chore(deps): update actions/setup-python action to v7 by renovate[bot] · Pull Request #411 · open-feature/spec

renovate · 2026-07-20T07:05:44Z

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-python	action	major	`v5` → `v7`

Release Notes

actions/setup-python

`v7.1.0`

Compare Source

What's Changed

Enhancements

Add mirror and mirror-token inputs for custom Python distribution sources by @luhenry in #1302
Improve error message clarity by @v-lmvysakh in #1351

Dependency Upgrade

Upgrade browserslist from 4.28.2 to 4.28.9 by @dependabot in #1353
Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in #1343
Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in #1342
Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in #1357
Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in #1359
Upgrade undici from 6.28.0 to 6.29.0 by @dependabot in #1364
Upgrade ts-jest from 29.4.11 to 29.4.14 by @dependabot in #1361
Upgrade brace-expansion from 5.0.9 to 5.0.12 by @dependabot in #1365
Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @dependabot in #1363
Upgrade @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @dependabot in #1369
Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #1345
Upgrade cache to 6.3.0 by @v-HarithaVattikuti in #1370
Resolve Basic Validation audit failures by @v-HarithaVattikuti in #1347
Resolve npm audit failures by @v-HarithaVattikuti in #1350

New Contributors

@luhenry made their first contribution in #1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

`v7.0.0`

Compare Source

What's Changed

Enhancements

Migrate to ESM and upgrade dependencies by @priyagupta108 in #1330
Pin SHA commits and update docs with latest versions by @HarithaVattikuti in #1338
Remove the pip-install input by @gowridurgad in #1336

Bug Fix

Fix to Classify stderr warning messages as warnings instead of errors in annotations by @lmvysakh in #1335
Validate and retry manifest fetch to prevent silent failures by @priyagupta108 in #1332

Dependency Upgrade

Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @dependabot in #1328
Remove EOL Python versions and Bumps numpy text fixture by @priya-kinthali in #1333
Upgrade @actions/cache to 6.2.0 by @philip-gai in #1337

New Contributors

@lmvysakh made their first contribution in #1335
@philip-gai made their first contribution in #1337

Full Changelog: actions/setup-python@v6...v7.0.0

`v6.3.0`

Compare Source

What's Changed

Enhancement

Add RHEL support and include Linux distro in cache keys by @priyagupta108 in #1323
Fix pip cache error handling on Windows by @priyagupta108 in #1040

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in #1281
Upgrade actions dependencies by @gowridurgad with @Copilot in #1303
Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in #1324
Upgrade dependency versions and test workflow configuration by @HarithaVattikuti in #1322

Documentation

Update advanced-usage.md by @Dunky-Z in #811

New Contributors

@gowridurgad with @Copilot made their first contribution in #1303
@jasongin made their first contribution in #1324
@Dunky-Z made their first contribution in #811

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

`v6.2.0`

Compare Source

What's Changed

Dependency Upgrades

Upgrade dependencies to Node 24 compatible versions by @salmanmkc in #1259
Upgrade urllib3 from 2.5.0 to 2.6.3 in /__tests__/data by @dependabot in #1253 and #1264

Full Changelog: actions/setup-python@v6...v6.2.0

`v6.1.0`

Compare Source

What's Changed

Enhancements:

Add support for pip-install input by @gowridurgad in #1201
Add graalpy early-access and windows builds by @timfel in #880

Dependency and Documentation updates:

Enhanced wording and updated example usage for allow-prereleases by @yarikoptic in #979
Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by @dependabot in #1139
Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by @dependabot in #1094
Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by @dependabot in #1199
Upgrade requests from 2.32.2 to 2.32.4 by @dependabot in #1130
Upgrade prettier from 3.5.3 to 3.6.2 by @dependabot in #1234
Upgrade @types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by @dependabot in #1235

