Update charmcraft.yaml build tools (main) #1089
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
added
the
not bug or enhancement
renovate
bot
added
the
not bug or enhancement
renovate
bot
requested review from
taurus-forever,
dragomirp and
marceloneppel
and removed request for
a team
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1089 +/- ##
=======================================
Coverage 75.74% 75.74%
=======================================
Files 16 16
Lines 4156 4156
Branches 628 628
=======================================
Hits 3148 3148
Misses 786 786
Partials 222 222 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
taurus-forever
approved these changes
Aug 13, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.1.3->2.1.41.88.0->1.89.00.8.4->0.8.8Release Notes
python-poetry/poetry (poetry)
v2.1.4Compare Source
Changed
virtualenv<20.33to work around an issue where Poetry uses the wrong Python version (#10491).pyproject.tomlfile (#10471).Fixed
poetry installwas called with--no-plugins(#10405).Docs
poetry addif no version constraint is explicitly specified (#10445).rust-lang/rust (rust-lang/rust)
v1.89.0Compare Source
==========================
Language
feature(generic_arg_infer))mismatched_lifetime_syntaxeslint.This lint detects when the same lifetime is referred to by different syntax categories between function arguments and return values, which can be confusing to read, especially in unsafe code.
This lint supersedes the warn-by-default
elided_named_lifetimeslint.unpredictable_function_pointer_comparisonsto also lint on function pointer comparisons in external macrosdangerous_implicit_autorefslint deny-by-defaultklandwidekltarget features for x86sha512,sm3andsm4target features for x86f,d,frecipe,lasx,lbt,lsx, andlvzi128andu128fromimproper_ctypes_definitionsrepr128(#[repr(u128)],#[repr(i128)])#![doc(test(attr(..)))]everywhereextern "C"functions on thewasm32-unknown-unknowntarget now have a standards compliant ABICompiler
Platform Support
loongarch32-unknown-noneandloongarch32-unknown-none-softfloatx86_64-apple-darwinis in the process of being demoted to Tier 2 with host toolsRefer to Rust's platform support page
for more information on Rust's tiered platform support.
Libraries
file!format_args!()in a variable#[must_use]to[T; N]::mapDerefMutforLazy{Cell,Lock}Defaultforarray::IntoIterCloneforslice::ChunkByio::Seekforio::TakeStabilized APIs
NonZero<char>SHA512,SM3andSM4intrinsicsFile::lockFile::lock_sharedFile::try_lockFile::try_lock_sharedFile::unlockNonNull::from_refNonNull::from_mutNonNull::without_provenanceNonNull::with_exposed_provenanceNonNull::expose_provenanceOsString::leakPathBuf::leakResult::flattenstd::os::linux::net::TcpStreamExt::quickackstd::os::linux::net::TcpStreamExt::set_quickackThese previously stable APIs are now stable in const contexts:
<[T; N]>::as_mut_slice<[u8]>::eq_ignore_ascii_casestr::eq_ignore_ascii_caseCargo
cargo fixandcargo clippy --fixnow default to the same Cargo target selection as other build commands. Previously it would apply to all targets (like binaries, examples, tests, etc.). The--editionflag still applies to all targets.runnersetting to run the tests. If you need to disable tests for a target, you can use the ignore doctest attribute to specify the targets to ignore.Rustdoc
Compatibility Notes
missing_fragment_specifieran unconditional errorneontarget feature onaarch64-unknown-none-softfloatcauses a warning because mixing code with and without that target feature is not properly supported by LLVM?Sizedbounds on impls on recursive types which contain associated type projections. It is not expected to affect any existing published crates. Can be fixed by refactoring the involved types or opting into thesized_hierarchyunstable feature. See the FCP report for a code example.elided_named_lifetimeslint is superseded by the warn-by-defaultmismatched_lifetime_syntaxeslint.Copyare now only available at the end of type checkingstd::intrinsics::{copy,copy_nonoverlapping,write_bytes}are now proper intrinsics. There are no debug assertions guarding against UB, and they cannot be coerced to function pointers.std::intrinsics::drop_in_place!) are now reported in dependenciesstd::ptr::copy_*intrinsics also perform the static self-init checksextern "C"functions on thewasm32-unknown-unknowntarget now have a standards compliant ABIInternal Changes
These changes do not affect any public interfaces of Rust, but they represent
significant improvements to the performance or internals of rustc and related
tools.
rustc-devcomponentastral-sh/uv (uv)
v0.8.8Compare Source
Bug fixes
find_uv_bincompatibility with Python <3.10 (#15177)v0.8.7Compare Source
Python
tkaggbackend (the default on Linux), Pillow'sPIL.ImageTklibrary, and other extension modules that need to use libtcl/libtk directly.See the
python-build-standalonerelease notes for details.Enhancements
uv.lockwhen using--isolated(#15154)--prefixand--withinstallations infind_uv_bin(#14184)find_uv_bin(#14181)find_uv_bin(#14182)Preview features
package-level conflicts in workspaces (#14906)Configuration
UV_DEVandUV_NO_DEVenvironment variables (for--devand--no-dev) (#15010)Bug fixes
--require-hashesapplied to build dependencies inuv pip install(#15153)find_uv_bin(#14191)Documentation
.) to list elements inFeaturesdocs page (#15138)v0.8.6Compare Source
This release contains hardening measures to address differentials in behavior between uv and Python's built-in ZIP parser (CVE-2025-54368).
Prior to this release, attackers could construct ZIP files that would be extracted differently by pip, uv, and other tools. As a result, ZIPs could be constructed that would be considered harmless by (e.g.) scanners, but contain a malicious payload when extracted by uv. As of v0.8.6, uv now applies additional checks to reject such ZIPs.
Thanks to a triage effort with the Python Security Response Team and PyPI maintainers, we were able to determine that these differentials were not exploited via PyPI during the time they were present. The PyPI team has also implemented similar checks and now guards against these parsing differentials on upload.
Although the practical risk of exploitation is low, we take the hypothetical risk of parser differentials very seriously. Out of an abundance of caution, we have assigned this advisory a CVE identifier and have given it a "moderate" severity suggestion.
These changes have been validated against the top 15,000 PyPI packages; however, it's plausible that a non-malicious ZIP could be falsely rejected with this additional hardening. As an escape hatch, users who do encounter breaking changes can enable
UV_INSECURE_NO_ZIP_VALIDATIONto restore the previous behavior. If you encounter such a rejection, please file an issue in uv and to the upstream package.For additional information, please refer to the following blog posts:
Security
Python
Configuration
Bug fixes
UV_HTTP_RETRIESinuv publish(#15106)UV_NO_EDITABLEwhere--no-editableis supported (#15107)cargo-distto addUV_INSTALLER_URLto PowerShell installer (#15114)h2again to avoidtoo_many_internal_resetserrors (#15111)pythonwwhen copying entry points in uv run (#15134)Documentation
v0.8.5Compare Source
Enhancements
uv runwith a GitHub Gist (#15058)uv tool install(#14014)Preview features
extra-build-dependencieswarnings foruv pip(#15088)pylockwarning (#15089)Bug fixes
python-preference = systemwhen managed interpreters are on the PATH (#15059)--systemis used (#15061)h2upgrade (#15079)Documentation
Configuration
📅 Schedule: Branch creation - Between 01:00 AM and 05:59 AM, only on Tuesday ( * 1-5 * * 2 ) in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.