build(deps): bump uv from 0.12.7 to 0.12.8

[dependabot]

Bumps uv from 0.12.7 to 0.12.8.

Release notes

Sourced from uv's releases.

0.12.8

Release Notes

Released on 2026-08-31.

Enhancements

• Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

• Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
• Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
• Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

• Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
• Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
• Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
• Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

• Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
• Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)
• Redact Azure shared access signature (sig) query parameters from displayed URLs (#21360)
• Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#21341)

Other changes

• Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#21346)

Install uv 0.12.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.8/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.8/uv-installer.ps1 | iex"

Download uv 0.12.8

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.8

Released on 2026-08-31.

Enhancements

• Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

• Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
• Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
• Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

• Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
• Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
• Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
• Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

• Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
• Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)
• Redact Azure shared access signature (sig) query parameters from displayed URLs (#21360)
• Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#21341)

Other changes

• Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#21346)

Commits

• 68209e5 Bump version to 0.12.8 (#21390)
• e0c5b7f Add preference for exhaustive matches to AGENTS.md (#21386)
• 0b19a85 Fix workflow checksums and tool upgrade test compilation (#21387)
• 068344a Add regression test for uv#21364 (#21383)
• fc332e3 Use test contexts for tool directories (#21380)
• 55075a3 Warn and skip invalid tool directories (#21368)
• 9078a76 Avoid duplicate concurrent wheel downloads (#21379)
• 442a3bf Version all Azure requests (#21366)
• 918e522 automations: skip workflow failure diagnosis on successfully retried re-runs ...
• 19600f6 Use package indices for additional lockfile traversals (#21377)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)