diff --git a/images/base/Dockerfile b/images/base/Dockerfile
index 63673624..6b96fa2b 100644
--- a/images/base/Dockerfile
+++ b/images/base/Dockerfile
@@ -21,7 +21,7 @@ ARG PYTHON_VERSION=3.14.8
 ARG PYTHON_315_VERSION=3.15.0
 ARG NODE_VERSION=24.22.0
 ARG NPM_VERSION=12.2.1
-ARG UV_VERSION=0.13.1
+ARG UV_VERSION=0.13.4
 
 LABEL org.opencontainers.image.title="Remote Dev Base" \
       org.opencontainers.image.description="Community remote development base for browser-hosted coding agents" \
@@ -212,6 +212,13 @@ RUN test "$(stat -c '%a' "$MISE_SYSTEM_CONFIG_DIR")" = 755 \
     && test "$(npm --version)" = "$NPM_VERSION" \
     && test "$(npx --version)" = "$NPM_VERSION" \
     && uv --version \
+    && test "$(uv --version | awk '{print $2}')" = "${UV_VERSION}" \
+    && for security_python in \
+      "$MISE_DATA_DIR/installs/python/$PYTHON_VERSION/bin/python3" \
+      "$MISE_DATA_DIR/installs/python/$PYTHON_315_VERSION/bin/python3"; do \
+        "$security_python" -I -c 'import pip; v=tuple(map(int,pip.__version__.split(".")[:3])); assert v >= (26,2,2), f"insecure pip {pip.__version__}"' || exit; \
+        "$security_python" -I -m pip --version || exit; \
+      done \
     && rm -rf "${MISE_CACHE_DIR:?}"/*
 
 # Keep project and bundled-component terms inspectable in both the repository and
diff --git a/mise.lock b/mise.lock
index a1393379..ebb67d4c 100644
--- a/mise.lock
+++ b/mise.lock
@@ -65,13 +65,13 @@ backend = "core:python"
 specifiers = ["3.14.8"]
 
 [tools.python."platforms.linux-arm64"]
-checksum = "sha256:4395ae16388f9d3409cba7e20161753ed3359b13d959345415029f874f675162"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8+20261001-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:6519109a1bed8cff79aad3a6df880c95dde153e2c4c9713846476fa344d94049"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8+20261020-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
 provenance = "github-attestations"
 
 [tools.python."platforms.linux-x64"]
-checksum = "sha256:b373a4a4e4e70fc05f368c9b53d7738bf37637682b650d96c742805d2da26c32"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8+20261001-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:b88a4ac994ac55c35a03a3672103618d5c5d5bf342db7b2093b8d328b6516b42"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8+20261020-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
 provenance = "github-attestations"
 
 [[tools.python]]
@@ -80,13 +80,13 @@ backend = "core:python"
 specifiers = ["3.15.0"]
 
 [tools.python."platforms.linux-arm64"]
-checksum = "sha256:00345e47b7f42d10ec60d28b2ccad6b1f33c40697f0ae57ee15d70896efad0b5"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0+20261009-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:341f9984c0206fef013761fa6adc5b26f28fcf333dd9bc9ff64f23b6fdf9b58b"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0+20261020-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
 provenance = "github-attestations"
 
 [tools.python."platforms.linux-x64"]
-checksum = "sha256:46edc8f6fccade47dc38001ef2d4094d9cedd21a1863d9b44b2a02c1ee76b94d"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0+20261009-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:d8982167b0b96b660a688f2b8f1e47e49d7c50da17029a07d3ac5fd418514c63"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0+20261020-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
 provenance = "github-attestations"
 
 [[tools.shfmt]]
@@ -105,20 +105,20 @@ url = "https://github.com/mvdan/sh/releases/download/v3.14.1/shfmt_v3.14.1_linux
 url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/547320883"
 
 [[tools.uv]]
-version = "0.13.1"
+version = "0.13.4"
 backend = "aqua:astral-sh/uv"
-specifiers = ["0.13.1"]
+specifiers = ["0.13.4"]
 
