build(deps): update astral-sh/setup-uv action to v10 (main)

Issue body

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | action | major | `v9.0.0` → `v10.2.0` | --- ### Release Notes <details> <summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary> ### [`v10.2.0`](https://redirect.github.com/astral-sh/setup-uv/compare/v10.1.0...v10.2.0) [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.1.0...v10.2.0) ### [`v10.1.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.1.0): 🌈 New output `python-runtime-id`and respect NO_PROXY [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.0.1...v10.1.0) ##### Changes This release adds more bheind the scene security improvements and also 2 small improvements. ##### NO\_PROXY This action now respects `no_proxy/NO_PROXY` environment variables which were previously ignored. ##### New output `python-runtime-id` The new output `python-runtime-id` can be used to know which python version exactly was installed if you use `activate-environment`. See [pyca/cryptography#15572 (comment)](https://redirect.github.com/pyca/cryptography/pull/15572#discussion_r3913508686) for details on why this can be useful. ##### 🐛 Bug fixes - fix: respect no proxy directive [@mj0nez](https://redirect.github.com/mj0nez) ([#1037](https://redirect.github.com/astral-sh/setup-uv/issues/1037)) - Use JSON + a typed wrapper instead of TS codegen [@woodruffw](https://redirect.github.com/woodruffw) ([#1025](https://redirect.github.com/astral-sh/setup-uv/issues/1025)) ##### 🚀 Enhancements - Expose a Python "identity" output [@woodruffw](https://redirect.github.com/woodruffw) ([#1036](https://redirect.github.com/astral-sh/setup-uv/issues/1036)) - Verify downloads with astral-sh/versions checksums [@zaniebot](https://redirect.github.com/zaniebot) ([#1033](https://redirect.github.com/astral-sh/setup-uv/issues/1033)) ##### 🧰 Maintenance - chore: update known checksums for 0.12.12 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1041](https://redirect.github.com/astral-sh/setup-uv/issues/1041)) - chore: update known checksums for 0.12.10/0.12.11 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1038](https://redirect.github.com/astral-sh/setup-uv/issues/1038)) - chore: update known checksums for 0.12.9 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1035](https://redirect.github.com/astral-sh/setup-uv/issues/1035)) - chore: update known checksums for 0.12.7/0.12.8 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1031](https://redirect.github.com/astral-sh/setup-uv/issues/1031)) - chore: update known checksums for 0.12.6 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1030](https://redirect.github.com/astral-sh/setup-uv/issues/1030)) - chore: update known checksums for 0.12.5 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1020](https://redirect.github.com/astral-sh/setup-uv/issues/1020)) - Use self-repo syntax for all in-repo actions/reusable workflows [@woodruffw](https://redirect.github.com/woodruffw) ([#1024](https://redirect.github.com/astral-sh/setup-uv/issues/1024)) - Pin one-shot tools [@woodruffw](https://redirect.github.com/woodruffw) ([#1022](https://redirect.github.com/astral-sh/setup-uv/issues/1022)) - ci: remove obsolete direct push attempts [@eifinger](https://redirect.github.com/eifinger) ([#1019](https://redirect.github.com/astral-sh/setup-uv/issues/1019)) ##### 📚 Documentation - docs: update version references to v10.0.1 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1018](https://redirect.github.com/astral-sh/setup-uv/issues/1018)) ##### ⬆️ Dependency updates - chore(deps-dev): roll up Dependabot updates [@eifinger](https://redirect.github.com/eifinger) ([#1043](https://redirect.github.com/astral-sh/setup-uv/issues/1043)) - Harden npm install defaults [@zaniebot](https://redirect.github.com/zaniebot) ([#1026](https://redirect.github.com/astral-sh/setup-uv/issues/1026)) - Add dependency cooldowns [@woodruffw](https://redirect.github.com/woodruffw) ([#1021](https://redirect.github.com/astral-sh/setup-uv/issues/1021)) ### [`v10.0.1`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.0.1): 🌈 Tolerate transient manifest timeouts [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.0.0...v10.0.1) ##### Changes Thank you [@arguile-](https://redirect.github.com/arguile-) for making this action more resilient. ##### 🐛 Bug fixes - Tolerate transient manifest timeouts [@arguile-](https://redirect.github.com/arguile-) ([#1016](https://redirect.github.com/astral-sh/setup-uv/issues/1016)) ##### 🧰 Maintenance - chore: update known checksums for 0.12.4 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1017](https://redirect.github.com/astral-sh/setup-uv/issues/1017)) ##### 📚 Documentation - docs: update version references to v10.0.0 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1014](https://redirect.github.com/astral-sh/setup-uv/issues/1014)) ### [`v10.0.