[frgfm]

Summary

A local composite action reads [tool.uv].required-version and installs its lowest compatible uv version. All workflows use it. The dependency checker keeps the Docker image tags aligned with the same lower bound.

The project requires >=0.13.4,<1.0.0. The lockfile updates certifi to 2026.10.19.

Why

Astral's uv advisory says versions before 0.13.4 include the affected emSign root. Certifi published a related advisory. Neither advisory has a CVE. This PR uses certifi 2026.10.19.

Test plan

• make deps-check passed. It checks the lockfile and dependency synchronization.
• Application tests were not run. This PR changes dependency and CI setup.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.56%. Comparing base (9f4c75f) to head (a27e794).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #721      +/-   ##
==========================================
+ Coverage   94.48%   94.56%   +0.08%     
==========================================
  Files          59       59              
  Lines        3246     3241       -5     
==========================================
- Hits         3067     3065       -2     
+ Misses        179      176       -3     

Flag	Coverage Δ
backend	94.71% <ø> (+0.08%)	⬆️
client	91.30% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[MateoLostanlen]

Hi @frgfm, heads up on a side effect of this PR.

The new required-version = ">=0.13.4,<1.0.0" in pyproject.toml breaks Dependabot. Dependabot runs its own uv (0.12.18) and refuses to work when the project requires a newer one. The uv update run on Oct 21 failed with tool_version_not_supported on every package, so we no longer get any Python dependency updates, including security fixes.

Our CI stays green because the composite action installs uv 0.13.4 itself, so this is easy to miss.

Was this expected? If not, could you propose a fix? One option is to drop required-version and pin uv 0.13.4 directly in .github/actions/setup-uv/action.yml (Dockerfiles are already on 0.13.4, and verify_deps_sync.py already checks they match), but you may see a better way.

[frgfm]

Yep, I know about the Dependabot update, but it's still ongoing, and we do need to fix CVE to the patch version, so we can't wait for Dependabot to catch up. I'm aware of this, and I've done it on other repositories. So yeah, I should have stated that I knew about this and this was acceptable. Considering the magnitude of the events of yesterday, it's very likely that Dependabot will support the updated version of UV anytime soon, and if they don't before this, they would provide unsecure updates. So I'd be careful in the meantime 😅

[MateoLostanlen]

OK, thanks for your feedback! Dependabot has resumed, so it should be fine.