[sentry-junior]

Drops pip from the build pipeline. Builds on #2639, which already reads each release from PyPI's JSON API.

uv has no pip download, so build.py now downloads files straight from the URLs the JSON API lists:

• Wheels: picks the most specific compatible wheel in tag-priority order, checks its sha256, and falls back to the next one if the arch check rejects it. This replaces pip's --platform=any retry.
• Sdists: fetched the same way, then built with uv build --wheel against our index.
• No more simple-index retries: the JSON lookup is the only step that waits for propagation. A release with no usable wheel and no sdist now fails right away.

Other pip users:

• validate.py uses uv venv + uv pip install.
• add_pkg.py resolves with uv pip compile.
• docker/install-pythons no longer runs ensurepip or installs pip/setuptools/wheel into the interpreters.
• pip and virtualenv are removed from the project dependencies.

Also bumps .python-version from 3.11.4 to 3.11.17. ubuntu-latest is rolling over to 26.04, where setup-python has no 3.11.4 build, so pre-commit was failing before any hooks ran.

Things to watch:

• Validation venvs are no longer seeded with pip/setuptools/wheel. A new package that imports pkg_resources without declaring setuptools will now fail validation. That matches how our uv-managed environments behave.
• The docker/ change only reaches the linux image after merge (the image is built from main). The macOS job runs install-pythons directly, so this PR covers that path.
• PR CI only builds packages that aren't already in the index, so uv build gets real coverage from new packages as they land.

via @joshuarli.

--

View Junior Session [Sentry]

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 133a11e. Configure here.}

[cursor]

Resolver drops upgrade_all stdin contract

Medium Severity

add_pkg now feeds uv pip compile via input= and -, so the process no longer inherits stdin. upgrade_all still invokes it as -r/dev/stdin and pipes package names in, so the documented upgrade path resolves the literal -r/dev/stdin instead of the package list and adds nothing or crashes.

 

^{Reviewed by Cursor Bugbot for commit 133a11e. Configure here.}