← Back to issue list

build(deps): update astral-sh/setup-uv action to v10 (main) - autoclosed

View original Github issue

Metadata

Project
craft-grammar
Number
#214
Type
pull request
State
merged
Author
renovate[bot]
Labels
PR: Dependencies
Created
Updated
Closed

Current evaluation

Renovate PR merged as commit fd4f8f5, bumping astral-sh/setup-uv v9.0.0 -> v10.0.1 (pinned SHA 20cfd1b) in .github/workflows/check-renovate.yaml; all CI checks passed.

Resolution: closed resolved

Reason: The PR itself was the fix and was merged to main in commit fd4f8f5 ("build(deps): update astral-sh/setup-uv action to v10 (main) (#214)"). The workflow now references astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1, and all CI checks (lint, tests, zizmor, policy) passed.

Evaluated by: mr-cal-bot

No scores available.

Issue body

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | action | major | `v9.0.0` → `v10.0.1` | --- ### Release Notes <details> <summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary> ### [`v10.0.1`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.0.1): 🌈 Tolerate transient manifest timeouts [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.0.0...v10.0.1) ##### Changes Thank you [@&#8203;arguile-](https://redirect.github.com/arguile-) for making this action more resilient. ##### 🐛 Bug fixes - Tolerate transient manifest timeouts [@&#8203;arguile-](https://redirect.github.com/arguile-) ([#&#8203;1016](https://redirect.github.com/astral-sh/setup-uv/issues/1016)) ##### 🧰 Maintenance - chore: update known checksums for 0.12.4 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;1017](https://redirect.github.com/astral-sh/setup-uv/issues/1017)) ##### 📚 Documentation - docs: update version references to v10.0.0 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;1014](https://redirect.github.com/astral-sh/setup-uv/issues/1014)) ### [`v10.0.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.0.0): 🌈 Disable automatic caching for sensitive events and new QOL features [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v9.0.0...v10.0.0) ##### Changes Another breaking release, directly after v9.0.0 but we think the added security justifies that. ##### Extra security by default If you use the default `enable-cache: auto` this will now **DISABLE THE CACHE** to protect against cache poisoning for the following events: - `pull_request_target` - `workflow_run` - `release` You can read the full reasoning in [#&#8203;984](https://redirect.github.com/astral-sh/setup-uv/issues/984) ##### `version: latest-known` ```yaml - name: Install the latest version of uv known to setup-uv uses: astral-sh/setup-uv@v10.0.0 with: version: "latest-known" ``` This will now install the latest version with a checksum that is known by this action. The [known `uv` checksums](https://redirect.github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts) are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security. ##### Read python version from `.tool-versions` ```yaml - name: Install uv based on the version defined in .tool-versions and also set python uses: astral-sh/setup-uv@v10.0.0 with: version-file: "pyproject.toml" ``` Will now also set the python version if it is defined in `.tool-versions`. You can read the details [in the docs](https://redirect.github.com/astral-sh/setup-uv/blob/main/docs/advanced-version-configuration.md#install-a-version-defined-in-a-requirements-or-config-file) ##### 🚨 Breaking changes - Disable automatic caching for sensitive events [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;992](https://redirect.github.com/astral-sh/setup-uv/issues/992)) ##### 🐛 Bug fixes - Reject paths in .tool-versions [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;1007](https://redirect.github.com/astral-sh/setup-uv/issues/1007)) ##### 🚀 Enhancements - Read Python version from .tool-versions [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;996](https://redirect.github.com/astral-sh/setup-uv/issues/996)) - Add latest-known version selector [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;993](https://redirect.github.com/astral-sh/setup-uv/issues/993)) ##### 🧰 Maintenance - Require pull requests for Dependabot rollups [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;1005](https://redirect.github.com/astral-sh/setup-uv/issues/1005)) - ci: pin Alpine container image [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;995](https://redirect.github.com/astral-sh/setup-uv/issues/995)) - chore: update known checksums for 0.12.3 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;991](https://redirect.github.com/astral-sh/setup-uv/issues/991)) - chore: update known checksums for 0.12.2 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;985](https://redirect.github.com/astral-sh/setup-uv/issues/985)) - chore: update known checksums for 0.12.1 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;982](https://redirect.github.com/astral-sh/setup-uv/issues/982)) - chore: update known checksums for 0.12.0 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;981](https://redirect.github.com/astral-sh/setup-uv/issues/981)) - chore: update known checksums for 0.11.31/0.11.32 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;972](https://redirect.github.com/astral-sh/setup-uv/issues/972)) ##### 📚 Documentation - docs: update version references to v9.0.0 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;971](https://redirect.github.com/astral-sh/setup-uv/issues/971)) ##### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;1013](https://redirect.github.com/astral-sh/setup-uv/issues/1013)) - chore(deps): roll up Dependabot updates [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;1004](https://redirect.github.com/astral-sh/setup-uv/issues/1004)) - chore(deps): roll up Dependabot updates [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;994](https://redirect.github.com/astral-sh/setup-uv/issues/994)) - chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;976](https://redirect.github.com/astral-sh/setup-uv/issues/976)) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;980](https://redirect.github.com/astral-sh/setup-uv/issues/980)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-grammar). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUFI6IERlcGVuZGVuY2llcyJdfQ==-->

