Skip to content

ci(deps): update python-dependencies (main) (major) - #2875

Merged
myakove merged 1 commit into
mainfrom
renovate/main-major-python-dependencies
Nov 13, 2026
Merged

ci(deps): update python-dependencies (main) (major)#2875
myakove merged 1 commit into
mainfrom
renovate/main-major-python-dependencies

Conversation

@renovate

@renovate renovate Bot commented Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/checkout action major v4 → v7
actions/deploy-pages action major v4 → v5
actions/upload-pages-artifact action major v3 → v5
astral-sh/setup-uv action major v6 → v10.3.3

Release Notes

actions/checkout

v7.0.1

Compare Source

v7.0.0

Compare Source

  • Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
  • Various dependency updates

v6.1.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v5.1.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v5.0.1...v5.1.0

v5.0.1

Compare Source

v5.0.0

Compare Source

actions/deploy-pages

v5.0.1

Compare Source

Changelog

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

v5.0.0

Compare Source

Changelog

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

actions/upload-pages-artifact

v5.0.0

Compare Source

Changelog

See details of all code changes since previous release.

v4.0.0

Compare Source

What's Changed

Full Changelog: actions/upload-pages-artifact@v3.0.1...v4.0.0

astral-sh/setup-uv

v10.3.3: 🌈 Use Astral mirror for version manifests with GitHub fallback

Compare Source

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable.
(Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes
🧰 Maintenance
📚 Documentation

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in #​984

version: latest-known
- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions
- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v9.0.0: 🌈 Change prune-cache default to false

Compare Source

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #​967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes
🐛 Bug fixes
  • fix: fall back to distribution ID when os-release has no version field @​cxzhong (#​961)
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v8.3.2: 🌈 update known checksums for 0.11.28

Compare Source

Changes

Just a maintenance release

🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v8.3.1: 🌈 update known checksums for 0.11.27

Compare Source

Changes

Just a maintenance release

🧰 Maintenance
📚 Documentation

v8.3.0: 🌈 Support uv.lock as a version-file source

Compare Source

Changes

Thanks to @​somaz94 you can now use the pinned version of uv itself in uv.lock. It gets picked up automatically.
If you have pinned another version of uv in your uv.lock you can use the inputs version or version-source to override this.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v8.2.0: 🌈 New inputs quiet and download-from-astral-mirror

Compare Source

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details.
In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates

v8.1.0: 🌈 New input no-project

Compare Source

Changes

This add the a new boolean input no-project.
It only makes sense to use in combination with activate-environment: true and will append --no project to the uv venv call. This is for example useful if you have a pyproject.toml file with parts unparseable by uv

🚀 Enhancements

🧰 Maintenance

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai

coderabbitai Bot commented Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@redhat-qe-bot

redhat-qe-bot commented Nov 6, 2026

Copy link
Copy Markdown
Contributor

Report bugs in Issues

Welcome! 🎉

This pull request will be automatically processed with the following features:

Note: You are an auto-verified user. Your PRs will be automatically verified and may be auto-merged when all requirements are met.

🔄 Automatic Actions

  • Reviewer Assignment: Reviewers are automatically assigned based on the OWNERS file in the repository root
  • Size Labeling: PR size labels (XS, S, M, L, XL, XXL) are automatically applied based on changes
  • Issue Creation: Disabled for this repository
  • Branch Labeling: Branch-specific labels are applied to track the target branch
  • Auto-verification: Auto-verified users have their PRs automatically marked as verified
  • Labels: All label categories are enabled (default configuration)

📋 Available Commands

PR Status Management

  • /wip - Mark PR as work in progress (adds WIP: prefix to title)
  • /wip cancel - Remove work in progress status
  • /hold - Block PR merging (PR author or approvers)
  • /hold cancel - Unblock PR merging (PR author or approvers)
  • /verified - Mark PR as verified
  • /verified cancel - Remove verification status
  • /reprocess - Trigger complete PR workflow reprocessing (useful if webhook failed or configuration changed)
  • /regenerate-welcome - Regenerate this welcome message
  • /security-override - Set security check runs to pass (maintainers only)
  • /security-override cancel - Re-run security checks

Review & Approval

  • /lgtm - Approve changes (looks good to me)
  • /approve - Approve PR (approvers only)
  • /automerge - Enable automatic merging when all requirements are met (maintainers and approvers only)
  • /automerge cancel - Remove automerge label (maintainers and approvers only)
  • /assign-reviewers - Assign reviewers based on OWNERS file
  • /assign-reviewer @username - Assign specific reviewer
  • /check-can-merge - Check if PR meets merge requirements

Testing & Validation

  • /retest tox - Run Python test suite with tox
  • /retest python-module-install - Test Python package installation
  • /retest conventional-title - Validate commit message format
  • /retest all - Run all available tests

Cherry-pick Operations

  • /cherry-pick <branch> - Schedule cherry-pick to target branch when PR is merged
    • Multiple branches: /cherry-pick branch1 branch2 branch3
  • /cherry-pick-retry <branch> - Retry a failed cherry-pick (merged PRs only)

Branch Management

  • /rebase - Rebase this PR branch onto its base branch

Label Management

  • /<label-name> - Add a label to the PR
  • /<label-name> cancel - Remove a label from the PR

✅ Merge Requirements

This PR will be automatically approved when the following conditions are met:

  1. Approval: /approve from at least one approver
  2. Status Checks: All required status checks must pass
  3. No Blockers: No wip, hold, has-conflicts labels and PR must be mergeable (no conflicts)
  4. Verified: PR must be marked as verified

📊 Review Process

Approvers and Reviewers

Approvers:

  • myakove
  • rnetser

Reviewers:

  • myakove
  • rnetser
Available Labels
  • hold
  • verified
  • wip
  • lgtm
  • approve
  • automerge
AI Features
  • Conventional Title: Mode: fix (EnMaaS/rits/deepseek-ai/DeepSeek-V4.1-Flash-1017)
  • Cherry-Pick Conflict Resolution: Enabled (EnMaaS/rits/deepseek-ai/DeepSeek-V4.1-Flash-1017)
Security Checks
  • Suspicious Path Detection: Monitors paths: .claude/, .vscode/, .cursor/, .devcontainer/, .pi/, .github/workflows/, .github/actions/
  • Committer Identity Check: Verifies last committer matches PR author
  • Mandatory: Security checks block merge (use /security-override to bypass — maintainers only)

💡 Tips

  • WIP Status: Use /wip when your PR is not ready for review
  • Verification: The verified label is removed on new commits unless the push is detected as a clean rebase
  • Cherry-picking: Cherry-pick labels are processed when the PR is merged
  • Permission Levels: Some commands require approver permissions
  • Auto-verified Users: Certain users have automatic verification and merge privileges

For more information, please refer to the project documentation or contact the maintainers.

@redhat-qe-bot
redhat-qe-bot requested a review from myakove November 6, 2026 18:35
@redhat-qe-bot
redhat-qe-bot requested a review from rnetser November 6, 2026 18:35
@redhat-qe-bot

redhat-qe-bot commented Nov 6, 2026

Copy link
Copy Markdown
Contributor

Auto-merge blocked: PR modifies security-sensitive paths: .github/workflows/docs.yml

@rnetser

rnetser commented Nov 8, 2026

Copy link
Copy Markdown
Collaborator

/approve
/lgtm
/security-override

@redhat-qe-bot1

redhat-qe-bot1 commented Nov 8, 2026

Copy link
Copy Markdown

Security checks overridden by @rnetser. Security check runs set to pass.

@rnetser

rnetser commented Nov 9, 2026

Copy link
Copy Markdown
Collaborator

/approve
/lgtm

@renovate
renovate Bot force-pushed the renovate/main-major-python-dependencies branch from 9d9451f to cd773d8 Compare November 9, 2026 08:13
@redhat-qe-bot1

redhat-qe-bot1 commented Nov 9, 2026

Copy link
Copy Markdown

Clean rebase detected — no code changes compared to previous head (9d9451f).
The following labels were preserved: verified, approved-rnetser, lgtm-rnetser.

@myakove

myakove commented Nov 9, 2026

Copy link
Copy Markdown
Collaborator

/approve
/lgtm

@renovate
renovate Bot force-pushed the renovate/main-major-python-dependencies branch from cd773d8 to 2516abf Compare November 11, 2026 08:38
@redhat-qe-bot2

redhat-qe-bot2 commented Nov 11, 2026

Copy link
Copy Markdown

Clean rebase detected — no code changes compared to previous head (cd773d8).
The following labels were preserved: verified, approved-rnetser, lgtm-rnetser.

@renovate
renovate Bot force-pushed the renovate/main-major-python-dependencies branch from 2516abf to 3b0827b Compare November 11, 2026 08:40
@redhat-qe-bot

redhat-qe-bot commented Nov 11, 2026

Copy link
Copy Markdown
Contributor

Clean rebase detected — no code changes compared to previous head (2516abf).
The following labels were preserved: verified, approved-rnetser, lgtm-rnetser.

@rnetser

rnetser commented Nov 12, 2026

Copy link
Copy Markdown
Collaborator

/approve
/lgtm

1 similar comment
@myakove

myakove commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator

/approve
/lgtm

@myakove

myakove commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator

/approve
/lgtm
/security-override

@redhat-qe-bot

redhat-qe-bot commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

Security checks overridden by @myakove. Security check runs set to pass.

@myakove
myakove merged commit 43ad3b2 into main Nov 13, 2026
10 checks passed
@myakove
myakove deleted the renovate/main-major-python-dependencies branch November 13, 2026 10:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@myakove myakove Awaiting requested review from myakove
@rnetser rnetser Awaiting requested review from rnetser

Assignees

@renovate renovate[bot]

Labels

approved-myakove approved-rnetser branch-main can-be-merged lgtm-myakove lgtm-rnetser size/XS verified

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@redhat-qe-bot @rnetser @redhat-qe-bot1 @myakove @redhat-qe-bot2 @rh-bot-1