[sentry-junior]

Moves uv from 0.12.10 to 0.13.4 for VULN-3216. uv 0.13.4 updates its bundled Mozilla root certificates (webpki-root-certs 1.0.10), which drops the compromised eMudhra CA roots. This PR replaces #126477, which only went to 0.12.23.

Changed: pins only. No lockfile or dependency changes.

• setup-uv version: '0.12.10' → '0.13.4' in .github/actions/setup-sentry/action.yml, .github/workflows/backend.yml (twice), bump-version.yml, development-environment.yml (twice), pre-commit.yml, react-to-product-owners-yml-changes.yml and self-hosted.yml
• self-hosted/Dockerfile: pip install --index-url https://pypi.devinfra.sentry.io/simple 'uv==0.12.10' → 'uv==0.13.4'

Verified locally:

• uv lock --check passes with both 0.12.10 and 0.13.4; uv.lock is unchanged.
• uv export --only-dev --no-hashes --no-annotate --no-header, which react-to-product-owners-yml-changes.yml uses, produces identical output under 0.12.10 and 0.13.4.
• pip install --index-url https://pypi.devinfra.sentry.io/simple 'uv==0.13.4' succeeds in a container.
• actionlint reports no findings on the changed workflows, before or after the change, and every changed YAML file parses.

Not verified: the self-hosted image build and CI.

The 0.13.0 breaking changes (Python 3.15 becomes the default download, --require-hashes in included constraints files, a stricter tar backend) don't affect the uv sync --frozen --active, uv pip install and uv export usage here.

Rollout: the self-hosted image, and any GoCD agent/server or other image that pins uv, only gets the fix once it is rebuilt and rolled out.

via Geoff Goldsmith.

--

View Junior Session [Sentry]

[linear-code]

VULN-3216

[sentry]

Sentry Snapshot Testing

Name	Added	Removed	Changed	Renamed	Unchanged	Skipped	Status
sentry-frontend sentry-frontend	0	0	0	0	726	0	✅ Unchanged

⚙️ sentry-frontend Snapshot Settings