Update charmcraft.yaml build tools

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Update
pip (changelog)	25.2 -> 25.3			minor
rust-lang/rust	1.90.0 -> 1.91.0			minor
uv (source, changelog)	0.9.4 -> 0.9.7			patch

---

Release Notes

pypa/pip (pip)

v25.3

Compare Source

rust-lang/rust (rust-lang/rust)

v1.91.0

Compare Source

==========================

Language

• Lower pattern bindings in the order they're written and base drop order on primary bindings' order
• Stabilize declaration of C-style variadic functions for sysv64, win64, efiapi, and aapcs ABIs.
  This brings these ABIs in line with the C ABI: variadic functions can be declared in extern blocks but not defined.
• Add dangling_pointers_from_locals lint to warn against dangling pointers from local variables
• Upgrade semicolon_in_expressions_from_macros from warn to deny
• Stabilize LoongArch32 inline assembly
• Add warn-by-default integer_to_ptr_transmutes lint against integer-to-pointer transmutes
• Stabilize sse4a and tbm target features
• Add target_env = "macabi" and target_env = "sim" cfgs as replacements for the target_abi cfgs with the same values.

Compiler

• Don't warn on never-to-any as casts as unreachable

Platform Support

• Promote aarch64-pc-windows-gnullvm and x86_64-pc-windows-gnullvm to Tier 2 with host tools.
  Note: llvm-tools and MSI installers are missing but will be added in future releases.
• Promote aarch64-pc-windows-msvc to Tier 1

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Libraries

• Print thread ID in panic message
• Fix overly restrictive lifetime in core::panic::Location::file return type
• Guarantee parameter order for _by() variants of min / max/ minmax in std::cmp
• Document assumptions about Clone and Eq traits
• std::thread: Return error if setting thread stack size fails
  This used to panic within the standard library.

Stabilized APIs

• Path::file_prefix
• AtomicPtr::fetch_ptr_add
• AtomicPtr::fetch_ptr_sub
• AtomicPtr::fetch_byte_add
• AtomicPtr::fetch_byte_sub
• AtomicPtr::fetch_or
• AtomicPtr::fetch_and
• AtomicPtr::fetch_xor
• {integer}::strict_add
• {integer}::strict_sub
• {integer}::strict_mul
• {integer}::strict_div
• {integer}::strict_div_euclid
• {integer}::strict_rem
• {integer}::strict_rem_euclid
• {integer}::strict_neg
• {integer}::strict_shl
• {integer}::strict_shr
• {integer}::strict_pow
• i{N}::strict_add_unsigned
• i{N}::strict_sub_unsigned
• i{N}::strict_abs
• u{N}::strict_add_signed
• u{N}::strict_sub_signed
• PanicHookInfo::payload_as_str
• core::iter::chain
• u{N}::checked_signed_diff
• core::array::repeat
• PathBuf::add_extension
• PathBuf::with_added_extension
• Duration::from_mins
• Duration::from_hours
• impl PartialEq<str> for PathBuf
• impl PartialEq<String> for PathBuf
• impl PartialEq<str> for Path
• impl PartialEq<String> for Path
• impl PartialEq<PathBuf> for String
• impl PartialEq<Path> for String
• impl PartialEq<PathBuf> for str
• impl PartialEq<Path> for str
• Ipv4Addr::from_octets
• Ipv6Addr::from_octets
• Ipv6Addr::from_segments
• impl<T> Default for Pin<Box<T>> where Box<T>: Default, T: ?Sized
• impl<T> Default for Pin<Rc<T>> where Rc<T>: Default, T: ?Sized
• impl<T> Default for Pin<Arc<T>> where Arc<T>: Default, T: ?Sized
• Cell::as_array_of_cells
• u{N}::carrying_add
• u{N}::borrowing_sub
• u{N}::carrying_mul
• u{N}::carrying_mul_add
• BTreeMap::extract_if
• BTreeSet::extract_if
• impl Debug for windows::ffi::EncodeWide<'_>
• str::ceil_char_boundary
• str::floor_char_boundary
• impl Sum for Saturating<u{N}>
• impl Sum<&Self> for Saturating<u{N}>
• impl Product for Saturating<u{N}>
• impl Product<&Self> for Saturating<u{N}>

