chore(ci): update dependency astral-sh/uv to v0.13.7 (#1789)

This PR contains the following updates:

| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
| [astral-sh/uv](https://redirect.github.com/astral-sh/uv) | uses-with |
patch | `0.13.6` → `0.13.7` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/astral-sh/uv/badge)](https://securityscorecards.dev/viewer/?uri=github.com/astral-sh/uv)
|

---

### Release Notes

<details>
<summary>astral-sh/uv</summary>

###
[`v0.13.7`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0137)

[Compare
Source](https://redirect.github.com/astral-sh/uv/compare/0.13.6...0.13.7)

Released on 2026-11-03.

##### Preview features

- Add `--output-version` to `uv workspace metadata` for requesting a
specific schema version
([#&#8203;22958](https://redirect.github.com/astral-sh/uv/pull/22958))
- Report aliased OSV records as a single vulnerability in `uv audit`
([#&#8203;22990](https://redirect.github.com/astral-sh/uv/pull/22990))

##### Bug fixes

- Treat workspace member paths added by `uv init` or `uv add` as
literals instead of glob patterns
([#&#8203;23008](https://redirect.github.com/astral-sh/uv/pull/23008))
- Prevent uv's Windows trampolines from closing handles they did not
inherit
([#&#8203;22977](https://redirect.github.com/astral-sh/uv/pull/22977))
- Allow `uvx` to run tools with CPython builds whose versions contain
local identifiers
([#&#8203;23013](https://redirect.github.com/astral-sh/uv/pull/23013))
- Generate valid module names when `uv init` creates packaged projects
whose names start with a digit
([#&#8203;23022](https://redirect.github.com/astral-sh/uv/pull/23022))
- Preserve comments around existing inline dependency groups when `uv
add` updates a group
([#&#8203;23017](https://redirect.github.com/astral-sh/uv/pull/23017))
- Allow `uv remove` with an empty inline `tool.uv.sources` table
([#&#8203;23012](https://redirect.github.com/astral-sh/uv/pull/23012))

##### Documentation

- Correct the `cache-keys` inline table example
([#&#8203;22984](https://redirect.github.com/astral-sh/uv/pull/22984))

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Los_Angeles)

- Branch creation
  - "before 6am"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend Renovate
CLI](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODguMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE4OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renokeeper[bot] <308156799+renokeeper[bot]@users.noreply.github.com>

Author: renokeeper[bot]

.github/actions/setup/action.yml

@@ -24,7 +24,7 @@ runs:
         # network call that flakes). Renovate's github-actions manager tracks this `version:`
         # input for astral-sh/setup-uv and opens a bump PR — keep the pin in the other workflows
         # (build-binaries, security, release, knope-*, nightly) in step with this one.
-        version: "0.13.6"
+        version: "0.13.7"
         enable-cache: true
     # The version flows through an env var (not inlined into `run:`) so zizmor's
     # template-injection analysis stays quiet; the value is always a hard-coded

.github/workflows/build-binaries.yml

@@ -75,7 +75,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
           enable-cache: true
       - name: Set up Python + build env
         run: |

.github/workflows/knope-prepare.yml

@@ -111,7 +111,7 @@ jobs:
         if: ${{ steps.changesets.outputs.has == 'true' }}
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
           enable-cache: false
       # A SEPARATE, read-only mint for the third-party download step. The
       # binary fetch needs public read only, so it must not carry the

.github/workflows/knope-release.yml

@@ -80,7 +80,7 @@ jobs:
       - name: Set up uv (build)
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
           enable-cache: false # a poisoned cache would taint what the release job signs
       - name: Build sdist + wheel
         run: uv build

.github/workflows/nightly.yml

@@ -313,7 +313,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
           # No cache in a publishing job (zizmor cache-poisoning): a cache
           # restored from a lower-privilege context could taint the artifact
           # this OIDC step ships. A once-a-night build gains little from a cache.

.github/workflows/release.yml

@@ -172,7 +172,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
           # Caching stays OFF even though this job no longer holds the token
           # (zizmor cache-poisoning): a cache restored from a lower-privilege
           # context could taint the artifact the publish job then ships to PyPI.

.github/workflows/security.yml

@@ -503,7 +503,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
       - name: Install zizmor
         env:
           # renovate: datasource=pypi depName=zizmor