#2267 chore(deps): bump uv from 0.11.14 to 0.11.15 Pull request opened by dependabot[bot] Bumps uv from 0.11.14 to 0.11.15. Release notes Sourced from uv's releases.

0.11.15

Release Notes

Released on 2026-05-18.

Security

• Fix a TAR parser differential, see GHSA-3cv2-h65g-fgmm (#19463)

• Enforce that entry points cannot escape in the scripts directory, see GHSA-4gg8-gxpx-9rph (#19464)

Enhancements

• Add TOML v1.1 -> v1.0 backwards compatibility for source distributions (#18741)

• Add support for Azure request signing (#19421)

• Apply stricter validation to all wheel filename segments (#19364)

• Reject empty strings as an invalid package name (#19435)

• Use structured errors for signing authentication failures (#19422)

Preview

• uv audit: Add JSON output (#19305)

Configuration

• Respect

required-environments

in

uv pip compile

(#19378)

Performance

• Avoid parsing JSON manifest when local Python is available (#19398)

• Avoid walking nested directories in linker conflict registration (#19382)

• Optimize async wheel ZIP writing (#19383)

• Fix dead "already trimmed" fast-path in

Version::only_release_trimmed

(#19425)

Bug fixes

• Apply workspace-member

[tool.uv.sources]

credentials under

uv sync --frozen

(#19423)

• Skip empty directories in uv build outputs (#19437)

• Fix Git submodule handling when using relative paths (#12156)

• Fix line number reporting in netrc parsing (#19452)

Documentation

• Move Bazel auth helper setup into integration guide (#19392)

Install uv 0.11.15

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-installer.sh | sh

</tr></table>

... (truncated) Changelog Sourced from uv's changelog.

0.11.15

Released on 2026-05-18.

Security

• Fix a TAR parser differential, see GHSA-3cv2-h65g-fgmm (#19463)

• Enforce that entry points cannot escape in the scripts directory, see GHSA-4gg8-gxpx-9rph (#19464)

Enhancements

• Add TOML v1.1 -> v1.0 backwards compatibility for source distributions (#18741)

• Add support for Azure request signing (#19421)

• Apply stricter validation to all wheel filename segments (#19364)

• Reject empty strings as an invalid package name (#19435)

• Use structured errors for signing authentication failures (#19422)

Preview

• uv audit: Add JSON output (#19305)

Configuration

• Respect

required-environments

in

uv pip compile

(#19378)

Performance

• Avoid parsing JSON manifest when local Python is available (#19398)

• Avoid walking nested directories in linker conflict registration (#19382)

• Optimize async wheel ZIP writing (#19383)

• Fix dead "already trimmed" fast-path in

Version::only_release_trimmed

(#19425)

Bug fixes

• Apply workspace-member

[tool.uv.sources]

credentials under

uv sync --frozen

(#19423)

• Skip empty directories in uv build outputs (#19437)

• Fix Git submodule handling when using relative paths (#12156)

• Fix line number reporting in netrc parsing (#19452)

Documentation

• Move Bazel auth helper setup into integration guide (#19392)

Commits • `3cffe97` Fix crates.io publish script lockfile (#19473) • `de16a7b` Bump version to 0.11.15 (#19472) • `cf826cc` Disable

test_simultaneous_create_set_then_move

on Linux (#19469) • `2d566bc` Allow retry of

custom-publish-crates

separately from

announce

(#19470) • `0588b8f` Run release builds on maturin version bumps in CI (#19466) • `9a65753` Enforce that entry points cannot escape in the scripts directory (#19464) • `d77d849` Revert "Update maturin to v1.13.2 (#19445)" (#19465) • `5373e96` Update Rust crate rustls to v0.23.40 (#19250) • `fb8d3d4` Update Rust crate rustls-pki-types to v1.14.1 (#19251) • `078480d` Configure maturin and uv so

uv run

can be used to wo… meltano/hub