diff --git a/.gitignore b/.gitignore
index 36e4cb1..623ffd4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,104 @@
-/uv-*.tar.gz
+/pubgrub-3f0ba760951ab0deeac874b98bb18fc90103fcf7.tar.gz
+/reqwest-middleware-21ceec9a5fd2e8d6f71c3ea2999078fecbd13cbe.tar.gz
+/rs-async-zip-011b24604fa7bc223daaad7712c0694bac8f0a87.tar.gz
+/uv-0.2.32.tar.gz
+/uv-0.2.33.tar.gz
+/pubgrub-2fac39371a47e7cb821e510aaa4de25405413d29.tar.gz
+/uv-0.2.34.tar.gz
+/uv-0.2.35.tar.gz
+/uv-0.2.37-filtered.tar.zst
+/uv-0.3.0-filtered.tar.zst
+/pubgrub-aaef464c1b0d8eea4ff9ffaee4f3458c236d10da.tar.gz
+/reqwest-middleware-5e3eaf254b5bd481c75d2710eed055f95b756913.tar.gz
+/uv-0.3.2-filtered.tar.zst
+/uv-0.3.3-filtered.tar.zst
+/pubgrub-388685a8711092971930986644cfed152d1a1f6c.tar.gz
+/uv-0.3.4-filtered.tar.zst
+/tl-6e25b2ee2513d75385101a8ff9f591ef51f314ec.tar.gz
+/uv-0.3.5-filtered.tar.zst
+/uv-0.4.0-filtered.tar.zst
+/uv-0.4.1-filtered.tar.zst
+/uv-0.4.2-filtered.tar.zst
+/uv-0.4.4-filtered.tar.zst
+/uv-0.4.5-filtered.tar.zst
+/uv-0.4.6-filtered.tar.zst
+/uv-0.4.7-filtered.tar.zst
+/uv-0.4.8-filtered.tar.zst
+/uv-0.4.9-filtered.tar.zst
+/uv-0.4.10-filtered.tar.zst
+/uv-0.4.15.tar.gz
+/uv-0.4.16.tar.gz
+/uv-0.4.17.tar.gz
+/uv-0.4.18.tar.gz
+/uv-0.4.19.tar.gz
+/uv-0.4.20.tar.gz
+/uv-0.4.21.tar.gz
+/uv-0.4.22.tar.gz
+/uv-0.4.23.tar.gz
+/pubgrub-19c77268c0ad5f69d7e12126e0cfacfbba466481.tar.gz
+/uv-0.4.24.tar.gz
+/uv-0.4.25.tar.gz
+/pubgrub-7243f4faf8e54837aa8a401a18406e7173de4ad5.tar.gz
+/reqwest-middleware-d95ec5a99fcc9a4339e1850d40378bbfe55ab121.tar.gz
+/uv-0.4.26.tar.gz
+/uv-0.4.27.tar.gz
+/uv-0.4.28.tar.gz
+/uv-0.4.29.tar.gz
+/pubgrub-95e1390399cdddee986b658be19587eb1fdb2d79.tar.gz
+/uv-0.4.30.tar.gz
+/uv-0.5.0.tar.gz
+/uv-0.5.1.tar.gz
+/uv-0.5.2.tar.gz
+/rs-async-zip-c909fda63fcafe4af496a07bfda28a5aae97e58d.tar.gz
+/uv-0.5.3.tar.gz
+/pubgrub-57afc831bf2551f164617a10383cf288bf5d190d.tar.gz
+/uv-0.5.4.tar.gz
+/uv-0.5.5.tar.gz
+/pubgrub-9cd9049a64c7352de2ff3b525b9ae36421b0cc18.tar.gz
+/uv-0.5.6.tar.gz
+/pubgrub-57832d0588fbb7aab824813481104761dc1c7740.tar.gz
+/uv-0.5.7.tar.gz
+/uv-0.5.8.tar.gz
+/uv-0.5.9.tar.gz
+/uv-0.5.10.tar.gz
+/pubgrub-05e8d12cea8d72c6d2d017900e478d0abd28fef4.tar.gz
+/uv-0.5.11.tar.gz
+/uv-0.5.12.tar.gz
+/pubgrub-648aa343486e5529953153781fc86025c73c4a61.tar.gz
+/uv-0.5.13.tar.gz
+/uv-0.5.14.tar.gz
+/uv-0.5.15.tar.gz
+/uv-0.5.16.tar.gz
+/uv-0.5.17.tar.gz
+/uv-0.5.18.tar.gz
+/uv-0.5.19.tar.gz
+/uv-0.5.20.tar.gz
+/uv-0.5.21.tar.gz
+/uv-0.5.22.tar.gz
+/uv-0.5.23.tar.gz
+/uv-0.5.24.tar.gz
+/uv-0.5.25.tar.gz
+/uv-0.5.26.tar.gz
+/uv-0.5.27.tar.gz
+/pubgrub-b70cf707aa43f21b32f3a61b8a0889b15032d5c4.tar.gz
+/tokio-tar-ba2b140f27d081c463335f0d68b5f8df8e6c845e.tar.gz
+/uv-0.5.28.tar.gz
+/tokio-tar-efeaea927c7a40ee66121de2e1bebfd5d7a4a602.tar.gz
+/uv-0.5.29.tar.gz
+/uv-0.5.30.tar.gz
+/uv-0.5.31.tar.gz
+/uv-0.6.0.tar.gz
+/uv-0.6.1.tar.gz
+/uv-0.6.2.tar.gz
+/uv-0.6.3.tar.gz
+/uv-0.6.4.tar.gz
+/uv-0.6.5.tar.gz
+/uv-0.6.6.tar.gz
+/uv-0.6.7.tar.gz
+/uv-0.6.8.tar.gz
+/uv-0.6.9.tar.gz
+/uv-0.6.10.tar.gz
+/uv-0.6.11.tar.gz
+/uv-0.6.12.tar.gz
+/uv-0.6.13.tar.gz
+/uv-0.6.14.tar.gz
diff --git a/0001-Downstream-only-do-not-override-the-default-allocato.patch b/0001-Downstream-only-do-not-override-the-default-allocato.patch
new file mode 100644
index 0000000..4126a49
--- /dev/null
+++ b/0001-Downstream-only-do-not-override-the-default-allocato.patch
@@ -0,0 +1,48 @@
+From 0a45f8027ae10006b2425f9047910dfe93817ca0 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Thu, 10 Oct 2024 07:03:45 -0400
+Subject: [PATCH] Downstream-only: do not override the default allocator
+
+In https://github.com/astral-sh/uv/pull/399, it was reasonably claimed
+that using tikv-jemallocator improved benchmarks by 10%, so it may be
+worth packaging it and dropping this patch.
+---
+ crates/uv-performance-memory-allocator/Cargo.toml |  3 ---
+ crates/uv-performance-memory-allocator/src/lib.rs | 13 -------------
+ 2 files changed, 16 deletions(-)
+
+diff --git a/crates/uv-performance-memory-allocator/Cargo.toml b/crates/uv-performance-memory-allocator/Cargo.toml
+index 50d2a149..6db2e207 100644
+--- a/crates/uv-performance-memory-allocator/Cargo.toml
++++ b/crates/uv-performance-memory-allocator/Cargo.toml
+@@ -7,6 +7,3 @@ publish = false
+ 
+ [target.'cfg(all(target_os = "windows"))'.dependencies]
+ mimalloc = { version = "0.1.43" }
+-
+-[target.'cfg(all(not(target_os = "windows"), not(target_os = "openbsd"), not(target_os = "freebsd"), any(target_arch = "x86_64", target_arch = "aarch64", target_arch = "powerpc64")))'.dependencies]
+-tikv-jemallocator = { version = "0.6.0" }
+diff --git a/crates/uv-performance-memory-allocator/src/lib.rs b/crates/uv-performance-memory-allocator/src/lib.rs
+index 03ec650b..e86a9553 100644
+--- a/crates/uv-performance-memory-allocator/src/lib.rs
++++ b/crates/uv-performance-memory-allocator/src/lib.rs
+@@ -4,16 +4,3 @@
+ #[cfg(target_os = "windows")]
+ #[global_allocator]
+ static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;
+-
+-#[cfg(all(
+-    not(target_os = "windows"),
+-    not(target_os = "openbsd"),
+-    not(target_os = "freebsd"),
+-    any(
+-        target_arch = "x86_64",
+-        target_arch = "aarch64",
+-        target_arch = "powerpc64"
+-    )
+-))]
+-#[global_allocator]
+-static GLOBAL: tikv_jemallocator::Jemalloc = tikv_jemallocator::Jemalloc;
+-- 
+2.47.0
+
diff --git a/0001-Downstream-patch-always-find-the-system-wide-uv-exec.patch b/0001-Downstream-patch-always-find-the-system-wide-uv-exec.patch
index 1552d94..119e6f7 100644
--- a/0001-Downstream-patch-always-find-the-system-wide-uv-exec.patch
+++ b/0001-Downstream-patch-always-find-the-system-wide-uv-exec.patch
@@ -1,4 +1,4 @@
-From 831cf2937a4b8b781d56d5fa18916d2bc42b244d Mon Sep 17 00:00:00 2001
+From 2efee35e5ca4248cfd5da36ff459292fc463a7ee Mon Sep 17 00:00:00 2001
 From: "Benjamin A. Beasley" <code@musicinmybrain.net>
 Date: Sun, 23 Jun 2024 16:29:05 -0400
 Subject: [PATCH] Downstream patch: always find the system-wide uv executable
@@ -9,16 +9,16 @@ Content-Transfer-Encoding: 8bit
 “Should uv.find_uv_bin() be able to find /usr/bin/uv?”
 https://github.com/astral-sh/uv/issues/4451
 ---
- python/uv/_find_uv.py | 8 ++++++++
- 1 file changed, 8 insertions(+)
+ python/uv/_find_uv.py | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
 
 diff --git a/python/uv/_find_uv.py b/python/uv/_find_uv.py
-index ebe6b8d5a..e25a2e28c 100644
+index 00b7d887..f4ff5b7f 100644
 --- a/python/uv/_find_uv.py
 +++ b/python/uv/_find_uv.py
-@@ -35,6 +35,14 @@ def find_uv_bin() -> str:
-         sysconfig.get_path("scripts", scheme=_user_scheme()),
-     ]
+@@ -10,6 +10,16 @@ def find_uv_bin() -> str:
+ 
+     uv_exe = "uv" + sysconfig.get_config_var("EXE")
  
