chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
astral-sh/uv-pre-commit	repository	patch	0.9.26 → 0.9.28
biomejs/pre-commit	repository	patch	v2.3.12 → v2.3.13
tombi-toml/tombi-pre-commit	repository	patch	v0.7.24 → v0.7.25	v0.7.26
		lockFileMaintenance	All locks refreshed
uv (source, changelog)	dependency-groups	patch	0.9.26 → 0.9.28

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

astral-sh/uv-pre-commit (astral-sh/uv-pre-commit)

v0.9.28

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.9.28

v0.9.27

Compare Source

See: https://github.com/astral-sh/uv/releases/tag/0.9.27

biomejs/pre-commit (biomejs/pre-commit)

v2.3.13

Compare Source

tombi-toml/tombi-pre-commit (tombi-toml/tombi-pre-commit)

v0.7.25

Compare Source

See: https://github.com/tombi-toml/tombi/releases/tag/v0.7.25

astral-sh/uv (uv)

v0.9.28

Compare Source

Released on 2026-01-29.

Python

• Update CPython to use OpenSSL 3.5.5 which includes fixes for high severity CVEs (python-build-standalone#960)

Enhancements

• Add support for Pyodide interpreter on Windows (#​17658)
• Warn if multiple indexes include default = true (#​17713)
• Skip uploads when validation reports 'Already uploaded' (#​17412)

Configuration

• Add a reflink alias for the "clone" link mode (#​17724)

Bug fixes

• Ensure uv.exe exits when uvw.exe or uvx.exe is killed (#​17500)

v0.9.27

Compare Source

Released on 2026-01-26.

Python

• Upgrade Pyodide to 0.29.2 (#​17652)
• Upgrade to GraalPy 25.0.2 (#​17634)

Enhancements

• Add -t shortform for --target to uv pip subcommands (#​17501)
• Add support for ROCm 7.0 and 7.1 accelerator backends (#​17681)
• Further improve free-threading ABI incompatibility errors (#​17491)
• Implement uv pip freeze --exclude flag (#​17045)
• Improve warnings for --system and --no-system in uv venv (#​17647)
• Make uv pip compile attempt to download a specified --python-version if it can. (#​17249)
• Support Trusted Publishing with pyx (#​17438)
• Fix JSON schema for exclude-newer-package (#​17665)

Preview features

• Better detection for conflicting packages (#​17623)
• Upgrade based on outdated build versions in uv python upgrade (#​17653)

Bug fixes

• Change chocolatey system test to ensure uv uses the right python (#​17533)
• Fix infinite loop when SSL_CERT_FILE is a directory (#​17503)

Documentation

• Add cargo-xwin to the CONTRIBUTING guide (#​17507)
• Fix typo in the documentation of UV_PUBLISH_INDEX (#​17672)
• Move MSRV to platform support section (#​17534)
• Update the testing instructions in the CONTRIBUTING guide (#​17528)
• Use --locked to install cargo-xwin in guide (#​17530)
• Warn about PyPy being unmaintained (#​17643)
• docs: Correct gitlab-ci.yml to .gitlab-ci.yml (#​17682)

Other changes

• Update MSRV to 1.91 (#​17677)

---

Configuration

📅 Schedule: Branch creation - "before 4am on monday" in timezone UTC, Automerge - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone UTC.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.