chore(deps-dev): Update uv requirement from 0.8.0 to 0.8.8

[dependabot]

Updates the requirements on uv to permit the latest version.

Release notes

Sourced from uv's releases.

0.8.8

Release Notes

Bug fixes

• Fix find_uv_bin compatibility with Python <3.10 (#15177)

Install uv 0.8.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.8.8/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/uv/releases/download/0.8.8/uv-installer.ps1 | iex"

Download uv 0.8.8

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64-unknown-linux-gnu.tar.gz	PPC64 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Changelog

Sourced from uv's changelog.

0.8.8

Bug fixes

• Fix find_uv_bin compatibility with Python <3.10 (#15177)

0.8.7

Python

• On Mac/Linux, libtcl, libtk, and _tkinter are built as separate shared objects, which fixes matplotlib's tkagg backend (the default on Linux), Pillow's PIL.ImageTk library, and other extension modules that need to use libtcl/libtk directly.
• Tix is no longer provided on Linux. This is a deprecated Tk extension that appears to have been previously broken.

See the python-build-standalone release notes for details.

Enhancements

• Do not update uv.lock when using --isolated (#15154)
• Add support for --prefix and --with installations in find_uv_bin (#14184)
• Add support for discovering base prefix installations in find_uv_bin (#14181)
• Improve error messages in find_uv_bin (#14182)
• Warn when two packages write to the same module (#13437)

Preview features

• Add support for package-level conflicts in workspaces (#14906)

Configuration

• Add UV_DEV and UV_NO_DEV environment variables (for --dev and --no-dev) (#15010)

Bug fixes

• Fix regression where --require-hashes applied to build dependencies in uv pip install (#15153)
• Ignore GraalPy devtags (#15013)
• Include all site packages directories in ephemeral environment overlays (#15121)
• Search in the user scheme scripts directory last in find_uv_bin (#14191)

Documentation

• Add missing periods (.) to list elements in Features docs page (#15138)

0.8.6

This release contains hardening measures to address differentials in behavior between uv and Python's built-in ZIP parser (CVE-2025-54368).

Prior to this release, attackers could construct ZIP files that would be extracted differently by pip, uv, and other tools. As a result, ZIPs could be constructed that would be considered harmless by (e.g.) scanners, but contain a malicious payload when extracted by uv. As of v0.8.6, uv now applies additional checks to reject such ZIPs.

Thanks to a triage effort with the Python Security Response Team and PyPI maintainers, we were able to determine that these differentials were not exploited via PyPI during the time they were present. The PyPI team has also implemented similar checks and now guards against these parsing differentials on upload.

... (truncated)

Commits

• 9a54754 Bump version to 0.8.8 (#15184)
• 15601c2 Add a test requirement on Python 3.14 (#15182)
• 0924490 fix: Use 3.9 compatible zip (#15177)
• 6b5d309 Add find_uv_bin test cases by Python version (#15181)
• 1567cc8 Revert "chore(ci): fix lint findings in build-docker (#15145)" (#15174)
• 8a22572 Bump version to 0.8.7 (#15173)
• d1beb7f Sync latest Python releases (#15171)
• bdb4b06 Include all site packages directories in ephemeral environment overlays (#15121)
• f6a9b55 Add UV_DEV and UV_NO_DEV environment variables (#15010)
• e18bfc6 Do not update uv.lock when using --isolated (#15154)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #953.