From 54bd5b3c37f29e40c6450eed353563e1c71f3aaa Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Feb 2026 04:30:05 +0000
Subject: [PATCH 2/2] Pin uv to version 0.9.28 to mitigate supply-chain risk

Co-authored-by: bandrel <3598052+bandrel@users.noreply.github.com>
---
 .github/workflows/tests.yml | 2 +-
 Dockerfile.test             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 8f41ef2..4d0ef10 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -20,7 +20,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y p7zip-full transmission-cli
 
       - name: Install uv
-        run: python -m pip install --upgrade pip uv pytest
+        run: python -m pip install --upgrade pip uv==0.9.28 pytest
 
       - name: Install project dependencies
         run: uv pip install .
diff --git a/Dockerfile.test b/Dockerfile.test
index 5f8fd71..3421916 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -15,7 +15,7 @@ RUN apt-get update \
         transmission-cli \
     && rm -rf /var/lib/apt/lists/*
 
-RUN python -m pip install -q uv
+RUN python -m pip install -q uv==0.9.28
 
 COPY . /workspace