chore(deps): update ci

[NickGhignatti]

This PR contains the following updates:

Package	Type	Update	Change
istioctl	tools	patch	1.31.0 → 1.31.1
ubi:moonrepo/moon	tools	patch	2.5.5 → 2.5.6
uv	tools	patch	0.12.17 → 0.12.19

---

Release Notes

istio/istio (istioctl)

v1.31.1: Istio 1.31.1

Compare Source

Artifacts
Release Notes

moonrepo/moon (ubi:moonrepo/moon)

v2.5.6

Compare Source

🐞 Fixes

• Fixed an issue where a dependency using cacheStrategy: outputs would produce a different hash
  for the dependent task when the dependency's outputs were hydrated from the content addressable
  storage (experiments.casOutputsCache) instead of being executed. The output glob walk was being
  cached before hydration, resulting in an empty file list when the dependent was hashed.
• Fixed an issue where a task with glob outputs would delete and restore its output files on every
  cached run, even when the hash matched the previous run and all files still existed. Each file
  received a new inode, causing file watchers to detect a change. We now record the files matched by
  output globs after each run, and reuse them as-is when they still exist, the same as literal file
  and directory outputs.
• Fixed an issue where the workspace graph cache was not invalidated when a file referenced by an
  inheritedBy.files condition was added to or removed from a project, resulting in stale task
  inheritance until the cache was cleared.
• Fixed an issue with the Rust toolchain where rustup binaries would shadow cargo binaries,
  resulting in a broken experience.

astral-sh/uv (uv)

v0.12.19

Compare Source

Released on 2026-09-24.

Python

• Add PyPy 3.11.16 and 3.12.14 (#​21847)
• Update GraalPy 3.13.0 to build 25.4.4 (#​21847)

Enhancements

• Format upload URLs with backticks in uv publish errors (#​21934)

Preview features

• Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#​21967)
• Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#​21913)

Bug fixes

• Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#​21971)
• Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#​21931)
• Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#​21891)
• Preserve always-false python_version markers when parsing their serialized form (#​21939)

Rust API

• Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#​21965)

Documentation

• Make individual preview-feature reference entries linkable by name (#​21950)

v0.12.18

Compare Source

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

• Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#​21893)
• Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#​21844)
• Identify failures from get_requires_for_build_* hooks correctly in build errors (#​21881)

Preview features

• Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#​21880)

Performance

• Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#​21918)

Bug fixes

• Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#​21835, #​21836)
• Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#​21860, #​21856)
• Use configured dependency-metadata when checking whether installed requirements are satisfied (#​21843)
• Reject archive entries that normalize to absolute Windows paths (#​21923)
• Recognize distribution filenames and archive extensions when URL fragments contain ? (#​21920)
• Generate correctly lowercased platform tags for BSD and Haiku releases (#​21853)
• Avoid rebuilding a Windows relative path into an absolute form (#​21923)

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.