Sync uv Dockerfile Python versions with python ecosystem by kbukum1 · Pull Request #15087 · dependabot/dependabot-core

kbukum1 · 2026-05-20T18:26:45Z

What are you trying to accomplish?

Sync the uv ecosystem with the Python version and dependency upgrades from #15058. The uv ecosystem aliases the Python Language class, so the code expects the updated versions when extracting compressed Python runtimes. Without this sync, the uv updater fails with tar: Cannot open: No such file or directory errors.

Python runtime updates (uv/Dockerfile):

3.14.2 → 3.14.5
3.13.11 → 3.13.13
3.12.12 → 3.12.13
3.11.14 → 3.11.15
3.10.19 → 3.10.20
3.9.24 → 3.9.25

Helper dependency updates (uv/helpers/requirements.txt, Python ≥3.10):

pip 24.0 → 26.1.1
pip-tools 7.4.1 → 7.5.3
flake8 7.1.0 → 7.3.0
hashin 1.0.3 → 1.0.5
pipenv 2024.0.2 → 2024.4.1
plette 2.1.0 → 2.2.1
poetry 1.8.5 → 2.3.4
tomli 2.0.1 → 2.4.1
Cython 3.0.10 → 3.2.4

Anything you want to highlight for special attention from reviewers?

Same approach as #15058: Several updated packages (pip 26.x, poetry 2.x) dropped Python 3.9 support. We introduced a separate requirements-3.9.txt pinned to the last known 3.9-compatible versions, and updated the build script to conditionally select the right file based on the target Python version.

Poetry version: Pinned to 2.3.4 — the minimum version that fixes both CVE-2026-34591 (GHSA-2599-h6xx-hpxp, high severity wheel path traversal) and CVE-2026-41140 (GHSA-73h3-mf4w-8647, low severity tar extraction path traversal). Poetry 2.4.1 was avoided as it introduces additional behavioral changes.

Fixture and spec sync: The poetry.lock fixture was upgraded from Poetry v1 format (using category field) to v2 format (using groups and files fields), synced from the python ecosystem. Poetry 2.3.4 cannot properly parse v1 lockfiles for production dependency classification. The spec was updated to use click as the dev sub-dependency (matching the python spec) since atomicwrites is not in the v2 fixture.

Other updates: The Dockerfile comment now correctly references python/lib/dependabot/python/language.rb since the uv language class is an alias. The language_spec.rb deprecated test version was updated from 3.8.1 to 3.9.1 to match the new DEPRECATED_VERSIONS.

How will you know you have accomplished your goal?

The uv updater Docker image builds successfully with the new Python versions
The tar: Cannot open errors are resolved for uv ecosystem jobs
CI dependency-review passes with no vulnerable packages
All uv specs pass

Checklist

I have run the complete test suite to ensure all tests and linters pass.
I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
I have written clear and descriptive commit messages.
I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
I have ensured that the code is well-documented and easy to understand.

Copilot

Pull request overview

Updates the uv ecosystem’s Docker image build to use the same pinned preinstalled Python patch versions as the shared Dependabot::Python::Language (which uv aliases), preventing runtime tarball mismatches during extraction.

Changes:

Bump pinned Python ARG versions in uv/Dockerfile to match the Python ecosystem’s preinstalled runtime list (3.14.5, 3.13.13, 3.12.13, 3.11.15, 3.10.20, 3.9.25).

Show a summary per file

File	Description
uv/Dockerfile	Updates Python version ARG pins to align with the shared Python language version list used by uv.

Copilot's findings

Files reviewed: 4/4 changed files
Comments generated: 1

Copilot

Copilot's findings

Files reviewed: 5/5 changed files
Comments generated: 1

Copilot

Copilot's findings

Files reviewed: 5/5 changed files
Comments generated: 0 new

AbhishekBhaskar

LGTM

kbukum1 · 2026-05-20T19:15:59Z


      describe "a development sub-dependency" do
-        subject(:dep) { dependencies.find { |d| d.name == "atomicwrites" } }
+        subject(:dep) { dependencies.find { |d| d.name == "click" } }


synced the spec with the python (pip) one.

