build(deps): update astral-sh/setup-uv action to v10 (main)
Metadata
Current evaluation
Merged in b6a98df: astral-sh/setup-uv GitHub Action updated from v9.0.0 to v10.2.0.
Resolution: closed resolved
Reason: PR #471 was merged as commit b6a98df, updating the astral-sh/setup-uv action dependency from v9.0.0 to v10.2.0.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | action | major | `v9.0.0` → `v10.2.0` |
---
### Release Notes
<details>
<summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary>
### [`v10.2.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.2.0): 🌈 Disable automatic cache saves for merge queues
[Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.1.0...v10.2.0)
##### Changes
This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.
##### 🚀 Enhancements
- Disable automatic cache saves for merge queues [@​eifinger](https://redirect.github.com/eifinger) ([#​1056](https://redirect.github.com/astral-sh/setup-uv/issues/1056))
##### 🧰 Maintenance
- chore: update known checksums for 0.12.17 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1058](https://redirect.github.com/astral-sh/setup-uv/issues/1058))
- chore: update known checksums for 0.12.16 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1057](https://redirect.github.com/astral-sh/setup-uv/issues/1057))
- chore: update known checksums for 0.12.15 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1054](https://redirect.github.com/astral-sh/setup-uv/issues/1054))
- chore: update known checksums for 0.12.14 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1053](https://redirect.github.com/astral-sh/setup-uv/issues/1053))
- chore: update known checksums for 0.12.13 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1045](https://redirect.github.com/astral-sh/setup-uv/issues/1045))
##### 📚 Documentation
- docs: update version references to v10.1.0 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1044](https://redirect.github.com/astral-sh/setup-uv/issues/1044))
##### ⬆️ Dependency updates
- chore(deps): roll up Dependabot updates [@​eifinger](https://redirect.github.com/eifinger) ([#​1059](https://redirect.github.com/astral-sh/setup-uv/issues/1059))
### [`v10.1.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.1.0): 🌈 New output `python-runtime-id`and respect NO_PROXY
[Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.0.1...v10.1.0)
##### Changes
This release adds more bheind the scene security improvements and also 2 small improvements.
##### NO_PROXY
This action now respects `no_proxy/NO_PROXY` environment variables which were previously ignored.
##### New output `python-runtime-id`
The new output `python-runtime-id` can be used to know which python version exactly was installed if you use `activate-environment`. See [pyca/cryptography#15572 (comment)](https://redirect.github.com/pyca/cryptography/pull/15572#discussion_r3913508686) for details on why this can be useful.
##### 🐛 Bug fixes
- fix: respect no proxy directive [@​mj0nez](https://redirect.github.com/mj0nez) ([#​1037](https://redirect.github.com/astral-sh/setup-uv/issues/1037))
- Use JSON + a typed wrapper instead of TS codegen [@​woodruffw](https://redirect.github.com/woodruffw) ([#​1025](https://redirect.github.com/astral-sh/setup-uv/issues/1025))
##### 🚀 Enhancements
- Expose a Python "identity" output [@​woodruffw](https://redirect.github.com/woodruffw) ([#​1036](https://redirect.github.com/astral-sh/setup-uv/issues/1036))
- Verify downloads with astral-sh/versions checksums [@​zaniebot](https://redirect.github.com/zaniebot) ([#​1033](https://redirect.github.com/astral-sh/setup-uv/issues/1033))
##### 🧰 Maintenance
- chore: update known checksums for 0.12.12 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1041](https://redirect.github.com/astral-sh/setup-uv/issues/1041))
- chore: update known checksums for 0.12.10/0.12.11 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1038](https://redirect.github.com/astral-sh/setup-uv/issues/1038))
- chore: update known checksums for 0.12.9 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1035](https://redirect.github.com/astral-sh/setup-uv/issues/1035))
- chore: update known checksums for 0.12.7/0.12.8 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1031](https://redirect.github.com/astral-sh/setup-uv/issues/1031))
- chore: update known checksums for 0.12.6 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1030](https://redirect.github.com/astral-sh/setup-uv/issues/1030))
- chore: update known checksums for 0.12.5 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1020](https://redirect.github.com/astral-sh/setup-uv/issues/1020))
- Use self-repo syntax for all in-repo actions/reusable workflows [@​woodruffw](https://redirect.github.com/woodruffw) ([#​1024](https://redirect.github.com/astral-sh/setup-uv/issues/1024))
- Pin one-shot tools [@​woodruffw](https://redirect.github.com/woodruffw) ([#​1022](https://redirect.github.com/astral-sh/setup-uv/issues/1022))
- ci: remove obsolete direct push attempts [@​eifinger](https://redirect.github.com/eifinger) ([#​1019](https://redirect.github.com/astral-sh/setup-uv/issues/1019))
##### 📚 Documentation
- docs: update version references to v10.0.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1018](https://redirect.github.com/astral-sh/setup-uv/issues/1018))
##### ⬆️ Dependency updates
- chore(deps-dev): roll up Dependabot updates [@​eifinger](https://redirect.github.com/eifinger) ([#​1043](https://redirect.github.com/astral-sh/setup-uv/issues/1043))
- Harden npm install defaults [@​zaniebot](https://redirect.github.com/zaniebot) ([#​1026](https://redirect.github.com/astral-sh/setup-uv/issues/1026))
- Add dependency cooldowns [@​woodruffw](https://redirect.github.com/woodruffw) ([#​1021](https://redirect.github.com/astral-sh/setup-uv/issues/1021))
### [`v10.0.1`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.0.1): 🌈 Tolerate transient manifest timeouts
[Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.0.0...v10.0.1)
##### Changes
Thank you [@​arguile-](https://redirect.github.com/arguile-) for making this action more resilient.