New Contributors

@yarikoptic made their first contribution in #979

Full Changelog: actions/setup-python@v6...v6.1.0

`v6.0.0`

Compare Source

What's Changed

Breaking Changes

Upgrade to node 24 by @salmanmkc in #1164

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Add support for pip-version by @priyagupta108 in #1129
Enhance reading from .python-version by @krystof-k in #787
Add version parsing from Pipfile by @aradkdj in #1067

Bug fixes:

Clarify pythonLocation behaviour for PyPy and GraalPy in environment variables by @aparnajyothi-y in #1183
Change missing cache directory error to warning by @aparnajyothi-y in #1182
Add Architecture-Specific PATH Management for Python with --user Flag on Windows by @aparnajyothi-y in #1122
Include python version in PyPy python-version output by @cdce8p in #1110
Update docs: clarification on pip authentication with setup-python by @priya-kinthali in #1156

Dependency updates:

Upgrade idna from 2.9 to 3.7 in /tests/data by @dependabot[bot] in #843
Upgrade form-data to fix critical vulnerabilities #182 & #183 by @aparnajyothi-y in #1163
Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download by @aparnajyothi-y in #1165
Upgrade actions/checkout from 4 to 5 by @dependabot[bot] in #1181
Upgrade @actions/tool-cache from 2.0.1 to 2.0.2 by @dependabot[bot] in #1095

New Contributors

@krystof-k made their first contribution in #787
@cdce8p made their first contribution in #1110
@aradkdj made their first contribution in #1067

Full Changelog: actions/setup-python@v5...v6.0.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-09-15T18:32:59Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 4a54d52d-22eb-4957-bf6d-b6724910f3ed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

