fix(ci): require uv >=0.8.6 for VULN-95456

[shuningc]

Summary

Remediates VULN-95456 / CVE-2025-54368 (GHSA-8qf3-x8v5-2pj8) by ensuring uv is at least 0.8.6 everywhere it is used in this repo.

uv ≤0.8.5 is vulnerable to ZIP payload obfuscation via parsing differentials — an attacker can craft ZIP archives that extract with benign contents under some installers and malicious contents under others (stacked/duplicate local file entries). This requires user interaction (installing an attacker-controlled package).

Changes

• CI workflows (.github/workflows/ci-tests-splunk-ao-adk.yaml, ci-tests-splunk-ao-a2a.yaml): add version: ">=0.8.6" to astral-sh/setup-uv so CI always installs a patched uv.
• Subproject pyproject.toml (splunk-ao-adk/, splunk-ao-a2a/): add [tool.uv] required-version = ">=0.8.6" so local dev also enforces the floor.

Fixed Version Rationale

Source	Detail
CVE	CVE-2025-54368
Advisory	GHSA-8qf3-x8v5-2pj8
Affected	uv ≤ 0.8.5
Fixed in	uv 0.8.6+
Pin applied	>=0.8.6 (minimum safe floor; allows newer compatible releases)

uv 0.8.6 reconciles local file entries with the central directory and rejects malformed/stacked ZIP archives.

Notes

• uv is not a Python package dependency in this repo — it is used as a CI/dev tool only.
• No lockfile regeneration needed (poetry.lock / uv.lock unaffected).
• Prior CI used setup-uv without an explicit version (defaulting to latest); this change makes the floor explicit and durable.

Test plan

• CI passes on ci-tests-splunk-ao-adk workflow
• CI passes on ci-tests-splunk-ao-a2a workflow
• Confirm installed uv version in CI logs is ≥ 0.8.6

[fercor-cisco]

🤖 This review was generated by the Astra agent (claude-opus-4-8). It may contain mistakes.

Verdict: request_changes — PR does not remediate VULN-95456: the flagged uv 0.8.9 in poetry.lock is untouched, and the applied floor (>=0.8.6) is below the required remediation (0.9.6).

General Comments

• 🔴 critical (bug): This PR does not actually remediate VULN-95456 and the ticket will not close.

The ticket (CVE-2025-13327) flags uv 0.8.9 with origin path poetry.lock and remediation 0.9.6. In this repo poetry.lock pins uv 0.8.9 (line 5636), pulled in transitively as an optional dependency of crewai (uv = ">=0.4.25", poetry.lock line 811) under the crewai/all extras. This PR does not modify poetry.lock at all, so the scanner will continue to report the vulnerable uv 0.8.9.

The PR body's claims that "uv is not a Python package dependency in this repo" and "No lockfile regeneration needed (poetry.lock/uv.lock unaffected)" are both incorrect. To close the ticket, poetry.lock must be regenerated so the transitive uv is >= 0.9.6 (e.g. add a floor on uv and re-lock, or constrain the transitive dependency), then verify FOSSA no longer flags it.

Separately, the CVE in the PR body (CVE-2025-54368, fixed in 0.8.6) does not match the ticket's CVE (CVE-2025-13327, remediation 0.9.6). Please reconcile which vulnerability is being remediated; addressing only CVE-2025-54368 leaves VULN-95456 open.

[fercor-cisco]

🟠 major (bug): Same as the a2a subproject: this floor >=0.8.6 is below the ticket's required remediation of uv 0.9.6, and required-version controls the uv executable, not the uv 0.8.9 locked in poetry.lock that the scanner actually flags.

Suggested change

	required-version = ">=0.8.6"
	required-version = ">=0.9.6"

🤖 Generated by the Astra agent