Repository navigation
Override Home Assistant's uv pin with >=0.13.4 - #298
Merged
Merged
Conversation
- homeassistant pins uv exactly (0.12.23 in 2026.10.x, 0.13.0 on dev); under `uv run` the venv's uv is first on PATH, so it shadows the mise-managed uv and anything run in the project uses the old version - 0.12.23 is affected by GHSA-hq85-5cpj-mr62 (emSign root, eMudhra CA compromise) and GHSA-2cv4-cqwr-gwf7 - dev/CI lock only; Home Assistant installs its own uv at runtime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
homeassistantpinsuvexactly: 0.12.23 in 2026.10.x, and still only 0.13.0 on HA'sdevbranch. That lands.venv/bin/uvat 0.12.23. Underuv runthe venv'sbincomes first on PATH, so anything run inside the project that callsuvgets the old version, not the mise-managed one. 0.12.23 is affected by GHSA-hq85-5cpj-mr62 (critical: emSign root, part of the eMudhra CA compromise) and GHSA-2cv4-cqwr-gwf7.uv>=0.13.4tooverride-dependencies. This affects only the dev/CI lock; Home Assistant installs its own uv at runtime. The lock only changes uv.uv pip install --no-config homeassistant==…, which skips the override, so HA's exact pin reinstalls the old uv in that job. It only runs tests there and doesn't invoke uv from inside the venv.Tested locally:
uv run uv --versionnow gives 0.13.4 (it was 0.12.23); pytest 2682 passed; ruff clean.Context: security report 2026-10-20, addendum.
🤖 Generated with Claude Code