Update Python version pins in the uv Dockerfile to match the versions already deployed in the python ecosystem (PR #15058). The uv ecosystem aliases the Python Language class, so the code expects these exact versions when extracting compressed Python runtimes. - 3.14.2 → 3.14.5 - 3.13.11 → 3.13.13 - 3.12.12 → 3.12.13 - 3.11.14 → 3.11.15 - 3.10.19 → 3.10.20 - 3.9.24 → 3.9.25 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Apply the same approach from #15058 to the uv ecosystem: - Upgrade helper packages to latest versions (pip 26.1.1, poetry 2.4.1, etc.) - Add requirements-3.9.txt with old 3.9-compatible versions - Update build script with conditional requirements selection Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Match the same change from python/spec in #15058 — deprecated version is now 3.9, not 3.8. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Use the same 3.9-compatible versions as python/helpers/requirements-3.9.txt to avoid unnecessary drift between ecosystems. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Poetry 2.4.1 changes behavior with old v1 lockfile format, causing subdependency metadata classification failures. Keep at 2.2.1 (same as python ecosystem) and defer the poetry upgrade to a follow-up PR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Poetry 2.2.1 has path traversal vulnerabilities. Use 2.3.3 which is the minimum patched version. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2.3.3 only fixed the high severity CVE; 2.3.4 also fixes the low severity tar extraction path traversal. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replace old v1 format fixture (using category field) with the v2 format (using groups and files fields) already used in the python ecosystem. Update spec to use 'click' as the dev sub-dependency (matching python spec) since 'atomicwrites' is not in the v2 fixture. This fixes the subdependency_metadata test failure with poetry 2.3.4 which cannot properly parse v1 lockfile format. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Sync uv Dockerfile Python versions with python ecosystem Update Python version pins in the uv Dockerfile to match the versions already deployed in the python ecosystem (PR #15058). The uv ecosystem aliases the Python Language class, so the code expects these exact versions when extracting compressed Python runtimes. - 3.14.2 → 3.14.5 - 3.13.11 → 3.13.13 - 3.12.12 → 3.12.13 - 3.11.14 → 3.11.15 - 3.10.19 → 3.10.20 - 3.9.24 → 3.9.25

Copilot AI review requested due to automatic review settings May 20, 2026 18:26

kbukum1 requested a review from a team as a code owner May 20, 2026 18:26

Copilot started reviewing on behalf of kbukum1 May 20, 2026 18:26 View session

github-actions Bot added the L: python:uv label May 20, 2026

Copilot AI reviewed May 20, 2026

View reviewed changes

Comment thread uv/Dockerfile Outdated

kbukum1 requested a review from Copilot May 20, 2026 18:30

Copilot started reviewing on behalf of kbukum1 May 20, 2026 18:30 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

Comment thread uv/helpers/requirements-3.9.txt Outdated

kbukum1 requested a review from Copilot May 20, 2026 18:34

Copilot started reviewing on behalf of kbukum1 May 20, 2026 18:34 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

AbhishekBhaskar previously approved these changes May 20, 2026

View reviewed changes

kbukum1 dismissed AbhishekBhaskar’s stale review via 74b11c8 May 20, 2026 18:46

kbukum1 force-pushed the kbukum1/upgrade-uv-python-versions branch from c41fb64 to 3c0759b Compare May 20, 2026 19:06

kbukum1 commented May 20, 2026

View reviewed changes

AbhishekBhaskar approved these changes May 20, 2026

View reviewed changes

kbukum1 and others added 9 commits May 20, 2026 15:07

Fix uv Dockerfile comment to reference python language.rb

2771bfe

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update uv language_spec deprecated test to use Python 3.9

d67e314

Match the same change from python/spec in #15058 — deprecated version is now 3.9, not 3.8. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Align uv requirements-3.9.txt with python ecosystem pins

e1f4695

Use the same 3.9-compatible versions as python/helpers/requirements-3.9.txt to avoid unnecessary drift between ecosystems. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Bump poetry to 2.3.3 to fix CVE-2026-34591 and GHSA-73h3-mf4w-8647

28eb380

Poetry 2.2.1 has path traversal vulnerabilities. Use 2.3.3 which is the minimum patched version. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Bump poetry to 2.3.4 to fix GHSA-73h3-mf4w-8647

0ffc310

2.3.3 only fixed the high severity CVE; 2.3.4 also fixes the low severity tar extraction path traversal. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

kbukum1 force-pushed the kbukum1/upgrade-uv-python-versions branch from 3c0759b to 3b88ed2 Compare May 20, 2026 20:07

kbukum1 merged commit 55910db into main May 20, 2026
90 checks passed

kbukum1 deleted the kbukum1/upgrade-uv-python-versions branch May 20, 2026 20:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sync uv Dockerfile Python versions with python ecosystem#15087

Sync uv Dockerfile Python versions with python ecosystem#15087
kbukum1 merged 9 commits into
mainfrom
kbukum1/upgrade-uv-python-versions

kbukum1 commented May 20, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

AbhishekBhaskar left a comment

Uh oh!

kbukum1 May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

kbukum1 commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What are you trying to accomplish?

Anything you want to highlight for special attention from reviewers?

How will you know you have accomplished your goal?

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

AbhishekBhaskar left a comment

Choose a reason for hiding this comment

Uh oh!

kbukum1 May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kbukum1 commented May 20, 2026 •

edited

Loading