##### 🐛 Bug fixes
- Tolerate transient manifest timeouts [@​arguile-](https://redirect.github.com/arguile-) ([#​1016](https://redirect.github.com/astral-sh/setup-uv/issues/1016))
##### 🧰 Maintenance
- chore: update known checksums for 0.12.4 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1017](https://redirect.github.com/astral-sh/setup-uv/issues/1017))
##### 📚 Documentation
- docs: update version references to v10.0.0 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1014](https://redirect.github.com/astral-sh/setup-uv/issues/1014))
### [`v10.0.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.0.0): 🌈 Disable automatic caching for sensitive events and new QOL features
[Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v9.0.0...v10.0.0)
##### Changes
Another breaking release, directly after v9.0.0 but we think the added security justifies that.
##### Extra security by default
If you use the default `enable-cache: auto` this will now **DISABLE THE CACHE** to protect against cache poisoning for the following events:
- `pull_request_target`
- `workflow_run`
- `release`
You can read the full reasoning in [#​984](https://redirect.github.com/astral-sh/setup-uv/issues/984)
##### `version: latest-known`
```yaml
- name: Install the latest version of uv known to setup-uv
uses: astral-sh/setup-uv@v10.0.0
with:
version: "latest-known"
```
This will now install the latest version with a checksum that is known by this action. The [known `uv` checksums](https://redirect.github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts) are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.
##### Read python version from `.tool-versions`
```yaml
- name: Install uv based on the version defined in .tool-versions and also set python
uses: astral-sh/setup-uv@v10.0.0
with:
version-file: "pyproject.toml"
```
Will now also set the python version if it is defined in `.tool-versions`. You can read the details [in the docs](https://redirect.github.com/astral-sh/setup-uv/blob/main/docs/advanced-version-configuration.md#install-a-version-defined-in-a-requirements-or-config-file)
##### 🚨 Breaking changes
- Disable automatic caching for sensitive events [@​eifinger](https://redirect.github.com/eifinger) ([#​992](https://redirect.github.com/astral-sh/setup-uv/issues/992))
##### 🐛 Bug fixes
- Reject paths in .tool-versions [@​eifinger](https://redirect.github.com/eifinger) ([#​1007](https://redirect.github.com/astral-sh/setup-uv/issues/1007))
##### 🚀 Enhancements
- Read Python version from .tool-versions [@​eifinger](https://redirect.github.com/eifinger) ([#​996](https://redirect.github.com/astral-sh/setup-uv/issues/996))
- Add latest-known version selector [@​eifinger](https://redirect.github.com/eifinger) ([#​993](https://redirect.github.com/astral-sh/setup-uv/issues/993))
##### 🧰 Maintenance
- Require pull requests for Dependabot rollups [@​eifinger](https://redirect.github.com/eifinger) ([#​1005](https://redirect.github.com/astral-sh/setup-uv/issues/1005))
- ci: pin Alpine container image [@​eifinger](https://redirect.github.com/eifinger) ([#​995](https://redirect.github.com/astral-sh/setup-uv/issues/995))
- chore: update known checksums for 0.12.3 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​991](https://redirect.github.com/astral-sh/setup-uv/issues/991))
- chore: update known checksums for 0.12.2 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​985](https://redirect.github.com/astral-sh/setup-uv/issues/985))
- chore: update known checksums for 0.12.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​982](https://redirect.github.com/astral-sh/setup-uv/issues/982))
- chore: update known checksums for 0.12.0 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​981](https://redirect.github.com/astral-sh/setup-uv/issues/981))
- chore: update known checksums for 0.11.31/0.11.32 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​972](https://redirect.github.com/astral-sh/setup-uv/issues/972))
##### 📚 Documentation
- docs: update version references to v9.0.0 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​971](https://redirect.github.com/astral-sh/setup-uv/issues/971))
##### ⬆️ Dependency updates
- chore(deps): roll up Dependabot updates [@​eifinger](https://redirect.github.com/eifinger) ([#​1013](https://redirect.github.com/astral-sh/setup-uv/issues/1013))
- chore(deps): roll up Dependabot updates [@​eifinger](https://redirect.github.com/eifinger) ([#​1004](https://redirect.github.com/astral-sh/setup-uv/issues/1004))
- chore(deps): roll up Dependabot updates [@​eifinger](https://redirect.github.com/eifinger) ([#​994](https://redirect.github.com/astral-sh/setup-uv/issues/994))
- chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#​976](https://redirect.github.com/astral-sh/setup-uv/issues/976))
- chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#​980](https://redirect.github.com/astral-sh/setup-uv/issues/980))
</details>
---
### Configuration
📅 **Schedule**: (in timezone Etc/UTC)
- Branch creation
- "every weekend"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/imagecraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJQUjogRGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| ~deepseek/deepseek-pro-latest | — | closed resolved | Merged in b6a98df: astral-sh/setup-uv GitHub Action updated from v9.0.0 to v10.2.0. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #264 build(deps): update astral-sh/setup-uv action to v10 (main) | craft-archives | closed | Automated dependency update merging astral-sh/setup-uv action from v9 to v10.3.0. | |
| #6505 build(deps): update astral-sh/setup-uv action to v10 (main) | snapcraft | merged | Updated astral-sh/setup-uv action from v9.0.0 to v10.3.0. Merged into main as a routine dependency update with all CI checks passing. | |
| #502 build(deps): update astral-sh/setup-uv action to v10.3.0 (main) | imagecraft | merged | Merged dependency update PR upgrading astral-sh/setup-uv GitHub Action from v10.2.0 to v10.3.0. All CI checks passed and the change was accepted. | |
| #1224 build(deps): update astral-sh/setup-uv action to v10 (main) | craft-application | merged | Updated the astral-sh/setup-uv GitHub Action from v9.0.0 to v10.3.0 to include new Python architecture selection, cache security improvements, and latest checksums. Merged automatically by Renovate. | |
| #1755 build(deps): update astral-sh/setup-uv action to v10 (main) | craft-parts | merged | Merged Renovate PR updating astral-sh/setup-uv GitHub Action from v9.0.0 to v10.2.0 in the main workflow. | |
| #620 build(deps): update astral-sh/setup-uv action to v10 (main) | starbase | merged | Merged Renovate PR updating the astral-sh/setup-uv GitHub Action from v9.0.0 to v10.2.0, incorporating security enhancements, new python-runtime-id output, and disabled cache saves for merge queues. | |
| #507 build(deps): update astral-sh/setup-uv action to v10.3.2 (main) | imagecraft | merged | Updates astral-sh/setup-uv GitHub Action from v10.3.0 to v10.3.2. Minor patch update with checksum maintenance and cache error fix. Auto-merge enabled, CI passing (except OSV-scanner). | |
| #424 build(deps): update astral-sh/setup-uv action to v10.1.0 (main) | craft-store | closed | Renovate PR #424 was auto-merged into main via commit 89c84fb, bumping astral-sh/setup-uv from v10.0.1 to v10.1.0 in the CI workflow. Later superseded by #429 (v10.2.0, commit 0f792e7). | |
| #429 build(deps): update astral-sh/setup-uv action to v10.2.0 (main) | craft-store | merged | Renovate PR #429 merged into main, bumping astral-sh/setup-uv from v10.1.0 to v10.2.0 (1 file, +1/-1); approved by 1 reviewer with all CI checks passing and no review comments. | |
| #214 build(deps): update astral-sh/setup-uv action to v10 (main) - autoclosed | craft-grammar | merged | Renovate PR merged as commit fd4f8f5, bumping astral-sh/setup-uv v9.0.0 -> v10.0.1 (pinned SHA 20cfd1b) in .github/workflows/check-renovate.yaml; all CI checks passed. |