[danceratopz]

Description

uv 0.13.4 fixes GHSA-hq85-5cpj-mr62. Older uv versions bundle and trust a root CA whose intermediate has been compromised. Astral recommends upgrading immediately. This PR moves CI and local development to uv 0.13.4.

Changes:

• CI: bump the uv version in .github/actions/setup-uv from 0.10.4 to 0.13.4. This composite action is what installs uv in CI. The UV_VERSION repo variable is already set to 0.13.4, but no workflow on this branch reads it.
• CI: bump astral-sh/setup-uv from v7.5.0 to v10.3.0. None of its breaking changes affect us. v10 only disables caching on sensitive events when enable-cache is auto, and we set it to true. v9 stops pruning the uv cache by default, so CI caches may be somewhat larger. v8 only changes custom manifest files, which we don't use.
• CI and Justfile: pin PyPy to pypy3.11.15. uv 0.13.4 resolves pypy3.11 to PyPy 8 (pypy3.11.16 and newer), which uses the pp80 ABI tag. Our compiled dependencies ship no pp80 wheels yet, so the PyPy jobs tried to build cryptography from source and failed. 3.11.15 is the newest PyPy 7.3 release uv 0.13.4 can download (it no longer offers 3.11.13, which CI used before this PR). The pin lives in a pypy Justfile variable, the setup-env-pypy action, and the PyPy jobs in test.yaml and benchmark.yaml.
• Tests: PyPy 3.11.15 is PyPy 7.3.23, whose pickle.Pickler no longer has a dispatch table. The cloudpickle bundled with joblib (1.5.2 and the latest 1.6.0) fails to import because of this (cloudpipe/cloudpickle#592, fix pending in #606), which broke fill-pypy at the EIP-2537 conftest. The BLS12-381 helpers now catch that import error and fall back to an in-process functools.lru_cache. This is the one change outside CI and tooling, so please review it. It can be reverted once a fixed cloudpickle ships in joblib.
• Local: raise required-version in both pyproject.toml files from >=0.7.0 to >=0.13.4, with a comment linking the advisory. Update the minimum version in docs/dev/deps_and_packaging.md.

Decision for reviewers: require all contributors to upgrade

Raising required-version makes every uv command in the repo fail for anyone on an older uv:

error: Required uv version `>=0.13.4` does not match the running version `0.10.4`. Update `uv` by running `uv self update`.

I think this is the responsible choice. The fix is one command, and without it contributors would keep using a uv that trusts the compromised CA whenever it downloads packages or Python builds. uv.lock hashes protect locked installs, but not new resolutions, uvx, or Python downloads. Anyone who installed uv with Homebrew or pip needs to upgrade it there, because uv self update only works for the standalone installer. Local Docker images built from ghcr.io/astral-sh/uv:python3.12-bookworm-slim need a fresh pull.

Verification

Run locally with uv 0.13.4: uv lock --check (uv.lock unchanged), just static, just lint-actions, just test-packaging, just test-tests, just test-tests-pypy, just fill-pypy (15048 passed on PyPy 3.11.15, run with an empty uv cache and Python install dir), and a Cancun fill of tests/cancun/eip4844_blobs/test_blob_txs.py. With uv 0.10.4, uv run fails with the error above.

Related Issues or PRs

N/A.

Checklist

• Ran fast static checks to avoid CI fails, see Code Standards & Verifying Changes: just static
• PR title has the form <type>(<area>): <description>, where <type> and <area> come from an appropriate C-<type>, respectively A-<area>, label. The title should match the target squash commit message.

Cute Animal Picture

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.09%. Comparing base (921c079) to head (abba93e).

Additional details and impacted files

@@              Coverage Diff              @@
##           forks/bogota    #3880   +/-   ##
=============================================
  Coverage         95.09%   95.09%           
=============================================
  Files               673      673           
  Lines             40904    40904           
  Branches           3778     3778           
=============================================
  Hits              38896    38896           
  Misses             1397     1397           
  Partials            611      611           

Flag	Coverage Δ
unittests	95.08% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fselmo]

Yeah makes sense to me 👍🏼. Approving but make sure CI failures are figured out before merging.