1.11.2: uv 0.13.6, past GHSA-hq85-5cpj-mr62

code_sandboxes/__version__.py

@@ -1 +1 @@
-__version__ = "1.11.1"
+__version__ = "1.11.2"

code_sandboxes/environments/adapters/datalayer.py

@@ -228,7 +228,7 @@ def _contract_layer(request: BuildRequest) -> list[str]:
         "RUN chmod 0755 /opt/datalayer /opt/datalayer/bin /opt/datalayer/bin/tini "
         "/opt/datalayer/bin/datalayer-sandbox /opt/datalayer/constraints "
         "/opt/datalayer/wheelhouse /usr/local/sbin/start-jupyter.sh",
-        'RUN python3 -m pip install --no-cache-dir "uv==0.12.11"',
+        'RUN python3 -m pip install --no-cache-dir "uv==0.13.6"',
     ]
 
 

code_sandboxes/environments/adapters/e2b.py

@@ -158,7 +158,7 @@
 CODE_INTERPRETER_BASE_TEMPLATE = "code-interpreter-v1"
 
 #: `uv`, pinned the same way E1-04/E3-04's bootstrap installs it.
-_UV_VERSION = "0.12.11"
+_UV_VERSION = "0.13.6"
 
 _DOCTOR_PATH = "/opt/datalayer/bin/datalayer-sandbox"
 _WHEELHOUSE_PATH = "/opt/datalayer/wheelhouse"

code_sandboxes/environments/adapters/modal.py

@@ -193,7 +193,7 @@ def modal_gpu(accelerator_type: str, count: int = 1) -> str | None:
 
 
 #: `uv`, pinned the same way every other builder's bootstrap is (E1-04/E3-04).
-_UV_VERSION = "0.12.11"
+_UV_VERSION = "0.13.6"
 
 _LOCK_PATH = "/opt/datalayer/lock.txt"
 _CONTENT_DIR = "/home/datalayer"

code_sandboxes/environments/resolve.py

@@ -816,7 +816,7 @@ def dockerfile(self, request: ResolveRequest) -> str:
                 "RUN python3 -c 'import sys; print(\"%d.%d\" % sys.version_info[:2])' "
                 "> /solve/python-version",
                 "COPY wheelhouse/ ./wheelhouse/",
-                'RUN python3 -m pip install --no-cache-dir "uv==0.12.11"',
+                'RUN python3 -m pip install --no-cache-dir "uv==0.13.6"',
             ]
         lines += [
             "COPY requirements.in constraints.txt ./",

tests/test_environment_datalayer_builder.py

@@ -405,13 +405,13 @@ def test_an_imported_image_bootstraps_uv_from_the_approved_bases_wheelhouse(self
         )
         dockerfile = a_builder().dockerfile(request)
         assert f"COPY --from={CONTRACT_BASE} /opt/datalayer/wheelhouse/" in dockerfile
-        assert 'RUN python3 -m pip install --no-cache-dir "uv==0.12.11"' in dockerfile
+        assert 'RUN python3 -m pip install --no-cache-dir "uv==0.13.6"' in dockerfile
         assert "--find-links /opt/datalayer/wheelhouse " in dockerfile
 
     def test_a_packages_source_never_copies_a_wheelhouse_in(self) -> None:
         dockerfile = a_builder().dockerfile(a_request())
         assert "COPY wheelhouse/" not in dockerfile
-        assert "uv==0.12.11" not in dockerfile
+        assert "uv==0.13.6" not in dockerfile
         assert "--find-links /opt/datalayer/wheelhouse " in dockerfile
 
     def test_it_ends_by_running_the_contracts_own_check(self) -> None:

tests/test_environment_resolve.py

@@ -5,7 +5,7 @@
 """Resolution: one lock, Datalayer's pins over the user's, and uv's refusals read (E1-04).
 
 The refusals below are **recorded**: each one is what `uv pip compile`
-(0.12.11) actually wrote for that input, box drawing and wrapping included, so
+(0.13.6) actually wrote for that input, box drawing and wrapping included, so
 the parser is tested against the resolver's own words rather than against a
 paraphrase of them that cannot go out of date.
 """
@@ -1191,7 +1191,7 @@ def test_an_imported_image_bootstraps_uv_from_its_own_wheelhouse(self) -> None:
                 bootstrap_uv=True,
             )
         )
-        assert 'RUN python3 -m pip install --no-cache-dir "uv==0.12.11"' in dockerfile
+        assert 'RUN python3 -m pip install --no-cache-dir "uv==0.13.6"' in dockerfile
         assert "COPY wheelhouse/ ./wheelhouse/" in dockerfile
         assert "--find-links /solve/wheelhouse" in dockerfile
         assert "/opt/datalayer/wheelhouse" not in dockerfile
@@ -1211,7 +1211,7 @@ def test_an_approved_base_never_copies_a_wheelhouse_in(self) -> None:
             )
         )
         assert "wheelhouse/ ./wheelhouse/" not in dockerfile
-        assert "uv==0.12.11" not in dockerfile
+        assert "uv==0.13.6" not in dockerfile
 
     def test_the_solve_copies_the_wheelhouse_into_the_build_context_when_asked(
         self, monkeypatch