Skip to content

fix: bump astral-sh/setup-uv from 10.2.0 to 10.3.1 - #2466

Draft
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/github_actions/astral-sh/setup-uv-10.3.1
Draft

fix: bump astral-sh/setup-uv from 10.2.0 to 10.3.1#2466
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/github_actions/astral-sh/setup-uv-10.3.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026 •
edited by groupthinking
Loading

Copy link
Copy Markdown
Contributor

Current review — November 12, 2026

Refreshed this existing PR with current main 512a2558f73d6281b6a880548bedf140b7e30292 in merge commit fe8fb4dba8ec287d9c7c91612a55c7a4d1eee4dc. GitHub reports the new head mergeable. This PR is now a draft to preserve the no-merge scope and prevent the repository's Dependabot auto-merge jobs from acting.

The effective change against that main is the original one-line setup-uv action update plus exact-branch Vercel exclusions in vercel.json and apps/web/vercel.json. Both exclude only dependabot/github_actions/astral-sh/setup-uv-10.3.1. No app manifest, lockfile, uv version, cache setting, CI permission, or test gate changes. Official upstream tag astral-sh/setup-uv@v10.3.1 was fetched and resolves to 18d369b23da25a81e9458561248e1aafff6a70fa.

Validation: CPython 3.12.14, pytest 9.2.0; python -m pytest tests/unit/test_workflow_pr_gate_coverage.py tests/unit/test_dependabot_automation_workflow.py -q -o addopts='' --confcutdir=tests/unit passed 40 tests (exit 0). YAML comparison confirmed the action pin is the only changed CI setting and uv 0.12.1 / enable-cache: false are unchanged. Both deployment configurations parsed with the exact branch set false. Whitespace checks passed. GitHub-created tree 47580e0034efe6f29310592844295ee5208e8dd7 exactly matches the tested local index tree.

Current-head hosted results: CI, Security Scan, Coverage, CodeQL, Dependency Review, and Secret Scan all completed successfully. Both Python matrix jobs, frontend tests, and web/image build passed. E2E run 43345900697 failed at preview discovery: No Vercel preview deployment became available for PR SHA fe8fb4dba8ec287d9c7c91612a55c7a4d1eee4dc. Both exact-head configuration files were re-fetched and use valid git.deploymentEnabled branch maps, with no github.enabled field. The preview-dependent gate remains unchanged and the PR remains on HOLD for full acceptance. A successful report-only security job is not a clean vulnerability finding. Earlier results below apply only to old heads. No merge, paid/provider call, or deployment was executed. Rollback before merge: keep this draft or revert the new branch commit; no production rollback is needed.

Review update — 2026-10-28

Current head f1e0ce2e31243ae8f750df4cf1f92fea32196b35 merges current main (ba2777d1b008c2148d413e07cc497791966310e0). Its effective diff is one line in .github/workflows/ci.yml: the astral-sh/setup-uv action pin changes from v10.2.0 to the official v10.3.1 tag commit 18d369b23da25a81e9458561248e1aafff6a70fa. The workflow still installs uv 0.12.1 with caching disabled.

Validation: the CI YAML parsed locally with 7 jobs; the action pin and unchanged uv/cache settings were checked; git diff --check passed. All hosted checks finished 26 passed, 3 skipped, and no review threads remain open at this head. This PR has not been merged. The original generated Dependabot notes follow for provenance.

Original Dependabot notes

Bumps astral-sh/setup-uv from 10.2.0 to 10.3.1.

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.3.0 🌈 Add Python architecture selection

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

... (truncated)

Commits
  • 18d369b chore(deps): roll up Dependabot updates (#1101)
  • 4ad2329 chore: update known checksums for 0.13.4 (#1099)
  • 4bc6759 chore: update known checksums for 0.13.2/0.13.3 (#1098)
  • c97f06e fix: preserve cache error class names in save-cache bundle (#1093)
  • 8ca4be0 chore: update known checksums for 0.13.1 (#1094)
  • b627d85 docs: cache-dependency-glob matches relative to the working directory (#1092)
  • f8c8897 Verify npm dependency signatures before builds (#1027)
  • f64d32b docs: update version references to v10.3.0 (#1090)
  • 1c37ad0 chore: update known checksums for 0.13.0 (#1089)
  • b3c9b5f chore: update known checksums for 0.12.24 (#1084)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
fix: bump astral-sh/setup-uv from 10.2.0 to 10.3.1
dbb0e01 
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.2.0 to 10.3.1.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@c18668a...18d369b)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from groupthinking as a code owner October 24, 2026 20:54
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 24, 2026
@vercel

vercel Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
v0-uvai Ready Ready Preview, v0 Oct 28, 2026 8:36am UTC

@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Oct 24, 2026
@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@dependabot dependabot Bot mentioned this pull request Oct 24, 2026
Closed
@github-actions github-actions Bot added the ci/cd label Oct 24, 2026
groupthinking
groupthinking reviewed Oct 28, 2026
View reviewed changes

@groupthinking groupthinking left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review status at head dbb0e016: the Closing keyword to open issue check fails on this dependency PR. I am holding approval until the canonical issue linkage or workflow policy is resolved and the check is green. No merge decision is implied by this review.

groupthinking
groupthinking previously approved these changes Oct 28, 2026
View reviewed changes

@groupthinking groupthinking left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed head f1e0ce2e31243ae8f750df4cf1f92fea32196b35. The PR changes only the pinned astral-sh/setup-uv action from v10.2.0 to the verified v10.3.1 release SHA, preserving uv 0.12.1 and disabled cache. Current checks are 27 passed and 3 skipped, and no review threads remain open. This approves the code change at this head; the separate decision to merge remains pending.

@dependabot @github

dependabot Bot commented on behalf of github Oct 31, 2026

Copy link
Copy Markdown
Contributor Author

A newer version of astral-sh/setup-uv exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

@groupthinking
groupthinking marked this pull request as draft November 13, 2026 01:33
@groupthinking
fix(ci): refresh setup-uv branch against current main
fe8fb4d 
Preserve uv 0.12.1 and disabled caching. Exclude this exact
review branch from Vercel deployments at both config roots.

This branch was successfully deployed

1 active (outdated) deployment
Preview — f1e0ce2e Deployed Oct 28, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@groupthinking groupthinking groupthinking left review comments

Assignees

No one assigned

Labels

ci/cd dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@groupthinking