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.0.0): 🌈 Disable automatic caching for sensitive events and new QOL features [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v9.0.0...v10.0.0) ##### Changes Another breaking release, directly after v9.0.0 but we think the added security justifies that. ##### Extra security by default If you use the default `enable-cache: auto` this will now **DISABLE THE CACHE** to protect against cache poisoning for the following events: - `pull_request_target` - `workflow_run` - `release` You can read the full reasoning in [#984](https://redirect.github.com/astral-sh/setup-uv/issues/984) ##### `version: latest-known` ```yaml - name: Install the latest version of uv known to setup-uv uses: astral-sh/setup-uv@v10.0.0 with: version: "latest-known" ``` This will now install the latest version with a checksum that is known by this action. The [known `uv` checksums](https://redirect.github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts) are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security. ##### Read python version from `.tool-versions` ```yaml - name: Install uv based on the version defined in .tool-versions and also set python uses: astral-sh/setup-uv@v10.0.0 with: version-file: "pyproject.toml" ``` Will now also set the python version if it is defined in `.tool-versions`. You can read the details [in the docs](https://redirect.github.com/astral-sh/setup-uv/blob/main/docs/advanced-version-configuration.md#install-a-version-defined-in-a-requirements-or-config-file) ##### 🚨 Breaking changes - Disable automatic caching for sensitive events [@eifinger](https://redirect.github.com/eifinger) ([#992](https://redirect.github.com/astral-sh/setup-uv/issues/992)) ##### 🐛 Bug fixes - Reject paths in .tool-versions [@eifinger](https://redirect.github.com/eifinger) ([#1007](https://redirect.github.com/astral-sh/setup-uv/issues/1007)) ##### 🚀 Enhancements - Read Python version from .tool-versions [@eifinger](https://redirect.github.com/eifinger) ([#996](https://redirect.github.com/astral-sh/setup-uv/issues/996)) - Add latest-known version selector [@eifinger](https://redirect.github.com/eifinger) ([#993](https://redirect.github.com/astral-sh/setup-uv/issues/993)) ##### 🧰 Maintenance - Require pull requests for Dependabot rollups [@eifinger](https://redirect.github.com/eifinger) ([#1005](https://redirect.github.com/astral-sh/setup-uv/issues/1005)) - ci: pin Alpine container image [@eifinger](https://redirect.github.com/eifinger) ([#995](https://redirect.github.com/astral-sh/setup-uv/issues/995)) - chore: update known checksums for 0.12.3 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#991](https://redirect.github.com/astral-sh/setup-uv/issues/991)) - chore: update known checksums for 0.12.2 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#985](https://redirect.github.com/astral-sh/setup-uv/issues/985)) - chore: update known checksums for 0.12.1 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#982](https://redirect.github.com/astral-sh/setup-uv/issues/982)) - chore: update known checksums for 0.12.0 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#981](https://redirect.github.com/astral-sh/setup-uv/issues/981)) - chore: update known checksums for 0.11.31/0.11.32 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#972](https://redirect.github.com/astral-sh/setup-uv/issues/972)) ##### 📚 Documentation - docs: update version references to v9.0.0 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#971](https://redirect.github.com/astral-sh/setup-uv/issues/971)) ##### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@eifinger](https://redirect.github.com/eifinger) ([#1013](https://redirect.github.com/astral-sh/setup-uv/issues/1013)) - chore(deps): roll up Dependabot updates [@eifinger](https://redirect.github.com/eifinger) ([#1004](https://redirect.github.com/astral-sh/setup-uv/issues/1004)) - chore(deps): roll up Dependabot updates [@eifinger](https://redirect.github.com/eifinger) ([#994](https://redirect.github.com/astral-sh/setup-uv/issues/994)) - chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#976](https://redirect.github.com/astral-sh/setup-uv/issues/976)) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#980](https://redirect.github.com/astral-sh/setup-uv/issues/980)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).

Evaluation history

Date	Model	Scores	Action	Summary
2026-10-05 02:12 PM UTC	~deepseek/deepseek-pro-latest	—	closed resolved	Merged Renovate PR bumping astral-sh/setup-uv from v9.0.0 to v10.2.0 in a charmcraft workflow.
2026-10-03 11:21 AM UTC	stealth/space-bunny-alpha	Impact: 25 Quick Win: 12 Complexity: 10 Confidence: 68 Actionability: 55	needs review	Renovate bumps astral-sh/setup-uv action v9.0.0 -> v10.2.0 in a charmcraft workflow (+1/-1). Automerge enabled; 13 checks pass, but lint / files and Security scan / OSV-scanner fail and some test jobs still pending.

Update history

Date	Change
2026-10-05 02:10 PM UTC	merged
2026-10-03 11:15 AM UTC	created

Related issues

Issue	Project	State	Summary	Similarity
#279 build(deps): update astral-sh/setup-uv action to v10 (main)	craft-platforms	merged	Merged Renovate PR bumping astral-sh/setup-uv from v9.0.0 to v10.2.0 in .github/workflows/check-renovate.yaml.	95%
#1755 build(deps): update astral-sh/setup-uv action to v10 (main)	craft-parts	merged	Merged Renovate PR updating astral-sh/setup-uv GitHub Action from v9.0.0 to v10.2.0 in the main workflow.	94%
#214 build(deps): update astral-sh/setup-uv action to v10 (main) - autoclosed	craft-grammar	merged	Renovate PR merged as commit fd4f8f5, bumping astral-sh/setup-uv v9.0.0 -> v10.0.1 (pinned SHA 20cfd1b) in .github/workflows/check-renovate.yaml; all CI checks passed.	92%
#620 build(deps): update astral-sh/setup-uv action to v10 (main)	starbase	merged	Merged Renovate PR updating the astral-sh/setup-uv GitHub Action from v9.0.0 to v10.2.0, incorporating security enhancements, new python-runtime-id output, and disabled cache saves for merge queues.	92%
#424 build(deps): update astral-sh/setup-uv action to v10.1.0 (main)	craft-store	closed	Renovate PR #424 was auto-merged into main via commit 89c84fb, bumping astral-sh/setup-uv from v10.0.1 to v10.1.0 in the CI workflow. Later superseded by #429 (v10.2.0, commit 0f792e7).	90%
#429 build(deps): update astral-sh/setup-uv action to v10.2.0 (main)	craft-store	merged	Renovate PR #429 merged into main, bumping astral-sh/setup-uv from v10.1.0 to v10.2.0 (1 file, +1/-1); approved by 1 reviewer with all CI checks passing and no review comments.	90%
#6505 build(deps): update astral-sh/setup-uv action to v10 (main)	snapcraft	merged	Updated astral-sh/setup-uv action from v9.0.0 to v10.3.0. Merged into main as a routine dependency update with all CI checks passing.	89%
#264 build(deps): update astral-sh/setup-uv action to v10 (main)	craft-archives	closed	Automated dependency update merging astral-sh/setup-uv action from v9 to v10.3.0.	89%
#471 build(deps): update astral-sh/setup-uv action to v10 (main)	imagecraft	merged	Merged in b6a98df: astral-sh/setup-uv GitHub Action updated from v9.0.0 to v10.2.0.	88%
#417 build(deps): update setup-uv action to v10	craft-store	merged	Renovate PR updating astral-sh/setup-uv to v10 in the CI workflow merged as commit 84bd42d. It replaced the earlier attempt #413 (closed unmerged due to OSV-scanner/zizmor failures); later bumps followed in #424 (v10.1.0) and #429 (v10.2.0).	88%