build(core): make sure `uv.lock` is up-to-date
What the developer wrote
Authored by Roman Zeyde
build(core): make sure `uv.lock` is up-to-date
[no changelog]
What changed, and why it matters
This is a one-line build script change that adds the '--locked' flag to a Python package manager command. It tells the build tool to refuse to proceed if its lock file is out of date, preventing accidental use of unexpected dependency versions. There is no security vulnerability or exploit here.
No security action required. Treat as a normal build-quality/reproducibility improvement.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies build-docker.sh so that ‘uv sync’ becomes ‘uv sync –locked’. The –locked flag causes uv to fail instead of updating uv.lock when the lock file is stale. This is a build-hardening/reproducibility improvement, not a patch for a security bug. No vulnerability is described, fixed, or implied by the diff.
Changed components
build-docker.shInspect captured patch +1 / −1
diff --git a/build-docker.sh b/build-docker.sh
index 958a8f5a6..c51274375 100755
--- a/build-docker.sh
+++ b/build-docker.sh
@@ -213,7 +213,7 @@ fi # init
cat <<EOF >> "$SCRIPT_NAME"
$GIT_CLEAN_REPO
git submodule update --init --recursive
- uv sync
+ uv sync --locked
cd core/embed/rust
cargo fetch
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.