Skip to content

Bump astral-sh/setup-uv from 8.2.0 to 10.3.0 - #351

Merged
leq-bot merged 2 commits into
release-v0.9.xfrom
dependabot/github_actions/astral-sh/setup-uv-10.0.1
Oct 23, 2026
Merged

leq-bot merged 2 commits into
release-v0.9.xfrom
dependabot/github_actions/astral-sh/setup-uv-10.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •

Copy link
Copy Markdown
Contributor

Bumps astral-sh/setup-uv from 8.2.0 to 10.3.0.

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.0 🌈 Add Python architecture selection

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

v10.2.0 🌈 Disable automatic cache saves for merge queues

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026
@rtibbles

rtibbles commented Oct 5, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot dependabot Bot changed the title Bump astral-sh/setup-uv from 8.2.0 to 10.0.1 Bump astral-sh/setup-uv from 8.2.0 to 10.2.0 Oct 5, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-10.0.1 branch from eb81ac7 to d976b8a Compare October 5, 2026 22:36
@dependabot
dependabot Bot requested review from a team and leq-bot October 5, 2026 22:36
@rtibbles
rtibbles requested a review from rtibblesbot October 22, 2026 18:08
@rtibblesbot

Copy link
Copy Markdown
Contributor

@dependabot rebase

@rtibblesbot

rtibblesbot commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

🟡 Waiting for changes

Outcome: reviewed 419fa6d

Last updated: 2026-10-23 19:27 UTC

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 10.3.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@v8.2.0...v10.3.0)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump astral-sh/setup-uv from 8.2.0 to 10.2.0 Bump astral-sh/setup-uv from 8.2.0 to 10.3.0 Oct 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-10.0.1 branch from d976b8a to d3e8611 Compare October 22, 2026 18:10

@rtibblesbot rtibblesbot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR #351: astral-sh/setup-uv v8.2.0 → v10.3.0: major bump, CI-only (dev) dependency. CI passing.

  • Breaking (v9): prune-cache default now false; affects cache size only.
  • Breaking (v10): enable-cache: auto no longer caches on pull_request_target, workflow_run or release. Every use here sets enable-cache explicitly, so nothing changes.
  • v10.3.0 adds an opt-in python-arch input.
  • Security fixes: none. Peer dependency changes: none. All inputs used here still exist.
  • One optional suggestion inline on python-publish.yml.

Written by rtibblesbot, an LLM-based coding agent.

Comment thread .github/workflows/python-publish.yml

@rtibblesbot rtibblesbot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR #351: 1 of 1 prior findings resolved.

  • astral-sh/setup-uv 8.2.0 → 10.3.0: major, CI-only (GitHub Actions).
  • Release build cache-poisoning risk: handled.
  • python-publish.yml now sets enable-cache: "false".
  • Security fixes / peer-dependency changes: none.
  • CI passing.
Prior-finding status

RESOLVED — .github/workflows/python-publish.yml:19 — enable-cache: "true" on release build


Written by rtibblesbot, an LLM-based coding agent.

@leq-bot
leq-bot merged commit 0a47405 into release-v0.9.x Oct 23, 2026
60 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/astral-sh/setup-uv-10.0.1 branch October 23, 2026 19:28
@rtibblesbot

Copy link
Copy Markdown
Contributor

Quick check on rtibblesbot's review of this PR: react 👍 helpful · 😕 mixed · 👎 not helpful. Reply with anything specific.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants