fix(uv): upgrade default uv to 0.13.5 (#4329) uv versions prior to 0.13.4 bundle the compromised emSign ECC Root CA - G3 root certificate in webpki-root-certs (GHSA-hq85-5cpj-mr62). Upgrade the default uv version and configured versions in examples and integration tests to 0.13.5, which removes the compromised root certificate and rejects certificate chains containing compromised eMudhra intermediate keys. Work towards #4299
diff --git a/MODULE.bazel b/MODULE.bazel index 3be1187..8e7e9b6 100644 --- a/MODULE.bazel +++ b/MODULE.bazel
@@ -456,7 +456,7 @@ uv.default( base_url = "https://github.com/astral-sh/uv/releases/download", manifest_filename = "dist-manifest.json", - version = "0.13.1", + version = "0.13.5", ) uv.default( compatible_with = [ @@ -524,7 +524,7 @@ dev_dependency = True, ) uv_dev.configure( - version = "0.13.1", + version = "0.13.5", ) flag_alias(
diff --git a/examples/bzlmod/MODULE.bazel b/examples/bzlmod/MODULE.bazel index d3d452a..2537764 100644 --- a/examples/bzlmod/MODULE.bazel +++ b/examples/bzlmod/MODULE.bazel
@@ -122,7 +122,7 @@ # module is used elsewhere. dev_dependency = True, ) -uv.configure(version = "0.6.2") +uv.configure(version = "0.13.5") # This extension allows a user to create modifications to how rules_python # creates different wheel repositories. Different attributes allow the user
diff --git a/gazelle/examples/bzlmod_build_file_generation/MODULE.bazel b/gazelle/examples/bzlmod_build_file_generation/MODULE.bazel index f048a7c..c1da34d 100644 --- a/gazelle/examples/bzlmod_build_file_generation/MODULE.bazel +++ b/gazelle/examples/bzlmod_build_file_generation/MODULE.bazel
@@ -89,4 +89,4 @@ "uv", dev_dependency = True, ) -uv.configure(version = "0.6.2") +uv.configure(version = "0.13.5")
diff --git a/news/4299.changed.md b/news/4299.changed.md new file mode 100644 index 0000000..49b9bf6 --- /dev/null +++ b/news/4299.changed.md
@@ -0,0 +1,3 @@ +(uv) Updated the default `uv` version to `0.13.5` to address +[GHSA-hq85-5cpj-mr62](https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62) +([#4299](https://github.com/bazel-contrib/rules_python/issues/4299)).
diff --git a/python/uv/private/uv.bzl b/python/uv/private/uv.bzl index 969b6f6..e9772ff 100644 --- a/python/uv/private/uv.bzl +++ b/python/uv/private/uv.bzl
@@ -36,7 +36,7 @@ # your module is used elsewhere. dev_dependency = True, ) -uv.configure(version = "0.5.24") +uv.configure(version = "0.13.5") ``` Since this is only for locking the requirements files, it should be always
diff --git a/tests/integration/bzlmod_lockfile/MODULE.bazel.lock b/tests/integration/bzlmod_lockfile/MODULE.bazel.lock index b3480a5..ce43056 100644 --- a/tests/integration/bzlmod_lockfile/MODULE.bazel.lock +++ b/tests/integration/bzlmod_lockfile/MODULE.bazel.lock
@@ -259,8 +259,8 @@ }, "@@rules_python+//python/uv:uv.bzl%uv": { "general": { - "bzlTransitiveDigest": "RZzpW71MGg3nl4bIIcWyM4+Su8RXUOhZKcuM+S0boQU=", - "usagesDigest": "4oeBVCEzXt49RrVnpRaNDbydAxQ9Yw+5jX6Xm82siGM=", + "bzlTransitiveDigest": "ftw8bFfcFDRCGiiWG42Oac7rJYWWcYAqsP4rkMPfpnI=", + "usagesDigest": "UgEeJTkNLce2eABymcbLBebdHpF0D8qrT6A6PSESotA=", "recordedInputs": [ "REPO_MAPPING:rules_python+,bazel_tools bazel_tools", "REPO_MAPPING:rules_python+,platforms platforms" @@ -399,8 +399,8 @@ "https://files.pythonhosted.org/packages/b9/fa/123043af240e49752f1c4bd24da5053b6bd00cad78c2be53c0d1e8b975bc/backports.tarfile-1.2.0-py3-none-any.whl": "sha256:77e284d754527b01fb1e6fa8a1afe577858ebe4e9dad8919e34c862cb399bc34" }, "certifi": { - "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl": "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", - "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz": "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55" + "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz": "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", + "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl": "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b" }, "cffi": { "https://files.pythonhosted.org/packages/01/9a/11f687cb39d6a3504060d5242f04f48c735afb4d3d533958a20594890cb2/cffi-2.1.1-cp313-cp313-win_arm64.whl": "sha256:63bbfd5ded17c4840ac07cd8f1c21ba9d9708141f840b324f422f41b207e3973", @@ -784,8 +784,8 @@ "https://files.pythonhosted.org/packages/d6/54/cfe61301667036ec958cb99bd3efefba235e65cdeb9c84d24a8293ba1d90/mdurl-0.1.2.tar.gz": "sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba" }, "more-itertools": { - "https://files.pythonhosted.org/packages/de/1d/f4da6f02cdffe04d6362210b807146a26044c88d839208aec273bb0d9184/more_itertools-11.1.0.tar.gz": "sha256:48e8f4d9e7e5878571ecf6f2b4e57634f93cd474cc8cfbd2376f2d11b396e30d", - "https://files.pythonhosted.org/packages/e8/3d/1087453384dbde46a8c7f9356eead2c58be8a7bf156bca40243377c85715/more_itertools-11.1.0-py3-none-any.whl": "sha256:4b65538ae22f6fed0ce4874efd317463a7489796a0939fa66824dd542125a192" + "https://files.pythonhosted.org/packages/52/b8/c63995bebbb9ac9c059350e0fb8c82c2420c85aeca7d34e40aecf3df9281/more_itertools-11.2.1.tar.gz": "sha256:cbf08fd0af284dc69718b9b76a8e6203df624d70209ea511e4219d350c856f63", + "https://files.pythonhosted.org/packages/5d/57/3c4b1c6f2e0cc29ba023802458ea3d2a996f87085559e4a5f2192d549532/more_itertools-11.2.1-py3-none-any.whl": "sha256:35a7377edd1dd6608dcb2cdf534ded55ea32d49448875ad042cd3f879fb1ded0" }, "nh3": { "https://files.pythonhosted.org/packages/00/0c/1a8985fd43fea5530c0ac890b6f0b423770ee72f111b70b7a77f2dec243a/nh3-0.3.7-cp38-abi3-musllinux_1_2_aarch64.whl": "sha256:d56e76bd3cadb09b6b0cef364850811663734b348a25f5f587a2819c495367bd",
diff --git a/tests/integration/uv_lock/MODULE.bazel b/tests/integration/uv_lock/MODULE.bazel index 982144b..de44afb 100644 --- a/tests/integration/uv_lock/MODULE.bazel +++ b/tests/integration/uv_lock/MODULE.bazel
@@ -12,7 +12,7 @@ python.toolchain(python_version = "3.13") uv = use_extension("@rules_python//python/uv:uv.bzl", "uv") -uv.configure(version = "0.13.1") +uv.configure(version = "0.13.5") use_repo(uv, "uv") register_toolchains("@uv//:all")