[ValentaTomas]

Moves certifi 2026.6.17 → 2026.10.19 in uv.lock and the release workflow's setup-uv pin 0.11.19 → 0.13.4 (the PyPI publish path) — the versions the eMudhra intermediate-CA disclosure lists as patched: https://emudhra.we-have-a-problem.com/. ci.yml has no uv pin and already runs the latest uv with the same uv sync --locked / build commands, so this PR's CI also exercises the newer uv on the release steps. Reviewers: check the lock diff is certifi only plus revision 3 → 5 (the format uv 0.13 writes, readable by the uv both workflows now run). Note the build job's twine check fails because the unpinned hatchling backend now writes Metadata-Version: 2.5, which the locked twine 6.2.0 rejects; this diff touches neither, so main should fail the same way (its last CI run was 2026-07-16), and it needs its own fix.

Update: 426e434 bumps twine 6.2.0 → 7.0.0 in uv.lock, which fixes that twine check failure here. twine 7.0.0 accepts Metadata 2.5. It is the only package the lock moves, because its packaging>=26.1 and rich>=14.3.3 requirements are already met.

[cursor]

PR Summary

Low Risk
Toolchain and transitive dependency bumps plus a patch release version; no application/runtime code changes.

Overview
Bumps the release workflow’s pinned uv from 0.11.19 to 0.13.4 and refreshes uv.lock (including lock revision format). The lock also updates certifi to a newer release cited for intermediate-CA fixes.

Release prep: project version 0.1.0 → 0.1.1, and dev twine is constrained to >=7.0.0 (lock resolves 7.0.0) so twine check on built wheels/sdists accepts Metadata-Version 2.5 from the current hatchling build backend.

^{Reviewed by Cursor Bugbot for commit 332b317. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ValentaTomas]

Verified the build job failure and fixed it in 426e434.

It fails on main too, so this PR didn't cause it. I exported origin/main (3d4a0b2) and ran the build job's steps with uv 0.13.4 and UV_PYTHON=3.12: uv sync --locked --extra dev, uv run python -m build, uv run twine check dist/*. The wheel says Metadata-Version: 2.5, and twine 6.2.0 fails it with InvalidDistribution: Invalid distribution metadata: '2.5' is not a valid metadata version.

Cause. twine 6.2.0 overwrites packaging.metadata._VALID_METADATA_VERSIONS with a list that ends at "2.4". That happens even though the locked packaging 26.2 already knows 2.5. twine 7.0.0 (2026-07-27) removes the override: its changelog says "Fix uploading packages with metadata version 2.5" (pypa/twine#1317).

Fix. uv lock --upgrade-package twine (uv 0.13.4) moves twine 6.2.0 → 7.0.0 and nothing else. twine 7 needs packaging>=26.1 and rich>=14.3.3, and the lock already has 26.2 and 15.0.0. The lock diff is the twine version, sdist and wheel lines only. [build-system] and the workflows are unchanged.

Run on this branch with the fix (uv 0.13.4):

• build job steps on Python 3.12 (as ci.yml) and 3.13 (as release.yml): uv sync --locked --extra dev, then uv run python -m build, then uv run twine check dist/*. Pass: wheel and sdist both PASSED, and the wheel is still Metadata-Version 2.5.
• The rest of release.yml on 3.13: uv run pytest (72 passed, 3 live deselected), uv run ruff check e2b_adk tests examples and uv run mypy e2b_adk. Pass.
• uv sync --locked --extra dev on 3.10 and 3.11: pass.

PR CI on 426e434 is all green on ubuntu with the latest uv: build passes, and so does lint-type-test on 3.10 through 3.13.