These previously stable APIs are now stable in const contexts:

• <[T; N]>::each_ref
• <[T; N]>::each_mut
• OsString::new
• PathBuf::new
• TypeId::of
• ptr::with_exposed_provenance
• ptr::with_exposed_provenance_mut

Cargo

• 🎉 Stabilize build.build-dir.
  This config sets the directory where intermediate build artifacts are stored.
  These artifacts are produced by Cargo and rustc during the build process.
  End users usually won't need to interact with them, and the layout inside
  build-dir is an implementation detail that may change without notice.
  (config doc)
  (build cache doc)
  #​15833
  #​15840
• The --target flag and the build.target configuration can now take literal
  "host-tuple" string, which will internally be substituted by the host
  machine's target triple.
  #​15838
  #​16003
  #​16032

Rustdoc

• In search results, rank doc aliases lower than non-alias items with the same name
• Raw pointers now work in type-based search like references. This means you can now search for things like *const u8 ->, and additionally functions that take or return raw pointers will now display their signature properly in search results.

Compatibility Notes

• Always require coroutine captures to be drop-live
• Apple: Always pass SDK root when linking with cc, and pass it via SDKROOT env var. This should fix linking issues with rustc running inside Xcode. Libraries in /usr/local/lib may no longer be linked automatically, if you develop or use a crate that relies on this, you should explicitly set cargo::rustc-link-search=/usr/local/lib in a build.rs script.
• Relaxed bounds in associated type bound position like in TraitRef<AssocTy: ?Sized> are now correctly forbidden
• Add unstable #[sanitize(xyz = "on|off")] built-in attribute that shadows procedural macros with the same name
• Fix the drop checker being more permissive for bindings declared with let-else
• Be more strict when parsing attributes, erroring on many invalid attributes
  • Error on invalid #[should_panic] attributes
  • Error on invalid #[link] attributes
• Mark all deprecation lints in name resolution as deny-by-default and also report in dependencies
• The lint semicolon_in_expressions_from_macros, for macro_rules! macros in expression position that expand to end in a semicolon (;), is now deny-by-default. It was already warn-by-default, and a future compatibility warning (FCW) that warned even in dependencies. This lint will become a hard error in the future.
• Trait impl modifiers (e.g., unsafe, !, default) in inherent impls are no longer syntactically valid
• Start reporting future breakage for ill_formed_attribute_input in dependencies
• Restrict the scope of temporaries created by the macros pin!, format_args!, write!, and writeln! in if let scrutinees in Rust Edition 2024. This applies Rust Edition 2024's if let temporary scope rules to these temporaries, which previously could live past the if expression regardless of Edition.
• Invalid numeric literal suffixes in tuple indexing, tuple struct indexing, and struct field name positions are now correctly rejected
• Closures marked with the keyword static are now syntactically invalid
• Shebangs inside --cfg and --check-cfg arguments are no longer allowed
• Add future incompatibility lint for temporary lifetime shortening in Rust 1.92

Cargo compatibility notes:

• cargo publish no longer keeps .crate tarballs as final build artifacts
  when build.build-dir is set. These tarballs were previously included due to
  an oversight and are now treated as intermediate artifacts.
  To get .crate tarballs as final artifacts, use cargo package.
  In a future version, this change will apply regardless of build.build-dir.
  #​15910
• Adjust Cargo messages to match rustc diagnostic style.
  This changes some of the terminal colors used by Cargo messages.
  #​15928
• Tools and projects relying on the
  internal details of Cargo's build-dir
  may not work for users changing their build-dir layout.
  For those doing so, we'd recommend proactively testing these cases
  particularly as we are considering changing the default location of the build-dir in the future
  (cargo#16147).
  If you can't migrate off of Cargo's internal details,
  we'd like to learn more about your use case as we prepare to change the layout of the build-dir
  (cargo#15010).

