## Summary

With `PreviewFeature::TargetWorkspaceDiscovery` enabled, `uv run` was
parsing both the current directory’s project and the target script’s
project. Parsing configuration from the current directory is undesirable
in this case, and might fail with an error if the current directory is
inaccessible.

- Fixes #18687.
- Followup to #17423.

## Test Plan

- See #18687.

---------

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
Co-authored-by: Charlie Marsh <charlie.r.marsh@gmail.com>

## Summary

A follow-up to #17890 to avoid some unwraps by separating pending from
ready commands.

…8645)

With -q, suppress informational messages but still show when an update
actually happens. With -qq, suppress all output.

Closes #18412

## Summary

Adds `stderr_important()` to `Printer` which is only suppressed with
`-qq` (silent), not `-q` (quiet). Uses this for the update success
message in `uv self update` so cron users can run with `-q` and only
get notified when an update actually occurs.

## Test Plan

A set of new tests.

---------

Co-authored-by: Tomasz (Tom) Kramkowski <tom@astral.sh>

To narrow in the location for
#18663, which currently has a too
generic error.

Moves from a crates.io API key to trusted publishing.

Setup of trusted publishing is automated via a script which creates the
trust relationship and disables publish by API key. The main breakage
here is that now, when we add a new crate, a release will fail. The
script is invoked during `release.sh` to catch this case and supports
creating a stub crate so the release can subsequently succeed — but this
will require the release author to have a local crates.io API key with
permissions to create projects and configure publishing. I tested this
script a few times end-to-end, but would not be surprised if it bites us
in the future.

## Summary

I've made `uv audit`'s approach to handling extras and groups
(explicitly) subtractive: we don't support flags like `--dev` (since `uv
audit` audits everything by default); instead, we only support flags
like `--no-dev`, `--no-group`, etc., that remove items from the
to-be-audited set.

To accomplish that, I've abstracted the filtering into a new
`Lock::packages_for_audit` API (maybe there's a better location for
it?). Implementation wise, it does a BFS similar to the one used in `uv
tree`. I _think_ there's some room/opportunity for DRYing there but I
wanted to keep the PR small/local 🙂

See #18506.

## Test Plan

None yet.

---------

Signed-off-by: William Woodruff <william@astral.sh>
Co-authored-by: konsti <konstin@mailbox.org>

Currently, axoupdater is using a plain reqwest client, not using uv's
TLS settings.

The warning is recently showing up a lot.

See astral-sh/ty#3147

…18731)

Automated update for Python releases.

Co-authored-by: zanieb <2586601+zanieb@users.noreply.github.com>