Update image dependencies and make PyCharm reviews reproducible

[dependabot]

Updates the pinned uv, Git, curl, and Ubuntu build images and makes the required PyCharm checks reproducible in isolated worktrees.

The shared inspection profile and scopes remain versioned. Worktree-specific interpreter/module files are generated locally from the locked development environment, with a documented path to clean, pinned external Odoo 19 sources. Helper path and response types are explicit, and the inspection cleanup preserves strict boolean workspace admission, bare-URL rejection, dependency provenance, and runtime layout.

Validation:

• PyCharm changed-file and whole-project inspections: GREEN, zero findings, clean lifecycle cleanup.
• Real local arm64 runtime and devtools builds with Odoo source b3e4ddcbcc3a6a5a28f18f70342dcd584432faef.
• Runtime and devtools smoke checks, database initialization and runtime health checks, and the downstream helper suite passed.
• Captured build-source hashes match all 38 tracked worktree files; development-only dependencies are excluded from Docker build context.

---

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the infrastructure group with 4 updates: astral-sh/uv, alpine/git, alpine/curl and ubuntu.

Updates astral-sh/uv from 0.12.16 to 0.12.19

Release notes

Sourced from astral-sh/uv's releases.

0.12.19

Release Notes

Released on 2026-09-24.

Python

• Add PyPy 3.11.16 and 3.12.14 (#21847)
• Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

• Format upload URLs with backticks in uv publish errors (#21934)

Preview features

• Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)
• Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

• Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)
• Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)
• Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)
• Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

• Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

• Make individual preview-feature reference entries linkable by name (#21950)

Install uv 0.12.19

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex"

Download uv 0.12.19

... (truncated)

Changelog

Sourced from astral-sh/uv's changelog.

0.12.19

Released on 2026-09-24.

Python

• Add PyPy 3.11.16 and 3.12.14 (#21847)
• Update GraalPy 3.13.0 to build 25.4.4 (#21847)

Enhancements

• Format upload URLs with backticks in uv publish errors (#21934)

Preview features

• Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)
• Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)

Bug fixes

• Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)
• Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)
• Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)
• Preserve always-false python_version markers when parsing their serialized form (#21939)

Rust API

• Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

Documentation

• Make individual preview-feature reference entries linkable by name (#21950)

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

• Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
• Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
• Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

• Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

... (truncated)

Commits

• bea1384 Bump version to 0.12.19 (#21975)
• 299a93d Sync latest Python releases (#21970)
• 30de9e2 Preserve query parameters in direct URL metadata (#21971)
• 0e7433e Filter distribution hashes in tests (#21941)
• c73db78 Omit unused runtime settings from lockfiles (#21913)
• ad12342 Add a preview feature for lazy build backend imports (#21967)
• dd965a2 Restore FlatDistributions for downstream resolvers (#21965)
• 214d7f6 Use Astra for PR security reviews (#21959)
• 3db6652 Disable incremental compilation when publishing docs (#21955)
• e18f413 Reproduce editable project relocation failure (#21948)
• Additional commits viewable in compare view

Updates alpine/git from 0b5f57d to ae0f6f4

Updates alpine/curl from d7720f8 to a39f52c

Updates ubuntu from b3cc40b to 008173c

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[shiny-code-app]

Dependency-update review on 2026-09-25 at 6e83ee8c22320aa585ec0b2987a20108c1b3845d: CI passes, the diff only updates four image references in Dockerfile, and no outstanding human review comments were found.

Local arm64 validation passed: runtime and runtime-devtools image builds, both smoke scripts, database initialization and Launchplane health checks, and downstream helper tests.

The required whole-project PyCharm assessment is RED, with 31 findings. These include unresolved packaging and odoo imports in unchanged Python files and type/style warnings. The Dockerfile-only inspection reported no native findings, but its overall result was UNKNOWN because the IDE removed a tracked sibling-project VCS mapping during the lifecycle. The exact generated metadata hunk was subsequently reversed; no source or inspection-profile changes were made.

This PR remains open because the requested clean-only merge sweep could not establish a clean full-project inspection. Next: prepare the IDE's documented dependencies/source roots, triage the remaining findings, then rerun the required inspection before merging. The isolated review checkout and inspection evidence are retained for that follow-up; temporary verification image tags are removed after testing.

[shiny-code-app]

Merged at 2e477789894d78a690f92ab85f1ab4e1dffc94e3. Post-merge Build And Publish Images passed both runtime/devtools verification and both publication jobs. CodeQL and dependency-graph runs for the same merge also succeeded.

Local changed-files and whole-project PyCharm inspections were GREEN with zero findings; runtime/devtools builds, smoke checks, database initialization/health, and downstream helper checks passed before push. Validation receipts and captured build inputs are retained under /Volumes/Developer-Artifacts/host-caches/dependency-review-20260925. The two clean, merged task worktrees were removed, and the primary checkout is clean at the landing SHA.

Alert-inventory visibility remains limited for the automation App (code-scanning/Dependabot alert APIs return 403; the redacted secret-scanning helper reports its public-repository API unavailable). Passing workflow scans are verified; this is not a claim that every repository alert inventory was readable. No tenant runtime was deployed.