From 5abaaaa1eda0de1ca64f148c411ac59542c1cf69 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 17 Oct 2026 10:21:44 +0000 Subject: [PATCH] build(deps): bump the actions-deps group across 1 directory with 6 updates Bumps the actions-deps group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884) Updates `github/codeql-action/init` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps ... Signed-off-by: dependabot[bot] --- .github/workflows/asvs-prove-absences.yml | 4 ++-- .github/workflows/ci.yml | 16 ++++++++-------- .github/workflows/codeql.yml | 4 ++-- .github/workflows/dast.yml | 4 ++-- .github/workflows/dependabot-lock-resync.yml | 4 ++-- .github/workflows/dependency-floors.yml | 2 +- .github/workflows/fuzz.yml | 2 +- .github/workflows/ingress-rate-probe.yml | 2 +- .github/workflows/invariant-mutations.yml | 2 +- .github/workflows/quality-advisory.yml | 4 ++-- .github/workflows/scorecard.yml | 4 ++-- 11 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/asvs-prove-absences.yml b/.github/workflows/asvs-prove-absences.yml index 525ae4bce7..ac4bac53a7 100644 --- a/.github/workflows/asvs-prove-absences.yml +++ b/.github/workflows/asvs-prove-absences.yml @@ -156,7 +156,7 @@ jobs: python-version: "3.14" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | pyproject.toml @@ -241,7 +241,7 @@ jobs: python-version: "3.14" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | engine/pyproject.toml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d2a173ab3d..84a513b208 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -335,7 +335,7 @@ jobs: # from docker/locks/* and installs nothing). - name: Set up uv if: needs.changes.outputs.code == 'true' || github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group' - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | pyproject.toml @@ -1280,7 +1280,7 @@ jobs: - name: Set up uv if: needs.changes.outputs.code == 'true' || github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group' - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | pyproject.toml @@ -2137,7 +2137,7 @@ jobs: exit 1 - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | pyproject.toml @@ -3045,7 +3045,7 @@ jobs: -Q "IF DB_ID('MessageFoundry') IS NULL CREATE DATABASE MessageFoundry" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | pyproject.toml @@ -3381,7 +3381,7 @@ jobs: python-version: "3.14" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | pyproject.toml @@ -3590,7 +3590,7 @@ jobs: python-version: "3.14" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | pyproject.toml @@ -3817,7 +3817,7 @@ jobs: -Q "IF DB_ID('MessageFoundry') IS NULL CREATE DATABASE MessageFoundry; ALTER DATABASE MessageFoundry SET READ_COMMITTED_SNAPSHOT ON WITH ROLLBACK IMMEDIATE;" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | pyproject.toml @@ -4027,7 +4027,7 @@ jobs: python-version: ${{ matrix.python-version }} - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | pyproject.toml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 666eba6a65..44ffe3e5f0 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -121,7 +121,7 @@ jobs: with: persist-credentials: false # CodeQL uploads via the job token, not a persisted git credential - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} # security-extended adds higher-recall security queries on top of the default suite. @@ -159,6 +159,6 @@ jobs: # results while every check stays green. The correct form leads with # `github.event_name == 'pull_request' &&`, which short-circuits before the null read. # Do not "simplify" that conjunct away. - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dast.yml b/.github/workflows/dast.yml index 287b937738..e776c2a172 100644 --- a/.github/workflows/dast.yml +++ b/.github/workflows/dast.yml @@ -81,7 +81,7 @@ jobs: # uv via the SHA-pinned action (ci.yml's pin), not an unpinned `pip install uv`: a version pin # does not satisfy Scorecard PinnedDependenciesID and this repo already carries two such findings. - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: # NO CACHE, unlike every other setup-uv use in this repo. Left at the default this would be # the only workflow here that BOTH restores a dependency cache AND is reachable from a @@ -194,7 +194,7 @@ jobs: with: python-version: "3.14" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: # No cache, for the release-tag cache-poisoning reason given on dast-auth's copy above. enable-cache: false diff --git a/.github/workflows/dependabot-lock-resync.yml b/.github/workflows/dependabot-lock-resync.yml index 0243398e11..2fa9d27f4d 100644 --- a/.github/workflows/dependabot-lock-resync.yml +++ b/.github/workflows/dependabot-lock-resync.yml @@ -107,7 +107,7 @@ jobs: - name: Mint a scoped GitHub App token id: app-token if: steps.creds.outputs.present == 'true' - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: app-id: ${{ secrets.LOCK_RESYNC_APP_ID }} private-key: ${{ secrets.LOCK_RESYNC_APP_PRIVATE_KEY }} @@ -129,7 +129,7 @@ jobs: - name: Set up uv if: steps.creds.outputs.present == 'true' - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Re-export the lock files (DEP-1 — byte-for-byte identical flags/paths) if: steps.creds.outputs.present == 'true' diff --git a/.github/workflows/dependency-floors.yml b/.github/workflows/dependency-floors.yml index f5b6eddbc1..7cbe628e12 100644 --- a/.github/workflows/dependency-floors.yml +++ b/.github/workflows/dependency-floors.yml @@ -88,7 +88,7 @@ jobs: with: python-version: "3.14" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: cache-dependency-glob: | pyproject.toml diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index d58de5a33a..17234c9159 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -129,7 +129,7 @@ jobs: with: python-version: "3.14" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Install the engine plus the fuzzing toolchain run: | set -euo pipefail diff --git a/.github/workflows/ingress-rate-probe.yml b/.github/workflows/ingress-rate-probe.yml index 8f4f2abd57..7205f7220c 100644 --- a/.github/workflows/ingress-rate-probe.yml +++ b/.github/workflows/ingress-rate-probe.yml @@ -66,7 +66,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Set up Python 3.14 uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 diff --git a/.github/workflows/invariant-mutations.yml b/.github/workflows/invariant-mutations.yml index d49782a44b..5122a5d2ed 100644 --- a/.github/workflows/invariant-mutations.yml +++ b/.github/workflows/invariant-mutations.yml @@ -65,7 +65,7 @@ jobs: with: python-version: "3.14" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Install the engine and the test toolchain run: | set -euo pipefail diff --git a/.github/workflows/quality-advisory.yml b/.github/workflows/quality-advisory.yml index 5ec9ad56de..bf360a025f 100644 --- a/.github/workflows/quality-advisory.yml +++ b/.github/workflows/quality-advisory.yml @@ -501,7 +501,7 @@ jobs: with: python-version: "3.14" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Qt headless system deps # BOUNDED AND RETRIED. Unguarded, this step turns an external apt-mirror hiccup into a # blocked merge queue: measured 2026-08-18, three hangs across two attempts on three @@ -854,7 +854,7 @@ jobs: with: python-version: "3.14" - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Qt headless system deps # BOUNDED AND RETRIED. Unguarded, this step turns an external apt-mirror hiccup into a # blocked merge queue: measured 2026-08-18, three hangs across two attempts on three diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c7fe1d0398..8d4feb1afc 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -56,7 +56,7 @@ jobs: with: persist-credentials: false - name: Run Scorecard - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif @@ -69,6 +69,6 @@ jobs: # REDUNDANT, which is a different finding: code scanning holds the same findings and is what # a human actually queries, and `publish_results: true` above additionally sends the score to # the public OpenSSF API. A third copy on a retention clock served neither reader. - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif