build: bump the docker group across 1 directory with 2 updates

[dependabot]

Bumps the docker group with 2 updates in the /.devcontainer directory: astral-sh/uv and devcontainers/python.

Updates astral-sh/uv from 0.11.23 to 0.11.28

Release notes

Sourced from astral-sh/uv's releases.

0.11.28

Release Notes

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

• Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

• Improve trace logs for unexpected error chains (#20220)
• Move lockfile update guidance to a hint (#20219)
• Preserve indentation for multiline error causes (#20156)
• Render user errors with their cause chains (#20217)
• Route final command errors through the printer to respect -q and -qq (#20163)
• Use standard rendering for uv build errors (#20159)
• Use standard rendering for tool requirement errors (#20160)

Performance

• Only compile bytecode for installed distributions in uv pip install (#19914)
• Avoid allocating URL-safe Git revisions (#20194)
• Avoid allocating canonical Python request strings (#20193)
• Avoid allocating custom Astral mirror URLs (#20204)
• Avoid allocating expanded compatibility tags (#20190)
• Avoid allocating shell strings that need no escaping (#20196)
• Avoid allocating static ABI descriptions (#20201)
• Avoid allocating static Windows executable names (#20200)
• Avoid allocating static dependency table names (#20199)
• Avoid allocating static platform triple components (#20195)
• Avoid allocating static resolver report labels (#20198)
• Avoid allocating static unavailable-version messages (#20197)
• Avoid allocating unchanged Python download architectures (#20202)
• Avoid allocating unchanged paths during case normalization (#20203)
• Avoid allocations when expanding group conflicts (#20211)
• Avoid allocations when formatting requirements (#20206)
• Avoid cloning credential lookup services (#20210)
• Avoid cloning dry-run distributions (#20209)
• Avoid cloning owned dependency metadata (#20212)
• Avoid redundant direct URL clones (#20207)
• Create metadata version errors lazily (#20205)
• Optimize expanded tag compatibility checks (#20171)
• Optimize parsing of single-digit three-part versions (#20118)

... (truncated)

Changelog

Sourced from astral-sh/uv's changelog.

0.11.28

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

• Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

• Improve trace logs for unexpected error chains (#20220)
• Move lockfile update guidance to a hint (#20219)
• Preserve indentation for multiline error causes (#20156)
• Render user errors with their cause chains (#20217)
• Route final command errors through the printer to respect -q and -qq (#20163)
• Use standard rendering for uv build errors (#20159)
• Use standard rendering for tool requirement errors (#20160)

Performance

• Only compile bytecode for installed distributions in uv pip install (#19914)
• Avoid allocating URL-safe Git revisions (#20194)
• Avoid allocating canonical Python request strings (#20193)
• Avoid allocating custom Astral mirror URLs (#20204)
• Avoid allocating expanded compatibility tags (#20190)
• Avoid allocating shell strings that need no escaping (#20196)
• Avoid allocating static ABI descriptions (#20201)
• Avoid allocating static Windows executable names (#20200)
• Avoid allocating static dependency table names (#20199)
• Avoid allocating static platform triple components (#20195)
• Avoid allocating static resolver report labels (#20198)
• Avoid allocating static unavailable-version messages (#20197)
• Avoid allocating unchanged Python download architectures (#20202)
• Avoid allocating unchanged paths during case normalization (#20203)
• Avoid allocations when expanding group conflicts (#20211)
• Avoid allocations when formatting requirements (#20206)
• Avoid cloning credential lookup services (#20210)
• Avoid cloning dry-run distributions (#20209)
• Avoid cloning owned dependency metadata (#20212)
• Avoid redundant direct URL clones (#20207)
• Create metadata version errors lazily (#20205)
• Optimize expanded tag compatibility checks (#20171)
• Optimize parsing of single-digit three-part versions (#20118)

... (truncated)

Commits

• ebf0f43 Bump version to 0.11.28 (#20226)
• dee7a10 fix(uv): uv tree fails on dependency-group-only pyproject.tomls (#19975) (#20...
• 95e2f57 Improve trace logs for debugging the error chain (#20220)
• 4fab9d3 Use standard rendering for tool requirement errors (#20160)
• f436bb3 Move canonical and Git URL clones to callers (#20221)
• 6dc1dad Move lockfile update guidance to a hint (#20219)
• 83158f4 Render user errors with their cause chains (#20217)
• 3cfcabe Route final command errors through the printer (#20163)
• da1613b Model final command errors explicitly (#20188)
• 0ea325e Document the bytecode compilation timeout override (#20189)
• Additional commits viewable in compare view

Updates devcontainers/python from 66af9ee to 1c3a630

[dependabot]

Labels

The following labels could not be found: docker. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[TheDZhon]

@dependabot rebase