 [tools.uv."platforms.linux-arm64"]
-checksum = "sha256:9041c73c99fdc5892cf128140beb354eca9231d502068cc36e6cb53a8e59ad14"
-url = "https://github.com/astral-sh/uv/releases/download/0.13.1/uv-aarch64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/639312990"
+checksum = "sha256:1ae72b4718729e2ccc4f1ae2c6d1e531ca8467800e0546e9130b3886023a60ab"
+url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/659693320"
 provenance = "github-attestations"
 
 [tools.uv."platforms.linux-x64"]
-checksum = "sha256:eadd9d27c134ab5ac1ffd4473b97a741407f3ea238288f03121fc4deddf90220"
-url = "https://github.com/astral-sh/uv/releases/download/0.13.1/uv-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/639313223"
+checksum = "sha256:2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f"
+url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/659693663"
 provenance = "github-attestations"
 
 [[tools.yq]]
diff --git a/mise.toml b/mise.toml
index bfbcf7e7..e09ad121 100644
--- a/mise.toml
+++ b/mise.toml
@@ -6,7 +6,7 @@ lockfile_platforms = ["linux-x64", "linux-arm64"]
 [tools]
 python = ["3.14.8", "3.15.0"]
 node = "24.22.0"
-uv = "0.13.1"
+uv = "0.13.4"
 "pypi:ruff" = { version = "0.17.1", python = "3.14.8" }
 "pypi:pytest" = { version = "9.1.1", python = "3.14.8" }
 "pypi:pre-commit" = { version = "4.7.0", python = "3.14.8" }
diff --git a/scripts/compact-python-runtime-notices.py b/scripts/compact-python-runtime-notices.py
index c3430332..9f086f16 100644
--- a/scripts/compact-python-runtime-notices.py
+++ b/scripts/compact-python-runtime-notices.py
@@ -206,8 +206,8 @@ def check(root: Path, output: Path, sync: ModuleType, python_version: str | None
         actual_digest = hashlib.sha256(content).hexdigest()
         if actual_digest != digest:
             fail(f"supplemental Python license digest mismatch: {path}")
-    if actual_supplemental != expected_supplemental:
-        fail("Python supplemental license sources do not match the reviewed mapping")
+    if not actual_supplemental.issubset(expected_supplemental):
+        fail("Python supplemental license manifest contains an unreviewed source")
 
     print("Compact Python standalone runtime notices: OK")
 
diff --git a/scripts/sync-python-runtime-notices.py b/scripts/sync-python-runtime-notices.py
index 40520c92..a0900242 100644
--- a/scripts/sync-python-runtime-notices.py
+++ b/scripts/sync-python-runtime-notices.py
@@ -411,13 +411,14 @@ def check(root: Path, output: Path, python_version: str | None = None) -> None:
     expected_supplemental = {
         (entry["url"], entry["sha256"]) for entry in SUPPLEMENTAL_LICENSES.values()
     }
+    if not all(isinstance(entry, dict) for entry in supplemental):
+        fail("Python supplemental license records must be objects")
     actual_supplemental = {
         (entry.get("source_url"), entry.get("sha256"))
         for entry in supplemental
-        if isinstance(entry, dict)
     }
-    if actual_supplemental != expected_supplemental:
-        fail("Python supplemental license sources do not match the reviewed mapping")
+    if not actual_supplemental.issubset(expected_supplemental):
+        fail("Python supplemental license manifest contains an unreviewed source")
 
     print("Python standalone runtime notices: OK")
 
diff --git a/scripts/test_sync_python_runtime_notices.py b/scripts/test_sync_python_runtime_notices.py
index 91d80878..b86e2d67 100644
--- a/scripts/test_sync_python_runtime_notices.py
+++ b/scripts/test_sync_python_runtime_notices.py
@@ -159,6 +159,22 @@ def test_check_accepts_metadata_tied_to_current_lock(self) -> None:
                 json.dumps(manifest), encoding="utf-8"
             )
             self.sync.check(root, output)
+            # New upstream full archives can already include both historical
+            # missing licenses; no supplemental download is then necessary.
+            manifest["supplemental_licenses"] = []
+            (output / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+            self.sync.check(root, output)
+            # Unknown or substituted supplemental sources must remain rejected.
+            manifest["supplemental_licenses"] = [
+                {"source_url": "https://example.invalid/LICENSE", "sha256": "0" * 64}
+            ]
+            (output / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+            self.assert_rejected(self.sync.check, root, output)
+            # A non-dictionary supplemental entry must fail even when its
+            # removal would otherwise make the approved subset look empty.
+            manifest["supplemental_licenses"] = [False]
+            (output / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+            self.assert_rejected(self.sync.check, root, output)
 
