chore(deps): Update docker images

[prefect-renovate]

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/astral-sh/uv	final	patch	0.12.10 → 0.12.13
ghcr.io/astral-sh/uv	stage	patch	0.12.10 → 0.12.13
python (source)	stage	minor	3.10-slim → 3.14-slim

---

Release Notes

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.12.13

Compare Source

Released on 2026-09-10.

Python

• Add GraalPy 3.13.0 (#​21431)

Enhancements

• Verify hashes when downloading PEP 658 metadata sidecars (#​21563)

Preview features

• Respect ty exclusions when uv check automatically selects members of a virtual workspace (#​21555)

Performance

• Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (#​21279)

Bug fixes

• Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (#​18713)
• Prefer core-metadata over legacy aliases in JSON index responses (#​21563)

v0.12.12

Compare Source

Released on 2026-09-09.

The executables in our macOS and Windows release archives and uv and uv_build wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

• Exclude distributions uploaded after the exclude-newer cutoff from lockfiles and generated requirement hashes (#​21539)

v0.12.11

Compare Source

Released on 2026-09-08.

Preview features

• Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#​20146)
• Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#​21462)

Performance

• Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#​21478)
• Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#​21468)
• Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#​21500)
• Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#​21499)
• Avoid transitive dependency checks and unnecessary resolution when uv pip install --no-deps finds the requested packages already installed (#​21523)

Bug fixes

• Verify source archives against hashes recorded in uv.lock before reading their metadata or running their build backends (#​21223)
• Verify supplied hashes for registry requirements pinned with === under both --verify-hashes and --require-hashes (#​21543)
• Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided (#​21544)
• Support PowerShell virtual environment activation from UNC paths, including WSL paths (#​19159)
• Trim surrounding whitespace from entries in .python-version and .python-versions files (#​21529)
• Suppress VIRTUAL_ENV mismatch warnings for uv add --no-sync, uv remove --no-sync, and uv add --frozen (#​21496)
• Warn and continue when uv python list cannot query an interpreter (#​21498)

Documentation

• Restore TOML syntax highlighting for exclude-newer examples (#​21534)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Claimed Python update is absent

The description claims a Python 3.14 default, but PYTHON_VERSION remains 3.10 in both Dockerfiles. The specification or implementation needs correction.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[codspeed]

Merging this PR will not alter performance

✅ 8 untouched benchmarks
⏩ 1 skipped benchmark¹

---

_{Comparing renovate/docker-images (87d2ebf) with main (5e94927)}

Footnotes

1. 1 benchmark was skipped, so the baseline result was used instead. If it was deleted from the codebase, click here and archive it to remove it from the performance reports. ↩

[jimid27]

TL;DR

🛑 DO NOT MERGE (yet) — One CI job failed (Canonical Tests: group 13/18), but the two failing tests are SIGTERM-timing tests that do not touch the Dockerfile and cannot be caused by this diff. Re-run the failed job; once green, this is a straightforward APPROVE.

📋 Full Review

Changes

Dependency	Old → New	Type
ghcr.io/astral-sh/uv (Dockerfile x2, client/Dockerfile x2)	0.12.10 → 0.12.13	patch

Note: the Renovate PR body also lists python 3.10-slim → 3.14-slim. That change is not in the diff. Both Dockerfiles still have ARG PYTHON_VERSION=3.10 on the PR branch; the only edits are the four COPY --from=ghcr.io/astral-sh/uv:... lines. Treat the body row as a stale Renovate artifact, not a Python base image bump.

Key Updates

uv 0.12.11 → 0.12.13 (changelog)

• 0.12.11: verifies source archives against uv.lock hashes before reading metadata or running build backends; hash verification for === pins under --verify-hashes/--require-hashes. Install-path performance work (hard-link/reflink replacement, ZIP reader reuse).
• 0.12.12: release binaries are now code-signed (macOS notarized, Windows Authenticode). Fixes exclude-newer cutoff leaking into lockfiles.
• 0.12.13: verifies hashes on PEP 658 metadata sidecars; prefers core-metadata over legacy aliases in JSON index responses.
• No breaking changes, no CLI flag changes. All three are hash-verification hardening and performance.

CI Status

🛑 1 failed / 99 passed / 3 skipped

Failing: Canonical Tests: group 13/18 - python:3.12, postgres:14 (job). 2 failed, 976 passed:

• tests/test_flows.py::TestFlowHooksOnCancellation::test_on_cancellation_hook_called_on_sigterm_when_cancel_intent_is_set — assert [] == [call('cancelled')]
• tests/test_flows.py::TestFlowHooksOnCancellation::test_other_cancellation_hooks_run_if_one_hook_fails — assert [] == [call('cancelled')...]

Category: flaky / unrelated. The canonical test lane installs via astral-sh/setup-uv + uv sync --locked directly on the runner; it never builds the Dockerfile, so the uv image tag in the diff is not on its code path. Both failures are SIGTERM-delivery race conditions (hooks list empty because the signal handler did not run before the assertion). The five docker, python:3.10..3.14 jobs, which actually build both Dockerfiles with uv 0.12.13, all pass.

Next step: re-run the failed job (gh run rerun 34860090682 --failed --repo PrefectHQ/prefect). If group 13 goes green, merge.

Risk Assessment

Low — Patch bump of a build-stage-only tool (uv is copied in to install Prefect; it does not ship behaviour into the runtime image beyond what it installs). Docker build matrix already passes on all five Python versions with the new uv. The only blocker is a CI re-run.

---

Reviewed by Claude Code /review-deps skill