chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
astral-sh/ruff-pre-commit	repository	minor	v0.13.3 -> v0.14.0
ghcr.io/astral-sh/uv	stage	minor	0.8.24 -> 0.9.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)

v0.14.0

Compare Source

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.9.0

Compare Source

Released on 2025-10-07.

Breaking changes

This breaking release is primarily motivated by the release of Python 3.14, which contains some breaking changes (we recommend reading the "What's new in Python 3.14" page). uv may use Python 3.14 in cases where it previously used 3.13, e.g., if you have not pinned your Python version and do not have any Python versions installed on your machine. While we think this is uncommon, we prefer to be cautious. We've included some additional small changes that could break workflows.

There are no breaking changes to uv_build. If you have an upper bound in your [build-system] table, you should update it.

• Python 3.14 is now the default stable version

  The default Python version has changed from 3.13 to 3.14. This applies to Python version installation when no Python version is requested, e.g., uv python install. By default, uv will use the system Python version if present, so this may not cause changes to general use of uv. For example, if Python 3.13 is installed already, then uv venv will use that version. If no Python versions are installed on a machine and automatic downloads are enabled, uv will now use 3.14 instead of 3.13, e.g., for uv venv or uvx python. This change will not affect users who are using a .python-version file to pin to a specific Python version.

• Allow use of free-threaded variants in Python 3.14+ without explicit opt-in (#​16142)

  Previously, free-threaded variants of Python were considered experimental and required explicit opt-in (i.e., with 3.14t) for usage. Now uv will allow use of free-threaded Python 3.14+ interpreters without explicit selection. The GIL-enabled build of Python will still be preferred, e.g., when performing an installation with uv python install 3.14. However, e.g., if a free-threaded interpreter comes before a GIL-enabled build on the PATH, it will be used. This change does not apply to free-threaded Python 3.13 interpreters, which will continue to require opt-in.

• Use Python 3.14 stable Docker images (#​16150)

  Previously, the Python 3.14 images had an -rc suffix, e.g., python:3.14-rc-alpine or
  python:3.14-rc-trixie. Now, the -rc suffix has been removed to match the stable
  upstream images. The -rc images tags will no longer be
  updated. This change should not break existing workflows.

• Upgrade Alpine Docker image to Alpine 3.22

  Previously, the uv:alpine Docker image was based on Alpine 3.21. Now, this image is based on Alpine 3.22. The previous image can be recovered with uv:alpine3.21 and will continue to be updated until a future release.

• Upgrade Debian Docker images to Debian 13 "Trixie"

  Previously, the uv:debian and uv:debian-slim Docker images were based on Debian 12 "Bookworm". Now, these images are based on Debian 13 "Trixie". The previous images can be recovered with uv:bookworm and uv:bookworm-slim and will continue to be updated until a future release.

• Fix incorrect output path when a trailing / is used in uv build (#​15133)

  When using uv build in a workspace, the artifacts are intended to be written to a dist directory in the workspace root. A bug caused workspace root determination to fail when the input path included a trailing / causing the dist directory to be placed in the child directory. This bug has been fixed in this release. For example, uv build child/ is used, the output path will now be in <workspace root>/dist/ rather than <workspace root>/child/dist/.

Python

• Add CPython 3.14.0
• Add CPython 3.13.8

Enhancements

• Don't warn when dependency is constraint by other dependency (#​16149)

Bug fixes

• Fix uv python upgrade / install output when there is a no-op for one request (#​16158)
• Surface pinned-version hint when uv tool upgrade can’t move the tool (#​16081)
• Ban pre-release versions in uv python upgrade requests (#​16160)
• Fix uv python upgrade replacement of installed binaries on pre-release to stable (#​16159)

Documentation

• Update uv pip compile args in layout.md (#​16155)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

KICS version: v2.1.14

Category Results CRITICAL 0 HIGH 0 MEDIUM 4 LOW 0 INFO 0 TRACE 0 TOTAL 4	Metric Values Files scanned 7 Files parsed 7 Files failed to scan 0 Total executed queries 73 Queries failed to execute 0 Execution time 1

Queries Results

Query Name Query Id Severity Platform Cwe Category Experimental Description File Name Line Issue Type Search Key Expected Value Actual Value Apt Get Install Pin Version Not Defined 965a08d7-ef86-4f14-8792-4a3b2098937e MEDIUM Dockerfile 1357 Supply-Chain false When installing a package, its pin version should be defined Dockerfile 94 MissingAttribute FROM={{dev AS compile}}.RUN={{apt-get update && apt-get install --yes --no-install-recommends binutils patchelf && rm -rf /var/lib/apt/lists/*}} Package 'binutils' has version defined Package 'binutils' does not have version defined Apt Get Install Pin Version Not Defined 965a08d7-ef86-4f14-8792-4a3b2098937e MEDIUM Dockerfile 1357 Supply-Chain false When installing a package, its pin version should be defined Dockerfile 46 MissingAttribute FROM={{base AS dev}}.RUN={{apt-get update && apt-get install --yes --no-install-recommends build-essential && rm -rf /var/lib/apt/lists/*}} Package 'build-essential' has version defined Package 'build-essential' does not have version defined Apt Get Install Pin Version Not Defined 965a08d7-ef86-4f14-8792-4a3b2098937e MEDIUM Dockerfile 1357 Supply-Chain false When installing a package, its pin version should be defined Dockerfile 36 MissingAttribute FROM={{debian:stable-slim@sha256:d6743b7859c917a488ca39f4ab5e174011305f50b44ce32d3b9ea5d81b291b3b AS base}}.RUN={{apt-get update && apt-get upgrade --yes && apt-get install --yes --no-install-recommends curl && rm -rf /var/lib/apt/lists/*}} Package 'curl' has version defined Package 'curl' does not have version defined Apt Get Install Pin Version Not Defined 965a08d7-ef86-4f14-8792-4a3b2098937e MEDIUM Dockerfile 1357 Supply-Chain false When installing a package, its pin version should be defined Dockerfile 94 MissingAttribute FROM={{dev AS compile}}.RUN={{apt-get update && apt-get install --yes --no-install-recommends binutils patchelf && rm -rf /var/lib/apt/lists/*}} Package 'patchelf' has version defined Package 'patchelf' does not have version defined

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	1.01s
✅ DOCKERFILE	hadolint	1		0	0	0.34s
✅ EDITORCONFIG	editorconfig-checker	2		0	0	0.18s
✅ REPOSITORY	gitleaks	yes		no	no	0.91s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	grype	yes		no	no	25.53s
✅ REPOSITORY	secretlint	yes		no	no	0.81s
✅ REPOSITORY	semgrep	yes		no	no	16.77s
✅ REPOSITORY	syft	yes		no	no	1.87s
✅ REPOSITORY	trivy	yes		no	no	6.92s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.08s
✅ REPOSITORY	trufflehog	yes		no	no	8.66s
✅ SPELL	lychee	1		0	0	1.17s
✅ YAML	prettier	1	0	0	0	0.33s
✅ YAML	v8r	1		0	0	2.84s
✅ YAML	yamllint	1		0	0	0.38s

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff