chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.31

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/astral-sh/uv	stage	patch	0.11.28 → 0.11.31

---

Release Notes

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.11.31

Compare Source

Released on 2026-07-21.

Enhancements

• Allow workspace sources to reference members in another workspace by path (#​18401)
• Support .venv files containing paths to centralized project environments (#​20022)
• Update bundled Windows timezone data to IANA 2026c (#​20554)

Preview features

• Add an index-specific hash-algorithm setting for lockfile generation (#​20605)

Configuration

• Add audit.malware-check and audit.malware-check-url settings (#​20587)

Performance

• Avoid quadratic work when deduplicating transitive conflicts (#​20578)

Bug fixes

• Suggest --emit-build-options for unsupported uv pip compile --emit-options (#​20582)
• Reject source distributions and wheels with mismatched package names (#​20432)
• Avoid retrying TLS certificate verification failures (#​16245)
• Avoid warnings about uv_build settings for in-tree build backends (#​20153)

v0.11.30

Compare Source

Released on 2026-07-20.

Python

• Add CPython 3.15.0b4 (#​20519)

Preview features

• Allow uv workspace metadata --sync to target the active virtual environment with --active (#​20500)
• Reuse centralized project environments when workspaces are accessed through symlinks (#​20436)

Performance

• Skip resolver candidates whose files are all excluded by exclude-newer (#​20460)
• Limit parallel cache reads to reduce resolver scheduling and allocation overhead (#​20427)
• Accelerate lockfile serialization with toml_writer (#​20450)
• Compact cached Simple API distribution metadata and hashes (#​20463, #​20483)
• Decode stale cache entries in a single blocking task (#​20486)
• Decode cached payloads outside resolver workers (#​20464)
• Cache resolver Python requirement markers (#​20461)
• Reuse resolver fork markers while recording preferences (#​20462)

Bug fixes

• Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall (#​20429)
• Preserve literal extends-environment paths in pyvenv.cfg on Unix (#​20466)

Documentation

• Add a contribution guide (#​20511, #​20552)

v0.11.29

Compare Source

Released on 2026-07-15.

Python

• Use gzip-compressed artifacts for PyPy downloads (#​20265)

Enhancements

• Add JSON output to uv tree (#​19978)
• Add CUDA 13.2 as a supported PyTorch backend (#​20267)
• Prefer local artifacts over URLs when installing from pylock.toml (#​20393)
• Clarify diagnostics for unsatisfiable direct requirement ranges (#​20227)
• Include the selected project name in missing-extra errors (#​20358)

Preview features

• Preserve extras and dependency-group conflict context when selecting locked project tools (#​20078)
• Split OSV audit queries that exceed the service's 1,000-package limit (#​20398)
• Apply OSV fixed-version information only to the matching package and ecosystem (#​20399)
• Skip the virtualenv distutils monkeypatch on Python 3.10 and later (#​20222)
• Report invalid uv audit --service-url values instead of panicking (#​20374)
• Include preview settings in the published SchemaStore schema (#​20304)

Performance

• Reduce resolver work by widening selected versions across ranges without other known candidates (#​20115)
• Defer client and build setup for no-op uv sync operations (#​20364)
• Reuse workspace discovery during frozen syncs (#​20363)
• Reuse workspace discovery after resolving settings (#​20356)
• Reuse workspace discovery in uv tree, uv export, uv format, and uv audit (#​20359)
• Avoid cache and interpreter setup when reading a project version (#​20360)

Bug fixes

• Reject duplicate active package entries in pylock.toml (#​20391)
• Preserve direct-archive hashes in uv pip freeze output (#​20395)
• Explain conflicting root requirements instead of displaying an empty version range (#​20228)
• Prevent build-backend data paths from escaping the project or bypassing wheel exclusions (#​20397)
• Reject PEP 517 backend paths outside the source tree, including paths that escape through symlinks (#​20387)
• Redact credentials from failed Git fetch commands (#​20401)
• Fix exclusive post-release range ordering to match PEP 440 (#​20268)
• Canonicalize equivalent PEP 440 ranges during dependency resolution (#​20182)
• Honor Python version pins when initializing scripts (#​20404)
• Respect package-scoped source filtering for scripts (#​20389)
• Report existing environment incompatibilities when uv pip install --strict has nothing to install (#​20388)
• Continue scanning platlib when purelib is missing (#​20405)
• Handle versionless .egg-info files as legacy package metadata (#​20403)
• Make repeated locking idempotent for impossible cross-variable platform markers (#​20369)
• Report invalid cloud credential endpoint URLs instead of panicking (#​20372)
• Report invalid pylock.toml artifact URLs instead of panicking (#​20373)
• Report non-UTF-8 virtual environment paths instead of panicking while generating activation scripts (#​20375)
• Return an unsupported-operation error from unimplemented build-backend requirement hooks (#​20376)

Documentation

• Clarify --no-build behavior for editable requirements (#​20234)
• Document uv's threat model (#​20236)
• Reduce the number of badges in the README (#​11257)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.