 +    # Downstream patch: always find the system-wide uv executable
 +    #
@@ -26,11 +26,13 @@ index ebe6b8d5a..e25a2e28c 100644
 +    #  https://github.com/astral-sh/uv/issues/4451
 +    bindir_path = sysconfig.get_config_var("BINDIR")
 +    if bindir_path is not None:
-+        targets.insert(0, os.path.join(bindir_path, uv_exe))
++        path = os.path.join(bindir_path, uv_exe)
++        if os.path.isfile(path):
++            return path
 +
-     seen = []
-     for target in targets:
-         if not target:
+     path = os.path.join(sysconfig.get_path("scripts"), uv_exe)
+     if os.path.isfile(path):
+         return path
 -- 
-2.53.0
+2.46.0
 
diff --git a/11.patch b/11.patch
new file mode 100644
index 0000000..1cc1ea6
--- /dev/null
+++ b/11.patch
@@ -0,0 +1,55 @@
+From 32769daca67af91c1f8bdb5972e500fa9e66c9ea Mon Sep 17 00:00:00 2001
+From: konstin <konstin@mailbox.org>
+Date: Tue, 4 Feb 2025 18:45:16 +0100
+Subject: [PATCH] Adapt directory permission test
+
+Adapt the directory permissions test to the changes made in https://github.com/astral-sh/tokio-tar/pull/8.
+---
+ tests/entry.rs | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/tests/entry.rs b/tests/entry.rs
+index 5b45669..4c31956 100644
+--- a/tests/entry.rs
++++ b/tests/entry.rs
+@@ -2,7 +2,7 @@ extern crate tokio_tar as async_tar;
+ 
+ extern crate tempfile;
+ 
+-use tokio::{fs::File, io::AsyncReadExt};
++use tokio::{fs, fs::File, io::AsyncReadExt};
+ use tokio_stream::*;
+ 
+ use tempfile::Builder;
+@@ -157,7 +157,7 @@ async fn relative_link_deref_error() {
+ 
+ #[tokio::test]
+ #[cfg(unix)]
+-async fn directory_maintains_permissions() {
++async fn directory_permissions_are_cleared() {
+     use ::std::os::unix::fs::PermissionsExt;
+ 
+     let mut ar = async_tar::Builder::new(Vec::new());
+@@ -176,9 +176,19 @@ async fn directory_maintains_permissions() {
+     let td = t!(Builder::new().prefix("tar").tempdir());
+     t!(ar.unpack(td.path()).await);
+     let f = t!(File::open(td.path().join("foo")).await);
+-    let md = t!(f.metadata().await);
+-    assert!(md.is_dir());
+-    assert_eq!(md.permissions().mode(), 0o40777);
++    let from_archive_md = t!(f.metadata().await);
++    assert!(from_archive_md.is_dir());
++
++    // To determine the default umask, create a fresh directory that gets it assigned by the OS.
++    let manually_created = td.path().join("bar");
++    t!(fs::create_dir(&manually_created).await);
++    let f = t!(File::open(&manually_created).await);
++    let loca_md = t!(f.metadata().await);
++
++    assert_eq!(
++        from_archive_md.permissions().mode(),
++        loca_md.permissions().mode()
++    );
+ }
+ 
+ #[tokio::test]
diff --git a/153.patch b/153.patch
new file mode 100644
index 0000000..5d8eeef
--- /dev/null
+++ b/153.patch
@@ -0,0 +1,29 @@
+From 5db00c2c55cd048f39313aff9f78ca5ff2af0f28 Mon Sep 17 00:00:00 2001
+From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
+Date: Fri, 8 Nov 2024 12:00:41 +0000
+Subject: [PATCH] Update sanitize-filename requirement from 0.5 to 0.6
+
+---
+updated-dependencies:
+- dependency-name: sanitize-filename
+  dependency-type: direct:production
+...
+
+Signed-off-by: dependabot[bot] <support@github.com>
+---
+ Cargo.toml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Cargo.toml b/Cargo.toml
+index 4740293..8ac4d1b 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -53,7 +53,7 @@ zip = "2.1.5"
+ 
+ # shared across multiple examples
+ anyhow = "1"
+-sanitize-filename = "0.5"
++sanitize-filename = "0.6"
+ 
+ # actix_multipart
+ actix-web = "4"
diff --git a/20174.patch b/20174.patch
deleted file mode 100644
index 2ae827b..0000000
--- a/20174.patch
+++ /dev/null
@@ -1,170 +0,0 @@
-From c77c2abf16c13b3ef26fae52b6bec97a7abad65b Mon Sep 17 00:00:00 2001
-From: "Benjamin A. Beasley" <code@musicinmybrain.net>
-Date: Tue, 7 Jul 2026 06:57:19 +0100
-Subject: [PATCH 1/4] Add BSD-3-Clause LICENSE file to ecosystem/jupyterlab
-
-https://github.com/jupyterlab/jupyterlab/raw/refs/tags/v4.6.1/LICENSE
----
- test/ecosystem/jupyterlab/LICENSE | 27 +++++++++++++++++++++++++++
- 1 file changed, 27 insertions(+)
- create mode 100644 test/ecosystem/jupyterlab/LICENSE
-
-diff --git a/test/ecosystem/jupyterlab/LICENSE b/test/ecosystem/jupyterlab/LICENSE
-new file mode 100644
-index 0000000000000..c73604f78a1f6
---- /dev/null
-+++ b/test/ecosystem/jupyterlab/LICENSE
-@@ -0,0 +1,27 @@
-+Copyright (c) 2015-2025 Project Jupyter Contributors
-+All rights reserved.
-+
-+Redistribution and use in source and binary forms, with or without
-+modification, are permitted provided that the following conditions are met:
-+
-+1. Redistributions of source code must retain the above copyright notice, this
-+   list of conditions and the following disclaimer.
-+
-+2. Redistributions in binary form must reproduce the above copyright notice,
-+   this list of conditions and the following disclaimer in the documentation
-+   and/or other materials provided with the distribution.
-+
-+3. Neither the name of the copyright holder nor the names of its
-+   contributors may be used to endorse or promote products derived from
-+   this software without specific prior written permission.
-+
-+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-From 0561c227905e972b0d415b0170053ce6ec278184 Mon Sep 17 00:00:00 2001
-From: "Benjamin A. Beasley" <code@musicinmybrain.net>
-Date: Tue, 7 Jul 2026 06:58:21 +0100
-Subject: [PATCH 2/4] Add BSD-3-Clause LICENSE file to ecosystem/pandas
-
-https://github.com/pandas-dev/pandas/raw/refs/tags/v3.0.4/LICENSE
----
- test/ecosystem/pandas/LICENSE | 31 +++++++++++++++++++++++++++++++
- 1 file changed, 31 insertions(+)
- create mode 100644 test/ecosystem/pandas/LICENSE
-
-diff --git a/test/ecosystem/pandas/LICENSE b/test/ecosystem/pandas/LICENSE
-new file mode 100644
-index 0000000000000..bd1cc2a30c626
---- /dev/null
-+++ b/test/ecosystem/pandas/LICENSE
-@@ -0,0 +1,31 @@
-+BSD 3-Clause License
-+
-+Copyright (c) 2008-2011, AQR Capital Management, LLC, Lambda Foundry, Inc. and PyData Development Team
-+All rights reserved.
-+
-+Copyright (c) 2011-2026, Open source contributors.
-+
-+Redistribution and use in source and binary forms, with or without
-+modification, are permitted provided that the following conditions are met:
-+
-+* Redistributions of source code must retain the above copyright notice, this
-+  list of conditions and the following disclaimer.
-+
-+* Redistributions in binary form must reproduce the above copyright notice,
-+  this list of conditions and the following disclaimer in the documentation
-+  and/or other materials provided with the distribution.
-+
-+* Neither the name of the copyright holder nor the names of its
-+  contributors may be used to endorse or promote products derived from
-+  this software without specific prior written permission.
-+
-+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-From d21662e1800682b4058dac8bb39079620eb21400 Mon Sep 17 00:00:00 2001
-From: "Benjamin A. Beasley" <code@musicinmybrain.net>
-Date: Tue, 7 Jul 2026 06:59:25 +0100
-Subject: [PATCH 3/4] Add MIT LICENSE file to ecosystem/poetry
-
-https://github.com/python-poetry/poetry/raw/refs/tags/2.4.1/LICENSE
----
- test/ecosystem/poetry/LICENSE | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
- create mode 100644 test/ecosystem/poetry/LICENSE
-
-diff --git a/test/ecosystem/poetry/LICENSE b/test/ecosystem/poetry/LICENSE
-new file mode 100644
-index 0000000000000..81a8e1e473986
---- /dev/null
-+++ b/test/ecosystem/poetry/LICENSE
-@@ -0,0 +1,20 @@
-+Copyright (c) 2018-present Sébastien Eustace
-+
-+Permission is hereby granted, free of charge, to any person obtaining
-+a copy of this software and associated documentation files (the
-+"Software"), to deal in the Software without restriction, including
-+without limitation the rights to use, copy, modify, merge, publish,
-+distribute, sublicense, and/or sell copies of the Software, and to
-+permit persons to whom the Software is furnished to do so, subject to
-+the following conditions:
-+
-+The above copyright notice and this permission notice shall be
-+included in all copies or substantial portions of the Software.
-+
-+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-From 708d1e5dfaaaee539308d60dbbfc0faa186885fd Mon Sep 17 00:00:00 2001
-From: "Benjamin A. Beasley" <code@musicinmybrain.net>
-Date: Tue, 7 Jul 2026 07:06:54 +0100
-Subject: [PATCH 4/4] Add MIT LICENSE file to ecosystem/semantic-kernel
-
-https://github.com/microsoft/semantic-kernel/raw/refs/tags/python-1.43.1/python/LICENSE
----
- test/ecosystem/semantic-kernel/LICENSE | 21 +++++++++++++++++++++
- 1 file changed, 21 insertions(+)
- create mode 100644 test/ecosystem/semantic-kernel/LICENSE
-
-diff --git a/test/ecosystem/semantic-kernel/LICENSE b/test/ecosystem/semantic-kernel/LICENSE
-new file mode 100644
-index 0000000000000..9e841e7a26e4e
---- /dev/null
-+++ b/test/ecosystem/semantic-kernel/LICENSE
-@@ -0,0 +1,21 @@
-+    MIT License
-+
-+    Copyright (c) Microsoft Corporation.
-+
-+    Permission is hereby granted, free of charge, to any person obtaining a copy
-+    of this software and associated documentation files (the "Software"), to deal
-+    in the Software without restriction, including without limitation the rights
-+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+    copies of the Software, and to permit persons to whom the Software is
-+    furnished to do so, subject to the following conditions:
-+
-+    The above copyright notice and this permission notice shall be included in all
-+    copies or substantial portions of the Software.
-+
-+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+    SOFTWARE
diff --git a/330.patch b/330.patch
new file mode 100644
index 0000000..69d3ab1
--- /dev/null
+++ b/330.patch
@@ -0,0 +1,107 @@
+From 583321b938988ae69e6f9ecc5647eba94c4fdcb8 Mon Sep 17 00:00:00 2001
+From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
+Date: Thu, 3 Apr 2025 15:32:00 +0000
+Subject: [PATCH 1/3] build(deps): bump ron from 0.9.0-alpha.1 to 0.9.0
+
+Bumps [ron](https://github.com/ron-rs/ron) from 0.9.0-alpha.1 to 0.9.0.
+- [Release notes](https://github.com/ron-rs/ron/releases)
+- [Changelog](https://github.com/ron-rs/ron/blob/master/CHANGELOG.md)
+- [Commits](https://github.com/ron-rs/ron/commits/v0.9.0)
+
+---
+updated-dependencies:
+- dependency-name: ron
+  dependency-version: 0.9.0
+  dependency-type: direct:production
+  update-type: version-update:semver-patch
+...
+
+Signed-off-by: dependabot[bot] <support@github.com>
+---
+ Cargo.lock                | 4 ++--
+ Cargo.toml                | 2 +-
+ version-ranges/Cargo.toml | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index bf2d6975..c35dbb2c 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -730,9 +730,9 @@ checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+ 
+ [[package]]
+ name = "ron"
+-version = "0.9.0-alpha.1"
++version = "0.9.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7644a2a539ff7fa991c8f4652373cd722d387e39229415103243914249730836"
++checksum = "63f3aa105dea217ef30d89581b65a4d527a19afc95ef5750be3890e8d3c5b837"
+ dependencies = [
+  "base64",
+  "bitflags",
+diff --git a/Cargo.toml b/Cargo.toml
+index 338ccb87..76c723b5 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -36,7 +36,7 @@ version-ranges = { version = "0.1.0", path = "version-ranges" }
+ criterion = { version = "2.7.2", package = "codspeed-criterion-compat" }
+ env_logger = "0.11.6"
+ proptest = "1.6.0"
+-ron = "=0.9.0-alpha.1"
++ron = "=0.9.0"
+ varisat = "0.2.2"
+ version-ranges = { version = "0.1.0", path = "version-ranges", features = ["proptest"] }
+ 
+diff --git a/version-ranges/Cargo.toml b/version-ranges/Cargo.toml
+index 4ba888bf..14405b89 100644
+--- a/version-ranges/Cargo.toml
++++ b/version-ranges/Cargo.toml
+@@ -18,4 +18,4 @@ serde = ["dep:serde", "smallvec/serde"]
+ 
+ [dev-dependencies]
+ proptest = "1.6.0"
+-ron = "=0.9.0-alpha.1"
++ron = "=0.9.0"
+
+From 8ef1f0e6cfc8ec847d5cefda7edcfbebd1a3017e Mon Sep 17 00:00:00 2001
+From: konstin <konstin@mailbox.org>
+Date: Mon, 7 Apr 2025 19:11:09 +0200
+Subject: [PATCH 2/3] Use SemVer again
+
+---
+ Cargo.toml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Cargo.toml b/Cargo.toml
+index 76c723b5..25125b6b 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -36,7 +36,7 @@ version-ranges = { version = "0.1.0", path = "version-ranges" }
+ criterion = { version = "2.7.2", package = "codspeed-criterion-compat" }
+ env_logger = "0.11.6"
+ proptest = "1.6.0"
+-ron = "=0.9.0"
++ron = "0.9.0"
+ varisat = "0.2.2"
+ version-ranges = { version = "0.1.0", path = "version-ranges", features = ["proptest"] }
+ 
+
+From 983d40d061296a22a97810ea6946eb67048f511b Mon Sep 17 00:00:00 2001
+From: konstin <konstin@mailbox.org>
+Date: Mon, 7 Apr 2025 19:51:38 +0200
+Subject: [PATCH 3/3] Use SemVer again
+
+---
+ version-ranges/Cargo.toml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/version-ranges/Cargo.toml b/version-ranges/Cargo.toml
+index 14405b89..ce2c69f1 100644
+--- a/version-ranges/Cargo.toml
++++ b/version-ranges/Cargo.toml
+@@ -18,4 +18,4 @@ serde = ["dep:serde", "smallvec/serde"]
+ 
+ [dev-dependencies]
+ proptest = "1.6.0"
+-ron = "=0.9.0"
++ron = "0.9.0"
diff --git a/sources b/sources
index ce4d7d8..4c1f8d3 100644
--- a/sources
+++ b/sources
@@ -1 +1,4 @@
-SHA512 (uv-0.12.3.tar.gz) = a4933b9b9b852dee2485800ad82ee3be111a4a5a437ab32d5064cfd4004e124ba733294a546a097379c74cf1fc234d1da0488aec7725037c7b967ec1aa862a71
+SHA512 (uv-0.6.14.tar.gz) = fd83f66d7be2c8bb0a30457433db00a7a0aa04d7f546a5a8833299e1e92dcf502c058a5dd8deb6b890aa21c10e3b9695e5444272efed9402e9722b01a71ff1b1
+SHA512 (rs-async-zip-c909fda63fcafe4af496a07bfda28a5aae97e58d.tar.gz) = 3a309566f4925b02496fcf19bc2865968edf6fb65082ca4079d2cee79e6b0353a1910c079f2afe656da0d0f6ddde5102052a221ea35a7dabc6d690a11218b20a
+SHA512 (pubgrub-b70cf707aa43f21b32f3a61b8a0889b15032d5c4.tar.gz) = 401ea5ca16e978d5407a1400e4e27cec9fcac11332067ee1ed8a3bc511901e08fc421ce875ebbb0990593ed549a4a5f4620914a71ae3490c7b8ae0f7b26b5937
+SHA512 (tl-6e25b2ee2513d75385101a8ff9f591ef51f314ec.tar.gz) = 4abbc4240ed129c92da8d616e27a6df0f24cdc85a0803acfdae588ca91f9e5b8d482e3ac88b2e657ff68917b1b43cef1e7ef3c887f624659b231fa5a13fcae68
diff --git a/uv-0.12.1-revert-blake2-beta.patch b/uv-0.12.1-revert-blake2-beta.patch
deleted file mode 100644
index 805ef98..0000000
--- a/uv-0.12.1-revert-blake2-beta.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff -Naur uv-0.12.1-original/crates/uv-extract/src/hash.rs uv-0.12.1/crates/uv-extract/src/hash.rs
---- uv-0.12.1-original/crates/uv-extract/src/hash.rs	2026-07-31 20:05:57.000000000 +0100
-+++ uv-0.12.1/crates/uv-extract/src/hash.rs	2026-08-02 11:53:13.406289238 +0100
-@@ -1,4 +1,6 @@
--use sha2::{Digest, digest::consts::U32};
-+// BLAKE2 still uses the `digest` 0.10 trait, while MD5 and SHA-2 use 0.11.
-+use blake2::digest::{Digest as _, consts::U32};
-+use sha2::Digest;
- use std::pin::Pin;
- use std::task::{Context, Poll};
- use tokio::io::{AsyncReadExt, ReadBuf};
diff --git a/uv.rpmlintrc b/uv.rpmlintrc
index 1c25d20..a24db03 100644
--- a/uv.rpmlintrc
+++ b/uv.rpmlintrc
@@ -1,6 +1,5 @@
 # Not real spelling errors
-addFilter(r"spelling-error \('([Ll]ockfile|[Ww]orkspace)s?',")
-addFilter(r"spelling-error \('([Dd]eduplication|pipx|macOS|(py|virtual)env)',")
+addFilter(r"spelling-error \('([Dd]eduplication|pipx|macOS|virtualenv)',")
 # TODO: We would like to add man pages.
 addFilter(r" no-manual-page-for-binary uv$")
 # Since it is just equivalent to “uv tool run,” uvx is unlikely to get its own
diff --git a/uv.spec b/uv.spec
index 3583aa3..6f2c0a0 100644
--- a/uv.spec
+++ b/uv.spec
@@ -1,18 +1,20 @@
 %bcond check 1
-# Should we run tests that require specific Python interpreter versions
-# (major.minor, not major.minor.patch)? This adds a few dozen tests, but adds
-# BuildRequires on more Python interpreters (which aren’t available in EPEL).
-%bcond other_python_versions %{undefined epel}
+# Should we run integration tests, many of which require specific Python
+# interpreter versions (major.minor, not major.minor.patch)? This adds a few
+# dozen tests, but adds BuildRequires on more Pythons, and could reduce our
+# confidence that everything works correctly in an environment that only has
+# the main system Python.
+#
+# For the time being, these are still disabled since many of them still want
+# network access, even when features like pypi and crates-io are removed from
+# the default features. We should discuss this with upstream and consider
+# offering a PR to conditionalize the affected tests. See
+# https://src.fedoraproject.org/rpms/uv/pull-request/18#comment-229365 and
+# https://github.com/astral-sh/uv/issues/8970#issuecomment-2466794088.
+%bcond it 0
 
 Name:           uv
-Version:        0.12.3
-# The uv package has a permanent exception to the Updates Policy in Fedora, so
-# it can be updated in stable releases across SemVer boundaries (subject to
-# good judgement and actual compatibility of any reverse dependencies). See
-# https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#_other_packages,
-# https://pagure.io/fesco/issue/3262. It also has a corresponding exception in
-# EPEL, but only in leading branches and only until version 1.0; see
-# https://pagure.io/epel/issue/317.
+Version:        0.6.14
 Release:        %autorelease
 Summary:        An extremely fast Python package installer and resolver, written in Rust
 
@@ -25,8 +27,6 @@ Summary:        An extremely fast Python package installer and resolver, written
 #     crate(r-shquote); the original code was (Apache-2.0 OR
 #     LGPL-2.1-or-later), but the vendored copy cites only the Apache-2.0
 #     option.
-#   - crates/uv-build-frontend/src/pipreqs/mappings is a data file taken from
-#     https://pypi.org/project/pipreqs, https://github.com/bndr/pipreqs
 #
 # Apache-2.0 OR BSD-2-Clause:
 #   - crates/uv-pep440/ is vendored and forked from crate(pep440_rs)
@@ -34,18 +34,17 @@ Summary:        An extremely fast Python package installer and resolver, written
 #   - crates/uv-python/packaging/ is vendored and forked from
 #     python3dist(packaging)
 #
-# (Apache-2.0 OR MIT) AND BSD-3-Clause:
+# (Apache-2.0 OR MIT) AND BSD-3-CLause:
 #   - The function wheel_metadata_from_remote_zip in
 #     crates/uv-client/src/remote_metadata.rs is vendored and forked from the
 #     function lazy_read_wheel_metadata in src/index/lazy_metadata.rs in
 #     crate(rattler_installs_packages) and is BSD-3-Clause AND (Apache-2.0 OR
-#     MIT): the original routine is BSD-3-Clause, and subsequent modifications
+#     MIT): the original routine is BSD-3-CLause, and subsequent modifications
 #     are explicitly (Apache-2.0 OR MIT).
 #
 # MIT
 #   - crates/uv-virtualenv/src/activator/ is vendored and forked from
 #     python3dist(virtualenv)
-#   - crates/uv-netrc/ is vendored from crate(rust-netrc)
 #
 # Additionally, the following are bundled/forked but happen to be under the
 # same (Apache-2.0 OR MIT) terms as uv itself:
@@ -53,36 +52,35 @@ Summary:        An extremely fast Python package installer and resolver, written
 #     forked from crate(ripunzip)
 #
 # The following are present in the source but believed not to contribute to the
-# licenses of the binary RPMs. Note that test/ecosystem/ contains only
+# licenses of the binary RPMs. Note that ecosystem/ contains only
 # pyproject.toml files used for testing, not complete bundled projects.
 #
 # Apache-2.0:
-#   - test/ecosystem/airflow/
-#   - test/ecosystem/home-assistant-core/
-#   - test/ecosystem/transformers/
-#   - test/ecosystem/warehouse/
+#   - ecosystem/airflow/
+#   - ecosystem/home-assistant-core/
+#   - ecosystem/transformers/
+#   - ecosystem/warehouse/
 # Apache-2.0 OR MIT:
-#   - test/ecosystem/packse/
+#   - ecosystem/packse/
 # BSD-2-Clause-Patent:
-#   - test/ecosystem/github-wikidata-bot/
+#   - ecosystem/github-wikidata-bot/
 # BSD-3-Clause:
-#   - test/ecosystem/jupyterlab/
-#   - test/ecosystem/pandas/
-#   - test/ecosystem/saleor/
+#   - ecosystem/saleor/
 # MIT:
 #   - crates/uv-python/fetch-download-metadata.py is derived from
 #     https://github.com/mitsuhiko/rye/tree/f9822267a7f00332d15be8551f89a212e7bc9017
 #     which was MIT.
-#   - test/ecosystem/black/
-#   - test/ecosystem/poetry/
-#   - test/ecosystem/semantic-kernel/
+#   - ecosystem/black/
 #
 # Rust crates compiled into the executable contribute additional license terms.
 # To obtain the following list of licenses, build the package and note the
-# output of %%{cargo_license_summary}.
+# output of %%{cargo_license_summary}. This should automatically include the
+# licenses of the following bundled forks:
+#   - async_zip, Source100, is MIT.
+#   - pubgrub/version-ranges, Source200, is MPL-2.0.
+#   - tl, Source400, is MIT.
 #
 # (Apache-2.0 OR MIT) AND BSD-3-Clause
-# (MIT OR Apache-2.0) AND Apache-2.0 AND CC0-1.0
 # (MIT OR Apache-2.0) AND Unicode-3.0
 # (MIT OR Apache-2.0) AND Unicode-DFS-2016
 # 0BSD
@@ -98,47 +96,43 @@ Summary:        An extremely fast Python package installer and resolver, written
 # Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT
 # BSD-2-Clause OR Apache-2.0 OR MIT
 # BSD-3-Clause
-# CDLA-Permissive-2.0
+# BSL-1.0
 # ISC
 # LGPL-3.0-or-later OR MPL-2.0
 # MIT
-# MIT AND (MIT OR Apache-2.0)
 # MIT OR Apache-2.0
 # MIT OR LGPL-3.0-or-later
 # MIT OR Zlib OR Apache-2.0
-# MIT-0
 # MIT-0 OR Apache-2.0
 # MPL-2.0
 # Unicode-3.0
 # Unlicense OR MIT
 # Zlib
 License:        %{shrink:
-    0BSD AND
-    (0BSD OR Apache-2.0 OR MIT) AND
-    Apache-2.0 AND
-    (Apache-2.0 OR BSD-2-Clause) AND
-    (Apache-2.0 OR BSD-2-Clause OR MIT) AND
-    (Apache-2.0 OR BSL-1.0) AND
-    (Apache-2.0 OR ISC OR MIT) AND
-    (Apache-2.0 OR MIT) AND
-    (Apache-2.0 OR MIT OR Zlib) AND
-    (Apache-2.0 OR MIT-0) AND
-    (Apache-2.0 WITH LLVM-exception) AND
-    (Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT) AND
-    BSD-3-Clause AND
-    CC0-1.0 AND
-    CDLA-Permissive-2.0 AND
-    ISC AND
-    (LGPL-3.0-or-later OR MIT) AND
-    (LGPL-3.0-or-later OR MPL-2.0) AND
-    MIT AND
-    MIT-0 AND
-    (MIT OR Unlicense) AND
-    MPL-2.0 AND
-    Unicode-3.0 AND
-    Unicode-DFS-2016 AND
-    Zlib
-    }
+                0BSD AND
+                (0BSD OR Apache-2.0 OR MIT) AND
+                Apache-2.0 AND
+                (Apache-2.0 OR BSD-2-Clause) AND
+                (Apache-2.0 OR BSD-2-Clause OR MIT) AND
+                (Apache-2.0 OR BSL-1.0) AND
+                (Apache-2.0 OR ISC OR MIT) AND
+                (Apache-2.0 OR MIT) AND
+                (Apache-2.0 OR MIT OR Zlib) AND
+                (Apache-2.0 OR MIT-0) AND
+                (Apache-2.0 WITH LLVM-exception) AND
+                (Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT) AND
+                BSD-3-Clause AND
+                BSL-1.0 AND
+                ISC AND
+                (LGPL-3.0-or-later OR MIT) AND
+                (LGPL-3.0-or-later OR MPL-2.0) AND
+                MIT AND
+                (MIT OR Unlicense) AND
+                MPL-2.0 AND
+                Unicode-3.0 AND
+                Unicode-DFS-2016 AND
+                Zlib
+                }
 # LICENSE.dependencies contains a full license breakdown
 URL:            https://github.com/astral-sh/uv
 Source0:        %{url}/archive/%{version}/uv-%{version}.tar.gz
@@ -146,21 +140,72 @@ Source0:        %{url}/archive/%{version}/uv-%{version}.tar.gz
 # https://docs.astral.sh/uv/configuration/files
 Source1:        uv.toml
 
+# Currently, uv must use a fork of async_zip, as explained in:
+#   Restore central directory buffering
+#   https://github.com/charliermarsh/rs-async-zip/pull/2
+# and further discussed in
+#   Please consider supporting the current release of async_zip
+#   https://github.com/prefix-dev/async_http_range_reader/issues/14
+# We therefore bundle the fork as prescribed in
+#   https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/#_replacing_git_dependencies
+%global async_zip_git https://github.com/charliermarsh/rs-async-zip
+%global async_zip_rev c909fda63fcafe4af496a07bfda28a5aae97e58d
+%global async_zip_baseversion 0.0.17
+%global async_zip_snapdate 20241114
+Source100:      %{async_zip_git}/archive/%{async_zip_rev}/rs-async-zip-%{async_zip_rev}.tar.gz
+
+# For the foreseeable future, uv must use a fork of pubgrub (and the
+# version-ranges crate, which belongs to the same project), as explained in:
+#   Plans for eventually using published pubgrub?
+#   https://github.com/astral-sh/uv/issues/3794
+# We therefore bundle the fork as prescribed in
+#   https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/#_replacing_git_dependencies
+%global pubgrub_git https://github.com/astral-sh/pubgrub
+%global pubgrub_rev b70cf707aa43f21b32f3a61b8a0889b15032d5c4
+%global pubgrub_baseversion 0.3.0~alpha.1
+%global pubgrub_snapdate 20250202
+%global version_ranges_baseversion 0.1.1
+Source200:      %{pubgrub_git}/archive/%{pubgrub_rev}/pubgrub-%{pubgrub_rev}.tar.gz
+
+# For the time being, uv must use a fork of tl. See:
+#   Path back to using released tl crate dependency?
+#   https://github.com/astral-sh/uv/issues/6687
+# It should be possible to stop forking and bundling if tl upstream merges and
+# releases the following fix:
+#   Avoid truncating URLs in unquoted hrefs
+#   https://github.com/y21/tl/pull/69
+# We therefore bundle the fork as prescribed in
+#   https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/#_replacing_git_dependencies
+%global tl_git https://github.com/astral-sh/tl
+%global tl_rev 6e25b2ee2513d75385101a8ff9f591ef51f314ec
+%global tl_baseversion 0.7.8
+%global tl_snapdate 20240825
+Source400:      %{tl_git}/archive/%{tl_rev}/tl-%{tl_rev}.tar.gz
+
+# Downstream-only: do not override the default allocator
+#
+# In https://github.com/astral-sh/uv/pull/399, it was reasonably claimed that
+# using tikv-jemallocator improved benchmarks by 10%. However, this would
+# require packaging at least the tikv-jemalloc-sys, tikv-jemalloc-ctl, and
+# tikv-jemallocator crates, and this is expected to be not quite trivial.
+# We use the default allocator for now, and reserve tikv-jemallocaator
+# packaging as optional future work.
+Patch:          0001-Downstream-only-do-not-override-the-default-allocato.patch
+
 # Downstream-only: Always find the system-wide uv executable
 # See discussion in
 #   Should uv.find_uv_bin() be able to find /usr/bin/uv?
 #   https://github.com/astral-sh/uv/issues/4451
 Patch:          0001-Downstream-patch-always-find-the-system-wide-uv-exec.patch
-# Downstream-only: revert source-code changes from “Upgrade BLAKE2 to unify
-# hashing digest versions”, https://github.com/astral-sh/uv/pull/20834. We do
-# not wish to upgrade rust-blake2 to a pre-release.
-Patch:          uv-0.12.1-revert-blake2-beta.patch
-# Add license texts for new contents of test/ecosystem/ from PR#20068
-# https://github.com/astral-sh/uv/pull/20174
-Patch:          %{url}/pull/20174.patch
 
-BuildSystem:    pyproject
-BuildOption(install): --assert-license uv
+# Update sanitize-filename requirement from 0.5 to 0.6
+Patch100:       https://github.com/Majored/rs-async-zip/pull/153.patch
+
+# This patch is for the forked, bundled pubgrub crate.
+#
+# build(deps): bump ron from 0.9.0-alpha.1 to 0.9.0
+# https://github.com/pubgrub-rs/pubgrub/pull/330
+Patch200:       https://github.com/pubgrub-rs/pubgrub/pull/330.patch
 
 # https://fedoraproject.org/wiki/Changes/EncourageI686LeafRemoval
 ExcludeArch:    %{ix86}
@@ -169,69 +214,68 @@ ExcludeArch:    %{ix86}
 # of memory in the final linking step. This cannot be fixed by adding
 # "-C link-args=-Wl,--no-keep-memory" to the RUSTFLAGS (as that seems to have
 # no significant effect on memory requirements), nor can it be fixed by
-# reducing parallelism (although we do need this as well), since nothing else
-# is happening at that point in the build. See:
+# reducing parallelism with e.g. the %%constrain_build macro (although we do
+# need this as well), since nothing else is happening at that point in the
+# build. See:
 # https://doc.rust-lang.org/rustc/codegen-options/index.html#debuginfo
 %global rustflags_debuginfo 1
 
-# As a separate limitation, memory exhaustion (OOM) can occur during parallel
-# portions of the build.
-# - Because very many workspace crates can be built in parallel, builders with
-#   a very large number of CPUs may OOM. Typical workspace crates peak out at
-#   roughly 2–4 GB per rustc process.
-# - The uv crate needs much more memory to compile and link, at least 8 GB, and
-#   when building the tests we may be building bin and lib versions at the same
-#   time, along with the it (integration test) crate, which is also rather
-#   large. This is a problem for “low memory” builders (<20 GB or so).
-# Unfortunately, this means that we need to scale the memory per task based on
-# the memory requirements of the top-level uv crate in order to avoid OOM on
-# all kinds of builders.
-%global _smp_tasksize_proc 10240
+# As a separate limitation, memory exhaustion can occur on builders with very
+# many CPUs. Typical workspace crates peak out at 2-4 GB per rustc invocation.
+# The uv crate needs much more memory to compile (see the RUSTFLAGS adjustment
+# in %%build), but in practice it is also compiled alone after all the other
+# crates have finished, so it does not need to influence (and does not benefit
+# from) this setting. Even though some crates will require more than 3GB, the
+# average should be below that on many-core systems. Increase as needed.
+%constrain_build -m 4096
 
-# Compilation may fail on builders with very many cores (e.g. 192 cores) due to
-# “too many open files.” Try to keep the files/core ratio from getting too low.
-%global _smp_ncpus_max 48
-
-BuildRequires:  cargo-rpm-macros
+BuildRequires:  cargo-rpm-macros >= 24
 BuildRequires:  rust2rpm-helper
 BuildRequires:  tomcli
-%if %{with check} && %{with other_python_versions}
+BuildRequires:  python3-devel
+%if %{with check} && %{with it}
 # See trove classifiers in pyproject.toml for supported Pythons.
+BuildRequires:  /usr/bin/python3.8
 BuildRequires:  /usr/bin/python3.9
 BuildRequires:  /usr/bin/python3.10
 BuildRequires:  /usr/bin/python3.11
 BuildRequires:  /usr/bin/python3.12
 BuildRequires:  /usr/bin/python3.13
-BuildRequires:  /usr/bin/python3.13t
-BuildRequires:  /usr/bin/python3.14
-BuildRequires:  /usr/bin/python3.14t
 %endif
 
+# This is a fork of async_zip; see the notes about Source100.
+%global async_zip_snapinfo %{async_zip_snapdate}git%{sub %{async_zip_rev} 1 7}
+%global async_zip_version %{async_zip_baseversion}^%{async_zip_snapinfo}
+Provides:       bundled(crate(async_zip)) = %{async_zip_version}
+# This is a fork of pubgrub/version-ranges; see the notes about Source200.
+%global pubgrub_snapinfo %{pubgrub_snapdate}git%{sub %{pubgrub_rev} 1 7}
+%global pubgrub_version %{pubgrub_baseversion}^%{pubgrub_snapinfo}
+%global version_ranges_version %{version_ranges_baseversion}^%{pubgrub_snapinfo}
+Provides:       bundled(crate(pubgrub)) = %{pubgrub_version}
+Provides:       bundled(crate(version-ranges)) = %{version_ranges_version}
+# This is a fork of tl; see the notes about Source400.
+%global tl_snapinfo %{tl_snapdate}git%{sub %{tl_rev} 1 7}
+%global tl_version %{tl_baseversion}^%{tl_snapinfo}
+Provides:       bundled(crate(tl)) = %{tl_version}
+
 # In https://github.com/astral-sh/uv/issues/5588#issuecomment-2257823242,
 # upstream writes “These have diverged significantly and the upstream versions
 # are only passively maintained, uv requires these custom versions and can't
 # use a system copy.”
 #
 # crates/uv-pep440/
-# Version number from crates/uv-pep440/CHANGELOG.md; it was also in
-# crates/uv-pep440/Cargo.toml until uv 0.9.11, when internal crates started
-# being versioned and published on crates.io.
+# Version number from Cargo.toml:
 Provides:       bundled(crate(pep440_rs)) = 0.7.0
 # crates/uv-pep508/
-# Version number from crates/uv-pep508/Changelog.md; it was also in
-# crates/uv-pep508/Cargo.toml until uv 0.9.11, when internal crates started
-# being versioned and published on crates.io, but the version in Cargo.toml was
-# 0.6.0. The source reflects upstream changes in 0.7.0.
+# Cargo.toml has 0.6.0, but Changelog.md shows 0.7.0, and the source reflects
+# the changes for 0.7.0:
 Provides:       bundled(crate(pep508_rs)) = 0.7.0
 # crates/uv-virtualenv/
 # As a whole, this crate is derived from https://github.com/konstin/gourgeist
 # 0.0.4, which was published as https://crates.io/crates/gourgeist. It looks
-# like the project was subsumed into `uv`, and the link to `uv` at
-# https://konstin.github.io/gourgeist/ (“See
-# https://github.com/astral-sh/uv/tree/main/crates/uv-virtualenv for the up to
-# date version”) supports this. We therefore consider this not to be a real
-# case of bundling, since the source in uv is now the canonical one, and we do
-# not add:
+# looks like the project was subsumed into `uv`, and the link to `uv` at
+# https://konstin.github.io/gourgeist/ seems to support this, so we consider
+# this not to be a real case of bundling, and we do not add:
 #   Provides:       bundled(crate(gourgeist)) = 0.0.4
 
 # crates/uv-extract/src/vendor/cloneable_seekable_reader.rs
@@ -262,32 +306,6 @@ Provides:       bundled(crate(glibc_version)) = 0.1.2^20221117git5e1002d
 # unmaintained upstream, https://github.com/astral-sh/uv/issues/11780.
 Provides:       bundled(crate(r-shquote)) = 0.1.1
 
-# crates/uv-keyring
-# From crates/uv-keyring/README.md, “This is vendored from [keyring-rs
-# crate](https://github.com/open-source-cooperative/keyring-rs)
-# commit 9635a2f53a19eb7f188cdc4e38982dcb19caee00.” The commit message of the
-# referenced upstream commit indicates it corresponds to 4.0.0-rc2.
-#
-# The text of https://github.com/astral-sh/uv/pull/14725 explains the differing
-# design goals and tradeoffs that lead uv to fork keyring-rs rather than using
-# the upstream https://crates.io/crates/keyring crate or trying to get the
-# necessary changes merged upstream. Based on this explanation, there does not
-# appear to be any prospect of unbundling.
-Provides:       bundled(crate(keyring)) = 4.0.0~rc2
-
-# crates/uv-netrc
-# From crates/uv-netrc/README.md, “This crate vendors the rust-netrc parser for
-# use by uv. The source was vendored from gribouille/netrc, as published in
-# rust-netrc 0.1.2[…]”
-#
-# Upstream justifies the bundling in
-# https://github.com/astral-sh/uv/pull/19409: they want unreleased bug fixes,
-# including those pertaining to https://github.com/astral-sh/uv/issues/16083,
-# and to avoid a dependency on thiserror v1. In response to the mandatory
-# query, they report they are open to de-vendoring if a new rust-netrc release
-# with the desired changes appears.
-Provides:       bundled(crate(rust-netrc)) = 0.1.2
-
 # The contents of crates/uv-virtualenv/src/activator/ are a bundled and
 # slightly forked copy of a subset of https://pypi.org/project/virtualenv; see
 # https://github.com/pypa/virtualenv/tree/main/src/virtualenv/activation.
@@ -298,10 +316,9 @@ Provides:       bundled(crate(rust-netrc)) = 0.1.2
 #   https://github.com/astral-sh/uv/issues/5588#issuecomment-2257474140
 #
 # The scripts were last updated from virtualenv upstream in
-# https://github.com/astral-sh/uv/pull/15272 on 2025-09-05. The PR was opened
-# on 2025-08-14 and last revised on 2025-08-30; the latest virtualenv release
-# throughout that time interval was 20.34.0.
-Provides:       bundled(python3dist(virtualenv)) = 20.34
+# https://github.com/astral-sh/uv/pull/3376 on 2024-05-04; the latest
+# virtualenv release at that time was 20.26.0.
+Provides:       bundled(python3dist(virtualenv)) = 20.26
 
 # The contents of crates/uv-python/python/packaging/ are a bundled copy of a
 # subset of https://pypi.org/project/packaging.
@@ -333,30 +350,25 @@ Provides:       bundled(python3dist(virtualenv)) = 20.34
 # snapshot date.
 Provides:       bundled(python3dist(packaging)) = 24.1~dev0^20240310gitcc938f9
 
-# The contents of crates/uv-build-frontend/src/pipreqs/mapping are copied from
-# https://pypi.org/project/pipreqs. Since this is just a data file, since uv
-# does not take Python dependencies, and since pipreqs is not currently
-# actively maintained anyway, there is no reasonable prospect of unbundling.
-# The version number is just that of the latest pipreqs release at the time the
-# data file was vendored.
-Provides:       bundled(python3dist(pipreqs)) = 0.5.0
-
 %global common_description %{expand:
-An extremely fast Python package and project manager, written in Rust.
+An extremely fast Python package installer and resolver, written in Rust.
+Designed as a drop-in replacement for common pip and pip-tools workflows.
 
 Highlights:
 
-  • A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twine,
-    virtualenv, and more.
-  • 10-100x faster than pip.
-  • Provides comprehensive project management, with a universal lockfile.
-  • Runs scripts, with support for inline dependency metadata.
-  • Installs and manages Python versions.
-  • Runs and installs tools published as Python packages.
-  • Includes a pip-compatible interface for a performance boost with a familiar
-    CLI.
-  • Supports Cargo-style workspaces for scalable projects.
-  • Disk-space efficient, with a global cache for dependency deduplication.}
+  • ⚖️ Drop-in replacement for common pip, pip-tools, and virtualenv commands.
+  • ⚡️ 10-100x faster than pip and pip-tools (pip-compile and pip-sync).
+  • 💾 Disk-space efficient, with a global cache for dependency deduplication.
+  • 🐍 Installable via curl, pip, pipx, etc. uv is a static binary that can be
+    installed without Rust or Python.
+  • 🧪 Tested at-scale against the top 10,000 PyPI packages.
+  • 🖥️ Support for macOS, Linux, and Windows.
+  • 🧰 Advanced features such as dependency version overrides and alternative
+    resolution strategies.
+  • ⁉️ Best-in-class error messages with a conflict-tracking resolver.
+  • 🤝 Support for a wide range of advanced pip features, including editable
+    installs, Git dependencies, direct URL dependencies, local dependencies,
+    constraints, source distributions, HTML and JSON indexes, and more.}
 
 %description %{common_description}
 
@@ -373,36 +385,91 @@ Requires:       uv = %{version}-%{release}
 This package provides an importable Python module for uv.
 
 
-%prep -a
-# Collect license files of vendored dependencies
-install -D --preserve-timestamps --mode=0644 \
-    --target=LICENSE.bundled/packaging \
+%prep
+%autosetup -N
+%autopatch -p1 -M99
+
+# Usage: git2path SELECTOR PATH
+# Replace a git dependency with a path dependency in Cargo.toml
+git2path() {
+  tomcli set Cargo.toml del "${1}.git"
+  tomcli set Cargo.toml del "${1}.rev"
+  tomcli set Cargo.toml str "${1}.path" "${2}"
+}
+
+# See comments above Source100:
+%setup -q -T -D -b 100 -n uv-%{version}
+# Adding the crate to the workspace (in this case implicitly, by linking it
+# under crates/) means %%cargo_generate_buildrequires can handle it correctly.
+ln -s '../../rs-async-zip-%{async_zip_rev}' crates/async_zip
+git2path workspace.dependencies.async_zip crates/async_zip
+pushd crates/async_zip
+%autopatch -p1 -m100 -M199
+popd
+install -t LICENSE.bundled/async_zip -D -p -m 0644 crates/async_zip/LICENSE
+# Drop dev-dependencies that are only required for compiling the
+# actix-multipart example, and remove it. Note that while “futures” is in this
+# section of Cargo.toml, it is in fact also used in a test.
+tomcli set crates/async_zip/Cargo.toml del dev-dependencies.actix-multipart
+mv crates/async_zip/examples/actix_multipart.rs{,.disabled}
+tomcli set crates/async_zip/Cargo.toml del dev-dependencies.actix-web
+tomcli set crates/async_zip/Cargo.toml del dev-dependencies.derive_more
+tomcli set crates/async_zip/Cargo.toml del dev-dependencies.uuid
+
+# See comments above Source200:
+%setup -q -T -D -b 200 -n uv-%{version}
+ln -s '../../pubgrub-%{pubgrub_rev}' crates/pubgrub
+git2path workspace.dependencies.pubgrub crates/pubgrub
+pushd crates/pubgrub
+%autopatch -p1 -m200 -M299
+popd
+install -t LICENSE.bundled/pubgrub -D -p -m 0644 crates/pubgrub/LICENSE
+# Drop a benchmark-only dev-dependency.
+tomcli set crates/pubgrub/Cargo.toml del dev-dependencies.criterion
+# Omit tests requiring varisat; it is not packaged and has significant
+# dependencies of its own.
+tomcli set crates/pubgrub/Cargo.toml del dev-dependencies.varisat
+mv crates/pubgrub/tests/proptest.rs{,.disabled}
+mv crates/pubgrub/tests/sat_dependency_provider.rs{,.disabled}
+# We can’t have two workspaces!
+tomcli set crates/pubgrub/Cargo.toml del workspace
+# Note that install does always dereference symlinks, which is what we want:
+install -t LICENSE.bundled/version-ranges -D -p -m 0644 \
+    crates/pubgrub/version-ranges/LICENSE
+git2path workspace.dependencies.version-ranges crates/pubgrub/version-ranges
+
+# See comments above Source400:
+%setup -q -T -D -b 400 -n uv-%{version}
+ln -s '../../tl-%{tl_rev}' crates/tl
+git2path workspace.dependencies.tl crates/tl
+pushd crates/tl
+%autopatch -p1 -m400 -M499
+popd
+install -t LICENSE.bundled/tl -D -p -m 0644 crates/tl/LICENSE
+# Drop a benchmark-only dev-dependency.
+tomcli set crates/tl/Cargo.toml del dev-dependencies.criterion
+
+# Collect license files of vendored dependencies in the main source archive
+install -t LICENSE.bundled/packaging -D -p -m 0644 \
     crates/uv-python/python/packaging/LICENSE.*
-install -D --preserve-timestamps --mode=0644 \
-    --target=LICENSE.bundled/pep440_rs crates/uv-pep440/License-*
-install -D --preserve-timestamps --mode=0644 \
-    --target=LICENSE.bundled/pep508_rs crates/uv-pep508/License-*
-install -D --preserve-timestamps --mode=0644 \
-    --target=LICENSE.bundled/pipreqs \
-    crates/uv-build-frontend/src/pipreqs/LICENSE
-install -D --preserve-timestamps --mode=0644 \
-    --target=LICENSE.bundled/ripunzip crates/uv-extract/src/vendor/LICENSE
-install -D --preserve-timestamps --mode=0644 \
-    --target=LICENSE.bundled/rust-netrc crates/uv-netrc/LICENSE
+install -t LICENSE.bundled/pep440_rs -D -p -m 0644 crates/uv-pep440/License-*
+install -t LICENSE.bundled/pep508_rs -D -p -m 0644 crates/uv-pep508/License-*
+install -t LICENSE.bundled/ripunzip -D -p -m 0644 \
+    crates/uv-extract/src/vendor/LICENSE
 # The original license text from rattler_installs_packages is present in a
 # comment, but we want it in a separate file so we can ensure it is present in
 # the binary RPM.
-install --directory LICENSE.bundled/rattler_installs_packages
+install -d LICENSE.bundled/rattler_installs_packages
 awk '$2 == "BSD" { out=1 }; $2 == "```" { out=0 }; out' \
     crates/uv-client/src/remote_metadata.rs |
-  sed --regexp-extended 's@^///( |$)@@' |
+  sed -r 's@^///( |$)@@' |
   tee LICENSE.bundled/rattler_installs_packages/LICENSE
 # Similarly for virtualenv. All files in
 # crates/uv-virtualenv/src/activator/activate/ have the same license text.
-install --directory LICENSE.bundled/virtualenv
+install -d LICENSE.bundled/virtualenv
 awk '$1 == "#" { out=1 }; $1 != "#" { out=0; exit }; out' \
     crates/uv-virtualenv/src/activator/activate |
-  sed --regexp-extended 's@^#( |$)@@' |
+  sed -r 's@^#( |$)@@' |
   tee LICENSE.bundled/virtualenv/LICENSE
 
 # Patch out foreign (e.g. Windows-only) dependencies. Follow symbolic links so
@@ -411,27 +478,15 @@ find -L . -type f -name Cargo.toml -print \
     -execdir rust2rpm-helper strip-foreign -o '{}' '{}' ';'
 
 # The uv-trampoline crate (a fork of posy trampolines, from
-# https://github.com/njsmith/posy) uses a set of trampoline Windows executables
-# for launching Python scripts. These precompiled executables are funished by
-# the uv-trampoline-builder crate. We must remove them to prove they are not
-# used in the build. Since they are used only on Windows, nothing is lost by
-# doing so.
-rm --verbose crates/uv-trampoline-builder/trampolines/*.exe
-# Per Cargo.toml, uv-trampoline is excluded from the workspace and not compiled
-# because it still requires a nightly compiler. For now, we remove it entirely
-# to show that we do not need to document bundling from posy. Note that we
-# *cannot* cleanly remove uv-trampoline-builder, only the precompiled
-# trampolines themselves.
-rm --recursive --verbose crates/uv-trampoline
-
-# Remove the dependency on embed-manifest, which applies only when (cross-?)
-# compiling for Windows.
-tomcli set Cargo.toml del workspace.dependencies.embed-manifest
-# We may have to do something more sophisticated if this build script ever
-# starts to do anything other than just embedding a manifest on Windows.
-rm --verbose crates/uv/build.rs
-tomcli set crates/uv/Cargo.toml del build-dependencies.embed-manifest
-# The embed-manifest depenency is also used in uv-trampoline, which we removed.
+# https://github.com/njsmith/posy) contains a set of trampoline Windows
+# executables for launching Python scripts. We must remove these to prove they
+# are not used in the build (and since they are only used on Windows, nothing
+# is lost by doing so).
+rm -v crates/uv-trampoline/trampolines/*.exe
+# Per Cargo.toml, uv-trampoline is excluded from the workspace and not
+# compiled because it still requires a nightly compiler. For now, we remove it
+# entirely to show that we do not need to document bundling from posy.
+rm -rv crates/uv-trampoline
 
 # Do not strip the compiled executable; we need useful debuginfo. Upstream set
 # this intentionally, so this change makes sense to keep downstream-only.
@@ -442,73 +497,59 @@ tomcli set Cargo.toml false profile.release.strip
 # benchmarks, and it brings in unwanted additional dev dependencies.
 tomcli set Cargo.toml append workspace.exclude crates/uv-bench
 # The uv-dev crate provides “development utilities for uv,” which should not be
-# needed here. It also brings extra dependencies that we would prefer to avoid.
+# needed here, and it also brings in extra dependencies that we would prefer to
+# do without.
 tomcli set Cargo.toml append workspace.exclude crates/uv-dev
 
+# Do not request static linking of liblzma – not even when the performance
+# feature is enabled.
+tomcli set crates/uv-extract/Cargo.toml lists delitem \
+    features.performance 'xz2/static'
+
 # Disable several default features that control which tests are compiled and
 # executed, and which are not usable in offline builds:
 #
-# - test-crates-io: Introduces a testing dependency on crates.io.
-# - test-git: Introduces a testing dependency on Git. This sounds innocuous –
-#   we have git! – but in fact, it controls tests of git dependencies, which
-#   implies accessing remote repositories, e.g. on GitHub.
-# - test-git-lfs: as for git, but also require Git Large File Storage; again,
-#   this implies accessing remote repositories
-# - test-pypi: Introduces a testing dependency on PyPI.
-# - test-python-managed: Introduces a testing dependency on managed Python
-#   installations. (These are pre-compiled Pythons downloaded from the
-#   Internet.)
-# - test-r2: Introduces a testing dependency on R2.
+# ”Introduces a dependency on managed Python installations.”
+# (These are pre-compiled Pythons downloaded from the Internet.)
+tomcli set crates/uv/Cargo.toml lists delitem features.default 'python-managed'
 #
-# These are OK:
-# - test-python: Introduces a testing dependency on a local Python installation.
-# - test-slow: Include "slow" test cases.
-# - test-ecosystem: Includes test cases that require ecosystem packages
+# ”Introduces a dependency on PyPI.”
+tomcli set crates/uv/Cargo.toml lists delitem features.default 'pypi'
 #
+# ”Introduces a dependency on Git.”
+# This sounds innocuous – we have git! – but in fact, it controls tests of git
+# dependencies, which implies accessing remote repositories, e.g. on GitHub.
+tomcli set crates/uv/Cargo.toml lists delitem features.default 'git'
+#
+# ”Introduces a dependency on crates.io.”
+tomcli set crates/uv/Cargo.toml lists delitem features.default 'crates-io'
 # Note that the python-patch feature, which ”introduces a dependency on a local
 # Python installation with specific patch versions,” is already not among the
 # default features.
-tomcli set crates/uv/Cargo.toml lists delitem features.test-defaults \
-    'test-(crates-io|git(-lfs)?|pypi|python-managed|r2)'
-# - -test-osv: Introduces a testing dependency on osv.dev.
-tomcli set crates/uv-audit/Cargo.toml lists delitem features.default \
-    'test-(osv)'
 
-%if %{without other_python_versions}
-# Many of these tests require specific Python versions (major.minor, not
-# major.minor.patch, unless the python-patch feature is enabled). Manually
-# selecting the tests in these modules that would succeed with just the system
-# Python would be far too tedious.
-omit_modules() {
-  set -o nounset
-  set -o errexit
-  main_module="${1}"
-  commented_modules=''
-  comment='Downstream-only: skip, needs specific Python interpreter versions'
-  shift
-  while [ "${#}" != 0 ]
-  do
-    commented_modules="${commented_modules-}${commented_modules+|}${1}"
-    shift
-  done
-  sed --regexp-extended --in-place \
-      "s@mod (${commented_modules});@// ${comment}\n#[cfg(any())]\n&@" \
-      "${main_module}"
-}
-# -p uv --test build
-omit_modules crates/uv/tests/build/main.rs build_backend
+# Omit tests requiring wiremock; its dependency tree is too large and complex
+# to consider packaging it right now. The conditional #[cfg(any())] is always
+# false.
+sed -r -i 's/^#\[cfg\(test\)\]/#[cfg(any())]\r&/' \
+    crates/uv-auth/src/middleware.rs
+tomcli set crates/uv-auth/Cargo.toml del dev-dependencies.wiremock
+
+%if %{without it}
+# Integration tests (it crate) nearly all require specific Python interpreter
+# versions (major.minor, not major.minor.patch, unless the python-patch feature
+# is enabled). We might choose to disable this in order to double-check that
+# everything else works well with only the primary system Python in the
+# environment.
 # -p uv --test it:
-omit_modules crates/uv/tests/it/main.rs \
-    auth branching_urls network upgrade version
-# -p uv --test python:
-omit_modules crates/uv/tests/python/main.rs \
-    'python_(dir|find|install|list|pin)' venv
-# -p uv --test workspace:
-omit_modules crates/uv/tests/workspace/main.rs \
-    workspace 'workspace_(dir|list|metadata)'
-# -p uv --test pip:
-omit_modules crates/uv/tests/pip/main.rs \
-    'pip_(debug|list|show|tree|uninstall)'
+mods="${mods-}${mods+|}branching_urls"
+mods="${mods-}${mods+|}build_backend"
+mods="${mods-}${mods+|}pip_(check|list|show|tree|uninstall)"
+mods="${mods-}${mods+|}python_(dir|find|install|list|pin)"
+mods="${mods-}${mods+|}venv"
+mods="${mods-}${mods+|}workspace"
+comment='Downstream-only: skip, needs specific Python interpreter versions'
+sed -r -i "s@mod (${mods});@// ${comment}\n#[cfg(any())]\n&@" \
+    crates/uv/tests/it/main.rs
 %endif
 
 # For unclear reasons, maturin checks for the presence of optional crate
@@ -520,38 +561,27 @@ tomcli set crates/uv/Cargo.toml del features.self-update
 tomcli set crates/uv/Cargo.toml del features.tracing-durations-export
 tomcli set crates/uv/Cargo.toml del dependencies.tracing-durations-export
 
-# We retain the following example even when there are currently no dependencies
-# that need to be adjusted.
+# Loosen some version bounds that were aggressively updated upstream by the
+# renovate bot. We retain this comment and the following example even when
+# there are currently no dependencies that need to be adjusted.
 #
 # # foocrate
 # #   wanted: 0.2.0
 # #   currently packaged: 0.1.2
 # #   https://bugzilla.redhat.com/show_bug.cgi?id=1234567
-# tomcli set Cargo.toml str workspace.dependencies.foocrate.version 0.1.2
+# tomcli set crates/uv/Cargo.toml str dev-dependencies.foocrate.version 0.1.2
 
-# tikv-jemallocator
-#   wanted: 0.6.0
-#   currently packaged: 0.7.0
-#   https://github.com/astral-sh/uv/pull/19735
-# We use sed instead of tomcli because the target.cfg(…) expression is a
-# *mess*, and we don’t want to have to write it out here.
-sed --regexp-extended --in-place \
-    's/^(tikv-jemallocator\b.*version = ")0\.6\.0"/\1>=0.6.0, <0.8.0"/' \
-    crates/uv-performance-memory-allocator/Cargo.toml
-
-# blake2
-#   wanted: 0.11.0-rc.6
-#   currently packaged: 0.10.6
-#   https://github.com/astral-sh/uv/pull/19735
-# Downstream-only: revert “Upgrade BLAKE2 to unify hashing digest versions”,
-# https://github.com/astral-sh/uv/pull/20834. We do not wish to upgrade
-# rust-blake2 to a pre-release. There is an anccompanying source-code patch.
-tomcli set Cargo.toml str workspace.dependencies.blake2.version 0.10.6
+# etcetera
+#   wanted: 0.10.0
+#   currently packaged: 0.8.0
+#   https://bugzilla.redhat.com/show_bug.cgi?id=2348721
+tomcli set Cargo.toml str workspace.dependencies.etcetera.version \
+    '>=0.8.0, <0.11.0'
 
 %cargo_prep
 
 
-%generate_buildrequires -p
+%generate_buildrequires
 # For unclear reasons, maturin checks for all crate dependencies when it is
 # invoked as part of %%pyproject_buildrequires – including those corresponding
 # to optional features.
@@ -563,14 +593,39 @@ tomcli set Cargo.toml str workspace.dependencies.blake2.version 0.10.6
 # Since maturin always checks for dev-dependencies, we need -t so that they are
 # generated even when the “check” bcond is disabled.
 %cargo_generate_buildrequires -a -t
+# These crates are excluded from the workspace – upstream writes:
+#   Only used to pull in features, allocators, etc. — we specifically don't
+#   want them to be part of a workspace-wide cargo check, cargo clippy, etc.
+#   – but they are still needed to support features, and the build will fail if
+#   we do not generate their dependencies, too:
+for cratedir in \
+    crates/uv-performance-memory-allocator
+do
+  pushd "${cratedir}" >/dev/null
+  %cargo_generate_buildrequires -a -t
+  popd >/dev/null
+done
+%pyproject_buildrequires
 
