build(deps-dev): update uv-build requirement from <0.13,>=0.11.25 to >=0.11.25,<0.14 (#6438)

Updates the requirements on [uv-build](https://github.com/astral-sh/uv)
to permit the latest version.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/releases">uv-build's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-09.</p>
<p>uv 0.13.0 makes Python 3.15 the default stable Python version. We've
also included several breaking changes to improve correctness,
performance, and compatibility, described below.</p>
<p><strong>We expect most users to be able to upgrade without making
changes.</strong></p>
<p>While not a breaking change, this release also updates the format of
many of uv's cache entries to improve performance. <strong>uv may
download or rebuild dependencies after upgrading</strong>, because some
cached entries from earlier versions cannot be reused. Multiple versions
of uv can still safely share the same cache directory.</p>
<p>There are no breaking changes to the configuration of the <a
href="https://docs.astral.sh/uv/concepts/build-backend/">uv build
backend</a>. If your <code>[build-system]</code> table includes an upper
bound on <code>uv_build</code>, update it to allow <code>uv_build</code>
0.13, e.g., <code>uv_build&gt;=0.13.0,&lt;0.14</code>.</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p><strong>Use Python 3.15 as the default stable version</strong></p>
<p>The default stable Python version has changed from 3.14 to 3.15. This
affects Python downloads when no version is requested or pinned, e.g.,
when running <code>uv python install</code>.</p>
<p>uv continues to use compatible Python installations that are already
present. For example, <code>uv venv</code> can still use an installed
Python 3.14. If no suitable interpreter is installed and automatic
downloads are enabled, commands such as <code>uv venv</code> and
<code>uvx python</code> can now download Python 3.15.</p>
<p>You can opt out of this behavior by requesting Python 3.14
explicitly, e.g., <code>uv venv --python 3.14</code>. For projects, use
<code>uv python pin 3.14</code> to record the version in
<code>.python-version</code>.</p>
</li>
<li>
<p><strong>Honor <code>--require-hashes</code> in included constraints
files</strong> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22275">#22275</a>)</p>
<p>Previously, uv ignored <code>--require-hashes</code> in constraints
files included with <code>-c</code> from a requirements file. Now, uv
honors the directive and requires hashes for all requirements in the
installation. Installs that previously succeeded can now fail if a
requirement is missing a hash.</p>
<p>You cannot opt out while the directive is present. Add the missing
hashes to your requirements, or remove the <code>--require-hashes</code>
directive from the included constraints file if hash checking is not
intended.</p>
</li>
<li>
<p><strong>Prefer native Python on Windows ARM64</strong> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22100">#22100</a>)</p>
<p>Previously, ARM64 builds of uv preferred emulated <code>x86_64</code>
Python installations because native wheel support was limited. Now, uv
prefers native ARM64 (<code>aarch64</code>) interpreters across Python
versions.</p>
<p>This follows similar changes in <a
href="https://discuss.python.org/t/python-on-windows-arm64/104524">CPython</a>,
the official Windows <a
href="https://discuss.python.org/t/python-install-manager-26-4/108846">Python
install manager</a>, and GitHub's <a
href="https://github.com/actions/setup-python#supported-architectures">actions/setup-python</a>.</p>
<p>When a native interpreter is unavailable, uv continues to fall back
to <code>x86_64</code>, then 32-bit <code>x86</code>.</p>
<p>You can opt out of this behavior by setting
<code>UV_PYTHON_ARCH=x86_64</code> or requesting an explicit
architecture, e.g., <code>cpython-3.14-windows-x86_64</code>. If you are
using <code>setup-uv</code>, you can set <a
href="https://github.com/astral-sh/setup-uv#python-architecture"><code>python-arch:
x86_64</code></a> instead.</p>
</li>
<li>
<p><strong>Reject editable requirements in included constraints
files</strong> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22282">#22282</a>)</p>
<p>Previously, uv silently ignored editable (<code>-e</code>)
requirements in constraints files included with <code>-c</code> from a
requirements file. Now, uv rejects these requirements with an error,
matching <a
href="https://pip.pypa.io/en/stable/user_guide/#constraints-files">pip's
behavior</a>.</p>