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Renovate PR merged as commit fd4f8f5, bumping astral-sh/setup-uv v9.0.0 -> v10.0.1 (pinned SHA 20cfd1b) in .github/workflows/check-renovate.yaml; all CI checks passed.
stealth/space-bunny-alpha — closed resolved Merged PR #214 updated astral-sh/setup-uv from v9.0.0 to v10.0.1 in commit fd4f8f5, with all CI checks passing.
stealth/space-bunny-alpha — closed resolved Renovate PR #214 merged, updating astral-sh/setup-uv from v9.0.0 to v10.0.1 in commit fd4f8f5.
qwen/qwen3.6-35b-a3b — — Merged into main after passing CI and two approvals. Updates astral-sh/setup-uv from v9.0.0 to v10.0.1, adding security hardening, a latest-known version selector, and disabling automatic caching for sensitive events.
qwen/qwen3.6-35b-a3b
Staleness: 0
Complexity: 5
Confidence: 95
needs review Updates astral-sh/setup-uv GitHub Action from v9 to v10.0.1. Includes breaking changes disabling cache for sensitive events and new features. Currently passing CI, awaiting maintainer review, with automerge enabled.

Update history

Date Change
updated
created

Related work

  • Related To: craft-grammar#585 (confidence 40%)

    Later commit fd4f8f5's file (.github/workflows/check-renovate.yaml) was subsequently touched by #585 resolving zizmor findings, following the setup-uv pin.

Related issues

Issue Project State Summary Similarity
#279 build(deps): update astral-sh/setup-uv action to v10 (main) craft-platforms merged Merged Renovate PR bumping astral-sh/setup-uv from v9.0.0 to v10.2.0 in .github/workflows/check-renovate.yaml.
96%
#1755 build(deps): update astral-sh/setup-uv action to v10 (main) craft-parts merged Merged Renovate PR updating astral-sh/setup-uv GitHub Action from v9.0.0 to v10.2.0 in the main workflow.
94%
#2912 build(deps): update astral-sh/setup-uv action to v10 (main) charmcraft merged Merged Renovate PR bumping astral-sh/setup-uv from v9.0.0 to v10.2.0 in a charmcraft workflow.
92%
#424 build(deps): update astral-sh/setup-uv action to v10.1.0 (main) craft-store closed Renovate PR #424 was auto-merged into main via commit 89c84fb, bumping astral-sh/setup-uv from v10.0.1 to v10.1.0 in the CI workflow. Later superseded by #429 (v10.2.0, commit 0f792e7).
92%
#429 build(deps): update astral-sh/setup-uv action to v10.2.0 (main) craft-store merged Renovate PR #429 merged into main, bumping astral-sh/setup-uv from v10.1.0 to v10.2.0 (1 file, +1/-1); approved by 1 reviewer with all CI checks passing and no review comments.
91%
#620 build(deps): update astral-sh/setup-uv action to v10 (main) starbase merged Merged Renovate PR updating the astral-sh/setup-uv GitHub Action from v9.0.0 to v10.2.0, incorporating security enhancements, new python-runtime-id output, and disabled cache saves for merge queues.
91%
#6505 build(deps): update astral-sh/setup-uv action to v10 (main) snapcraft merged Updated astral-sh/setup-uv action from v9.0.0 to v10.3.0. Merged into main as a routine dependency update with all CI checks passing.
91%
#502 build(deps): update astral-sh/setup-uv action to v10.3.0 (main) imagecraft merged Merged dependency update PR upgrading astral-sh/setup-uv GitHub Action from v10.2.0 to v10.3.0. All CI checks passed and the change was accepted.
89%
#417 build(deps): update setup-uv action to v10 craft-store merged Renovate PR updating astral-sh/setup-uv to v10 in the CI workflow merged as commit 84bd42d. It replaced the earlier attempt #413 (closed unmerged due to OSV-scanner/zizmor failures); later bumps followed in #424 (v10.1.0) and #429 (v10.2.0).
89%
#471 build(deps): update astral-sh/setup-uv action to v10 (main) imagecraft merged Merged in b6a98df: astral-sh/setup-uv GitHub Action updated from v9.0.0 to v10.2.0.
89%