[vvillait88]

Summary

Maintenance sweep for 2026-10-22. Nothing here ships, so no release.

• ty: 0.0.89 to 0.0.90. This is the only dependency uv lock --upgrade moved.
• astral-sh/setup-uv: v10.3.0 to v10.3.2.
• uv version input: 0.13.1 to 0.13.5, the latest uv release. Dependabot cannot see this pin because it is an action input.
• pypa/gh-action-pypi-publish: v1.14.2 to v1.14.3.

Two of these are security fixes, so this should merge before the next tag publish:

• uv 0.13.4 and later: fixes GHSA-hq85-5cpj-mr62, which removes the compromised emSign roots.
• pypi-publish 1.14.3: fixes GHSA-5xjx-3w67-w9x9 (critical), a CA problem in the Sigstore chain that Trusted Publishing relies on.

Worked with Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged. Nothing in the published package changes, so this does not bump the version or cut a release.

Test plan

• Ran uv sync --frozen --all-extras --all-groups, then these, all passing:
  • ruff check and ruff format --check
  • ty check
  • vulture
  • pytest (172 passed, 2 skipped)
• osv-scanner on uv.lock: no issues found.

Checklist

• Tests cover the new behavior, and the suite passes locally (no new behavior; the existing suite passes)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review: no blocking findings

Read at head cfa8a03. Probes and numbers below.

Each pin is upstream's latest

• astral-sh/setup-uv: releases/latest is v10.3.2 (2026-10-22), and the newest tag is also v10.3.2. Sorting the matching v1* refs by version ends v10.3.0, v10.3.1, v10.3.2. The two sources agree.
• uv: releases/latest is 0.13.5 (2026-10-22), and it is also the newest tag. The CI log for ci, test (3.12) and test (3.15) reads Successfully installed uv version 0.13.5.
• pypa/gh-action-pypi-publish: releases/latest is v1.14.3 (2026-10-20), and it is also the newest tag.
• ty: 0.0.90 is PyPI's current version.
• Every setup-uv use (ci x2, publish, security) and every version: input moved. No 0.13.1 or v10.3.0 is left in .github/.

Release notes, no breaking changes

• setup-uv v10.3.1 and v10.3.2: a cache-warning fix, npm signature verification, and checksum updates.
• uv 0.13.2 to 0.13.5: enhancements, performance, bug fixes and security only.
  • 0.13.4 fixes GHSA-hq85-5cpj-mr62 (the emSign root).
  • 0.13.5 rejects chains containing the compromised eMudhra intermediate keys and ships CPython 3.15.1, 3.14.9 and 3.13.17.
  • 0.13.5 also changes how uv export handles optional dependencies. The pip-audit job uses uv export, and it is green.
• ty 0.0.90: bug fixes and inference changes. ty check passes in CI.
• pypi-publish v1.14.3: fixes GHSA-5xjx-3w67-w9x9. The advisory API reports it as critical, titled "Revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI". It also turns on hash-checking for the action's own dependencies. No inputs changed.

Lock diff is ty only. All 38 changed lines in uv.lock are the ty version, its sdist and its 17 wheels. With local uv 0.13.5, uv lock --check passes and uv lock --upgrade --dry-run reports No lockfile changes detected, so nothing was held back. No a, b or rc versions are in the lock.

certifi floor intact. pyproject.toml still requires certifi>=2026.10.19 with its comment. The lock specifier is >=2026.10.19 and it resolves 2026.10.19, which is PyPI's latest.

CI. gh pr checks 112 shows 13 rows, all pass, exit 0. All three required checks (ci, Dependency Scan, Python Audit) are present and green.

osv-scanner 2.7.0

• Head uv.lock: 24 packages, no issues.
• Base uv.lock: 24 packages, no issues.
• This repo has no osv-scanner.toml, so no ignores apply.
• Positive control (an npm lock with lodash 4.17.15) reports 6 vulnerabilities, so the scanner was reaching the database.

No version bump and no release is correct. The build backend is hatchling from [build-system], not the uv CLI, and the only lock change is a dev tool. The wheel and sdist would be identical to v2.8.1.

Non-blocking: say why the security fixes matter. The body lists the pypi-publish and uv bumps as routine. They carry the two advisories above, and the pypi-publish one concerns the Trusted Publishing chain the next tag publish will use. One line in the summary naming GHSA-5xjx-3w67-w9x9 and GHSA-hq85-5cpj-mr62 would show readers this should merge before the next release tag.

[vvillait88]

Body updated: it now names the uv and pypi-publish security fixes and that this merges before the next tag publish.