 
 if __name__ == "__main__":
diff --git a/third_party/components/python-build-standalone-315/amd64/license-metadata.json b/third_party/components/python-build-standalone-315/amd64/license-metadata.json
index d7a52b00..8fa9fcce 100644
--- a/third_party/components/python-build-standalone-315/amd64/license-metadata.json
+++ b/third_party/components/python-build-standalone-315/amd64/license-metadata.json
@@ -21,7 +21,6 @@
     "licenses/LICENSE.libxcb.txt",
     "licenses/LICENSE.mpdecimal.txt",
     "licenses/LICENSE.ncurses.txt",
-    "licenses/LICENSE.openssl-1.1.txt",
     "licenses/LICENSE.openssl-3.txt",
     "licenses/LICENSE.sqlite.txt",
     "licenses/LICENSE.tcl.txt",
@@ -93,11 +92,9 @@
     "_hashlib": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
@@ -133,11 +130,9 @@
     "_ssl": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
diff --git a/third_party/components/python-build-standalone-315/arm64/license-metadata.json b/third_party/components/python-build-standalone-315/arm64/license-metadata.json
index 3f76a322..a3fa4a2e 100644
--- a/third_party/components/python-build-standalone-315/arm64/license-metadata.json
+++ b/third_party/components/python-build-standalone-315/arm64/license-metadata.json
@@ -21,7 +21,6 @@
     "licenses/LICENSE.libxcb.txt",
     "licenses/LICENSE.mpdecimal.txt",
     "licenses/LICENSE.ncurses.txt",
-    "licenses/LICENSE.openssl-1.1.txt",
     "licenses/LICENSE.openssl-3.txt",
     "licenses/LICENSE.sqlite.txt",
     "licenses/LICENSE.tcl.txt",
@@ -93,11 +92,9 @@
     "_hashlib": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
@@ -133,11 +130,9 @@
     "_ssl": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
diff --git a/third_party/components/python-build-standalone-315/licenses/LICENSE.openssl-1.1.txt b/third_party/components/python-build-standalone-315/licenses/LICENSE.openssl-1.1.txt
deleted file mode 100644
index 5b5ccdc9..00000000
--- a/third_party/components/python-build-standalone-315/licenses/LICENSE.openssl-1.1.txt
+++ /dev/null
@@ -1,124 +0,0 @@
-
-  LICENSE ISSUES
-  ==============
-
-  The OpenSSL toolkit stays under a double license, i.e. both the conditions of
-  the OpenSSL License and the original SSLeay license apply to the toolkit.
-  See below for the actual license texts.
-
-  OpenSSL License
-  ---------------
-
-/* ====================================================================
- * Copyright (c) 1998-2019 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
- Original SSLeay License
- -----------------------
-
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
diff --git a/third_party/components/python-build-standalone-315/manifest.json b/third_party/components/python-build-standalone-315/manifest.json
index e392535d..86129066 100644
--- a/third_party/components/python-build-standalone-315/manifest.json
+++ b/third_party/components/python-build-standalone-315/manifest.json
@@ -8,40 +8,29 @@
     "noopt"
   ],
   "shared_license_texts": true,
-  "supplemental_licenses": [
-    {
-      "path": "licenses/LICENSE.zlib-ng.txt",
-      "source_url": "https://raw.githubusercontent.com/python/cpython-source-deps/zlib-ng-2.2.4/LICENSE.md",
-      "sha256": "6c9f0d975b41afaa34d22f55bb8986ce69e5cb7ad327cb2b28820cd425edf5ee"
-    },
-    {
-      "path": "licenses/LICENSE.zstd.txt",
-      "source_url": "https://raw.githubusercontent.com/python/cpython-source-deps/zstd-1.5.7/LICENSE",
-      "sha256": "7055266497633c9025b777c78eb7235af13922117480ed5c674677adc381c9d8"
-    }
-  ],
+  "supplemental_licenses": [],
   "artifacts": [
     {
       "arch": "amd64",
       "target": "x86_64-unknown-linux-gnu",
       "python_version": "3.15.0",
-      "release": "20261009",
-      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0+20261009-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
-      "full_asset_name": "cpython-3.15.0+20261009-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst",
-      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0%2B20261009-x86_64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
-      "full_asset_sha256": "61f112783818a61cebc0d6b9894614295fd38e7d885833cbc5d5c1d565a2a5a9",
-      "full_asset_size": 119795975
+      "release": "20261020",
+      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0+20261020-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
+      "full_asset_name": "cpython-3.15.0+20261020-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst",
+      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0%2B20261020-x86_64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
+      "full_asset_sha256": "e3ad05e5f5a00d4b9d74cddf81258a8e934b7f24e316c4fe4ec508432fe0982a",
+      "full_asset_size": 122797375
     },
     {
       "arch": "arm64",
       "target": "aarch64-unknown-linux-gnu",
       "python_version": "3.15.0",
-      "release": "20261009",
-      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0+20261009-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
-      "full_asset_name": "cpython-3.15.0+20261009-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst",
-      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0%2B20261009-aarch64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
-      "full_asset_sha256": "449a4331f64967bf047e720eb3ef0a791796cc0a0f6785c000461fe0e6905220",
-      "full_asset_size": 104006693
+      "release": "20261020",
+      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0+20261020-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
+      "full_asset_name": "cpython-3.15.0+20261020-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst",
+      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0%2B20261020-aarch64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
+      "full_asset_sha256": "2da40807fd62dd351355d2d0a82b6273ee1bede82744daae2d4044602b8b15ed",
+      "full_asset_size": 106109980
     }
   ]
 }
diff --git a/third_party/components/python-build-standalone/amd64/license-metadata.json b/third_party/components/python-build-standalone/amd64/license-metadata.json
index 6408bb80..b05d5c9b 100644
--- a/third_party/components/python-build-standalone/amd64/license-metadata.json
+++ b/third_party/components/python-build-standalone/amd64/license-metadata.json
@@ -21,7 +21,6 @@
     "licenses/LICENSE.libxcb.txt",
     "licenses/LICENSE.mpdecimal.txt",
     "licenses/LICENSE.ncurses.txt",
-    "licenses/LICENSE.openssl-1.1.txt",
     "licenses/LICENSE.openssl-3.txt",
     "licenses/LICENSE.sqlite.txt",
     "licenses/LICENSE.tcl.txt",
@@ -93,11 +92,9 @@
     "_hashlib": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
@@ -123,11 +120,9 @@
     "_ssl": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
diff --git a/third_party/components/python-build-standalone/arm64/license-metadata.json b/third_party/components/python-build-standalone/arm64/license-metadata.json
index 971a2238..41d4a137 100644
--- a/third_party/components/python-build-standalone/arm64/license-metadata.json
+++ b/third_party/components/python-build-standalone/arm64/license-metadata.json
@@ -21,7 +21,6 @@
     "licenses/LICENSE.libxcb.txt",
     "licenses/LICENSE.mpdecimal.txt",
     "licenses/LICENSE.ncurses.txt",
-    "licenses/LICENSE.openssl-1.1.txt",
     "licenses/LICENSE.openssl-3.txt",
     "licenses/LICENSE.sqlite.txt",
     "licenses/LICENSE.tcl.txt",
@@ -93,11 +92,9 @@
     "_hashlib": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
@@ -123,11 +120,9 @@
     "_ssl": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
diff --git a/third_party/components/python-build-standalone/licenses/LICENSE.openssl-1.1.txt b/third_party/components/python-build-standalone/licenses/LICENSE.openssl-1.1.txt
deleted file mode 100644
index 5b5ccdc9..00000000
--- a/third_party/components/python-build-standalone/licenses/LICENSE.openssl-1.1.txt
+++ /dev/null
@@ -1,124 +0,0 @@
-
-  LICENSE ISSUES
-  ==============
-
-  The OpenSSL toolkit stays under a double license, i.e. both the conditions of
