## Summary

Prior to this change, `uv cache clean <package>` treated every resolved
cache reference as an archive entry. On Unix, an unexpected symlink in a
wheel or source-distribution cache bucket could therefore cause
package-specific cleanup to remove a directory outside the cache after
deleting the symlink.

This PR restricts post-cleanup archive garbage collection to canonical
targets beneath `archive-v0`. It preserves normal archive cleanup and
adds integration coverage that confirms an in-cache archive is removed
while an external symlink target is preserved.

Follow-up to #19543.

Released on 2026-06-10.

### Enhancements

- Add `--emit-index-url` and `--emit-find-links` to `uv export`
([#18370](#18370))
- Add `--find-links` support for `uv pip list`
([#16103](#16103))
- Group executable install errors during `uv python install`
([#19691](#19691))
- Use ICF in macOS release builds to reduce binary sizes
([#19615](#19615))

### Preview features

- Add initial hidden `uv upgrade` command
([#19678](#19678))
- Reject Git revisions in `uv upgrade`
([#19742](#19742))

### Configuration

- Recognize `UV_NO_INSTALL_PROJECT`, `UV_NO_INSTALL_WORKSPACE`,
`UV_NO_INSTALL_LOCAL`
([#19323](#19323))

### Performance

- Speed up discovery of large workspaces
([#18311](#18311))

### Bug fixes

- Allow unknown preview flags with a warning again
([#19669](#19669))
- Apply dependency exclusions to direct requirements
([#19699](#19699))
- Avoid following external symlinks during cache clean
([#19682](#19682))
- Avoid following symlinks during cache prune
([#19543](#19543))
- Fix Git cache keys for worktrees and packed refs
([#19706](#19706))
- Make resolver error handling iterative to avoid stack overflows
([#19695](#19695))
- Pass `VIRTUAL_ENV` through `cygpath` inside `fish` on Windows
([#19703](#19703))
- Rebuild explicit local directory tool installs
([#19591](#19591))
- Validate egg top-level entries as identifiers
([#19679](#19679))

### Documentation

- Document `--find-links` caching behavior
([#19585](#19585))
- Add a small section for malware checks
([#19680](#19680))

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.11.19` → `0.11.20` |

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.11.20`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01120)

Released on 2026-06-10.

##### Enhancements

- Add `--emit-index-url` and `--emit-find-links` to `uv export` ([#&#8203;18370](astral-sh/uv#18370))
- Add `--find-links` support for `uv pip list` ([#&#8203;16103](astral-sh/uv#16103))
- Group executable install errors during `uv python install` ([#&#8203;19691](astral-sh/uv#19691))
- Use ICF in macOS release builds to reduce binary sizes ([#&#8203;19615](astral-sh/uv#19615))

##### Preview features

- Add initial hidden `uv upgrade` command ([#&#8203;19678](astral-sh/uv#19678))
- Reject Git revisions in `uv upgrade` ([#&#8203;19742](astral-sh/uv#19742))

##### Configuration

- Recognize `UV_NO_INSTALL_PROJECT`, `UV_NO_INSTALL_WORKSPACE`, `UV_NO_INSTALL_LOCAL` ([#&#8203;19323](astral-sh/uv#19323))

##### Performance

- Speed up discovery of large workspaces ([#&#8203;18311](astral-sh/uv#18311))

##### Bug fixes

- Allow unknown preview flags with a warning again ([#&#8203;19669](astral-sh/uv#19669))
- Apply dependency exclusions to direct requirements ([#&#8203;19699](astral-sh/uv#19699))
- Avoid following external symlinks during cache clean ([#&#8203;19682](astral-sh/uv#19682))
- Avoid following symlinks during cache prune ([#&#8203;19543](astral-sh/uv#19543))
- Fix Git cache keys for worktrees and packed refs ([#&#8203;19706](astral-sh/uv#19706))
- Make resolver error handling iterative to avoid stack overflows ([#&#8203;19695](astral-sh/uv#19695))
- Pass `VIRTUAL_ENV` through `cygpath` inside `fish` on Windows ([#&#8203;19703](astral-sh/uv#19703))
- Rebuild explicit local directory tool installs ([#&#8203;19591](astral-sh/uv#19591))
- Validate egg top-level entries as identifiers ([#&#8203;19679](astral-sh/uv#19679))

##### Documentation

- Document `--find-links` caching behavior ([#&#8203;19585](astral-sh/uv#19585))
- Add a small section for malware checks ([#&#8203;19680](astral-sh/uv#19680))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIyMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: Renovate Bot <renovate@bhamm-lab.com>
Reviewed-on: https://codeberg.org/blake-hamm/bhamm-lab/pulls/186