Repository navigation
chore(deps): Bump astral-sh/setup-uv from 10.1.0 to 10.3.0 - #22
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.1.0 to 10.3.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@bec219d...1c37ad0) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
github_actions
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sentinel-by-digital-frontier[bot]](https://avatars.githubusercontent.com/u/275657175?s=60&v=4){kind=small}
There was a problem hiding this comment.
🛡️ Sentinel review — clean. No findings on changed lines.
📊 Scan report — every finding in the changed files, ranked, plus the scan summary
🛡️ Sentinel PR review
3 file(s) changed · 0 introduced by this diff (secrets+SAST) · dependencies unchanged — SCA/CVE not re-scanned. Advisory — the fail-closed gate is the post-merge pentest.
Findings — ranked by criticality
No issues found on the changed surface.
🤖 Code review (Flynn)
No issues found.
Scan summary
| Category | Scope | Findings |
|---|---|---|
| Secrets | this diff | 0 |
| Static analysis | changed files | 0 |
| Dependencies + IaC | skipped (no manifest changed) | 0 |
| Known CVEs | skipped (no manifest changed) | 0 |
There was a problem hiding this comment.
🟢 Approval recommended
The pinned action version is updated consistently without changing workflow behavior.
0 open findings
What changed in this PR
Updates the pinned astral-sh/setup-uv action from v10.1.0 to v10.3.0 across automation workflows.
Changes:
- Updates all four
setup-uvreferences to the v10.3.0 commit SHA. - Preserves existing cache and Python setup configuration.
| File | Description |
|---|---|
.github/workflows/sync-upstream.yml |
Updates setup-uv for upstream synchronization. |
.github/workflows/release.yml |
Updates setup-uv for release builds. |
.github/workflows/ci.yml |
Updates setup-uv for CI test and build jobs. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Bumps astral-sh/setup-uv from 10.1.0 to 10.3.0.
Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
1c37ad0chore: update known checksums for 0.13.0 (#1089)b3c9b5fchore: update known checksums for 0.12.24 (#1084)b06acffAddpython-archsupport (#1079)c84232cchore: update known checksums for 0.12.23 (#1082)51fdd26Use macOS 15 runners for tests (#1081)a96208bchore: update known checksums for 0.12.22 (#1080)0e3884bchore: update known checksums for 0.12.21 (#1078)bcf0580chore: update known checksums for 0.12.20 (#1076)b92a892chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#1077)227a0f6chore: update known checksums for 0.12.19 (#1068)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)