LCORE-2251: CVE-free uv for hermetic build

[tisnik]

Description

LCORE-2251: CVE-free uv for hermetic build

Type of change

• Refactor
• New feature
• Bug fix
• CVE fix
• Optimization
• Documentation Update
• Configuration Update
• Bump-up service version
• Bump-up dependent library
• Bump-up library or tool used for development (does not change the final image)
• CI configuration change
• Konflux configuration change
• Unit tests improvement
• Integration tests improvement
• End to end tests improvement
• Benchmarks improvement

Tools used to create PR

• Assisted-by: N/A
• Generated by: N/A

Related Tickets & Documents

• Related Issue #LCORE-2251

Summary by CodeRabbit

• Chores
  • Updated development build tooling dependency to a newer version for improved system reliability and stability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0adb5883-2529-49e5-8234-7944df1c4c80

📥 Commits

Reviewing files that changed from the base of the PR and between fd4acfa and fe03225.

📒 Files selected for processing (1)

• .konflux/requirements.hermetic.txt

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (20)

• GitHub Check: mypy
• GitHub Check: unit_tests (3.12)
• GitHub Check: black
• GitHub Check: pydocstyle
• GitHub Check: radon
• GitHub Check: check_dependencies
• GitHub Check: Pyright
• GitHub Check: integration_tests (3.12)
• GitHub Check: integration_tests (3.13)
• GitHub Check: list_outdated_dependencies
• GitHub Check: bandit
• GitHub Check: E2E: library mode / ci / group 3
• GitHub Check: E2E: library mode / ci / group 1
• GitHub Check: E2E: library mode / ci / group 2
• GitHub Check: E2E: server mode / ci / group 1
• GitHub Check: E2E: server mode / ci / group 3
• GitHub Check: E2E: server mode / ci / group 2
• GitHub Check: E2E Tests for Lightspeed Evaluation job
• GitHub Check: Pylinter
• GitHub Check: Konflux kflux-prd-rh02 / lightspeed-stack-on-pull-request

🔇 Additional comments (1)

.konflux/requirements.hermetic.txt (1)

1-1: LGTM!

---

Walkthrough

The hermetic build requirements file is updated to pin a newer version of the uv package manager, bumping from 0.9.26 to 0.11.6 while keeping pip==25.3 unchanged.

Changes

Build Tool Dependencies

Layer / File(s)	Summary
Uv version bump .konflux/requirements.hermetic.txt	The uv dependency is updated from version 0.9.26 to 0.11.6 in the hermetic requirements file.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: updating uv to a CVE-free version for the hermetic build configuration, which directly corresponds to the file change in .konflux/requirements.hermetic.txt.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}