Repository navigation
Update GitHub Actions dependencies - #799
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
The following commit authors need to sign the Contributor License Agreement:
|
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #799 +/- ##
=======================================
Coverage 97.26% 97.26%
=======================================
Files 3 3
Lines 7859 7859
=======================================
Hits 7644 7644
Misses 215 215
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/github-actions-dependencies
branch
from
October 12, 2026 16:36
8109231 to
d8a74cd
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v7.0.0→v7.0.1v6.3.0→v7.0.0v8.2.0→v10.2.0v10.3.00.12.7→0.12.230.13.0(+1)v7.0.0→v7.1.1v1.14.0→v1.14.2Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
actions/setup-python (actions/setup-python)
v7.0.0Compare Source
What's Changed
Enhancements
Bug Fix
Dependency Upgrade
New Contributors
Full Changelog: actions/setup-python@v6...v7.0.0
astral-sh/setup-uv (astral-sh/setup-uv)
v10.2.0: 🌈 Disable automatic cache saves for merge queuesCompare Source
Changes
This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v10.1.0: 🌈 New outputpython-runtime-idand respect NO_PROXYCompare Source
Changes
This release adds more bheind the scene security improvements and also 2 small improvements.
NO_PROXY
This action now respects
no_proxy/NO_PROXYenvironment variables which were previously ignored.New output
python-runtime-idThe new output
python-runtime-idcan be used to know which python version exactly was installed if you useactivate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v10.0.1: 🌈 Tolerate transient manifest timeoutsCompare Source
Changes
Thank you @arguile- for making this action more resilient.
🐛 Bug fixes
🧰 Maintenance
📚 Documentation
v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL featuresCompare Source
Changes
Another breaking release, directly after v9.0.0 but we think the added security justifies that.
Extra security by default
If you use the default
enable-cache: autothis will now DISABLE THE CACHE to protect against cache poisoning for the following events:pull_request_targetworkflow_runreleaseYou can read the full reasoning in #984
version: latest-knownThis will now install the latest version with a checksum that is known by this action. The known
uvchecksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.Read python version from
.tool-versionsWill now also set the python version if it is defined in
.tool-versions. You can read the details in the docs🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v9.0.0: 🌈 Changeprune-cachedefault tofalseCompare Source
Changes
This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967
Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.
🚨 Breaking changes
prune-cachedefault tofalse@charliermarsh (#967)🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.3.2: 🌈 update known checksums for 0.11.28Compare Source
Changes
Just a maintenance release
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.3.1: 🌈 update known checksums for 0.11.27Compare Source
Changes
Just a maintenance release
🧰 Maintenance
📚 Documentation
v8.3.0: 🌈 Support uv.lock as a version-file sourceCompare Source
Changes
Thanks to @somaz94 you can now use the pinned version of uv itself in
uv.lock. It gets picked up automatically.If you have pinned another version of uv in your
uv.lockyou can use the inputsversionorversion-sourceto override this.🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
astral-sh/uv (astral-sh/uv)
v0.12.23Compare Source
Release Notes
Released on 2026-10-03.
Python
Preview features
uv.lockwithout a workspace manifest usinguv sync --frozenwithfrozen-lockfile(#22018)uv.lockwithout a workspace manifest usinguv export --frozenwithfrozen-lockfile(#22007)uv.lockwithout a workspace manifest usinguv tree --frozenwithfrozen-lockfile(#22016)uv.lockwithout a workspace manifest usinguv workspace metadata --frozenwithfrozen-lockfile(#22017, #22018)Bug fixes
win_amd64wheels instead of building from source (#22099)Install uv 0.12.23
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.23/uv-installer.ps1 | iex"Download uv 0.12.23
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.12.22Compare Source
Release Notes
Released on 2026-10-01.
Python
Enhancements
--offlineoption fromuv publishhelp (#22124)Preview features
--no-default-groupsinuv audit(#22090)uv auditoruv tool auditruns offline and hide the unsupported option from help (#22114)Configuration
UV_PYTHON_ARCHto select an interpreter architecture independently of its Python version (#22098)Performance
Bug fixes
Other changes
Install uv 0.12.22
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.22/uv-installer.ps1 | iex"Download uv 0.12.22
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.12.21Compare Source
Release Notes
Released on 2026-09-29.
Python
Enhancements
[manifest]tables from lockfiles that contain only manifest subtables (#22070)Preview features
uv.lock, including those involving pre-releases, with theresolution-inputspreview feature (#22004, #22068)Bug fixes
uv python pin --rmfrom removing a global.python-versionsfile without--global(#21992)Install uv 0.12.21
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.21/uv-installer.ps1 | iex"Download uv 0.12.21
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
v0.12.20Compare Source
Release Notes
Released on 2026-09-28.
Enhancements
Preview features
lockfile-normalizationpreview feature (#21951)pylock.toml(#22003)pylock.tomlfiles relative to the output file (#22042)tool-install-locksrequirements resolve to the same package (#22000)lock-without-metadatalockfiles for conflicting groups with distinct base and extra requirement specifiers (#22055)uv workspace metadataanduv tree --format jsonoutput (#22050)Configuration
XDG_CONFIG_DIRSafter empty entries (#21987)Performance
Bug fixes
--require-hashesand--verify-hashes(#21996)--no-build(#21988)--all-packages, including--no-install-projectand--no-emit-project(#21994)pyproject.tomlifuv upgradefails or is interrupted (#21983)--show-settings(#21989)uv python listanduv python upgradeinstead of panicking (#22033)/install(#22036)Install uv 0.12.20
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.20/uv-installer.ps1 | iex"Download uv 0.12.20