chore: bump uv to 0.13.4 in every pin

Dependabot moved uv in pyproject.toml alone, while validate.yml and
CONTRIBUTING kept 0.12.9. Both pins move together, and a test now
fails when a package pinned in both carries two versions.

.github/workflows/validate.yml

@@ -247,7 +247,7 @@ jobs:
       # setuptools reads pyproject.toml for the packaging guard, and uv builds
       # the PyPI package the way a release builds it.
       - name: Install dependencies
-        run: pip install pyyaml "jsonschema[format-nongpl]==4.26.0" "markdown==3.10.2" "pyte==0.8.2" "hypothesis==6.170.8" "vermin==1.9.2" "setuptools==80.9.0" "uv==0.12.9"
+        run: pip install pyyaml "jsonschema[format-nongpl]==4.26.0" "markdown==3.10.2" "pyte==0.8.2" "hypothesis==6.170.8" "vermin==1.9.2" "setuptools==80.9.0" "uv==0.13.4"
 
       # The full screen also runs under the 3.8 floor: the end-to-end tests
       # start install.py with the interpreter that runs them.

CONTRIBUTING.md

@@ -72,7 +72,7 @@ validation above is its check. For code, profiles or platform files, these are
 the checks CI runs on a pull request (Python 3.12 or newer):
 
 ```bash
-pip install pyyaml "jsonschema[format-nongpl]==4.26.0" "markdown==3.10.2" "pyte==0.8.2" "hypothesis==6.170.8" "vermin==1.9.2" "setuptools==80.9.0" "uv==0.12.9"
+pip install pyyaml "jsonschema[format-nongpl]==4.26.0" "markdown==3.10.2" "pyte==0.8.2" "hypothesis==6.170.8" "vermin==1.9.2" "setuptools==80.9.0" "uv==0.13.4"
 python scripts/pr_checks.py
 ```
 

pyproject.toml

@@ -42,7 +42,7 @@ dev = [
     # bundles: without it the guard skipped on every CI run.
     "setuptools>=61",
     # scripts/build_pypi.py runs `uv build` for the PyPI package and its test.
-    "uv==0.12.9",
+    "uv==0.13.4",
     # The type check CI runs, pinned: another mypy reports other errors
     # than the ones mypy-baseline.txt holds.
     "mypy==1.18.2",

tests/test_contributing_text.py

@@ -216,6 +216,24 @@ class TheGuideRebuildsWhenItsPinsMove(unittest.TestCase):
         self.assertIn(".github/workflows/validate.yml", paths)
 
 
+class TheDevPinsAreTheOnesCiInstalls(unittest.TestCase):
+    """Dependabot bumped uv in pyproject.toml alone, while validate.yml and
+    CONTRIBUTING kept the older pin: a contributor and CI ran two builds."""
+
+    PIN = re.compile(r'"([A-Za-z0-9_.-]+)(?:\[[^\]]*\])?==([^"]+)"')
+
+    def test_a_package_both_pin_has_one_version(self):
+        workflow = (REPO_ROOT / ".github" / "workflows" / "validate.yml").read_text(encoding="utf-8")
+        project = (REPO_ROOT / "pyproject.toml").read_text(encoding="utf-8")
+        ci = {name.lower(): version for name, version in self.PIN.findall(workflow)}
+        dev = {name.lower(): version for name, version in self.PIN.findall(project)}
+        shared = sorted(set(ci) & set(dev))
+        self.assertIn("uv", shared)
+        for name in shared:
+            with self.subTest(package=name):
+                self.assertEqual(dev[name], ci[name])
+
+
 class OneCommandRunsTheChecks(unittest.TestCase):
     """A contributor copied ten commands by hand before a pull request, and
     skipping one (refresh_data_dirs) failed the pack tests with no hint."""