diff --git a/.github/workflows/auto_release_internal.yml b/.github/workflows/auto_release_internal.yml index 1735f86d510..26e279b94e8 100644 --- a/.github/workflows/auto_release_internal.yml +++ b/.github/workflows/auto_release_internal.yml @@ -43,8 +43,8 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.6" + python-version: "3.14.10" - id: detect env: DISPATCH_PACKAGE: ${{ inputs.package }} diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 94b64679209..1da15979415 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -79,8 +79,8 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.6" + python-version: "3.14.10" # The heading guard runs even for skip-changelog PRs: that label only # waives the news-fragment requirement, not the publish-trigger guard. # diff --git a/.github/workflows/dispatch_release.yml b/.github/workflows/dispatch_release.yml index 65f3826c84c..e11adc81957 100644 --- a/.github/workflows/dispatch_release.yml +++ b/.github/workflows/dispatch_release.yml @@ -182,8 +182,8 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.6" + python-version: "3.14.10" - name: Plan versions id: plan env: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 36807ad2865..b359754b209 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -104,8 +104,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.6" + python-version: "3.14.10" - name: Validate against changelog, branch rules and existing tags id: prepare @@ -134,8 +134,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.6" + python-version: "3.14.10" - name: Pin lockstep siblings to exact versions env: @@ -211,8 +211,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.6" + python-version: "3.14.10" # One artifact per build job — a platform matrix uploads one per leg — # merged into a single dist/. The `--` in the pattern is what keeps a @@ -373,8 +373,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.6" + python-version: "3.14.10" enable-cache: "false" ignore-empty-workdir: "true" @@ -415,8 +415,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.6" + python-version: "3.14.10" # The same artifact the approval covered: the release notes and the # checksum manifest of exactly what was uploaded. diff --git a/.github/workflows/release_from_changelog.yml b/.github/workflows/release_from_changelog.yml index 51d1c7e70ae..ff30292144c 100644 --- a/.github/workflows/release_from_changelog.yml +++ b/.github/workflows/release_from_changelog.yml @@ -58,8 +58,8 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.6" + python-version: "3.14.10" - id: detect env: REF_NAME: ${{ github.ref_name }} diff --git a/packages/reflex-release/README.md b/packages/reflex-release/README.md index 598ee26e594..59f0cba084e 100644 --- a/packages/reflex-release/README.md +++ b/packages/reflex-release/README.md @@ -86,8 +86,8 @@ cli-command = "uvx reflex-release@0.1.0" # this tool pins, so upgrading reflex-release moves them too — and `sync # --check` reports that as drift until you regenerate. Set either one to keep # your own cadence, or to "" to install whatever setup-uv defaults to. -uv-version = "0.12.5" -python-version = "3.14.7" +uv-version = "0.13.6" +python-version = "3.14.10" # Whether the release may be approved by the person who triggered it. True (the # default) keeps GitHub's own behavior: the environment's reviewer list decides diff --git a/packages/reflex-release/news/+python-uv-security-pins.misc.md b/packages/reflex-release/news/+python-uv-security-pins.misc.md new file mode 100644 index 00000000000..f37eef84693 --- /dev/null +++ b/packages/reflex-release/news/+python-uv-security-pins.misc.md @@ -0,0 +1 @@ +Generated release workflows now default to uv 0.13.6 and Python 3.14.10, which reject the compromised eMudhra intermediate CA certificates. diff --git a/packages/reflex-release/src/reflex_release/config.py b/packages/reflex-release/src/reflex_release/config.py index b1bf7205800..e8a9d720dd7 100644 --- a/packages/reflex-release/src/reflex_release/config.py +++ b/packages/reflex-release/src/reflex_release/config.py @@ -27,11 +27,11 @@ #: workflow drift the next ``sync --check`` reports — which is the point: the #: tool and the release path it generates move together. A repository that wants #: its own cadence sets ``uv-version``. -DEFAULT_UV_VERSION = "0.12.5" +DEFAULT_UV_VERSION = "0.13.6" #: The Python the generated workflows run uv with, pinned for the same reason. A #: repository whose packages cannot build on it sets ``python-version``. -DEFAULT_PYTHON_VERSION = "3.14.7" +DEFAULT_PYTHON_VERSION = "3.14.10" #: What ``uv-version`` and ``python-version`` may contain. Both are interpolated #: into a double-quoted YAML scalar in the generated workflows, so the allowed diff --git a/tests/units/reflex_release/test_scaffold.py b/tests/units/reflex_release/test_scaffold.py index 1b57896163f..2aab1cd4c9e 100644 --- a/tests/units/reflex_release/test_scaffold.py +++ b/tests/units/reflex_release/test_scaffold.py @@ -148,7 +148,7 @@ def test_render_pins_uv_and_python(config: Config) -> None: @pytest.mark.parametrize( ("body", "expected", "absent"), [ - ('uv-version = "9.9.9"', ' version: "9.9.9"', "0.12.5"), + ('uv-version = "9.9.9"', ' version: "9.9.9"', DEFAULT_UV_VERSION), ('python-version = "3.11"', ' python-version: "3.11"', "3.14"), ('uv-version = ""', ' python-version: "', ' version: "'), ],