diff --git a/Cargo.lock b/Cargo.lock index 57b6f3c65..d3a80b4cf 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -8227,9 +8227,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -10209,18 +10209,18 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] diff --git a/ci/Dockerfile.ci b/ci/Dockerfile.ci index 201394d67..b009aff6b 100644 --- a/ci/Dockerfile.ci +++ b/ci/Dockerfile.ci @@ -18,8 +18,8 @@ ARG PROTOC_GEN_GO_VERSION=v1.36.11 ARG PROTOC_GEN_GO_GRPC_VERSION=v1.6.1 ARG SCCACHE_VERSION=0.16.0 ARG SCCACHE_X86_64_SHA256=aec995a83ad3dff3d14b6314e08858b7b73d35ca85a5bcf3d3a9ec07dee35588 -ARG UV_VERSION=0.12.18 -ARG UV_X86_64_SHA256=89eadd7c76fc063887959510d5ba0ab1264dfd5f1143b925ddb73021a40acf16 +ARG UV_VERSION=0.13.4 +ARG UV_X86_64_SHA256=2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f ARG WILD_VERSION=0.9.0 ARG WILD_X86_64_SHA256=deb6ee0e5caec798053ec4aafaba042e20a8edf91f08cb4d36268571cc628d3b diff --git a/ci/scripts/ensure-uv.sh b/ci/scripts/ensure-uv.sh index ac35746b4..884d06fcd 100644 --- a/ci/scripts/ensure-uv.sh +++ b/ci/scripts/ensure-uv.sh @@ -14,23 +14,23 @@ LOCAL_UV_BIN="${LOCAL_BIN_DIR}/uv" # together. Each checksum below is the asset's `digest` in GitHub's release # API (gh api repos/astral-sh/uv/releases/tags/) and matches the # archive both hosts serve. -UV_VERSION="${SPACE_UV_VERSION:-0.12.18}" +UV_VERSION="${SPACE_UV_VERSION:-0.13.4}" case "$(uname -s)-$(uname -m)" in Linux-x86_64) uv_target=x86_64-unknown-linux-gnu - uv_sha256=89eadd7c76fc063887959510d5ba0ab1264dfd5f1143b925ddb73021a40acf16 + uv_sha256=2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f ;; Linux-aarch64 | Linux-arm64) uv_target=aarch64-unknown-linux-gnu - uv_sha256=afb6291f3f0a6b4521fc67b947822506c41dde5b60d2189dd8f3695b2ac8c9e7 + uv_sha256=1ae72b4718729e2ccc4f1ae2c6d1e531ca8467800e0546e9130b3886023a60ab ;; Darwin-arm64) uv_target=aarch64-apple-darwin - uv_sha256=cf40e0c6a202190ccd9e0406dcfdd5b2d6668a9a5c779b17948963df32aafe5b + uv_sha256=e0b1d4743ce64c55d9f0f4a444afa6b81125680070ee04e853fcd0f6c1ebf8f1 ;; Darwin-x86_64) uv_target=x86_64-apple-darwin - uv_sha256=2e4108f5395397c8bc5d43bf83d3bdbb2d0e92b90d0efa607756be704905fa33 + uv_sha256=7be2dcd316122f4b3e5a0a7889f6248266c14425374e105ff7dc9779184603a6 ;; *) uv_target="" diff --git a/scripts/netgtw/traffic/requirements.txt b/scripts/netgtw/traffic/requirements.txt index b9fc1f313..16ead58ad 100644 --- a/scripts/netgtw/traffic/requirements.txt +++ b/scripts/netgtw/traffic/requirements.txt @@ -4,7 +4,7 @@ aioquic==1.3.0 # via -r scripts/netgtw/traffic/requirements.in attrs==26.1.0 # via service-identity -certifi==2026.7.22 +certifi==2026.10.19 # via aioquic cffi==2.1.1 ; platform_python_implementation != 'PyPy' # via cryptography diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 1dd168a67..7f7c7efca 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -1516,7 +1516,7 @@ version = "0.1.1" criteria = "safe-to-deploy" [[exemptions.rustls-webpki]] -version = "0.103.15" +version = "0.103.16" criteria = "safe-to-deploy" [[exemptions.rustversion]] @@ -2032,11 +2032,11 @@ version = "1.1.0" criteria = "safe-to-deploy" [[exemptions.webpki-root-certs]] -version = "1.0.9" +version = "1.0.10" criteria = "safe-to-deploy" [[exemptions.webpki-roots]] -version = "1.0.9" +version = "1.0.10" criteria = "safe-to-deploy" [[exemptions.whoami]] diff --git a/templates/firecracker/recipes/code-runtime.toml b/templates/firecracker/recipes/code-runtime.toml index 296e4d51e..3def34d1d 100644 --- a/templates/firecracker/recipes/code-runtime.toml +++ b/templates/firecracker/recipes/code-runtime.toml @@ -37,7 +37,7 @@ name = "Install system packages" type = "run" command = """ set -eu -APT_SNAPSHOT="20261016T000000Z" +APT_SNAPSHOT="20261020T200000Z" PACKAGES="python3 python3-venv python3-pip python-is-python3 python3-dev python3-setuptools curl ca-certificates sudo git git-lfs procps jq wget lsof sqlite3 iputils-ping libcap2-bin iproute2" @@ -140,10 +140,10 @@ name = "Install uv package manager" type = "run" command = """ set -eu -UV_VERSION="0.12.18" +UV_VERSION="0.13.4" case "$(uname -m)" in - aarch64) UV_ARCH="aarch64"; UV_SHA256="afb6291f3f0a6b4521fc67b947822506c41dde5b60d2189dd8f3695b2ac8c9e7" ;; - x86_64) UV_ARCH="x86_64"; UV_SHA256="89eadd7c76fc063887959510d5ba0ab1264dfd5f1143b925ddb73021a40acf16" ;; + aarch64) UV_ARCH="aarch64"; UV_SHA256="1ae72b4718729e2ccc4f1ae2c6d1e531ca8467800e0546e9130b3886023a60ab" ;; + x86_64) UV_ARCH="x86_64"; UV_SHA256="2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f" ;; *) echo "Unsupported uv architecture" >&2; exit 1 ;; esac UV_PACKAGE="uv-${UV_ARCH}-unknown-linux-gnu" diff --git a/templates/firecracker/recipes/code-runtime/pyproject.toml b/templates/firecracker/recipes/code-runtime/pyproject.toml index 922bd7a7e..7763db4d4 100644 --- a/templates/firecracker/recipes/code-runtime/pyproject.toml +++ b/templates/firecracker/recipes/code-runtime/pyproject.toml @@ -40,6 +40,8 @@ no-build = true # Lock only releases at least a week old, so new releases settle before a # rebuild picks them up. exclude-newer = "7 days" +# Permit the current CA bundle update through the settling window. +exclude-newer-package = { certifi = "2026-10-21T00:00:00Z" } # Builders run x86_64 or aarch64 Linux; locking only those keeps uv.lock small. environments = [ "sys_platform == 'linux' and (platform_machine == 'x86_64' or platform_machine == 'aarch64')", diff --git a/templates/firecracker/recipes/code-runtime/uv.lock b/templates/firecracker/recipes/code-runtime/uv.lock index 0a8c8896b..d936a20e2 100644 --- a/templates/firecracker/recipes/code-runtime/uv.lock +++ b/templates/firecracker/recipes/code-runtime/uv.lock @@ -12,6 +12,9 @@ supported-markers = [ exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values. exclude-newer-span = "P7D" +[options.exclude-newer-package] +certifi = "2026-10-21T00:00:00Z" + [[package]] name = "annotated-doc" version = "0.0.5" @@ -199,11 +202,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] diff --git a/templates/firecracker/seed/README.md b/templates/firecracker/seed/README.md index c780f07bc..eef43acab 100644 --- a/templates/firecracker/seed/README.md +++ b/templates/firecracker/seed/README.md @@ -204,14 +204,14 @@ extraction. A missing checksum, invalid signature, or mismatched download stops the build. Checksum metadata must remain reachable even when the image is cached. The maintained code-runtime recipe pins Node.js 20.20.2, GitHub CLI 2.101.0, -and uv 0.12.18 (also used by the CI image), with SHA-256 values for both +and uv 0.13.4 (also used by the CI image), with SHA-256 values for both architectures checked before extraction. uv is installed from its release archive without executing a remote installer. `scripts/build-code-runtime.py` reads these installation commands from the recipe. The digest sources are: - [Node.js release checksums](https://nodejs.org/dist/v20.20.2/SHASUMS256.txt) - [GitHub CLI release checksums](https://github.com/cli/cli/releases/download/v2.101.0/gh_2.101.0_checksums.txt) -- uv [aarch64 checksum](https://github.com/astral-sh/uv/releases/download/0.12.18/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) and [x86_64 checksum](https://github.com/astral-sh/uv/releases/download/0.12.18/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) +- uv [aarch64 checksum](https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) and [x86_64 checksum](https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) The recipe's Python packages are listed in `recipes/code-runtime/pyproject.toml` and pinned, with every transitive dependency, to wheel hashes in diff --git a/uv.lock b/uv.lock index dbe2bf870..33c9a3338 100644 --- a/uv.lock +++ b/uv.lock @@ -93,11 +93,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]]