Repository navigation
Update uv to 0.13.4 - #967
Merged
Merged
Conversation
Member
Bump uv 0.12.23 -> 0.13.4 (clears GHSA-hq85-5cpj-mr62) and keep the CVE-2026-111943 lock pin. 0.13.4's own Cargo.lock already has webpki-root-certs 1.0.10 but still locks rustls-webpki 0.103.14 (RUSTSEC-2026-0382 needs >= 0.103.16), so the lock patch is regenerated against the pristine 0.13.4 lock and now moves only rustls-webpki (version + checksum). The `patch` build dep and the fail-closed build.sh guard stay. Supersedes the bot PR #962, which dropped the patch Local and the `patch` dep from a stale pre-#953 recipe snapshot while build.sh still applied it (pkgmgr fix: gominimal/pkgmgr-rs#1030). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Closed
Contributor
|
Warning Review limit reached
This review includes 2 billable files and costs up to $0.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 40 minutes for your next included review. View limit details
Comment |
norrietaylor
approved these changes
Oct 22, 2026
Member
There was a problem hiding this comment.
LGTM. Thanks for redoing #962 by hand and keeping the webpki lock pin.
- The sha256 matches the staging copy.
- The lock patch applies cleanly to the pristine lock, and rustls-webpki 0.103.16's checksum matches crates.io.
- uv 0.13.4 needs Rust ≥1.97 and we have 1.99.0.
- None of 0.13's breaking changes affect our builds (Python 3.15 default download, constraint-file handling, tar-codec, cache format), and it clears GHSA-hq85-5cpj-mr62.
- The only dependents are diffoscope and httpie, and neither actually invokes uv.
Pre-existing gaps for a follow-up, not this PR:
build.sh:9lacks the--remap-path-prefixflags AGENTS.md requires.uvxisn't shipped.build.ncl:49declares theuvbinary asOutputLibrather thanOutputBin.
Generated by Claude Code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update uv
0.12.23→0.13.4Replaces the bot PR #962. That PR dropped the CVE-2026-111943 lock-patch
| Localand thepatchbuild dep, while build.sh still ranpatch -Np1 -i ../cve-2026-111943-webpki-lock.patch, so the build failed with./build.sh: line 14: patch: command not found. The cause was a stale pre-#953 recipe snapshot in the runner, fixed in gominimal/pkgmgr-rs#1030.Source:
github:astral-sh/uv. Release: https://github.com/astral-sh/uv/releases/tag/0.13.4. Clears GHSA-hq85-5cpj-mr62 (HIGH, fixed in>=0.13.4).0.12.230.13.4662023e7…182d66815490dbb497b456a6fde93c7e66ae7f27a50a2065b3b5a06fbb3a20bdgs://minimal-staging-archives/uv-0.12.23.tar.gzgs://minimal-staging-archives/uv-0.13.4.tar.gz(already mirrored by the updater at 05:38Z; I re-downloaded it and the sha256 matches)CVE-2026-111943 lock pin: kept, regenerated
uv 0.13.4's own
Cargo.lock:^1.18cve-2026-111943-webpki-lock.patchwas regenerated against the pristine 0.13.4 lock. It is now one hunk: rustls-webpki0.103.14→0.103.16plus its checksum. The webpki-root-certs hunk is gone because upstream already ships 1.0.10.cargo update -p rustls-webpki --precise 0.103.16output verbatim. With cargo 1.97 that command also re-resolveswindows-sys 0.52.0 → 0.60.2in 9 unrelated entries. I kept the delta lock-only, as SECURITY: uv, prek, tealdeer, nickel, nickel-lsp, tuicr, biome, teamtype, probe-rs, sccache, railway: lock rustls-webpki 0.103.16 + webpki-roots 1.0.10 (CVE-2026-111943) #953 did.patchstays inbuild_deps. build.sh is unchanged: the apply line and both fail-closed guards (0.103.16 present; no pre-fix 0.103.x / 1.0.x left) remain.Verified locally (resolution only, no compile)
patch -Np1) to the pristineuv-0.13.4/Cargo.locktaken from the mirrored tarball. That lock is byte-identical to the one at upstream tag0.13.4.cargo metadata --lockedon the patched 0.13.4 tree resolves without rewriting the lock (rustls-webpki 0.103.16).Not verified locally: the build itself. That needs the buildbot run on this PR.
🤖 Generated with Claude Code