Bump uv from 0.11.15 to 0.11.31 in /.github

[dependabot]

Bumps uv from 0.11.15 to 0.11.31.

Release notes

Sourced from uv's releases.

0.11.31

Release Notes

Released on 2026-07-21.

Enhancements

• Allow workspace sources to reference members in another workspace by path (#18401)
• Support .venv files containing paths to centralized project environments (#20022)
• Update bundled Windows timezone data to IANA 2026c (#20554)

Preview features

• Add an index-specific hash-algorithm setting for lockfile generation (#20605)

Configuration

• Add audit.malware-check and audit.malware-check-url settings (#20587)

Performance

• Avoid quadratic work when deduplicating transitive conflicts (#20578)

Bug fixes

• Suggest --emit-build-options for unsupported uv pip compile --emit-options (#20582)
• Reject source distributions and wheels with mismatched package names (#20432)
• Avoid retrying TLS certificate verification failures (#16245)
• Avoid warnings about uv_build settings for in-tree build backends (#20153)

Install uv 0.11.31

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"

Download uv 0.11.31

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.11.31

Released on 2026-07-21.

Enhancements

• Allow workspace sources to reference members in another workspace by path (#18401)
• Support .venv files containing paths to centralized project environments (#20022)
• Update bundled Windows timezone data to IANA 2026c (#20554)

Preview features

• Add an index-specific hash-algorithm setting for lockfile generation (#20605)

Configuration

• Add audit.malware-check and audit.malware-check-url settings (#20587)

Performance

• Avoid quadratic work when deduplicating transitive conflicts (#20578)

Bug fixes

• Suggest --emit-build-options for unsupported uv pip compile --emit-options (#20582)
• Reject source distributions and wheels with mismatched package names (#20432)
• Avoid retrying TLS certificate verification failures (#16245)
• Avoid warnings about uv_build settings for in-tree build backends (#20153)

0.11.30

Released on 2026-07-20.

Python

• Add CPython 3.15.0b4 (#20519)

Preview features

• Allow uv workspace metadata --sync to target the active virtual environment with --active (#20500)
• Reuse centralized project environments when workspaces are accessed through symlinks (#20436)

Performance

• Skip resolver candidates whose files are all excluded by exclude-newer (#20460)
• Limit parallel cache reads to reduce resolver scheduling and allocation overhead (#20427)
• Accelerate lockfile serialization with toml_writer (#20450)
• Compact cached Simple API distribution metadata and hashes (#20463, #20483)
• Decode stale cache entries in a single blocking task (#20486)
• Decode cached payloads outside resolver workers (#20464)

... (truncated)

Commits

• b7fdec6 Bump version to 0.11.31 (#20608)
• 5b70d39 Allow requiring a hash algorithm for an index (#20605)
• f30c2ff Update Astral OIDC broker policy to schema v2 (#20606)
• a677fa2 Move macOS dev-binary builds to Namespace (#20604)
• fd00f8d Route all workflow failure issues to uv-dev (#20600)
• 88a0e28 Host the Astral credential broker policy in-repo (#20603)
• 219b232 Use stable Rust for development builds (#20601)
• 8da71e4 Allow automation to add notes to repeated workflow failures (#20599)
• 1e1d01f Fix various comments (#20597)
• e500216 Use Packse for the Android lock test (#20602)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.65%. Comparing base (b2b4734) to head (2d51bad).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #572   +/-   ##
=======================================
  Coverage   90.65%   90.65%           
=======================================
  Files          49       49           
  Lines        7477     7477           
=======================================
  Hits         6778     6778           
  Misses        699      699           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.