Update uv-build requirement from <0.13.0,>=0.12.13 to >=0.12.16,<0.13.0 in the python group

[dependabot]

Updates the requirements on uv-build to permit the latest version.
Updates uv-build to 0.12.16

Release notes

Sourced from uv-build's releases.

0.12.16

Release Notes

Released on 2026-09-17.

Python

• Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#21741)

Enhancements

• Verify downloaded wheels and source distributions against hashes supplied by package indexes (#21562)
• Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#21467)
• Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#21766)
• Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#21779)

Preview features

• Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#21163)
• Honor configured and command-line index settings, including credentials, in uv upgrade (#21776)
• Allow uv check to run in projects that are not managed by uv and outside workspaces (#21777)
• Respect --python and UV_PYTHON when selecting the Python version for uv check (#21744)

Bug fixes

• Redact Azure shared access signatures from displayed and logged URLs (#21755)
• Check archive sizes from pylock.toml before reusing cached distributions (#21609)
• Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#20631)
• Use the bundled uv_build backend only when its version matches active version pins (#21742)
• Handle malformed index URLs without panicking when credentials are configured (#21784)
• Report a configuration error instead of panicking for proxy URLs without a host (#21781)
• Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#21783)

Install uv 0.12.16

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1 | iex"

Download uv 0.12.16

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.12.16

Released on 2026-09-17.

Python

• Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#21741)

Enhancements

• Verify downloaded wheels and source distributions against hashes supplied by package indexes (#21562)
• Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#21467)
• Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#21766)
• Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#21779)

Preview features

• Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#21163)
• Honor configured and command-line index settings, including credentials, in uv upgrade (#21776)
• Allow uv check to run in projects that are not managed by uv and outside workspaces (#21777)
• Respect --python and UV_PYTHON when selecting the Python version for uv check (#21744)

Bug fixes

• Redact Azure shared access signatures from displayed and logged URLs (#21755)
• Check archive sizes from pylock.toml before reusing cached distributions (#21609)
• Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#20631)
• Use the bundled uv_build backend only when its version matches active version pins (#21742)
• Handle malformed index URLs without panicking when credentials are configured (#21784)
• Report a configuration error instead of panicking for proxy URLs without a host (#21781)
• Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#21783)

0.12.15

Released on 2026-09-15.

Performance

• Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#21675)

Bug fixes

• Fix regressions in 0.12.14 when installing to symlinked destinations or using uv pip install --target . (#21699)

0.12.14

Released on 2026-09-15.

Enhancements

... (truncated)

Commits

• 761ff13 Bump version to 0.12.16 (#21809)
• a2f820a Assign release pull requests to the workflow initiator (#21808)
• 6dffe7e Ignore UV_NATIVE_TLS when UV_SYSTEM_CERTS is set (#21805)
• 7bc3676 Avoid warning when both native-tls and system-certs are configured (#21806)
• 07b838a Avoid warning when both UV_NATIVE_TLS and UV_SYSTEM_CERTS are set (#21788)
• 5d64ede Remove Hash API (#21786)
• 9ddc430 Move shared thread initialization into uv-threads (#21746)
• ef1e068 Make Git stamping opt-in for development builds (#21750)
• 6ce0977 Avoid panics for non-base index URLs (#21784)
• 47f19ec Return an error for failed VerbatimUrl path conversions (#21783)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions