ci: bump uv from 0.12.5 to 0.12.20 in /.github

[dependabot]

Bumps uv from 0.12.5 to 0.12.20.

Release notes

Sourced from uv's releases.

0.12.20

Release Notes

Released on 2026-09-28.

Enhancements

• Reuse lockfiles when dependency declarations are semantically equivalent (#21951)
• Preserve second-line encoding declarations when installing wheel scripts with CRLF shebangs (#21990)

Preview features

• Write normalized requirement declarations with the lockfile-normalization preview feature (#21951)
• Honor synthetic default groups when installing or syncing from pylock.toml (#22003)
• Resolve local paths in exported pylock.toml files relative to the output file (#22042)
• Install each package only once when repeated tool-install-locks requirements resolve to the same package (#22000)
• Reuse lock-without-metadata lockfiles for conflicting groups with distinct base and extra requirement specifiers (#22055)
• Use consistent root-package paths in uv workspace metadata and uv tree --format json output (#22050)

Configuration

• Continue searching XDG_CONFIG_DIRS after empty entries (#21987)

Performance

• Restore the previous HTTP cache-write scheduling while investigating severe cache-revalidation stalls on ext4 filesystems (#22051)

Bug fixes

• Apply hash constraints to every repeated requirement under --require-hashes and --verify-hashes (#21996)
• Allow metadata builds for first-party workspace projects under --no-build (#21988)
• Honor project exclusion flags with --all-packages, including --no-install-project and --no-emit-project (#21994)
• Restore pyproject.toml if uv upgrade fails or is interrupted (#21983)
• Generate working Nushell activation scripts for relocatable virtual environments (#21979)
• Prevent commands from running and changing state after displaying --show-settings (#21989)
• Treat UTF-16 requirements files containing only a byte-order mark as empty (#21991)
• Ignore unrecognized managed-Python implementation directories during uv python list and uv python upgrade instead of panicking (#22033)
• Avoid panics and incorrect rewriting when managed Python sysconfig paths merely start with /install (#22036)
• Report whitespace-only non-ASCII requirements as invalid instead of panicking (#22035)
• Avoid a resolver panic when trace logging an always-false constraint (#22034)

Install uv 0.12.20

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.20/uv-installer.sh | sh

Install prebuilt binaries via powershell script

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.20

Released on 2026-09-28.

Enhancements

• Reuse lockfiles when dependency declarations are semantically equivalent (#21951)
• Preserve second-line encoding declarations when installing wheel scripts with CRLF shebangs (#21990)

Preview features

• Write normalized requirement declarations with the lockfile-normalization preview feature (#21951)
• Honor synthetic default groups when installing or syncing from pylock.toml (#22003)
• Resolve local paths in exported pylock.toml files relative to the output file (#22042)
• Install each package only once when repeated tool-install-locks requirements resolve to the same package (#22000)
• Reuse lock-without-metadata lockfiles for conflicting groups with distinct base and extra requirement specifiers (#22055)
• Use consistent root-package paths in uv workspace metadata and uv tree --format json output (#22050)

Configuration

• Continue searching XDG_CONFIG_DIRS after empty entries (#21987)

Performance

• Restore the previous HTTP cache-write scheduling while investigating severe cache-revalidation stalls on ext4 filesystems (#22051)

Bug fixes

• Apply hash constraints to every repeated requirement under --require-hashes and --verify-hashes (#21996)
• Allow metadata builds for first-party workspace projects under --no-build (#21988)
• Honor project exclusion flags with --all-packages, including --no-install-project and --no-emit-project (#21994)
• Restore pyproject.toml if uv upgrade fails or is interrupted (#21983)
• Generate working Nushell activation scripts for relocatable virtual environments (#21979)
• Prevent commands from running and changing state after displaying --show-settings (#21989)
• Treat UTF-16 requirements files containing only a byte-order mark as empty (#21991)
• Ignore unrecognized managed-Python implementation directories during uv python list and uv python upgrade instead of panicking (#22033)
• Avoid panics and incorrect rewriting when managed Python sysconfig paths merely start with /install (#22036)
• Report whitespace-only non-ASCII requirements as invalid instead of panicking (#22035)
• Avoid a resolver panic when trace logging an always-false constraint (#22034)

0.12.19

Released on 2026-09-24.

Python

• Add PyPy 3.11.16 and 3.12.14 (#21847)
• Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

... (truncated)

Commits

• 2274b80 Bump version to 0.12.20 (#22064)
• 8ee7eeb Add atomic write and HTTP cache benchmarks (#22054)
• fc012a6 Reuse conflicting group locks with distinct extra specifiers (#22055)
• c9dab42 Revert "Batch HTTP cache writes in blocking tasks" (#22051)
• b92dafc Normalize root paths in metadata output (#22050)
• 4d3ce16 Normalize requirement declarations in lockfiles (#21951)
• 13fd524 Downgrade some of reqsign's transitive deps (#22047)
• 7a3bc07 Avoid panics for unknown managed Python implementations (#22033)
• a41dbfc Fix local paths in pylock.toml exports (#22042)
• 38502bc Update Rust crate owo-colors to v4.4.0 (#22031)
• Additional commits viewable in compare view