fix(deps): update all non-major dependencies in .github/workflows/pypi-test-release.yml

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
astral-sh/uv	uses-with	patch	0.10.2 → 0.10.4
dulwich	project.dependencies	minor	>=1.0.0,<1.1.0 → >=1.1.0,<1.2.0
github/codeql-action (changelog)	action	digest	9e907b5 → 89a39a4

---

Release Notes

astral-sh/uv (astral-sh/uv)

v0.10.4

Compare Source

Released on 2026-02-17.

Enhancements

• Remove duplicate references to the affected paths when showing uv python errors (#​18008)
• Skip discovery of workspace members that contain only git-ignored files, including in sub-directories (#​18051)

Bug fixes

• Don't panic when initialising a package at the filesystem root (e.g. uv init / --name foo) (#​17983)
• Fix permissions on wheel and sdist files produced by the uv_build build backend (#​18020)
• Revert locked file change to fix locked files on NFS mounts (#​18071)

v0.10.3

Compare Source

Released on 2026-02-16.

Python

• Add CPython 3.15.0a6

Enhancements

• Don't open file locks for writing (#​17956)
• Make Windows trampoline error messages consistent with uv proper (#​17969)
• Log which preview features are enabled (#​17968)

Preview features

• Add support for ruff version constraints and exclude-newer in uv format (#​17651)
• Fix script path handling when target-workspace-discovery is enabled (#​17965)
• Use version constraints to select the default ruff version used by uv format (#​17977)

Bug fixes

• Avoid matching managed Python versions by prefixes, e.g. don't match CPython 3.10 when cpython-3.1 is specified (#​17972)
• Fix handling of --allow-existing with minor version links on Windows (#​17978)
• Fix panic when encountering unmanaged workspace members (#​17974)
• Improve accuracy of request timing (#​18007)
• Reject u64::MAX in version segments to prevent overflow (#​17985)

Documentation

• Reference Debian Trixie instead of Bookworm (#​17991)

dulwich/dulwich (dulwich)

v1.1.0: 1.1.0

Compare Source

What's Changed

• Add reference to c-git-compatibility doc in README.md by @​jelmer in jelmer#2069
• Implement cli commands for more porcelain by @​jelmer in jelmer#2071
• Support GIT_TRACE_PACKET by @​jelmer in jelmer#2073
• Fix cloning of SHA-256 repositories with protocol v2 by @​jelmer in jelmer#2074
• skip tests that require merge3 when it's not available by @​kulikjak in jelmer#2075
• Add test-minimal to CI; run tests without installing any optional dependencies by @​jelmer in jelmer#2076
• Update SECURITY.md by @​jelmer in jelmer#2077
• Don't skip 3.14 wheels by @​bowiechen in jelmer#2078
• Add Git protocol v2 packfile-uris client support by @​jelmer in jelmer#2079
• Attempt to fix occasional issues with long running lfs processes in tests by @​jelmer in jelmer#2081
• Allow passing commit and author timestamps into porcelain.commit by @​ading2210 in jelmer#2080
• Skip Python 3.14 x86_64/universal2 wheels on macOS by @​jelmer in jelmer#2082
• Improve exception message for tags by @​jelmer in jelmer#2083
• ci(deps): bump dependabot/fetch-metadata from 2.4.0 to 2.5.0 by @​dependabot[bot] in jelmer#2084
• ci(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @​dependabot[bot] in jelmer#2085
• deps(deps-dev): bump ruff from 0.14.10 to 0.14.14 in the pip group by @​dependabot[bot] in jelmer#2086
• Add bundle URI support for faster clones and fetches by @​jelmer in jelmer#2087
• Add basic subtree support by @​jelmer in jelmer#2088
• Add support for core.trustctime configuration option by @​jelmer in jelmer#2091
• Fix LFS client selection for file:// URLs by @​jelmer in jelmer#2089
• Add support for core.commentChar configuration option (#​1852) by @​jelmer in jelmer#2092
• Add --unshallow support to fetch command by @​jelmer in jelmer#2093
• Add progress reporting during pack file downloads by @​jelmer in jelmer#2094
• Macos wheels fix by @​jelmer in jelmer#2095
• Disable git-lfs filter process in LFS status tests to fix flaky Windows failures by @​jelmer in jelmer#2096
• Server side hooks by @​jelmer in jelmer#2097
• Fix checkout skipping files with paths starting with '.git' by @​jelmer in jelmer#2098

New Contributors

• @​bowiechen made their first contribution in jelmer#2078
• @​ading2210 made their first contribution in jelmer#2080

Full Changelog: jelmer/dulwich@dulwich-1.0.0...dulwich-1.1.0

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.