From cd52dcba14f8dc5f5b59bbc9919326923d3c3898 Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Thu, 22 Oct 2026 22:10:40 -0700 Subject: [PATCH] fix(uv): upgrade default uv to 0.13.5 uv versions prior to 0.13.4 bundle the compromised emSign ECC Root CA - G3 root certificate in webpki-root-certs (GHSA-hq85-5cpj-mr62). Upgrade the default uv version and configured versions in examples and integration tests to 0.13.5, which removes the compromised root certificate and rejects certificate chains containing compromised eMudhra intermediate keys. Work towards #4299 --- MODULE.bazel | 4 ++-- examples/bzlmod/MODULE.bazel | 2 +- .../bzlmod_build_file_generation/MODULE.bazel | 2 +- news/4299.changed.md | 3 +++ python/uv/private/uv.bzl | 2 +- tests/integration/bzlmod_lockfile/MODULE.bazel.lock | 12 ++++++------ tests/integration/uv_lock/MODULE.bazel | 2 +- 7 files changed, 15 insertions(+), 12 deletions(-) create mode 100644 news/4299.changed.md diff --git a/MODULE.bazel b/MODULE.bazel index 3be1187056..8e7e9b649e 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -456,7 +456,7 @@ uv = use_extension("//python/uv:uv.bzl", "uv") uv.default( base_url = "https://github.com/astral-sh/uv/releases/download", manifest_filename = "dist-manifest.json", - version = "0.13.1", + version = "0.13.5", ) uv.default( compatible_with = [ @@ -524,7 +524,7 @@ uv_dev = use_extension( dev_dependency = True, ) uv_dev.configure( - version = "0.13.1", + version = "0.13.5", ) flag_alias( diff --git a/examples/bzlmod/MODULE.bazel b/examples/bzlmod/MODULE.bazel index d3d452ab42..253776426e 100644 --- a/examples/bzlmod/MODULE.bazel +++ b/examples/bzlmod/MODULE.bazel @@ -122,7 +122,7 @@ uv = use_extension( # module is used elsewhere. dev_dependency = True, ) -uv.configure(version = "0.6.2") +uv.configure(version = "0.13.5") # This extension allows a user to create modifications to how rules_python # creates different wheel repositories. Different attributes allow the user diff --git a/gazelle/examples/bzlmod_build_file_generation/MODULE.bazel b/gazelle/examples/bzlmod_build_file_generation/MODULE.bazel index f048a7cf6a..c1da34d473 100644 --- a/gazelle/examples/bzlmod_build_file_generation/MODULE.bazel +++ b/gazelle/examples/bzlmod_build_file_generation/MODULE.bazel @@ -89,4 +89,4 @@ uv = use_extension( "uv", dev_dependency = True, ) -uv.configure(version = "0.6.2") +uv.configure(version = "0.13.5") diff --git a/news/4299.changed.md b/news/4299.changed.md new file mode 100644 index 0000000000..49b9bf6b68 --- /dev/null +++ b/news/4299.changed.md @@ -0,0 +1,3 @@ +(uv) Updated the default `uv` version to `0.13.5` to address +[GHSA-hq85-5cpj-mr62](https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62) +([#4299](https://github.com/bazel-contrib/rules_python/issues/4299)). diff --git a/python/uv/private/uv.bzl b/python/uv/private/uv.bzl index 969b6f672d..e9772ffcd2 100644 --- a/python/uv/private/uv.bzl +++ b/python/uv/private/uv.bzl @@ -36,7 +36,7 @@ uv = use_extension( # your module is used elsewhere. dev_dependency = True, ) -uv.configure(version = "0.5.24") +uv.configure(version = "0.13.5") ``` Since this is only for locking the requirements files, it should be always diff --git a/tests/integration/bzlmod_lockfile/MODULE.bazel.lock b/tests/integration/bzlmod_lockfile/MODULE.bazel.lock index b3480a57bf..ce430569b8 100644 --- a/tests/integration/bzlmod_lockfile/MODULE.bazel.lock +++ b/tests/integration/bzlmod_lockfile/MODULE.bazel.lock @@ -259,8 +259,8 @@ }, "@@rules_python+//python/uv:uv.bzl%uv": { "general": { - "bzlTransitiveDigest": "RZzpW71MGg3nl4bIIcWyM4+Su8RXUOhZKcuM+S0boQU=", - "usagesDigest": "4oeBVCEzXt49RrVnpRaNDbydAxQ9Yw+5jX6Xm82siGM=", + "bzlTransitiveDigest": "ftw8bFfcFDRCGiiWG42Oac7rJYWWcYAqsP4rkMPfpnI=", + "usagesDigest": "UgEeJTkNLce2eABymcbLBebdHpF0D8qrT6A6PSESotA=", "recordedInputs": [ "REPO_MAPPING:rules_python+,bazel_tools bazel_tools", "REPO_MAPPING:rules_python+,platforms platforms" @@ -399,8 +399,8 @@ "https://files.pythonhosted.org/packages/b9/fa/123043af240e49752f1c4bd24da5053b6bd00cad78c2be53c0d1e8b975bc/backports.tarfile-1.2.0-py3-none-any.whl": "sha256:77e284d754527b01fb1e6fa8a1afe577858ebe4e9dad8919e34c862cb399bc34" }, "certifi": { - "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl": "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", - "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz": "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55" + "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz": "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", + "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl": "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b" }, "cffi": { "https://files.pythonhosted.org/packages/01/9a/11f687cb39d6a3504060d5242f04f48c735afb4d3d533958a20594890cb2/cffi-2.1.1-cp313-cp313-win_arm64.whl": "sha256:63bbfd5ded17c4840ac07cd8f1c21ba9d9708141f840b324f422f41b207e3973", @@ -784,8 +784,8 @@ "https://files.pythonhosted.org/packages/d6/54/cfe61301667036ec958cb99bd3efefba235e65cdeb9c84d24a8293ba1d90/mdurl-0.1.2.tar.gz": "sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba" }, "more-itertools": { - "https://files.pythonhosted.org/packages/de/1d/f4da6f02cdffe04d6362210b807146a26044c88d839208aec273bb0d9184/more_itertools-11.1.0.tar.gz": "sha256:48e8f4d9e7e5878571ecf6f2b4e57634f93cd474cc8cfbd2376f2d11b396e30d", - "https://files.pythonhosted.org/packages/e8/3d/1087453384dbde46a8c7f9356eead2c58be8a7bf156bca40243377c85715/more_itertools-11.1.0-py3-none-any.whl": "sha256:4b65538ae22f6fed0ce4874efd317463a7489796a0939fa66824dd542125a192" + "https://files.pythonhosted.org/packages/52/b8/c63995bebbb9ac9c059350e0fb8c82c2420c85aeca7d34e40aecf3df9281/more_itertools-11.2.1.tar.gz": "sha256:cbf08fd0af284dc69718b9b76a8e6203df624d70209ea511e4219d350c856f63", + "https://files.pythonhosted.org/packages/5d/57/3c4b1c6f2e0cc29ba023802458ea3d2a996f87085559e4a5f2192d549532/more_itertools-11.2.1-py3-none-any.whl": "sha256:35a7377edd1dd6608dcb2cdf534ded55ea32d49448875ad042cd3f879fb1ded0" }, "nh3": { "https://files.pythonhosted.org/packages/00/0c/1a8985fd43fea5530c0ac890b6f0b423770ee72f111b70b7a77f2dec243a/nh3-0.3.7-cp38-abi3-musllinux_1_2_aarch64.whl": "sha256:d56e76bd3cadb09b6b0cef364850811663734b348a25f5f587a2819c495367bd", diff --git a/tests/integration/uv_lock/MODULE.bazel b/tests/integration/uv_lock/MODULE.bazel index 982144bfc2..de44afb7f3 100644 --- a/tests/integration/uv_lock/MODULE.bazel +++ b/tests/integration/uv_lock/MODULE.bazel @@ -12,7 +12,7 @@ python = use_extension("@rules_python//python/extensions:python.bzl", "python") python.toolchain(python_version = "3.13") uv = use_extension("@rules_python//python/uv:uv.bzl", "uv") -uv.configure(version = "0.13.1") +uv.configure(version = "0.13.5") use_repo(uv, "uv") register_toolchains("@uv//:all")