From 86e1e011a5fa3fd9cd8258c3630215bc44b80fdb Mon Sep 17 00:00:00 2001 From: Farhan Date: Mon, 26 Oct 2026 20:29:56 +0000 Subject: [PATCH 1/2] Bump release workflow pins to uv 0.13.4 and Python 3.14.10 Both releases reject the compromised eMudhra intermediate CA certificates (CVE-2026-115557). The release workflows build and upload to PyPI, so they should not run on toolchains that still trust those keys. Regenerated the workflows with `reflex-release sync`. Claude-Session: https://claude.ai/code/session_01PQmXVHN8tSWmHPJgm9GFEe --- .github/workflows/auto_release_internal.yml | 4 ++-- .github/workflows/changelog.yml | 4 ++-- .github/workflows/dispatch_release.yml | 4 ++-- .github/workflows/publish.yml | 20 +++++++++---------- .github/workflows/release_from_changelog.yml | 4 ++-- packages/reflex-release/README.md | 4 ++-- .../news/+python-uv-security-pins.misc.md | 1 + .../src/reflex_release/config.py | 4 ++-- tests/units/reflex_release/test_scaffold.py | 2 +- 9 files changed, 24 insertions(+), 23 deletions(-) create mode 100644 packages/reflex-release/news/+python-uv-security-pins.misc.md diff --git a/.github/workflows/auto_release_internal.yml b/.github/workflows/auto_release_internal.yml index 1735f86d510..e746cf5ec3a 100644 --- a/.github/workflows/auto_release_internal.yml +++ b/.github/workflows/auto_release_internal.yml @@ -43,8 +43,8 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.4" + python-version: "3.14.10" - id: detect env: DISPATCH_PACKAGE: ${{ inputs.package }} diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 94b64679209..e53807da735 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -79,8 +79,8 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.4" + python-version: "3.14.10" # The heading guard runs even for skip-changelog PRs: that label only # waives the news-fragment requirement, not the publish-trigger guard. # diff --git a/.github/workflows/dispatch_release.yml b/.github/workflows/dispatch_release.yml index 65f3826c84c..8ecf7694ba5 100644 --- a/.github/workflows/dispatch_release.yml +++ b/.github/workflows/dispatch_release.yml @@ -182,8 +182,8 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.4" + python-version: "3.14.10" - name: Plan versions id: plan env: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 36807ad2865..1949753e06b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -104,8 +104,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.4" + python-version: "3.14.10" - name: Validate against changelog, branch rules and existing tags id: prepare @@ -134,8 +134,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.4" + python-version: "3.14.10" - name: Pin lockstep siblings to exact versions env: @@ -211,8 +211,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.4" + python-version: "3.14.10" # One artifact per build job — a platform matrix uploads one per leg — # merged into a single dist/. The `--` in the pattern is what keeps a @@ -373,8 +373,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.4" + python-version: "3.14.10" enable-cache: "false" ignore-empty-workdir: "true" @@ -415,8 +415,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.4" + python-version: "3.14.10" # The same artifact the approval covered: the release notes and the # checksum manifest of exactly what was uploaded. diff --git a/.github/workflows/release_from_changelog.yml b/.github/workflows/release_from_changelog.yml index 51d1c7e70ae..b60c2523b4a 100644 --- a/.github/workflows/release_from_changelog.yml +++ b/.github/workflows/release_from_changelog.yml @@ -58,8 +58,8 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.12.5" - python-version: "3.14.7" + version: "0.13.4" + python-version: "3.14.10" - id: detect env: REF_NAME: ${{ github.ref_name }} diff --git a/packages/reflex-release/README.md b/packages/reflex-release/README.md index 598ee26e594..89f4386cb56 100644 --- a/packages/reflex-release/README.md +++ b/packages/reflex-release/README.md @@ -86,8 +86,8 @@ cli-command = "uvx reflex-release@0.1.0" # this tool pins, so upgrading reflex-release moves them too — and `sync # --check` reports that as drift until you regenerate. Set either one to keep # your own cadence, or to "" to install whatever setup-uv defaults to. -uv-version = "0.12.5" -python-version = "3.14.7" +uv-version = "0.13.4" +python-version = "3.14.10" # Whether the release may be approved by the person who triggered it. True (the # default) keeps GitHub's own behavior: the environment's reviewer list decides diff --git a/packages/reflex-release/news/+python-uv-security-pins.misc.md b/packages/reflex-release/news/+python-uv-security-pins.misc.md new file mode 100644 index 00000000000..741da9d498b --- /dev/null +++ b/packages/reflex-release/news/+python-uv-security-pins.misc.md @@ -0,0 +1 @@ +Generated release workflows now default to uv 0.13.4 and Python 3.14.10, which reject the compromised eMudhra intermediate CA certificates. diff --git a/packages/reflex-release/src/reflex_release/config.py b/packages/reflex-release/src/reflex_release/config.py index b1bf7205800..ed1e204789f 100644 --- a/packages/reflex-release/src/reflex_release/config.py +++ b/packages/reflex-release/src/reflex_release/config.py @@ -27,11 +27,11 @@ #: workflow drift the next ``sync --check`` reports — which is the point: the #: tool and the release path it generates move together. A repository that wants #: its own cadence sets ``uv-version``. -DEFAULT_UV_VERSION = "0.12.5" +DEFAULT_UV_VERSION = "0.13.4" #: The Python the generated workflows run uv with, pinned for the same reason. A #: repository whose packages cannot build on it sets ``python-version``. -DEFAULT_PYTHON_VERSION = "3.14.7" +DEFAULT_PYTHON_VERSION = "3.14.10" #: What ``uv-version`` and ``python-version`` may contain. Both are interpolated #: into a double-quoted YAML scalar in the generated workflows, so the allowed diff --git a/tests/units/reflex_release/test_scaffold.py b/tests/units/reflex_release/test_scaffold.py index 1b57896163f..2aab1cd4c9e 100644 --- a/tests/units/reflex_release/test_scaffold.py +++ b/tests/units/reflex_release/test_scaffold.py @@ -148,7 +148,7 @@ def test_render_pins_uv_and_python(config: Config) -> None: @pytest.mark.parametrize( ("body", "expected", "absent"), [ - ('uv-version = "9.9.9"', ' version: "9.9.9"', "0.12.5"), + ('uv-version = "9.9.9"', ' version: "9.9.9"', DEFAULT_UV_VERSION), ('python-version = "3.11"', ' python-version: "3.11"', "3.14"), ('uv-version = ""', ' python-version: "', ' version: "'), ], From 2cbb2647caf221f68e8e825d1b5a0c54589eb9ab Mon Sep 17 00:00:00 2001 From: Farhan Date: Tue, 27 Oct 2026 23:33:18 +0500 Subject: [PATCH 2/2] Pin release workflows to uv 0.13.6 uv 0.13.4 cannot download Python 3.14.10; its embedded list stops at 3.14.8, so every generated workflow failed at its first uv command. 0.13.6 is the first uv that adds CPython 3.14.10, and it includes the 0.13.5 rustls-webpki update that rejects the compromised eMudhra intermediate keys. --- .github/workflows/auto_release_internal.yml | 2 +- .github/workflows/changelog.yml | 2 +- .github/workflows/dispatch_release.yml | 2 +- .github/workflows/publish.yml | 10 +++++----- .github/workflows/release_from_changelog.yml | 2 +- packages/reflex-release/README.md | 2 +- .../news/+python-uv-security-pins.misc.md | 2 +- packages/reflex-release/src/reflex_release/config.py | 2 +- 8 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/auto_release_internal.yml b/.github/workflows/auto_release_internal.yml index e746cf5ec3a..26e279b94e8 100644 --- a/.github/workflows/auto_release_internal.yml +++ b/.github/workflows/auto_release_internal.yml @@ -43,7 +43,7 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.13.4" + version: "0.13.6" python-version: "3.14.10" - id: detect env: diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index e53807da735..1da15979415 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -79,7 +79,7 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.13.4" + version: "0.13.6" python-version: "3.14.10" # The heading guard runs even for skip-changelog PRs: that label only # waives the news-fragment requirement, not the publish-trigger guard. diff --git a/.github/workflows/dispatch_release.yml b/.github/workflows/dispatch_release.yml index 8ecf7694ba5..e11adc81957 100644 --- a/.github/workflows/dispatch_release.yml +++ b/.github/workflows/dispatch_release.yml @@ -182,7 +182,7 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.13.4" + version: "0.13.6" python-version: "3.14.10" - name: Plan versions id: plan diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 1949753e06b..b359754b209 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -104,7 +104,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.13.4" + version: "0.13.6" python-version: "3.14.10" - name: Validate against changelog, branch rules and existing tags @@ -134,7 +134,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.13.4" + version: "0.13.6" python-version: "3.14.10" - name: Pin lockstep siblings to exact versions @@ -211,7 +211,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.13.4" + version: "0.13.6" python-version: "3.14.10" # One artifact per build job — a platform matrix uploads one per leg — @@ -373,7 +373,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.13.4" + version: "0.13.6" python-version: "3.14.10" enable-cache: "false" ignore-empty-workdir: "true" @@ -415,7 +415,7 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.13.4" + version: "0.13.6" python-version: "3.14.10" # The same artifact the approval covered: the release notes and the diff --git a/.github/workflows/release_from_changelog.yml b/.github/workflows/release_from_changelog.yml index b60c2523b4a..ff30292144c 100644 --- a/.github/workflows/release_from_changelog.yml +++ b/.github/workflows/release_from_changelog.yml @@ -58,7 +58,7 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: - version: "0.13.4" + version: "0.13.6" python-version: "3.14.10" - id: detect env: diff --git a/packages/reflex-release/README.md b/packages/reflex-release/README.md index 89f4386cb56..59f0cba084e 100644 --- a/packages/reflex-release/README.md +++ b/packages/reflex-release/README.md @@ -86,7 +86,7 @@ cli-command = "uvx reflex-release@0.1.0" # this tool pins, so upgrading reflex-release moves them too — and `sync # --check` reports that as drift until you regenerate. Set either one to keep # your own cadence, or to "" to install whatever setup-uv defaults to. -uv-version = "0.13.4" +uv-version = "0.13.6" python-version = "3.14.10" # Whether the release may be approved by the person who triggered it. True (the diff --git a/packages/reflex-release/news/+python-uv-security-pins.misc.md b/packages/reflex-release/news/+python-uv-security-pins.misc.md index 741da9d498b..f37eef84693 100644 --- a/packages/reflex-release/news/+python-uv-security-pins.misc.md +++ b/packages/reflex-release/news/+python-uv-security-pins.misc.md @@ -1 +1 @@ -Generated release workflows now default to uv 0.13.4 and Python 3.14.10, which reject the compromised eMudhra intermediate CA certificates. +Generated release workflows now default to uv 0.13.6 and Python 3.14.10, which reject the compromised eMudhra intermediate CA certificates. diff --git a/packages/reflex-release/src/reflex_release/config.py b/packages/reflex-release/src/reflex_release/config.py index ed1e204789f..e8a9d720dd7 100644 --- a/packages/reflex-release/src/reflex_release/config.py +++ b/packages/reflex-release/src/reflex_release/config.py @@ -27,7 +27,7 @@ #: workflow drift the next ``sync --check`` reports — which is the point: the #: tool and the release path it generates move together. A repository that wants #: its own cadence sets ``uv-version``. -DEFAULT_UV_VERSION = "0.13.4" +DEFAULT_UV_VERSION = "0.13.6" #: The Python the generated workflows run uv with, pinned for the same reason. A #: repository whose packages cannot build on it sets ``python-version``.