build: move to Python 3.14.9 and uv 0.13.5 for the CA certificate incident

.github/workflows/ci.yml

@@ -55,6 +55,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.13.5"
+          python-version: "3.14.9"
 
       - name: Run ruff check
         run: uv run ruff check
@@ -75,6 +78,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.13.5"
+          python-version: "3.14.9"
 
       - name: Run ty
         run: uv run ty check
@@ -92,6 +98,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.13.5"
+          python-version: "3.14.9"
 
       - name: Run tests
         run: uv run pytest --cov
@@ -109,6 +118,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.13.5"
+          python-version: "3.14.9"
 
       - name: Run deptry
         run: uv run --group audit deptry .

flake.nix

@@ -20,11 +20,11 @@
             deadnix
             ls-lint
             nixfmt
-            python314
             statix
-            uv
           ])
           ++ [
+            (pkgs.callPackage ./nix/python.nix { })
+            (pkgs.callPackage ./nix/uv.nix { })
             # lefthook before 2.1.6 runs hooks under a pty, which agent sandboxes deny.
             nixpkgs-unstable.legacyPackages.${system}.lefthook
           ];

nix/python.nix

@@ -0,0 +1,22 @@
+{
+  fetchurl,
+  mailcap,
+  python314,
+}:
+
+# TODO: Drop this and use pkgs.python314 once the nixpkgs input has >= 3.14.9.
+# 3.14.9 replaces the compromised emSign root in the bundled pip/certifi CA store.
+# nixpkgs' mimetypes patch no longer applies to 3.14.9's `knownfiles`, so the same
+# substitution is done in postPatch instead.
+(python314.override { mimetypesSupport = false; }).overrideAttrs (previousAttrs: rec {
+  version = "3.14.9";
+  src = fetchurl {
+    url = "https://www.python.org/ftp/python/${version}/Python-${version}.tar.xz";
+    hash = "sha256-4C2awhzr2m5GQ1NpdEqSxlzHzYZpaXaUEiz5f/rNHlM=";
+  };
+
+  postPatch = (previousAttrs.postPatch or "") + ''
+    substituteInPlace Lib/mimetypes.py \
+      --replace-fail '"/etc/mime.types",' '"${mailcap}/etc/mime.types",'
+  '';
+})

nix/uv.nix

@@ -0,0 +1,43 @@
+{
+  fetchurl,
+  lib,
+  stdenvNoCC,
+  versionCheckHook,
+}:
+
+# TODO: Drop this and use pkgs.uv once the nixpkgs input has >= 0.13.5.
+# Official build of uv 0.13.5. 0.13.4 drops the compromised emSign root from its bundled CA store,
+# but 0.13.5 is the first release that can install managed CPython 3.14.9.
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "uv";
+  version = "0.13.5";
+
+  src = fetchurl {
+    url = "https://github.com/astral-sh/uv/releases/download/${finalAttrs.version}/uv-aarch64-apple-darwin.tar.gz";
+    hash = "sha256-dD+FA1oZluyzUGWeAc2frqlwmCm+CbG0sDxz6vPJzXM=";
+  };
+
+  dontBuild = true;
+  dontStrip = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 -t "$out/bin" uv uvx
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Python package and project manager, official macOS build";
+    homepage = "https://github.com/astral-sh/uv";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    mainProgram = "uv";
+    platforms = [ "aarch64-darwin" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+})

pyproject.toml

@@ -3,7 +3,7 @@ name = "template-python"
 version = "0.1.0"
 description = ""
 readme = "README.md"
-requires-python = "== 3.14.*"
+requires-python = ">= 3.14.9, < 3.15"
 dependencies = []
 
 [tool.hatch.build.targets.wheel]