Bump release workflow pins to uv 0.13.6 and Python 3.14.10

FA
1h ago
+24-23

All Submissions:

  • Have you followed the guidelines stated in CONTRIBUTING.md file?
  • Have you checked to ensure there aren't any other open Pull Requests for the desired changed?

Type of change

  • Bug fix (non-breaking change which fixes an issue)

Changes To Core Features:

  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Have you written new tests for your core changes, as applicable?
  • Have you successfully ran tests with your changes locally?

Description

Python and uv have published expedited security releases because eMudhra intermediate CA keys were compromised (CVE-2026-115557). Python 3.14.10 is the patched CPython. On the uv side, 0.13.4 only removes the affected root from uv's own certificate store; 0.13.5 adds the rejection of chains that contain the compromised intermediate keys; and 0.13.6 is the first uv that can download CPython 3.14.10 (0.13.4 stops at 3.14.8 and fails with "No interpreter found for Python 3.14.10"). Our release workflows build packages and upload them to PyPI, but they still pinned uv 0.12.5 and Python 3.14.7.

  • Bumps DEFAULT_UV_VERSION to 0.13.6 and DEFAULT_PYTHON_VERSION to 3.14.10 in reflex_release/config.py, and updates the README example to match.
  • Regenerates the five release workflows with uv run reflex-release sync: publish, dispatch_release, changelog, release_from_changelog and auto_release_internal.
  • Changes a scaffold test to use DEFAULT_UV_VERSION. It had 0.12.5 written in, which would have gone stale on every bump.
  • Adds a reflex-release news fragment.

Nothing else needs to change. The other CI workflows use floating Python minor versions and an unpinned setup-uv, so they pick up the patched releases on their own. uv.lock already has certifi 2026.10.19 and virtualenv 21.14.12.

Worth checking before this merges: uv moves up a minor version (0.12 → 0.13). The unit tests can't show whether uv build or uv publish behave differently in 0.13; only a release run would.

Tests: the tests/units/reflex_release and test_workflow_gates.py suites pass (550 tests), reflex-release sync --check reports the workflows up to date, and ruff and pyright are clean.

https://discuss.python.org/t/python-3-15-2-3-14-10-3-13-18-3-12-16-and-3-11-18-are-out/109678