[egabancho]

Moves uv to the 0.13 tag in both images and requires pip 26.2.2 or newer in the Debian image. Older versions bundle certificate stores that still trust the compromised eMudhra emSign roots (advisory).

• uv: the 0.13 tag (currently 0.13.5) in Debian and AlmaLinux.
• pip (Debian): requires 26.2.2 or newer. The image previously used the base image's pip (26.2.1).
• pip (AlmaLinux): still affected. The image uses the system Python 3.9, where the newest pip available is 26.0.1. The fixed pip needs Python 3.10 or newer, and AlmaLinux 9's ca-certificates still includes the emSign roots.

Evidence

Before (Debian): pip 26.2.1, uv 0.11.33
After (Debian): pip 26.2.2, uv 0.13.5

Assisted by: Claude Code

Checklist

Ticks in all boxes and 🟢 on all GitHub actions status checks are required to merge:

• I'm aware of the code of conduct.
• I've created logical separate commits and followed the commit message format.
• I've added relevant test cases.
• I've added relevant documentation.
• I've marked translation strings.
  • For translation updates, see the translation release policy.
• I've identified the copyright holder(s) and updated copyright headers for touched files (>15 lines contributions).
• I've NOT included third-party code (copy/pasted source code or new dependencies).
  • If you have added third-party code (copy/pasted or new dependencies), please reach out to an architect on Discord.

Frontend

• I've followed the CSS/JS and React guidelines.
• I've followed the web accessibility guidelines.
• I've followed the user interface guidelines.

Reminder

By using GitHub, you have already agreed to the GitHub’s Terms of Service including that:

1. You license your contribution under the same terms as the current repository’s license.
2. You agree that you have the right to license your contribution under the current repository’s license.