<p>You cannot opt out of this behavior. Move editable requirements to a
requirements file passed with <code>-r</code>, or pass them directly
with <code>--editable</code>, instead of including them in a constraints
file.</p>
</li>
<li>
<p><strong>Omit the distutils startup patch on Python 3.10 and
later</strong> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22096">#22096</a>)</p>
<p>Previously, uv installed <code>_virtualenv.py</code> and
<code>_virtualenv.pth</code> into every new virtual environment to
prevent distutils configuration from changing installation paths. Now,
like <a
href="https://github.com/pypa/virtualenv/releases/tag/21.6.0"><code>virtualenv</code>
21.6.0</a>, uv omits these files on Python 3.10 and later, which already
ignore the affected configuration keys. This reduces Python startup
overhead. Python 3.9 and earlier retain the patch.</p>
<p>You cannot opt out of this behavior. Existing virtual environments
are not modified automatically. Recreate an environment with Python 3.10
or later to remove the patch.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">uv-build's
changelog</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<p>Released on 2026-10-09.</p>
<p>uv 0.13.0 makes Python 3.15 the default stable Python version. We've
also included several breaking changes to improve correctness,
performance, and compatibility, described below.</p>
<p><strong>We expect most users to be able to upgrade without making
changes.</strong></p>
<p>While not a breaking change, this release also updates the format of
many of uv's cache entries to improve performance. <strong>uv may
download or rebuild dependencies after upgrading</strong>, because some
cached entries from earlier versions cannot be reused. Multiple versions
of uv can still safely share the same cache directory.</p>
<p>There are no breaking changes to the configuration of the <a
href="https://docs.astral.sh/uv/concepts/build-backend/">uv build
backend</a>. If your <code>[build-system]</code> table includes an upper
bound on <code>uv_build</code>, update it to allow <code>uv_build</code>
0.13, e.g., <code>uv_build&gt;=0.13.0,&lt;0.14</code>.</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p><strong>Use Python 3.15 as the default stable version</strong></p>
<p>The default stable Python version has changed from 3.14 to 3.15. This
affects Python downloads when no version is requested or pinned, e.g.,
when running <code>uv python install</code>.</p>
<p>uv continues to use compatible Python installations that are already
present. For example, <code>uv venv</code> can still use an installed
Python 3.14. If no suitable interpreter is installed and automatic
downloads are enabled, commands such as <code>uv venv</code> and
<code>uvx python</code> can now download Python 3.15.</p>
<p>You can opt out of this behavior by requesting Python 3.14
explicitly, e.g., <code>uv venv --python 3.14</code>. For projects, use
<code>uv python pin 3.14</code> to record the version in
<code>.python-version</code>.</p>
</li>
<li>
<p><strong>Honor <code>--require-hashes</code> in included constraints
files</strong> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22275">#22275</a>)</p>
<p>Previously, uv ignored <code>--require-hashes</code> in constraints
files included with <code>-c</code> from a requirements file. Now, uv
honors the directive and requires hashes for all requirements in the
installation. Installs that previously succeeded can now fail if a
requirement is missing a hash.</p>
<p>You cannot opt out while the directive is present. Add the missing
hashes to your requirements, or remove the <code>--require-hashes</code>
directive from the included constraints file if hash checking is not
intended.</p>
</li>
<li>
<p><strong>Prefer native Python on Windows ARM64</strong> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22100">#22100</a>)</p>
<p>Previously, ARM64 builds of uv preferred emulated <code>x86_64</code>
Python installations because native wheel support was limited. Now, uv
prefers native ARM64 (<code>aarch64</code>) interpreters across Python
versions.</p>
<p>This follows similar changes in <a
href="https://discuss.python.org/t/python-on-windows-arm64/104524">CPython</a>,
the official Windows <a
href="https://discuss.python.org/t/python-install-manager-26-4/108846">Python
install manager</a>, and GitHub's <a
href="https://github.com/actions/setup-python#supported-architectures">actions/setup-python</a>.</p>
<p>When a native interpreter is unavailable, uv continues to fall back
to <code>x86_64</code>, then 32-bit <code>x86</code>.</p>
