Sweep: ty 0.0.90, setup-uv v10.3.2, uv 0.13.5, pypi-publish v1.14.3 (#112)

## Summary

Maintenance sweep for 2026-10-22. Nothing here ships, so no release.

- **ty:** 0.0.89 to 0.0.90. This is the only dependency `uv lock
--upgrade` moved.
- **astral-sh/setup-uv:** v10.3.0 to v10.3.2.
- **uv version input:** 0.13.1 to 0.13.5, the latest uv release.
Dependabot cannot see this pin because it is an action input.
- **pypa/gh-action-pypi-publish:** v1.14.2 to v1.14.3.

Two of these are security fixes, so this should merge before the next
tag publish:
- **uv 0.13.4 and later:** fixes GHSA-hq85-5cpj-mr62, which removes the
compromised emSign roots.
- **pypi-publish 1.14.3:** fixes GHSA-5xjx-3w67-w9x9 (critical), a CA
problem in the Sigstore chain that Trusted Publishing relies on.

Worked with Varun.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

Unchanged. Nothing in the published package changes, so this does not
bump the version or cut a release.

## Test plan

- Ran `uv sync --frozen --all-extras --all-groups`, then these, all
passing:
  - `ruff check` and `ruff format --check`
  - `ty check`
  - `vulture`
  - `pytest` (172 passed, 2 skipped)
- `osv-scanner` on `uv.lock`: no issues found.

## Checklist

- [ ] Tests cover the new behavior, and the suite passes locally (no new
behavior; the existing suite passes)
- [x] Lint, format, and type checks pass
- [ ] Docs and README examples updated if the public surface changed
(the public surface did not change)
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

.github/workflows/ci.yml

@@ -20,9 +20,9 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: useblacksmith/checkout@v1
-      - uses: astral-sh/setup-uv@v10.3.0
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
-          version: "0.13.1"
+          version: "0.13.5"
       - run: uv python install 3.15
       - uses: actions/cache@v6
         with:
@@ -47,9 +47,9 @@ jobs:
         python: ["3.11", "3.12", "3.13", "3.14", "3.15"]
     steps:
       - uses: useblacksmith/checkout@v1
-      - uses: astral-sh/setup-uv@v10.3.0
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
-          version: "0.13.1"
+          version: "0.13.5"
       - run: uv python install ${{ matrix.python }}
       - run: uv sync --frozen --all-extras --all-groups --python ${{ matrix.python }}
       - run: uv run --python ${{ matrix.python }} pytest tests/ -q

.github/workflows/publish.yml

@@ -19,17 +19,17 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@v10.3.0
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
-          version: "0.13.1"
+          version: "0.13.5"
 
       - name: Set version from tag
         run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml
 
       - run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.14.2
+        uses: pypa/gh-action-pypi-publish@v1.14.3
 
       - name: Create GitHub Release
         run: gh release create "$GITHUB_REF_NAME" --generate-notes

.github/workflows/security.yml

@@ -36,9 +36,9 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: useblacksmith/checkout@v1
-      - uses: astral-sh/setup-uv@v10.3.0
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
-          version: "0.13.1"
+          version: "0.13.5"
       - uses: actions/setup-python@v7
         with:
           python-version: "3.15"