline threads were present; the tested one-line dependency pin does not require a commissioned another-provider review under the maintained review reference. No matching background review is observable in the PR records.

Supervisor next: use the repository-supported train retry route. After exact-head CI passes, an executor reruns Dockerfile/whole-project IDE qualification in the prepared worktree when the shared lock is available, retains permitted IDE UNKNOWN honestly, accounts for any current findings, and posts the exact Ready handoff only when qualification permits it. Keep #111 open and #112 plan:active. No new Director decision is needed. No rerun/dispatch, source edit, commit/push, tag, PR label or merge was performed here.

Custody: Supervisor retains the clean exact-head worktree /Volumes/Developer-Artifacts/worktrees/odoo-docker/odd-112-d1 and acceptance evidence /Volumes/Developer-Artifacts/task-evidence/odoo-docker/odd-112-d1 through adoption and landing/closure. Preserve ignored interpreter/IDE setup. Then retire with dev-worktree and dispose of consumed evidence. The two task image tags were removed, test container/network cleanup completed, the CI watcher stopped, and both inspection processes ended. Primary and other task checkouts were untouched.

[shiny-code-app]

INFRA-DEPS-D1: stopping at the existing Supervisor handoff; held, not Ready.

Read the complete PR discussion, reviews/inline comments and linked qualification record #112 before work. Fresh current-head checks at 1154119d4dddd85d8d232323ff778ef8bd0f85a3 still show three failed checks, zero pending checks and zero unfinished workflows; PR is BEHIND. The existing diagnosis attributes run 37872170990 to archived Ubuntu HTTP 503/apt exit 100, not a demonstrated uv regression. #112 already records completed local executable qualification, unresolved IDE evidence, and Supervisor custody of the prepared worktree. Its executing claim was released, but custody and the supported Supervisor retry remain explicit; this brief supplies no handoff adopting that worktree or authority to drive the train.

Next actor remains Supervisor: use the repository-supported train retry, then route IDE requalification under #112 before Ready. No new Director decision. Do not duplicate the completed qualification or take over retained artifacts. No claim, new worktree, source edit, test rerun, CI rerun/dispatch, label, merge, image publication or deployment by this session; both coordinated PRs remain untouched apart from this disposition comment. The current planning skill confirms PR-only Dependabot work uses the PR record and issue-only claim does not claim a PR.

Capacity context: verified Owner decision cbusillo/codex-skills#1043 (comment) and current overall DIRECTION.md Order 3 permit tooling when every milestone's available work already has the sessions it can use and provider capacity would otherwise go unused. That admission does not supersede the existing handoff. #112 remains plan:active with its recorded agent next action. No unattended continuation from this session. Safe to exit: yes.

[shiny-code-app]

ODOCK111-1 — stopped before claim/worktree; held, not Ready.

The canonical #112 refresh claim using --resume-from 6086901218 --refresh-pr https://github.com/cbusillo/odoo-docker/pull/111 --handoff-comment 6087138451 refused with Refresh target must be an open same-repository PR linked to the issue and attested in the released handoff; write_outcome: not_started, no claim comment. Source native session 01a121ec-f591-7740-ab37-8667956abf9f was read through supported task tools and has a completed final answer and exact released claim. This is a refresh-admission stop, not evidence of another live owner.

The maintained helper's retained-handoff check requires the target PR author to match the old claim author. This PR is Dependabot-authored; #112's released qualification claim is automation-authored and records a different work branch. The PR body also lacks the independent #112 reference. Cleanup cannot make those identities match. Preserve the prepared worktree/evidence: #112 still depends on their interpreter/IDE setup, so they are not disposable.

Fresh checks at 1154119d4dddd85d8d232323ff778ef8bd0f85a3: three failures, zero pending/unfinished workflows, BEHIND. No review submissions or inline comments; full-history external-comment radar is clear. Existing executable qualification and IDE gaps remain at #111 (comment) . No fresh local builds or IDE checks were run because claim admission stopped.

Next actor: Supervisor resolves the supported canonical-issue refresh route for this Dependabot-authored PR, then assigns refresh, repository-supported verification retry and #112 requalification. Proposed codex-skills follow-up: support a released canonical qualification claim for a Dependabot PR without requiring the automation worker to have authored that PR; preserve explicit head/branch, release and ownership checks. No change or issue was made outside this brief's scope. #112 is now natively linked as blocking direction#52 for milestone admission.

No new worktree, adoption, source edit, commit/push, CI retry/dispatch, tag, train label, Ready, merge, publication or deployment. No claim exists to release. No Director decision is requested.

Client test notes

Nothing for the Client to test for this pure uv dependency update. Required engineering qualification remains incomplete; this is not a release acceptance or Ready handoff. The successor should add this heading to the PR body before Ready.

[shiny-code-app]

Closing this PR as superseded by odoo-docker#120 build(deps): update pinned uv image to 0.12.24.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml