chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
ghcr.io/astral-sh/uv	stage	patch	0.11.6 → 0.11.7

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.11.7

Compare Source

Released on 2026-04-15.

Python

• Upgrade CPython build to 2026041 including an OpenSSL security upgrade (#​19004)

Enhancements

• Elevate configuration errors to required-version mismatches (#​18977)
• Further improve TLS certificate validation messages (#​18933)
• Improve --exclude-newer hints (#​18952)

Preview features

• Fix --script handling in uv audit (#​18970)
• Fix traversal of extras in uv audit (#​18970)

Bug fixes

• De-quote workspace metadata in linehaul data (#​18966)
• Avoid installing tool workspace member dependencies as editable (#​18891)
• Emit JSON report for uv sync --check failures (#​18976)
• Filter and warn on invalid TLS certificates (#​18951)
• Fix equality comparisons for version specifiers with ~= operators (#​18960)
• Fix stale Python upgrade preview feature check in project environment construction (#​18961)
• Improve Windows path normalization (#​18945)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	1.49s
✅ DOCKERFILE	hadolint	1		0	0	0.22s
✅ EDITORCONFIG	editorconfig-checker	1		0	0	0.01s
⚠️ REPOSITORY	checkov	yes		no	1	22.91s
✅ REPOSITORY	gitleaks	yes		no	no	0.46s
✅ REPOSITORY	git_diff	yes		no	no	0.0s
✅ REPOSITORY	grype	yes		no	no	43.24s
⚠️ REPOSITORY	kics	yes		no	1	4.64s
✅ REPOSITORY	secretlint	yes		no	no	1.61s
✅ REPOSITORY	semgrep	yes		no	no	24.84s
✅ REPOSITORY	syft	yes		no	no	2.3s
✅ REPOSITORY	trivy	yes		no	no	13.11s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.14s
✅ REPOSITORY	trufflehog	yes		no	no	4.65s

Detailed Issues

⚠️ REPOSITORY / checkov - 1 warning

error: Ensure the base image uses a non latest version tag
  ┌─ Dockerfile:9:1
  │
9 │ FROM ${BASE_IMAGE} AS base
  │ ^^^^^^^^^^^^^^^^^^^^^^^^^^
  │
  = Ensure the base image uses a non latest version tag
  = Ensure the base image uses a non latest version tag

error: Ensure that sudo isn't used
   ┌─ Dockerfile:40:1
   │  
40 │ ╭ RUN useradd --create-home libraries && usermod --lock libraries && \
41 │ │     # Warning: the created user has root permissions inside the container
42 │ │     # Warning: you still need to start the ssh process with `sudo service ssh start`
43 │ │     if ! id -u ubuntu; then useradd --create-home --shell /bin/bash --groups sudo ubuntu; fi
   │ ╰────────────────────────────────────────────────────────────────────────────────────────────^
   │  
   = Ensure that sudo isn't used
   = Ensure that sudo isn't used

error: Ensure that sudo isn't used
   ┌─ Dockerfile:56:1
   │  
56 │ ╭ RUN apt-get update && \
57 │ │     apt-get install --yes --no-install-recommends \
58 │ │     # minimal
59 │ │     bash \
   · │
75 │ │     git \
76 │ │     && rm -rf /var/lib/apt/lists/*
   │ ╰──────────────────────────────────^
   │  
   = Ensure that sudo isn't used
   = Ensure that sudo isn't used

warning: Ensure that a user for the container has been created
    ┌─ Dockerfile:1:1
    │  
  1 │ ╭ # hadolint global ignore=DL3008
  2 │ │ # kics-scan disable=fd54f200-402c-4333-a5a4-36ef6709af2f,965a08d7-ef86-4f14-8792-4a3b2098937e
  3 │ │ # checkov:skip=CKV_DOCKER_3
  4 │ │ ARG BASE_IMAGE=public.ecr.aws/ubuntu/ubuntu:24.04@sha256:748740465d0aadaa69ab6e6c295892f17d7a8f44a85090dbb571ec0bb8c5674f
    · │
111 │ │ 
112 │ │ HEALTHCHECK CMD ["uv", "pip", "list"]
    │ ╰─────────────────────────────────────^
    │  
    = Ensure that a user for the container has been created
    = Ensure that a user for the container has been created

warning: 1 warnings emitted
error: 3 errors emitted

⚠️ REPOSITORY / kics - 1 warning

warning: RUN instruction uv venv "/databricks/python3" --seed &&     uv pip install --no-cache-dir --requirements requirements.txt pyspark=="4.0.0" &&     uv pip uninstall pyspark &&     uv pip list does not use package pinning form
   ┌─ Dockerfile:94:1
   │
94 │ FROM base AS build
   │ ^^^^^^^^^^^^^^^^^^
   │
   = Unpinned Package Version in Pip Install
   = Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes

warning: 1 warnings emitted

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

Show us your support by starring ⭐ the repository