 
-%build -a
+%build
+%pyproject_wheel
+
 %{cargo_license_summary}
 %{cargo_license} > LICENSE.dependencies
 
+# TODO: Since the --help output interacts well with help2man, use it to
+# generate man pages: ideally, a man page for each (sub)command
+# cross-referenced appropriately. (There are many subcommands, and this would
+# be tedious to do manually.) This should be feasible with the --include option
+# to help2man and a bit of scripting, but we choose to ship the initial package
+# without man pages and defer this to a later effort.
+
+
+%install
+%pyproject_install
+%pyproject_save_files uv
 
-%install -a
 if [ '%{python3_sitearch}' != '%{python3_sitelib}' ]
 then
   # Maturin is really designed to build compiled Python extensions, but (when
@@ -578,10 +633,9 @@ then
   # library is actually pure-Python, and the python3-uv subpackage can be
   # noarch. We can’t tell maturin to install to the appropriate site-packages
   # directory, but we can fix the installation path manually.
-  install --directory %{buildroot}%{python3_sitelib}
+  install -d %{buildroot}%{python3_sitelib}
   mv %{buildroot}%{python3_sitearch}/uv* %{buildroot}%{python3_sitelib}
-  sed --regexp-extended --in-place \
-      's@%{python3_sitearch}@%{python3_sitelib}@' %{pyproject_files}
+  sed -r -i 's@%{python3_sitearch}@%{python3_sitelib}@' %{pyproject_files}
 fi
 
 # generate and install shell completions
@@ -597,11 +651,10 @@ do
 done
 
 # Install a default system-wide configuration file
-install -D --preserve-timestamps --mode=0644 \
-    --target='%{buildroot}%{_sysconfdir}/uv' '%{SOURCE1}'
+install -t '%{buildroot}%{_sysconfdir}/uv' -p -m 0644 -D '%{SOURCE1}'
 
 
-%check -a
+%check
 %if %{with check}
 # These tests rely on debug assertions, and fail when tests are compiled in
 # release mode:
@@ -612,122 +665,56 @@ skip="${skip-} --skip keyring::tests::fetch_url_with_empty_username"
 skip="${skip-} --skip keyring::tests::fetch_url_with_no_username"
 skip="${skip-} --skip keyring::tests::fetch_url_with_password"
 
-%if %{without other_python_versions}
-# These tests require specific Python interpreter versions, which upstream
-# normally downloads, precompiled, into the build area.
-skip="${skip-} --skip version::self_version"
-skip="${skip-} --skip version::self_version_json"
-skip="${skip-} --skip version::self_version_short"
-%endif
-
-%ifnarch %{x86_64} %{arm64}
-# On other architectures, the list of available downloads differs, e.g. pypy
-# and graalpy downloads may be missing.
-skip="${skip-} --skip python_list::python_list_downloads"
-# Similarly, version numbers may not match exactly.
-skip="${skip-} --skip python_list::python_list_with_mirrors"
-%endif
-%ifarch %{power64}
-# The error message lacks the expected hint:
-#   hint: A managed Python download is available for PyPy, but Python downloads
-#   are set to 'never'
-# This might be worth reporting upstream, but is not a serious issue.
-skip="${skip-} --skip python_pin::python_pin_resolve"
-%endif
-%ifarch riscv64
-# These expect managed interpreters of the form
-# cpython-3.##-linux-riscv64gc-any, but crates/uv-python/download-metadata.json
-# only has them for cpython-3.##-linux-riscv64-gnu. It’s not weird to find
-# holes in the managed interpreter support matrix for less common
-# architectures.
-skip="${skip-} --skip python_find::python_find"
-skip="${skip-} --skip python_list::python_list"
-skip="${skip-} --skip python_pin::python_pin_resolve"
-%endif
-
-# It’s not clear what causes the trivial discrepancy, but we find that this
-# fails when building in qemu-user-static emulated chroots.
-#    4       │-  Caused by: Failed to query Python interpreter at `[TEMP_DIR]/bar`
-#    5       │-  Caused by: [PERMISSION DENIED]
-#          4 │+  Caused by: Querying Python at `[TEMP_DIR]/bar` failed with
-#                exit status exit status: 127
-skip="${skip-} --skip python_find::python_find_path"
-
-# Test registry_client::tests::test_redirect_to_server_with_credentials is
-# flaky
-# https://github.com/astral-sh/uv/issues/16447
-skip="${skip-} --skip registry_client::tests::test_redirect_to_server_with_credentials"
-
-# This requires specific Python interpreter versions (so it would be grouped
-# with the conditionalized integration tests above), but it also requires
-# network access to PyPI, so it must be skipped either way until it can be
-# appropriately conditionalized upstream; see
-# https://github.com/astral-sh/uv/pull/13699#issuecomment-2916115588.
+# These tests require specific Python interpreter versions (down to patch
+# release number), which upstream normally downloads, precompiled, into the
+# build area; they might also require network access.
+# -p uv-client --test it:
 skip="${skip-} --skip remote_metadata::remote_metadata_with_and_without_cache"
 
-# Upstream is trying to ensure platform-independent byte-for-byte deterministic
-# wheels. This isn’t quite working out. It would be nice to understand this,
-# but this kind of reproducibility can be brittle, and there are many possible
-# innocuous reasons behind it.
-# ---- tests::built_by_uv_building stdout ----
+# This snapshot test fails due to a trivial difference in error message text
+# between url 2.5.2 and 2.5.3. The meaning of the message is the same. See
+# https://github.com/astral-sh/uv/commit/9368268e494cbf05374165f25cdf1e9f6d2cceb9.
+# We can stop skipping this test once the rust-url package is updated to 2.5.3,
+# https://bugzilla.redhat.com/show_bug.cgi?id=2323618.
+#
+# ---- metadata::requires_dist::test::invalid_url stdout ----
 # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Snapshot Summary ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-# Snapshot: built_by_uv_building-4
-# Source: crates/uv-build-backend/src/lib.rs:652
+# Snapshot: invalid_url
+# Source: crates/uv-distribution/src/metadata/requires_dist.rs:460
 # ────────────────────────────────────────────────────────────────────────────────
-# Expression: format!("{:x}", sha2::Sha256::digest(fs_err::read(&wheel_path).unwrap()))
+# Expression: format_err(input).await
 # ────────────────────────────────────────────────────────────────────────────────
 # -old snapshot
 # +new results
 # ────────────┬───────────────────────────────────────────────────────────────────
-#     1       │-319afb04e87caf894b1362b508ec745253c6d241423ea59021694d2015e821da
-#           1 │+007327b23085c5debf31fb44df7a2294b5882aefdba960bdd68fab665db12c5a
+#     0     0 │ error: TOML parse error at line 8, column 16
+#     1     1 │   |
+#     2     2 │ 8 | tqdm = { url = "§invalid#+#*Ä" }
+#     3     3 │   |                ^^^^^^^^^^^^^^^^^
+#     4       │-relative URL without a base: "§invalid#+#*Ä"
+#           4 │+invalid value: string "§invalid#+#*Ä", expected relative URL without a base
 # ────────────┴───────────────────────────────────────────────────────────────────
-skip="${skip-} --skip tests::built_by_uv_building"
+skip="${skip-} --skip metadata::requires_dist::test::invalid_url"
 
-# The list of HTTP status codes contains 103, but the expected list from the
-# snapshot doesn’t. This seems like a trivial discrepancy, probably due to a
-# dependency version differing from Cargo.lock.
-skip="${skip-} --skip base_client::tests::retried_status_codes"
-
-# Harmless and trivial discrepancies in error messages:
-#     8       │-  Caused by: error decoding response body for url (http://[LOCALHOST]/tqdm/)
-#           8 │+  Caused by: error decoding response body
-skip="${skip-} --skip network::retry_read_timeout_index"
-#     9       │-  Caused by: error decoding response body for url (http://[LOCALHOST]/)
-#           9 │+  Caused by: error decoding response body
-skip="${skip-} --skip network::retry_read_timeout_python_downloads_json"
-
-# These fail flakily: most frequently on ppc64le, but this seems to be just a
-# matter of luck, since we suspect a race condition. We have also seen failures
-# on aarch64. This is probably a race involving the SSL_CERT_FILE environment
-# variable, which process-isolated testing in “cargo nextest” (used by
-# upstream) should avoid. That suggests there is nothing to report upstream.
-# When this fails, the error looks something like:
-#   Error: failed to build HTTP client
-#   Caused by:
-#       0: certificate in `/tmp/uv/tests/certs/.tmpFF0lkk/ca.pem` (from
-#          `SSL_CERT_FILE`) could not be used as a trust anchor on certificate
-#          `CN=uv-test-ca, O=Astral Software Inc.`
-#       1: ExtensionValueInvalid
-skip="${skip-} --skip user_agent_version::test_user_agent_has_linehaul"
-skip="${skip-} --skip user_agent_version::test_user_agent_has_subcommand"
-skip="${skip-} --skip user_agent_version::test_user_agent_has_version"
-# Similarly, with an error like:
-#   Client::new(): reqwest::Error {
-#     kind: Builder,
-#     source: General("No CA certificates were loaded from the system")
-#   }
-# There are probably more of these.
-skip="${skip-} --skip retry::tests::retried_status_codes"
+%if %[ %{defined fc41} || %{defined fc40} || %{defined el10} || %{defined el9} ]
+# Trivial difference in snapshots: packages appear in a different order.
+skip="${skip-} --skip lock::tests::missing_dependency_source_unambiguous"
+skip="${skip-} --skip lock::tests::missing_dependency_version_dynamic"
+skip="${skip-} --skip lock::tests::missing_dependency_source_version_unambiguous"
+skip="${skip-} --skip lock::tests::missing_dependency_version_unambiguous"
+%endif
 
 %cargo_test -- -- --exact ${skip-}
 %endif
 
+%pyproject_check_import
+
 
 %files
 %license LICENSE-APACHE LICENSE-MIT LICENSE.dependencies LICENSE.bundled/
 %doc CHANGELOG.md
 %doc README.md
+%doc PIP_COMPATIBILITY.md
 
 %{_bindir}/uv
 # Equivalent to “uv tool run”: