Repository navigation
chore(deps): Bump uv to 0.12.23 and install self-hosted deps from uv.lock alone - #126477
Closed
sentry-junior[bot] wants to merge 1 commit into
Closed
sentry-junior[bot] wants to merge 1 commit into
sentry-junior[bot] wants to merge 1 commit into
Conversation
…lock alone Co-Authored-By: Joshua Li <14209781+joshuarli@users.noreply.github.com>
github-actions
Bot
added
the
Scope: Backend
Contributor
Author
|
Superseded by #128348, which bumps uv to 0.13.4 (the patched release for VULN-3216). Closing this 0.12.23 draft in its favor. |
joshuarli
pushed a commit
that referenced
this pull request
Oct 21, 2026
Moves uv from 0.12.10 to 0.13.4 for [VULN-3216](https://linear.app/getsentry/issue/VULN-3216/emudhra-ca-compromise). uv 0.13.4 updates its bundled Mozilla root certificates (`webpki-root-certs` 1.0.10), which drops the compromised eMudhra CA roots. This PR replaces #126477, which only went to 0.12.23. Changed: pins only. No lockfile or dependency changes. - setup-uv `version: '0.12.10'` → `'0.13.4'` in `.github/actions/setup-sentry/action.yml`, `.github/workflows/backend.yml` (twice), `bump-version.yml`, `development-environment.yml` (twice), `pre-commit.yml`, `react-to-product-owners-yml-changes.yml` and `self-hosted.yml` - `self-hosted/Dockerfile`: `pip install --index-url https://pypi.devinfra.sentry.io/simple 'uv==0.12.10'` → `'uv==0.13.4'` Verified locally: - `uv lock --check` passes with both 0.12.10 and 0.13.4; `uv.lock` is unchanged. - `uv export --only-dev --no-hashes --no-annotate --no-header`, which `react-to-product-owners-yml-changes.yml` uses, produces identical output under 0.12.10 and 0.13.4. - `pip install --index-url https://pypi.devinfra.sentry.io/simple 'uv==0.13.4'` succeeds in a container. - `actionlint` reports no findings on the changed workflows, before or after the change, and every changed YAML file parses. Not verified: the self-hosted image build and CI. The 0.13.0 breaking changes (Python 3.15 becomes the default download, `--require-hashes` in included constraints files, a stricter tar backend) don't affect the `uv sync --frozen --active`, `uv pip install` and `uv export` usage here. **Rollout:** the self-hosted image, and any GoCD agent/server or other image that pins uv, only gets the fix once it is rebuilt and rolled out. <!-- junior-request-attribution:start --> via **Geoff Goldsmith**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:agent%3A99375738fa14def2f3ee6f2418473ee8 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/agent%3A99375738fa14def2f3ee6f2418473ee8) [[Sentry]](https://sentry.sentry.io/explore/conversations/agent%3A99375738fa14def2f3ee6f2418473ee8/?project=4510944073809921) <!-- junior-session-footer:end --> Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Geoff Goldsmith <geoff.goldsmith@sentry.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps our pinned uv from 0.12.10 to 0.12.23 (the
astral-sh/setup-uvpins in CI plusself-hosted/Dockerfile), and switches the self-hosted dependency layer to install fromuv.lockalone.uv 0.12.23 can
uv sync --frozenwithout apyproject.tomlbehind thefrozen-lockfilepreview feature. The self-hosted image now only copiesuv.lockinto the dependency layer, sopyproject.tomledits that don't touch the lock no longer bust it.Lockfile-only sync requires lockfile revision 5+, so
uv.lockis rewritten by uv 0.12.23. Only therevisionline changes; no package versions move. The installed set is identical to the manifest-based sync (249 packages, same dev-group defaults).Depends on getsentry/pypi adding uv 0.12.23 to our index. getsentry will pick up the revision-5 lock via
bump_sentryfor its own image change. Refs DI-2520.via Joshua Li.
--
View Junior Session [Sentry]