Update TLS trust dependencies

ci/Dockerfile.ci

@@ -18,8 +18,8 @@ ARG PROTOC_GEN_GO_VERSION=v1.36.11
 ARG PROTOC_GEN_GO_GRPC_VERSION=v1.6.1
 ARG SCCACHE_VERSION=0.16.0
 ARG SCCACHE_X86_64_SHA256=aec995a83ad3dff3d14b6314e08858b7b73d35ca85a5bcf3d3a9ec07dee35588
-ARG UV_VERSION=0.12.18
-ARG UV_X86_64_SHA256=89eadd7c76fc063887959510d5ba0ab1264dfd5f1143b925ddb73021a40acf16
+ARG UV_VERSION=0.13.4
+ARG UV_X86_64_SHA256=2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f
 ARG WILD_VERSION=0.9.0
 ARG WILD_X86_64_SHA256=deb6ee0e5caec798053ec4aafaba042e20a8edf91f08cb4d36268571cc628d3b
 

ci/scripts/ensure-uv.sh

@@ -14,23 +14,23 @@ LOCAL_UV_BIN="${LOCAL_BIN_DIR}/uv"
 # together. Each checksum below is the asset's `digest` in GitHub's release
 # API (gh api repos/astral-sh/uv/releases/tags/<version>) and matches the
 # archive both hosts serve.
-UV_VERSION="${SPACE_UV_VERSION:-0.12.18}"
+UV_VERSION="${SPACE_UV_VERSION:-0.13.4}"
 case "$(uname -s)-$(uname -m)" in
     Linux-x86_64)
         uv_target=x86_64-unknown-linux-gnu
-        uv_sha256=89eadd7c76fc063887959510d5ba0ab1264dfd5f1143b925ddb73021a40acf16
+        uv_sha256=2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f
         ;;
     Linux-aarch64 | Linux-arm64)
         uv_target=aarch64-unknown-linux-gnu
-        uv_sha256=afb6291f3f0a6b4521fc67b947822506c41dde5b60d2189dd8f3695b2ac8c9e7
+        uv_sha256=1ae72b4718729e2ccc4f1ae2c6d1e531ca8467800e0546e9130b3886023a60ab
         ;;
     Darwin-arm64)
         uv_target=aarch64-apple-darwin
-        uv_sha256=cf40e0c6a202190ccd9e0406dcfdd5b2d6668a9a5c779b17948963df32aafe5b
+        uv_sha256=e0b1d4743ce64c55d9f0f4a444afa6b81125680070ee04e853fcd0f6c1ebf8f1
         ;;
     Darwin-x86_64)
         uv_target=x86_64-apple-darwin
-        uv_sha256=2e4108f5395397c8bc5d43bf83d3bdbb2d0e92b90d0efa607756be704905fa33
+        uv_sha256=7be2dcd316122f4b3e5a0a7889f6248266c14425374e105ff7dc9779184603a6
         ;;
     *)
         uv_target=""

scripts/netgtw/traffic/requirements.txt

@@ -4,7 +4,7 @@ aioquic==1.3.0
     # via -r scripts/netgtw/traffic/requirements.in
 attrs==26.1.0
     # via service-identity
-certifi==2026.7.22
+certifi==2026.10.19
     # via aioquic
 cffi==2.1.1 ; platform_python_implementation != 'PyPy'
     # via cryptography

supply-chain/config.toml

@@ -1516,7 +1516,7 @@ version = "0.1.1"
 criteria = "safe-to-deploy"
 
 [[exemptions.rustls-webpki]]
-version = "0.103.15"
+version = "0.103.16"
 criteria = "safe-to-deploy"
 
 [[exemptions.rustversion]]
@@ -2032,11 +2032,11 @@ version = "1.1.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.webpki-root-certs]]
-version = "1.0.9"
+version = "1.0.10"
 criteria = "safe-to-deploy"
 
 [[exemptions.webpki-roots]]
-version = "1.0.9"
+version = "1.0.10"
 criteria = "safe-to-deploy"
 
 [[exemptions.whoami]]

templates/firecracker/recipes/code-runtime.toml

@@ -37,7 +37,7 @@ name = "Install system packages"
 type = "run"
 command = """
 set -eu
-APT_SNAPSHOT="20261016T000000Z"
+APT_SNAPSHOT="20261020T200000Z"
 PACKAGES="python3 python3-venv python3-pip python-is-python3 python3-dev
   python3-setuptools curl ca-certificates sudo git git-lfs procps jq wget lsof
   sqlite3 iputils-ping libcap2-bin iproute2"
@@ -140,10 +140,10 @@ name = "Install uv package manager"
 type = "run"
 command = """
 set -eu
-UV_VERSION="0.12.18"
+UV_VERSION="0.13.4"
 case "$(uname -m)" in
-  aarch64) UV_ARCH="aarch64"; UV_SHA256="afb6291f3f0a6b4521fc67b947822506c41dde5b60d2189dd8f3695b2ac8c9e7" ;;
-  x86_64) UV_ARCH="x86_64"; UV_SHA256="89eadd7c76fc063887959510d5ba0ab1264dfd5f1143b925ddb73021a40acf16" ;;
+  aarch64) UV_ARCH="aarch64"; UV_SHA256="1ae72b4718729e2ccc4f1ae2c6d1e531ca8467800e0546e9130b3886023a60ab" ;;
+  x86_64) UV_ARCH="x86_64"; UV_SHA256="2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f" ;;
   *) echo "Unsupported uv architecture" >&2; exit 1 ;;
 esac
 UV_PACKAGE="uv-${UV_ARCH}-unknown-linux-gnu"

templates/firecracker/recipes/code-runtime/pyproject.toml

@@ -40,6 +40,8 @@ no-build = true
 # Lock only releases at least a week old, so new releases settle before a
 # rebuild picks them up.
 exclude-newer = "7 days"
+# Permit the current CA bundle update through the settling window.
+exclude-newer-package = { certifi = "2026-10-21T00:00:00Z" }
 # Builders run x86_64 or aarch64 Linux; locking only those keeps uv.lock small.
 environments = [
     "sys_platform == 'linux' and (platform_machine == 'x86_64' or platform_machine == 'aarch64')",

templates/firecracker/seed/README.md

@@ -204,14 +204,14 @@ extraction. A missing checksum, invalid signature, or mismatched download stops
 the build. Checksum metadata must remain reachable even when the image is cached.
 
 The maintained code-runtime recipe pins Node.js 20.20.2, GitHub CLI 2.101.0,
-and uv 0.12.18 (also used by the CI image), with SHA-256 values for both
+and uv 0.13.4 (also used by the CI image), with SHA-256 values for both
 architectures checked before extraction. uv is installed from its release
 archive without executing a remote installer. `scripts/build-code-runtime.py`
 reads these installation commands from the recipe. The digest sources are:
 
 - [Node.js release checksums](https://nodejs.org/dist/v20.20.2/SHASUMS256.txt)
 - [GitHub CLI release checksums](https://github.com/cli/cli/releases/download/v2.101.0/gh_2.101.0_checksums.txt)
-- uv [aarch64 checksum](https://github.com/astral-sh/uv/releases/download/0.12.18/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) and [x86_64 checksum](https://github.com/astral-sh/uv/releases/download/0.12.18/uv-x86_64-unknown-linux-gnu.tar.gz.sha256)
+- uv [aarch64 checksum](https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) and [x86_64 checksum](https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz.sha256)
 
 The recipe's Python packages are listed in `recipes/code-runtime/pyproject.toml`
 and pinned, with every transitive dependency, to wheel hashes in