chore(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 in the github-actions group - #1827
Conversation
Bumps the github-actions group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `astral-sh/setup-uv` from 10.0.0 to 10.0.1 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@ae62891...20cfd1b) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine patch bump of astral-sh/setup-uv from v10.0.1 pinned by SHA (10.0.0 → 10.0.1), consistently applied across all 5 usages in ci.yml and release.yml with matching version comments.
Extended reasoning...
Overview
This PR is a Dependabot-authored update to the astral-sh/setup-uv GitHub Action, bumping it from v10.0.0 to v10.0.1 across two workflow files (.github/workflows/ci.yml and .github/workflows/release.yml). The change touches 5 usages total, each updating both the pinned commit SHA and the trailing version comment consistently. This is a patch release per the action'''s own release notes (tolerating transient manifest timeouts, plus checksum/doc maintenance) — no breaking changes.
Security risks
None. The action is still pinned to a full commit SHA (not a mutable tag), which is the correct security practice for third-party GitHub Actions and mitigates supply-chain risk. I confirmed the new SHA (20cfd1bf945f4377ade1205e4dbc17946fc9a30d) matches the version comment (v10.0.1) and is consistent with the SHA referenced in the PR description'''s commit links.
Level of scrutiny
Minimal scrutiny is warranted. This is a mechanical, auto-generated dependency bump with no logic changes, no new inputs/permissions, and no changes to workflow behavior beyond picking up upstream bug fixes. All 5 occurrences were updated identically and correctly.
Other factors
No prior reviews exist on this PR. The diff is fully mechanical (SHA + comment swap only), matches the standard Dependabot PR pattern seen in recent merged history (e.g. the prior setup-uv bumps), and there is nothing here that would benefit from human judgment.
wochinge
left a comment
wochinge
left a comment
There was a problem hiding this comment.
Approved: SHA-pinned setup-uv patch update; all substantive checks pass and no review threads remain.
1 participant
Bumps the github-actions group with 1 update: astral-sh/setup-uv.
Updates
astral-sh/setup-uvfrom 10.0.0 to 10.0.1Release notes
Sourced from astral-sh/setup-uv's releases.
Commits
20cfd1bchore: update known checksums for 0.12.4 (#1017)d73a0caTolerate transient manifest timeouts (#1016)ae3b92ddocs: update version references to v10.0.0 (#1014)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions