chore(deps): update dependency astral-sh/uv to v0.5.18

[renovate]

This PR contains the following updates:

Package	Update	Change
astral-sh/uv	patch	0.5.15 -> 0.5.18

---

Release Notes

astral-sh/uv (astral-sh/uv)

v0.5.18

Compare Source

Bug fixes

• Avoid forking for identical markers (#​10490)
• Avoid panic in uv remove when only comments exist (#​10484)
• Revert "improve shell compatibility of venv activate scripts (#​10397)" (#​10497)

v0.5.17

Compare Source

This release includes support for generating lockfiles from scripts based on inline metadata, as defined in PEP 723.

By default, scripts remain unlocked, and must be locked explicitly with uv lock --script /path/to/script.py, which
will generate a lockfile adjacent to the script (e.g., script.py.lock). Once generated, the lockfile will be
respected (and updated, if necessary) across uv run --script, uv add --script, and uv remove --script invocations.

This release also includes support for uv export --script and uv tree --script. Both commands support PEP 723
scripts with and without accompanying lockfiles.

Enhancements

• Add support for locking PEP 723 scripts (#​10135)
• Respect PEP 723 script lockfiles in uv run (#​10136)
• Update PEP 723 lockfile in uv add --script (#​10145)
• Update PEP 723 lockfile in uv remove --script (#​10162)
• Add --script support to uv export for PEP 723 scripts (#​10160)
• Add --script support to uv tree for PEP 723 scripts (#​10159)
• Add ls alias to uv {tool, python, pip} list (#​10240)
• Allow reading --with-requirements from stdin in uv add and uv run (#​10447)
• Warn-and-ignore for unsupported requirements.txt options (#​10420)

Preview features

• Add remaining Python type annotations to build backend (#​10434)

Performance

• Avoid allocating for names in the PEP 508 parser (#​10476)
• Fetch concurrently for non-first-match index strategies (#​10432)
• Remove unnecessary .to_string() call (#​10419)
• Respect sentinels in package prioritization (#​10443)
• Use ArcStr for marker values (#​10453)
• Use ArcStr for package, extra, and group names (#​10475)
• Use matches! rather than contains in requirements.txt parsing (#​10423)
• Use faster disjointness check for markers (#​10439)
• Pre-compute PEP 508 markers from universal markers (#​10472)

Bug fixes

• Fix UV_FIND_LINKS delimiter to split on commas (#​10477)
• Improve uv tool list output when tool environment is broken (#​10409)
• Only track markers for compatible versions (#​10457)
• Respect requires-python when installing tools (#​10401)
• Visit proxy packages eagerly (#​10441)
• Improve shell compatibility of venv activate scripts (#​10397)
• Read publish username from URL (#​10469)

Documentation

• Add Lambda layer instructions to AWS Lambda guide (#​10411)
• Add uv lock --script to the docs (#​10414)
• Use Windows-specific instructions in Jupyter guide (#​10446)

v0.5.16

Compare Source

Enhancements

• Accept full requirements in uv remove (#​10338)

Performance

• Avoid over-counting versions in batch prefetcher (#​10350)
• Deactivate tracing for version-choosing (#​10351)
• Force a niche into VersionSmall (#​10385)
• Optimize requirements_for_extra (#​10348)
• Re-enable zlib-ng on x86 platforms (#​10365)
• Re-enable zlib-ng on all platforms (except s390x, PowerPC, and FreeBSD) (#​10370)
• Remove [u64; 4] from small version to move Arc to full version (#​10345)
• Shrink Dist from 352 to 288 bytes (#​10389)
• Speed up file pins by removing nested hash map (#​10346)
• Buffer file reads in serde_json::from_reader (#​10341)

Bug fixes

• Avoid enforcing project-level required version for uv self (#​10374)
• Fix Ruff linting warnings from generated template files for extension modules (#​10371)

Documentation

• Add AWS Lambda integration guide (#​10278)

---

Configuration

📅 Schedule: Branch creation - "before 4am on Wednesday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🦙 MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ API	spectral	1		0	1.98s
⚠️ BASH	bash-exec	6		1	0.02s
✅ BASH	shellcheck	6		0	0.24s
✅ BASH	shfmt	6	0	0	0.97s
✅ COPYPASTE	jscpd	yes		no	4.96s
✅ DOCKERFILE	hadolint	129		0	24.8s
✅ JSON	jsonlint	20		0	0.22s
✅ JSON	v8r	22		0	15.11s
⚠️ MARKDOWN	markdownlint	267	0	302	25.93s
✅ MARKDOWN	markdown-table-formatter	267	0	0	159.84s
⚠️ PYTHON	bandit	214		66	3.41s
✅ PYTHON	black	214	0	0	4.95s
✅ PYTHON	flake8	214		0	1.94s
✅ PYTHON	isort	214	0	0	1.08s
✅ PYTHON	mypy	214		0	16.0s
✅ PYTHON	pylint	214		0	35.14s
✅ PYTHON	ruff	214	0	0	0.48s
✅ REPOSITORY	checkov	yes		no	36.15s
✅ REPOSITORY	git_diff	yes		no	1.11s
⚠️ REPOSITORY	grype	yes		26	12.42s
✅ REPOSITORY	secretlint	yes		no	11.37s
✅ REPOSITORY	trivy	yes		no	16.43s
✅ REPOSITORY	trivy-sbom	yes		no	0.28s
⚠️ REPOSITORY	trufflehog	yes		1	53.7s
✅ SPELL	cspell	717		0	13.85s
⚠️ SPELL	lychee	349		16	5.97s
✅ XML	xmllint	3	0	0	0.91s
✅ YAML	prettier	160	0	0	4.8s
✅ YAML	v8r	102		0	31.05s
✅ YAML	yamllint	161		0	3.27s

See detailed report in MegaLinter reports

MegaLinter is graciously provided by