chore(ci): update dependency astral-sh/uv to v0.13.7

Author: renokeeper[bot]

.github/actions/setup/action.yml

@@ -24,7 +24,7 @@ runs:
         # network call that flakes). Renovate's github-actions manager tracks this `version:`
         # input for astral-sh/setup-uv and opens a bump PR — keep the pin in the other workflows
         # (build-binaries, security, release, knope-*, nightly) in step with this one.
-        version: "0.13.6"
+        version: "0.13.7"
         enable-cache: true
     # The version flows through an env var (not inlined into `run:`) so zizmor's
     # template-injection analysis stays quiet; the value is always a hard-coded

.github/workflows/build-binaries.yml

@@ -75,7 +75,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
           enable-cache: true
       - name: Set up Python + build env
         run: |

.github/workflows/knope-prepare.yml

@@ -111,7 +111,7 @@ jobs:
         if: ${{ steps.changesets.outputs.has == 'true' }}
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
           enable-cache: false
       # A SEPARATE, read-only mint for the third-party download step. The
       # binary fetch needs public read only, so it must not carry the

.github/workflows/knope-release.yml

@@ -80,7 +80,7 @@ jobs:
       - name: Set up uv (build)
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
           enable-cache: false # a poisoned cache would taint what the release job signs
       - name: Build sdist + wheel
         run: uv build

.github/workflows/nightly.yml

@@ -313,7 +313,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
           # No cache in a publishing job (zizmor cache-poisoning): a cache
           # restored from a lower-privilege context could taint the artifact
           # this OIDC step ships. A once-a-night build gains little from a cache.

.github/workflows/release.yml

@@ -172,7 +172,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
           # Caching stays OFF even though this job no longer holds the token
           # (zizmor cache-poisoning): a cache restored from a lower-privilege
           # context could taint the artifact the publish job then ships to PyPI.

.github/workflows/security.yml

@@ -503,7 +503,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
-          version: "0.13.6" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
+          version: "0.13.7" # pinned uv (Renovate-tracked); skip the flaky "latest" fetch
       - name: Install zizmor
         env:
           # renovate: datasource=pypi depName=zizmor