8000 Update uv to 0.13.4 by gominimal-pkgmgr-mgr[bot] · Pull Request #962 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

Update uv to 0.13.4 - #962

Closed
gominimal-pkgmgr-mgr[bot] wants to merge 1 commit into
mainfrom
update-uv-0.13.4
Closed

Update uv to 0.13.4#962
gominimal-pkgmgr-mgr[bot] wants to merge 1 commit into
mainfrom
update-uv-0.13.4

Conversation

@gominimal-pkgmgr-mgr
@gominimal-pkgmgr-mgr gominimal-pkgmgr-mgr Bot commented Oct 21, 2026
Copy link
Copy Markdown
Contributor

Update uv 0.12.23 → 0.13.4

Source: github:astral-sh/uv
Release: https://github.com/astral-sh/uv/releases/tag/0.13.4
Changelog: astral-sh/uv@0.12.23...0.13.4
Released: 14 hours ago (2026-10-20)

Pkgscan: clean — diff against the prior version surfaced no newly-introduced suspicious patterns.

Vulnerability impact

Partition analysis at 0.13.4 (uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):

  • 1 cleared — the new version is outside the advisory's affected range, OR the tag's lineage includes a known fix-commit. These will drop off the next scan.

Vulnerabilities fixed (1)

This update clears 1 vulnerabilities affecting 0.12.23:

CVE / GHSA Severity Fixed in
GHSA-hq85-5cpj-mr62 HIGH >=0.13.4

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
Component Old New
~ uv 0.12.23 0.13.4
~ uv-upstream 0.12.23 0.13.4

Changes

Old New
Version 0.12.23 0.13.4
SHA256 662023e7453d40c2... 182d66815490dbb4...
Size 8.8 MB 8.9 MB
Source gs://minimal-staging-archives/uv-0.12.23.tar.gz gs://minimal-staging-archives/uv-0.13.4.tar.gz
  • License: MIT OR Apache-2.0 (source: GitHub + tarball)

Quality suggestions

  • Missing tests block. This package has no standalone tests, so the buildbot will only verify compilation — not functional correctness. Consider adding a minimal smoke test (e.g., a --version or small round-trip invocation) as part of this PR so future bumps catch regressions. See packages/python/build.ncl for a simple example.

Created by pkgmgr

@gominimal-pkgmgr-mgr
gominimal-pkgmgr-mgr Bot requested a review from a team as a code owner October 21, 2026 05:38
@gominimal-pkgmgr-mgr gominimal-pkgmgr-mgr Bot added the auto-update Opened autonomously by pkgmgr auto-update label Oct 21, 2026
@coderabbitai
coderabbitai Bot commented Oct 21, 2026
Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 7c7b5a31-6065-48de-a6b0-f99c699aa555

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@bryan-minimal bryan-minimal mentioned this pull request Oct 21, 2026
Merged
@bryan-minimal
bryan-minimal commented Oct 21, 2026
Copy link
Copy Markdown
Member

Superseded by #967. Closing this bot PR.

This PR's build.ncl came from a stale pre-#953 snapshot. The runner (execution pkgmgr-runner-8x2z4) discovered packages at about 05:3x, before it fast-forwarded pkgs to origin/main at 05:37:55, and #953 had merged at 05:18:58. The rewrite therefore reverted #953's cve-2026-111943-webpki-lock.patch Local and the patch dep, while build.sh, read fresh from disk, still applied the patch, so the build failed with patch: command not found. Dropping the patch was also wrong on the merits: uv 0.13.4's own lock still has rustls-webpki 0.103.14, below the 0.103.16 floor.

#967 keeps the pin, regenerated for 0.13.4's lock (rustls-webpki only). The updater fix is gominimal/pkgmgr-rs#1030: it syncs before discovery, refuses stale snapshots, aborts if build.sh applies a patch build.ncl no longer declares, and checks lockfile security floors.

🤖 Generated with Claude Code
8000

github-merge-queue Bot pushed a commit that referenced this pull request Oct 22, 2026
@bryan-minimal @claude
Update uv to 0.13.4 (#967)
34f4090 
Bump uv 0.12.23 -> 0.13.4 (clears GHSA-hq85-5cpj-mr62) and keep the
CVE-2026-111943 lock pin. 0.13.4's own Cargo.lock already has
webpki-root-certs 1.0.10 but still locks rustls-webpki 0.103.14
(RUSTSEC-2026-0382 needs >= 0.103.16), so the lock patch is regenerated
against the pristine 0.13.4 lock and now moves only rustls-webpki
(version + checksum). The `patch` build dep and the fail-closed build.sh
guard stay. Supersedes the bot PR #962, which dropped the patch Local and the
`patch` dep from a stale pre-#953 recipe snapshot while build.sh still
applied it (pkgmgr fix: gominimal/pkgmgr-rs#1030).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

auto-update Opened autonomously by pkgmgr auto-update

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bryan-minimal
0