uv lock --upgrade under a new supply-chain cooldown (exclude-newer =
"7 days"): releases younger than a week never enter the lock, so a
hijacked or yanked-within-days upload can't land on day one. 158
packages move; the advisory set clears entirely (trivy 0.76.0 on
uv.lock + pyproject.toml: 32 findings -> 0):
aiohttp 3.14.3 -> 3.14.5 pyjwt 2.13.0 -> 2.15.1
urllib3 2.7.0 -> 2.8.0 oauthlib 3.3.1 -> 4.0.0
certifi 2026.1.4 -> 2026.10.19 fsspec 2026.2.0 -> 2026.9.0
multidict 6.7.1 -> 6.9.1 opentelemetry-* 1.40.0 -> 1.45.1
pillow 12.1.1 -> 13.0.0
pyproject floors raised for the direct deps that carried advisories
(pyjwt, fsspec, opentelemetry-api/-sdk).
The cooldown lives in [tool.uv], and uv.toml is folded into it: uv
ignores [tool.uv] whenever a uv.toml exists, and the images copy only
pyproject.toml + uv.lock — the lock records the span, so `uv sync
--locked` fails anywhere the setting isn't visible.
Held deliberately:
- pymupdf <2: 2.x folds the former pymupdf_layout code (Polyform
Noncommercial / Artifex commercial) into the core wheel and pulls
onnxruntime into every image — a licence call, not a routine bump.
1.28.2 is the current 1.x.
- duckdb stays on 1.5.6: 2.0.0 is six days old, so the cooldown keeps
it out; it arrives as a reviewable Renovate major.
polars 1.38 -> 2.0 removed String -> Date casts; the one src caller
(aco.express.pharmacy) now parses explicitly when the column arrives
as a string, and keeps working for date-typed and duckdb inputs.
Full suite: 15591 passed. pkg-manifest regenerated (it was already
stale on main).
Refs #1365
b597f3518d