build(deps): update uv requirement from >=0.4 to >=0.12.19

[dependabot]

Updates the requirements on uv to permit the latest version.

Release notes

Sourced from uv's releases.

0.12.19

Release Notes

Released on 2026-09-24.

Python

• Add PyPy 3.11.16 and 3.12.14 (#21847)
• Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

• Format upload URLs with backticks in uv publish errors (#21934)

Preview features

• Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)
• Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

• Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)
• Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)
• Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)
• Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

• Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

• Make individual preview-feature reference entries linkable by name (#21950)

Install uv 0.12.19

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex"

Download uv 0.12.19

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.19

Released on 2026-09-24.

Python

• Add PyPy 3.11.16 and 3.12.14 (#21847)
• Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

• Format upload URLs with backticks in uv publish errors (#21934)

Preview features

• Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)
• Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

• Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)
• Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)
• Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)
• Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

• Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

• Make individual preview-feature reference entries linkable by name (#21950)

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

• Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
• Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
• Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

• Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

... (truncated)

Commits

• bea1384 Bump version to 0.12.19 (#21975)
• 299a93d Sync latest Python releases (#21970)
• 30de9e2 Preserve query parameters in direct URL metadata (#21971)
• 0e7433e Filter distribution hashes in tests (#21941)
• c73db78 Omit unused runtime settings from lockfiles (#21913)
• ad12342 Add a preview feature for lazy build backend imports (#21967)
• dd965a2 Restore FlatDistributions for downstream resolvers (#21965)
• 214d7f6 Use Astra for PR security reviews (#21959)
• 3db6652 Disable incremental compilation when publishing docs (#21955)
• e18f413 Reproduce editable project relocation failure (#21948)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 49d48ee3-312f-4d11-99fc-29571fb67868

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}