Internal Changes

These changes do not affect any public interfaces of Rust, but they represent
significant improvements to the performance or internals of rustc and related
tools.

• Update to LLVM 21

astral-sh/uv (uv)

v0.9.7

Compare Source

Released on 2025-10-30.

Enhancements

• Add Windows x86-32 emulation support to interpreter architecture checks (#​13475)
• Improve readability of progress bars (#​16509)
• Add GitHub attestations for uv release artifacts (#​11357)

Bug fixes

• Drop terminal coloring from uv auth token output (#​16504)
• Don't use UV_LOCKED to enable --check flag (#​16521)

v0.9.6

Compare Source

Released on 2025-10-29.

This release contains an upgrade to Astral's fork of async_zip, which addresses potential sources of ZIP parsing differentials between uv and other Python packaging tooling. See GHSA-pqhf-p39g-3x64 for additional details.

Security

• Address ZIP parsing differentials (GHSA-pqhf-p39g-3x64)

Python

• Upgrade GraalPy to 25.0.1 (#​16401)

Enhancements

• Add --clear to uv build to remove old build artifacts (#​16371)
• Add --no-create-gitignore to uv build (#​16369)
• Do not error when a virtual environment directory cannot be removed due to a busy error (#​16394)
• Improve hint on pip install --system when externally managed (#​16392)
• Running uv lock --check with outdated lockfile will print that --check was passed, instead of --locked (#​16322)
• Update uv init template for Maturin (#​16449)
• Improve ordering of Python sources in logs (#​16463)
• Restore DockerHub release images and annotations (#​16441)

Bug fixes

• Check for matching Python implementation during uv python upgrade (#​16420)
• Deterministically order --find-links distributions (#​16446)
• Don't panic in uv export --frozen when the lockfile is outdated (#​16407)
• Fix root of uv tree when --package is used with circular dependencies (#​15908)
• Show package list with pip freeze --quiet (#​16491)
• Limit uv auth login pyx.dev retries to 60s (#​16498)
• Add an empty group with uv add --group ... -r ... (#​16490)

Documentation

• Update docs for maturin build backend init template (#​16469)
• Update docs to reflect previous changes to signal forwarding semantics (#​16430)
• Add instructions for installing via MacPorts (#​16039)

v0.9.5

Compare Source

Released on 2025-10-21.

This release contains an upgrade to astral-tokio-tar, which addresses a vulnerability in tar extraction on malformed archives with mismatching size information between the ustar header and PAX extensions. While the astral-tokio-tar advisory has been graded as "high" due its potential broader impact, the specific impact to uv is low due to a lack of novel attacker capability. Specifically, uv only processes tar archives from source distributions, which already possess the capability for full arbitrary code execution by design, meaning that an attacker gains no additional capabilities through astral-tokio-tar.

Regardless, we take the hypothetical risk of parser differentials very seriously. Out of an abundance of caution, we have assigned this upgrade an advisory: GHSA-w476-p2h3-79g9

Security

• Upgrade astral-tokio-tar to 0.5.6 to address a parsing differential (#​16387)

Enhancements

• Add required environment marker example to hint (#​16244)
• Fix typo in MissingTopLevel warning (#​16351)
• Improve 403 Forbidden error message to indicate package may not exist (#​16353)
• Add a hint on uv pip install failure if the --system flag is used to select an externally managed interpreter (#​16318)

Bug fixes

• Fix backtick escaping for PowerShell (#​16307)

Documentation

• Document metadata consistency expectation (#​15683)
• Remove outdated aarch64 musl note (#​16385)

---

Configuration

📅 Schedule: Branch creation - Between 01:00 AM and 05:59 AM, only on Tuesday ( * 1-5 * * 2 ) in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.