From c93b60c492317f5a84f36a9cf5ee29608fc2713e Mon Sep 17 00:00:00 2001 From: Eric Charles Date: Sun, 1 Nov 2026 09:49:23 +0100 Subject: [PATCH] 1.11.2: uv 0.13.6, past GHSA-hq85-5cpj-mr62 --- code_sandboxes/__version__.py | 2 +- code_sandboxes/environments/adapters/datalayer.py | 2 +- code_sandboxes/environments/adapters/e2b.py | 2 +- code_sandboxes/environments/adapters/modal.py | 2 +- code_sandboxes/environments/resolve.py | 2 +- tests/test_environment_datalayer_builder.py | 4 ++-- tests/test_environment_resolve.py | 6 +++--- 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/code_sandboxes/__version__.py b/code_sandboxes/__version__.py index c3fa782..e9139df 100644 --- a/code_sandboxes/__version__.py +++ b/code_sandboxes/__version__.py @@ -1 +1 @@ -__version__ = "1.11.1" +__version__ = "1.11.2" diff --git a/code_sandboxes/environments/adapters/datalayer.py b/code_sandboxes/environments/adapters/datalayer.py index 73a14a8..430930b 100644 --- a/code_sandboxes/environments/adapters/datalayer.py +++ b/code_sandboxes/environments/adapters/datalayer.py @@ -228,7 +228,7 @@ def _contract_layer(request: BuildRequest) -> list[str]: "RUN chmod 0755 /opt/datalayer /opt/datalayer/bin /opt/datalayer/bin/tini " "/opt/datalayer/bin/datalayer-sandbox /opt/datalayer/constraints " "/opt/datalayer/wheelhouse /usr/local/sbin/start-jupyter.sh", - 'RUN python3 -m pip install --no-cache-dir "uv==0.12.11"', + 'RUN python3 -m pip install --no-cache-dir "uv==0.13.6"', ] diff --git a/code_sandboxes/environments/adapters/e2b.py b/code_sandboxes/environments/adapters/e2b.py index 90057cb..a367451 100644 --- a/code_sandboxes/environments/adapters/e2b.py +++ b/code_sandboxes/environments/adapters/e2b.py @@ -158,7 +158,7 @@ CODE_INTERPRETER_BASE_TEMPLATE = "code-interpreter-v1" #: `uv`, pinned the same way E1-04/E3-04's bootstrap installs it. -_UV_VERSION = "0.12.11" +_UV_VERSION = "0.13.6" _DOCTOR_PATH = "/opt/datalayer/bin/datalayer-sandbox" _WHEELHOUSE_PATH = "/opt/datalayer/wheelhouse" diff --git a/code_sandboxes/environments/adapters/modal.py b/code_sandboxes/environments/adapters/modal.py index bfbb86b..c62c7f7 100644 --- a/code_sandboxes/environments/adapters/modal.py +++ b/code_sandboxes/environments/adapters/modal.py @@ -193,7 +193,7 @@ def modal_gpu(accelerator_type: str, count: int = 1) -> str | None: #: `uv`, pinned the same way every other builder's bootstrap is (E1-04/E3-04). -_UV_VERSION = "0.12.11" +_UV_VERSION = "0.13.6" _LOCK_PATH = "/opt/datalayer/lock.txt" _CONTENT_DIR = "/home/datalayer" diff --git a/code_sandboxes/environments/resolve.py b/code_sandboxes/environments/resolve.py index 36fae2c..08167b6 100644 --- a/code_sandboxes/environments/resolve.py +++ b/code_sandboxes/environments/resolve.py @@ -816,7 +816,7 @@ def dockerfile(self, request: ResolveRequest) -> str: "RUN python3 -c 'import sys; print(\"%d.%d\" % sys.version_info[:2])' " "> /solve/python-version", "COPY wheelhouse/ ./wheelhouse/", - 'RUN python3 -m pip install --no-cache-dir "uv==0.12.11"', + 'RUN python3 -m pip install --no-cache-dir "uv==0.13.6"', ] lines += [ "COPY requirements.in constraints.txt ./", diff --git a/tests/test_environment_datalayer_builder.py b/tests/test_environment_datalayer_builder.py index 3074b71..d717f84 100644 --- a/tests/test_environment_datalayer_builder.py +++ b/tests/test_environment_datalayer_builder.py @@ -405,13 +405,13 @@ def test_an_imported_image_bootstraps_uv_from_the_approved_bases_wheelhouse(self ) dockerfile = a_builder().dockerfile(request) assert f"COPY --from={CONTRACT_BASE} /opt/datalayer/wheelhouse/" in dockerfile - assert 'RUN python3 -m pip install --no-cache-dir "uv==0.12.11"' in dockerfile + assert 'RUN python3 -m pip install --no-cache-dir "uv==0.13.6"' in dockerfile assert "--find-links /opt/datalayer/wheelhouse " in dockerfile def test_a_packages_source_never_copies_a_wheelhouse_in(self) -> None: dockerfile = a_builder().dockerfile(a_request()) assert "COPY wheelhouse/" not in dockerfile - assert "uv==0.12.11" not in dockerfile + assert "uv==0.13.6" not in dockerfile assert "--find-links /opt/datalayer/wheelhouse " in dockerfile def test_it_ends_by_running_the_contracts_own_check(self) -> None: diff --git a/tests/test_environment_resolve.py b/tests/test_environment_resolve.py index 2e172b5..18f0512 100644 --- a/tests/test_environment_resolve.py +++ b/tests/test_environment_resolve.py @@ -5,7 +5,7 @@ """Resolution: one lock, Datalayer's pins over the user's, and uv's refusals read (E1-04). The refusals below are **recorded**: each one is what `uv pip compile` -(0.12.11) actually wrote for that input, box drawing and wrapping included, so +(0.13.6) actually wrote for that input, box drawing and wrapping included, so the parser is tested against the resolver's own words rather than against a paraphrase of them that cannot go out of date. """ @@ -1191,7 +1191,7 @@ def test_an_imported_image_bootstraps_uv_from_its_own_wheelhouse(self) -> None: bootstrap_uv=True, ) ) - assert 'RUN python3 -m pip install --no-cache-dir "uv==0.12.11"' in dockerfile + assert 'RUN python3 -m pip install --no-cache-dir "uv==0.13.6"' in dockerfile assert "COPY wheelhouse/ ./wheelhouse/" in dockerfile assert "--find-links /solve/wheelhouse" in dockerfile assert "/opt/datalayer/wheelhouse" not in dockerfile @@ -1211,7 +1211,7 @@ def test_an_approved_base_never_copies_a_wheelhouse_in(self) -> None: ) ) assert "wheelhouse/ ./wheelhouse/" not in dockerfile - assert "uv==0.12.11" not in dockerfile + assert "uv==0.13.6" not in dockerfile def test_the_solve_copies_the_wheelhouse_into_the_build_context_when_asked( self, monkeypatch