Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-uv for openSUSE:Factory checked in at 2026-10-23 20:22:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-uv (Old) and /work/SRC/openSUSE:Factory/.python-uv.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-uv" Fri Oct 23 20:22:18 2026 rev:136 rq:1387126 version:0.13.5 Changes: -------- --- /work/SRC/openSUSE:Factory/python-uv/python-uv.changes 2026-10-21 20:52:11.987660733 +0200 +++ /work/SRC/openSUSE:Factory/.python-uv.new.2252680/python-uv.changes 2026-10-23 20:23:00.644281716 +0200 @@ -1,0 +2,23 @@ +Thu Oct 22 13:37:48 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 0.13.5: + * Security: drop the compromised emSign ECC Root CA - G3 from + the bundled CA certificates (GHSA-hq85-5cpj-mr62); follow up + by rejecting chains with its compromised intermediate keys + via rustls-webpki 0.103.16. Managed CPython 3.13/3.14/3.15 + move to the 3.15.1, 3.14.9 and 3.13.17 security patch + releases with pip 26.2.2 and certifi 2026.10.19; run + `uv python upgrade` for the new builds. + * Preview: validate PEP 825 variant metadata, treating package + versions with invalid metadata as unavailable under + wheel-variants; rank variants with no required properties. + * Report incompatible self-dependencies directly in resolution + errors; lower peak resolver memory use; faster exports with + complex transitive extras; smaller binaries. + * Fix Android-only wheels with no sdist failing to lock, and + optional dependencies lost through transitive extras. +- Drop uv-astral-version-ranges-0.2.3-display.patch: upstream now + formats singleton ranges as "==1.0" itself, so the floated + astral-version-ranges 0.2.3 needs no test adaptation. + +------------------------------------------------------------------- Old: ---- python-uv-0.13.3.tar.gz New: ---- python-uv-0.13.5.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-uv.spec ++++++ --- /var/tmp/diff_new_pack.b1qNNs/_old 2026-10-23 20:23:03.388395667 +0200 +++ /var/tmp/diff_new_pack.b1qNNs/_new 2026-10-23 20:23:03.389395709 +0200 @@ -36,11 +36,11 @@ %global build_rustflags -C linker=clang -C link-arg=-fuse-ld=%{_bindir}/mold -C link-arg=-Wl,-z,relro,-z,now -C debuginfo=2 -C incremental=false -C strip=none %endif Name: %{origname}%{psuffix} -Version: 0.13.3 +Version: 0.13.5 Release: 0 Summary: A Python package installer and resolver, written in Rust # Legal-Review-Notice: uv itself is "Apache-2.0 OR MIT", but the binary -# statically links the vendored Rust dependencies. Re-derived on the 0.13.3 +# statically links the vendored Rust dependencies. Re-derived on the 0.13.5 # re-vendor with "cargo tree --offline -p uv -e normal" over the vendored # tree (502 unique name-version nodes); the copyleft licences in the linked graph are: # - MPL-2.0 from astral-pubgrub, astral-version-ranges and option-ext ++++++ python-uv-0.13.3.tar.gz -> python-uv-0.13.5.tar.gz ++++++ /work/SRC/openSUSE:Factory/python-uv/python-uv-0.13.3.tar.gz /work/SRC/openSUSE:Factory/.python-uv.new.2252680/python-uv-0.13.5.tar.gz differ: char 29, line 1 ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/python-uv/vendor.tar.zst /work/SRC/openSUSE:Factory/.python-uv.new.2252680/vendor.tar.zst differ: char 7, line 1
