fix: uv CVE-2025-62518 astral-tokio-tar issue GHSA-j5gw-2vrg-8fgx (#1505)

2025-10-22 15:52:56 +02:00
parent 1200ba0082
commit 35a9ccdb42
2 changed files with 4 additions and 4 deletions
@@ -18,7 +18,7 @@ jobs:
      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true
-          version: 0.7.2
+          version: 0.9.5

      - name: Install dependencies
        run: uv sync --frozen --all-extras --python 3.10
@@ -46,7 +46,7 @@ jobs:
        uses: astral-sh/setup-uv@v3
        with:
          enable-cache: true
-          version: 0.7.2
+          version: 0.9.5

      - name: Install the project
        run: uv sync --frozen --all-extras --python ${{ matrix.python-version }} --resolution ${{ matrix.dep-resolution }}
@@ -62,7 +62,7 @@ jobs:
      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true
-          version: 0.7.2
+          version: 0.9.5

      - name: Install dependencies
        run: uv sync --frozen --all-extras --python 3.10
@@ -45,7 +45,7 @@ mcp = "mcp.cli:app [cli]"

 [tool.uv]
 default-groups = ["dev", "docs"]
-required-version = ">=0.7.2"
+required-version = ">=0.9.5"

 [dependency-groups]
 dev = [