[sentry-junior]

Part of VULN-3216 (eMudhra CA compromise). This moves the devenv-pinned uv from 0.8.2 to 0.13.4. uv 0.13.4 updates its bundled Mozilla root certificates (webpki-root-certs 1.0.10), which drop the eMudhra roots. It only affects the dev tooling, not the SDK.

Changed

• devenv/config.ini [uv]: release URLs, all four per-platform sha256s, and version. Developers get uv 0.13.4 on their next devenv sync.

The checksums come from the official .sha256 files on the 0.13.4 release. I also downloaded all four tarballs and hashed them, and the hashes match.

Worth knowing

• 0.8 → 0.13 crosses five minor lines that include breaking changes. I checked them against devenv/sync.py. In 0.10, uv venv started requiring --clear to replace an existing venv. That doesn't affect this repo, because sync.py only runs uv venv --seed when .venv doesn't exist. Then it runs uv sync --frozen --quiet. .python-version pins 3.13.3, so the default-Python change doesn't matter here. The project doesn't use uv_build.

Verified locally

• uv --version → uv 0.13.4, installed from the release tarball with the sha256 checked
• uv lock --check passes with 0.13.4 and with 0.8.2. The lockfile is unchanged.
• uv sync --frozen with 0.13.4 into a throwaway env passes

Not verified: devenv sync on a developer machine, and CI on this PR.

#skip-changelog

via Geoff Goldsmith.

--

View Junior Session [Sentry]

[linear-code]

VULN-3216

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.61.0 (1)	release

⚙️ sentry-android Build Distribution Settings