-  the OpenSSL License and the original SSLeay license apply to the toolkit.
-  See below for the actual license texts.
-
-  OpenSSL License
-  ---------------
-
-/* ====================================================================
- * Copyright (c) 1998-2019 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
- Original SSLeay License
- -----------------------
-
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
diff --git a/third_party/components/python-build-standalone/manifest.json b/third_party/components/python-build-standalone/manifest.json
index a7f4fbe9..ca17b2a9 100644
--- a/third_party/components/python-build-standalone/manifest.json
+++ b/third_party/components/python-build-standalone/manifest.json
@@ -8,40 +8,29 @@
     "noopt"
   ],
   "shared_license_texts": true,
-  "supplemental_licenses": [
-    {
-      "path": "licenses/LICENSE.zlib-ng.txt",
-      "source_url": "https://raw.githubusercontent.com/python/cpython-source-deps/zlib-ng-2.2.4/LICENSE.md",
-      "sha256": "6c9f0d975b41afaa34d22f55bb8986ce69e5cb7ad327cb2b28820cd425edf5ee"
-    },
-    {
-      "path": "licenses/LICENSE.zstd.txt",
-      "source_url": "https://raw.githubusercontent.com/python/cpython-source-deps/zstd-1.5.7/LICENSE",
-      "sha256": "7055266497633c9025b777c78eb7235af13922117480ed5c674677adc381c9d8"
-    }
-  ],
+  "supplemental_licenses": [],
   "artifacts": [
     {
       "arch": "amd64",
       "target": "x86_64-unknown-linux-gnu",
       "python_version": "3.14.8",
-      "release": "20261001",
-      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8+20261001-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
-      "full_asset_name": "cpython-3.14.8+20261001-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst",
-      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8%2B20261001-x86_64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
-      "full_asset_sha256": "0f5cfcf664aa406ee958625ed5b29b1bfc76d553e8ad1304f48fec39b74e0554",
-      "full_asset_size": 111212592
+      "release": "20261020",
+      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8+20261020-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
+      "full_asset_name": "cpython-3.14.8+20261020-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst",
+      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8%2B20261020-x86_64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
+      "full_asset_sha256": "1c891c5652f6ac56522baedba920064466cebbba7c3ccd1e35a0ff31aae68ef4",
+      "full_asset_size": 114456621
     },
     {
       "arch": "arm64",
       "target": "aarch64-unknown-linux-gnu",
       "python_version": "3.14.8",
-      "release": "20261001",
-      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8+20261001-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
-      "full_asset_name": "cpython-3.14.8+20261001-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst",
-      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8%2B20261001-aarch64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
-      "full_asset_sha256": "15f23cb65278486f65c718e0fe706d131dd25ffb8bed99ef5676daf4ffebd9d3",
-      "full_asset_size": 96982577
+      "release": "20261020",
+      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8+20261020-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
+      "full_asset_name": "cpython-3.14.8+20261020-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst",
+      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8%2B20261020-aarch64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
+      "full_asset_sha256": "37736480b609b184e2710f263bc8f27b7c326d5446a13ce2753846c5b8990d04",
+      "full_asset_size": 99809172
     }
   ]
 }
diff --git a/third_party/inventory.json b/third_party/inventory.json
index 5e3c384a..a822ce1a 100644
--- a/third_party/inventory.json
+++ b/third_party/inventory.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "reviewed_on": "2026-08-29",
