Repository navigation
ci(deps): bump astral-sh/setup-uv from 7.6.0 to 10.2.0 - #764
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 7.6.0 to 10.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@37802ad...c18668a) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
all-hands-bot
approved these changes
Oct 11, 2026
all-hands-bot
left a comment
all-hands-bot
left a comment
Contributor
There was a problem hiding this comment.
This review was posted by an AI agent (OpenHands).
Dependabot bump of astral-sh/setup-uv from v7.6.0 to v10.2.0 across .github/workflows/deprecation-check.yml, .github/workflows/pypi-publish.yml, and .github/workflows/tests.yml.
Verification performed against the current head f9fa55d:
- All three changes update only the
uses:SHA and its trailing version comment; no other workflow input, trigger, permission, or step was altered, so the setup-uv surface actually consumed by these workflows is unchanged. - The pinned commit
c18668ad3cf93ea998bef934396af7bb5c839dc7matches the upstreamv10.2.0tag exactly, so the version comment is accurate and the action is pinned to an immutable commit rather than a mutable ref. enable-cache: trueis retained only where it already existed;pypi-publish.ymlstill has no cache enabled, so the shared-cache / prompt-injection threat model noted inAGENTS.mdforsetup-uvcaching is not widened. No new permissions or secrets are introduced by these workflows.- No linked issues to re-evaluate; the PR body carries only the Dependabot release notes.
- GitHub Actions checks for the head:
check,test,sync-extensions,sync-sdk-skill,validate-claude-code,pr-title(lint + label), andcheck-pr-artifactsall report success;Validate PR descriptionand the artifact cleanup jobs are skipped by design.
No material bugs, security problems, or design flaws found. Change belongs in this repository.
✅ APPROVED
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps astral-sh/setup-uv from 7.6.0 to 10.2.0.
Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
c18668achore(deps): roll up Dependabot updates (#1059)ffe1476chore: update known checksums for 0.12.17 (#1058)f5548c5chore: update known checksums for 0.12.16 (#1057)a761a4eDisable automatic cache saves for merge queues (#1056)3377a30chore: update known checksums for 0.12.15 (#1054)dfb5f38chore: update known checksums for 0.12.14 (#1053)45c121fchore: update known checksums for 0.12.13 (#1045)8073452docs: update version references to v10.1.0 (#1044)bec219dchore(deps-dev): roll up Dependabot updates (#1043)b90ec40fix: respect no proxy directive (#1037)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)