From 2969fe4e662a6d29d33c8ff44099368eb041fee4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Wirtel?= <stephane@wirtel.be>
Date: Sat, 31 Oct 2026 23:37:16 +0100
Subject: [PATCH] chore(dev): require uv >= 0.13.6

uv < 0.13.4 bundles a root CA whose intermediate has been compromised
(GHSA-hq85-5cpj-mr62). Bump every uv pin to 0.13.6 (mise, Dockerfile,
uv-pre-commit hook, dev dependency lower bound) and set
[tool.uv] required-version so older uv binaries refuse to run on the
project, in CI (setup-uv reads it) and on developer machines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .pre-commit-config.yaml | 2 +-
 Dockerfile              | 2 +-
 mise.toml               | 2 +-
 pyproject.toml          | 4 +++-
 uv.lock                 | 4 ++--
 5 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c8bdd67..0494347 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -40,7 +40,7 @@ repos:
   # Keeps uv.lock in sync with pyproject.toml. The rev tracks the uv version
   # pinned in mise.toml and the dev dependency group (Renovate "uv" group).
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.12.19
+    rev: 0.13.6
     hooks:
       - id: uv-lock
 
diff --git a/Dockerfile b/Dockerfile
index 3f07089..123b58b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 # ---- builder: install Python deps into an isolated venv via uv ----
 FROM python:3.13-slim AS builder
 
-COPY --from=ghcr.io/astral-sh/uv:0.12.19 /uv /uvx /usr/local/bin/
+COPY --from=ghcr.io/astral-sh/uv:0.13.6 /uv /uvx /usr/local/bin/
 
 ENV UV_LINK_MODE=copy \
     UV_PROJECT_ENVIRONMENT=/opt/venv \
diff --git a/mise.toml b/mise.toml
index 389e5f8..60bdc7d 100644
--- a/mise.toml
+++ b/mise.toml
@@ -2,4 +2,4 @@
 prek = "0.5.3"
 python = "3.13"
 task = "3.53.1"
-uv = "0.12.19"
+uv = "0.13.6"
diff --git a/pyproject.toml b/pyproject.toml
index bd82add..8caf225 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -40,12 +40,14 @@ dev = [
     "pip-audit>=2.10.1",
     "pipdeptree>=4.2.5",
     "ruff==0.16.9", # pinned: ruff minor releases change the default lint rule set
-    "uv>=0.12.19",
+    "uv>=0.13.6",
     "wagtail-factories>=4.5.0",
 ]
 
 [tool.uv]
 package = false
+# Refuse uv releases older than the GHSA-hq85-5cpj-mr62 fix (compromised CA).
+required-version = ">=0.13.6"
 
 [tool.ruff]
 target-version = "py313"
diff --git a/uv.lock b/uv.lock
index e4c67bc..0786cb0 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 5
 requires-python = "==3.13.*"
 resolution-markers = [
     "sys_platform == 'win32'",
@@ -1224,7 +1224,7 @@ dev = [
     { name = "pip-audit", specifier = ">=2.10.1" },
     { name = "pipdeptree", specifier = ">=4.2.5" },
     { name = "ruff", specifier = "==0.16.9" },
-    { name = "uv", specifier = ">=0.12.19" },
+    { name = "uv", specifier = ">=0.13.6" },
     { name = "wagtail-factories", specifier = ">=4.5.0" },
 ]