-  "refreshed_on": "2026-10-18",
+  "refreshed_on": "2026-10-21",
   "policy": {
     "source_of_truth": "versions.env",
     "maintenance": "Version changes require a reviewed inventory and notice update in the same pull request.",
@@ -180,19 +180,19 @@
       "name": "uv",
       "image_scope": "both",
       "version_key": "UV_VERSION",
-      "version": "0.13.1",
+      "version": "0.13.4",
       "source": "https://github.com/astral-sh/uv",
       "license": "Apache-2.0 OR MIT",
       "notices": [
         {
           "path": "components/uv/LICENSE-APACHE-2.0",
           "source": "repository",
-          "reviewed_from": "https://raw.githubusercontent.com/astral-sh/uv/0.13.1/LICENSE-APACHE"
+          "reviewed_from": "https://raw.githubusercontent.com/astral-sh/uv/0.13.4/LICENSE-APACHE"
         },
         {
           "path": "components/uv/LICENSE-MIT",
           "source": "repository",
-          "reviewed_from": "https://raw.githubusercontent.com/astral-sh/uv/0.13.1/LICENSE-MIT"
+          "reviewed_from": "https://raw.githubusercontent.com/astral-sh/uv/0.13.4/LICENSE-MIT"
         }
       ]
     },
diff --git a/third_party/standalone-artifact-inspection.json b/third_party/standalone-artifact-inspection.json
index 29da0bf5..aff3cf90 100644
--- a/third_party/standalone-artifact-inspection.json
+++ b/third_party/standalone-artifact-inspection.json
@@ -173,7 +173,7 @@
     },
     {
       "id": "uv",
-      "version": "0.13.1",
+      "version": "0.13.4",
       "packaging": "tar.gz",
       "repository_notices": [
         {
@@ -190,16 +190,16 @@
       "architecture_legal_sets_equal": true,
       "architectures": {
         "amd64": {
-          "asset_url": "https://github.com/astral-sh/uv/releases/download/0.13.1/uv-x86_64-unknown-linux-gnu.tar.gz",
-          "asset_sha256": "eadd9d27c134ab5ac1ffd4473b97a741407f3ea238288f03121fc4deddf90220",
-          "asset_size": 16738706,
+          "asset_url": "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz",
+          "asset_sha256": "2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f",
+          "asset_size": 16653835,
           "archive_member_count": 3,
           "legal_members": []
         },
         "arm64": {
-          "asset_url": "https://github.com/astral-sh/uv/releases/download/0.13.1/uv-aarch64-unknown-linux-gnu.tar.gz",
-          "asset_sha256": "9041c73c99fdc5892cf128140beb354eca9231d502068cc36e6cb53a8e59ad14",
-          "asset_size": 15838367,
+          "asset_url": "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz",
+          "asset_sha256": "1ae72b4718729e2ccc4f1ae2c6d1e531ca8467800e0546e9130b3886023a60ab",
+          "asset_size": 15769557,
           "archive_member_count": 3,
           "legal_members": []
         }
diff --git a/third_party/standalone-artifact-inspection.md b/third_party/standalone-artifact-inspection.md
index 49738510..6f30501a 100644
--- a/third_party/standalone-artifact-inspection.md
+++ b/third_party/standalone-artifact-inspection.md
@@ -9,7 +9,7 @@ This is a bounded inspection of the exact AMD64 and ARM64 release assets pinned
 | codex-code-mode-host | `rust-v0.163.0` | tar.gz | None | LICENSE, NOTICE |
 | ttyd | `1.7.7` | raw-binary | None | LICENSE |
 | mise | `2026.10.13` | raw-binary | None | LICENSE |
-| uv | `0.13.1` | tar.gz | None | LICENSE-APACHE-2.0, LICENSE-MIT |
+| uv | `0.13.4` | tar.gz | None | LICENSE-APACHE-2.0, LICENSE-MIT |
 | yq | `4.54.1` | raw-binary | None | LICENSE |
 | shfmt | `3.14.1` | raw-binary | None | LICENSE |
 | actionlint | `1.7.12` | tar.gz | LICENSE.txt | LICENSE.txt |
diff --git a/versions.env b/versions.env
index 79c43744..7bdacbf6 100644
--- a/versions.env
+++ b/versions.env
@@ -29,7 +29,7 @@ PYTHON_315_VERSION=3.15.0
 NODE_VERSION=24.22.0
 # Updated together with the other runtime pins by check-upstream.yml.
 NPM_VERSION=12.2.1
-UV_VERSION=0.13.1
+UV_VERSION=0.13.4
 RUFF_VERSION=0.17.1
 PYTEST_VERSION=9.1.1
 PRE_COMMIT_VERSION=4.7.0