<p>You can opt out of this behavior by setting
<code>UV_PYTHON_ARCH=x86_64</code> or requesting an explicit
architecture, e.g., <code>cpython-3.14-windows-x86_64</code>. If you are
using <code>setup-uv</code>, you can set <a
href="https://github.com/astral-sh/setup-uv#python-architecture"><code>python-arch:
x86_64</code></a> instead.</p>
</li>
<li>
<p><strong>Reject editable requirements in included constraints
files</strong> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22282">#22282</a>)</p>
<p>Previously, uv silently ignored editable (<code>-e</code>)
requirements in constraints files included with <code>-c</code> from a
requirements file. Now, uv rejects these requirements with an error,
matching <a
href="https://pip.pypa.io/en/stable/user_guide/#constraints-files">pip's
behavior</a>.</p>
<p>You cannot opt out of this behavior. Move editable requirements to a
requirements file passed with <code>-r</code>, or pass them directly
with <code>--editable</code>, instead of including them in a constraints
file.</p>
</li>
<li>
<p><strong>Omit the distutils startup patch on Python 3.10 and
later</strong> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22096">#22096</a>)</p>
<p>Previously, uv installed <code>_virtualenv.py</code> and
<code>_virtualenv.pth</code> into every new virtual environment to
prevent distutils configuration from changing installation paths. Now,
like <a
href="https://github.com/pypa/virtualenv/releases/tag/21.6.0"><code>virtualenv</code>
21.6.0</a>, uv omits these files on Python 3.10 and later, which already
ignore the affected configuration keys. This reduces Python startup
overhead. Python 3.9 and earlier retain the patch.</p>
<p>You cannot opt out of this behavior. Existing virtual environments
are not modified automatically. Recreate an environment with Python 3.10
or later to remove the patch.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/uv/commit/4ecd0eff2a81e3ffdcd7cfee10d08936e4747c17"><code>4ecd0ef</code></a>
Document <code>virtualenv</code> alignment in the distutils release note
(<a
href="https://redirect.github.com/astral-sh/uv/issues/22443">#22443</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/d13bcd3f53ada08e20f06c3583a5bac2ab476111"><code>d13bcd3</code></a>
Scope cached build metadata by build settings (<a
href="https://redirect.github.com/astral-sh/uv/issues/22404">#22404</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/0c674bf3a0e46204672997a2a2fae9a020c74446"><code>0c674bf</code></a>
Clarify opt-outs for the 0.13 breaking changes (<a
href="https://redirect.github.com/astral-sh/uv/issues/22442">#22442</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/a434966597ba425fc785d66141ad4f31f3189076"><code>a434966</code></a>
Avoid clearing build source directories (<a
href="https://redirect.github.com/astral-sh/uv/issues/22276">#22276</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/8dcc24eaf9cf270c09ea282a77f8e14236472685"><code>8dcc24e</code></a>
Mention <code>setup-uv</code> architecture input in breaking changes (<a
href="https://redirect.github.com/astral-sh/uv/issues/22441">#22441</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/0c97f21b56bd2733a3dab1dbe23dec45c46f19c3"><code>0c97f21</code></a>
Exercise <code>UV_PYTHON_ARCH</code> in Windows ARM64 integration (<a
href="https://redirect.github.com/astral-sh/uv/issues/22440">#22440</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/ee7b9f09c6b335235fb81bcabc24d9876db70198"><code>ee7b9f0</code></a>
Bump version to 0.13.0 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22415">#22415</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/1711e26b7a8a28a6be2aee5270c5bad36916a3f9"><code>1711e26</code></a>
Require planned Docker builds to pass (<a
href="https://redirect.github.com/astral-sh/uv/issues/22438">#22438</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/f719b590424e4051333716c129c0b49010a7b230"><code>f719b59</code></a>
Skip benchmarks for Rust integration test changes (<a
href="https://redirect.github.com/astral-sh/uv/issues/22437">#22437</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/aca615c1d8211558b08985c062a058c1877fc268"><code>aca615c</code></a>
Add <code>TestContext::read_bytes</code> for binary fixtures (<a
href="https://redirect.github.com/astral-sh/uv/issues/22436">#22436</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/uv/compare/0.11.25...0.13.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["uv_build >=0.11.25,<0.13"]
+requires = ["uv_build >=0.11.25,<0.14"]
 build-backend = "uv_build"
 
 [project]