[reyammer]

Upgrade uv, pip, certifi, and PyPI publishing workflows to address the eMudhra / emSign root CA security advisory (Python advisory, GHSA-hq85-5cpj-mr62, GHSA-6q48-6c7w-9gw2, GHSA-5xjx-3w67-w9x9):

• Enforce uv >= 0.13.4:
  • Bump UV_VERSION from "0.12.12" to "0.13.4" across all 7 GitHub Actions workflows.
  • Set required-version = ">=0.13.4" under [tool.uv] in python/pyproject.toml and in all 9 PEP 723 standalone scripts (scripts/sync_kb.py and python/scripts/*.py).
• Enforce certifi >= 2026.10.19 and pip >= 26.2.2 constraints:
  • Add constraint-dependencies = ["certifi>=2026.10.19", "pip>=26.2.2"] and exclude-newer-package = { certifi = false, pip = false } under [tool.uv] in python/pyproject.toml, and update python/uv.lock (certifi 2026.7.22 -> 2026.10.19).
• Harden pip usage in CI and split legacy Python 3.8/3.9 wheel testing:
  • In .github/workflows/python-build-test-and-release-package.yml, run test-wheels on Python 3.10–3.14 (upgrading pip via uv pip install --upgrade "pip>=26.2.2" inside test-pip-venv and adding a uv add wheel installation test), add a dedicated test-wheels-legacy-python job for Python 3.8–3.9 using uv only, and gate publish-to-pypi / publish-to-testpypi on both jobs.
  • In .github/workflows/python-test-published-package.yml and .github/workflows/python-test-published-rc-package.yml, update the python-version matrix to ["3.10", "3.11", "3.12", "3.13", "3.14"] and upgrade pip via uv pip install --system --upgrade "pip>=26.2.2".
• Upgrade pypa/gh-action-pypi-publish:
  • Bump pypa/gh-action-pypi-publish from v1.14.2 (dc37677b2e1c63e2034f94d8a5b11f265b73ba33) to v1.14.3 (7245906fb61fa33a13554f9d5fb856fe61758086) in .github/workflows/python-build-test-and-release-package.yml.

[coveralls]

Coverage Report for CI Build 39759838684

Coverage remained the same at 96.841%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	728
Covered Lines:	705
Line Coverage:	96.84%
Coverage Strength:	0.97 hits per line

---

💛 - Coveralls