> **Part of [#417](#417 This PR is the **assets** — the files four conformance implementations execute. It stacks on [#440](#440), which configures the releases that give these assets a tag. The normative description of them, Appendix F, is [#439](#439), stacked on this. [#425](#425) adds the machine-readable report. > > This PR previously carried the appendix too. It was split so the assets can land while the prose is still being reviewed. ## What The artifacts a provider conformance suite runs against: | path | what it is | |---|---| | `assets/provider-tck/gherkin/` | six feature files — evaluation, errors, events, lifecycle, reason, metadata | | `assets/provider-tck/flags/canonical-flags.json` | the flag set every scenario assumes | | `assets/provider-tck/openapi/control-api.yaml` | the HTTP surface a backend under test must expose | | `assets/provider-tck/go.mod`, `embed.go` | a nested Go module exposing the artifacts as an `embed.FS` | | `release-please-config.json`, `.release-please-manifest.json` | registers the assets as a releasable component; the general setup is #440 | Marked **experimental**: the scenario set is a representative subset, and the capability vocabulary may still change. ## Why this is split out Four language implementations already run these files, and all four are currently pinned to an **unmerged branch tip**. Every rebase here invalidates them — it has happened three times in two weeks. Nothing about those pins becomes real until the assets are on `main` with a tag, so landing the executable half first is worth more than landing it together with prose that will take longer to review. Appendix F is the same work, reviewed on its own terms. ## Why a Go module is in here A Go module is distributed as a zip of the VCS tree, in which a git submodule is only a gitlink and its files are absent. The other three languages build from a working tree and keep using the submodule, but a Go suite would have to vendor a copy of every artifact and police it against drift. `embed.go` removes the copy: a consumer pins a revision, the checksum database makes it immutable, and the embedded bytes are the same bytes every other language reads out of the submodule. `go.mod` and `embed.go` are inert for every non-Go consumer. Precedent: `open-feature/flagd-schemas`. The release config tags the assets as their own component, `specification/assets/provider-tck/vX.Y.Z` — the shape `go get` needs. Without it a Go consumer can only name a pseudo-version. ## Releasing the assets The general release-please setup is [#440](#440), which this stacks on. What this PR adds is the part that describes *these* assets: a second package, so they are tagged `specification/assets/provider-tck/vX.Y.Z`. That tag shape is what `go get` needs. Without it a Go consumer can only name a pseudo-version, which is what the four conformance implementations have had to do while this branch was unmerged, and it has cost several rounds of re-pinning. The specification package sets `exclude-paths` for this directory, so an asset-only change no longer cuts a specification release, and `separate-pull-requests` keeps the two from sharing one release pull request. ## The capability vocabulary lives in the README, for now A scenario exercising an optional part of the contract carries a tag; a provider declares what it supports, and a scenario gated on an undeclared tag is reported **skipped, with the reason** — never as passed. A suite that quietly goes green on scenarios it did not run is worse than no suite at all. That rule and the tag table are in `assets/provider-tck/README.md` so the tags in the feature files are not left undefined while the appendix is in review. #439 moves them into the appendix and leaves a pointer behind, so they end up with one home rather than two that can disagree. Worth stating plainly: **withholding a tag is not an admission of a defect.** `@numeric-coercion` borrows its rule from flagd's coercion ADR, and `@string-typing` / `@fully-typed-values` sit on a question the specification does not answer at all — [#430](#430) and [#433](#433). ## Decisions worth reviewing - **`assets/provider-tck/` rather than beside the SDK Gherkin**, because `assets/gherkin/evaluation.feature` already exists and tests an SDK, not a provider. This answers #417's Q1 — the subdirectory is forced rather than chosen. - **`.gitattributes` normalises these to LF.** Four languages consume them byte for byte and copy them verbatim into published artifacts, so a Windows checkout must not package differently from a Linux one. - **`missing-flag` must not exist** in the flag set — its absence is what the `FLAG_NOT_FOUND` scenario tests. The other four load-bearing properties of the flag set are in the README; each one, if seeded wrong, turns a scenario green or red for the wrong reason in every language at once. - **No container restarts.** Outages are produced through the control API, because orchestrators reassign host ports on restart and every provider pointed at the old one then fails looking flaky. ## Implementations All four execute exactly these files, against flagd (both resolvers), OFREP and Flagsmith: | | suite | flagd | OFREP | Flagsmith | |---|---|---|---|---| | Java | [#1830](open-feature/java-sdk-contrib#1830) | [#1847](open-feature/java-sdk-contrib#1847) | [#1840](open-feature/java-sdk-contrib#1840) | [#1849](open-feature/java-sdk-contrib#1849) | | Go | [#940](open-feature/go-sdk-contrib#940) | [#941](open-feature/go-sdk-contrib#941) | [#942](open-feature/go-sdk-contrib#942) | [#959](open-feature/go-sdk-contrib#959) | | JavaScript | [#1606](open-feature/js-sdk-contrib#1606) | [#1608](open-feature/js-sdk-contrib#1608) | [#1612](open-feature/js-sdk-contrib#1612) | [#1623](open-feature/js-sdk-contrib#1623) | | Python | [#409](open-feature/python-sdk-contrib#409) | [#411](open-feature/python-sdk-contrib#411) | [#414](open-feature/python-sdk-contrib#414) | — | ## What running them has found - **flagd silently narrows a float flag to an integer**, Go and Java, both resolvers, no error code — [flagd#1996](open-feature/flagd#1996) - **flagd reported ready before flags were evaluable**, on 100% of starts — [flagd#2047](open-feature/flagd#2047), fixed in flagd v0.17.0 - **The Java SDK's `MultiProvider` swallows child provider events** — [java-sdk#1882](open-feature/java-sdk#1882) - **The Python flagd provider widens a boolean to a float** — [python-sdk-contrib#417](open-feature/python-sdk-contrib#417) - **The JavaScript Flagsmith provider stringifies unconditionally** where its other paths correctly report a mismatch — visible only because three languages ran identical scenarios against one backend - two specification gaps, raised rather than decided here: [#430](#430), [#433](#433) --------- Signed-off-by: Simon Schrottner <simon.schrottner@flagsmith.com>

renovate Bot added the renovate label Jul 20, 2026

renovate Bot force-pushed the renovate/actions-setup-python-7.x branch 5 times, most recently from a22d340 to ef7ef30 Compare July 24, 2026 16:59

jonathannorris approved these changes Jul 27, 2026

View reviewed changes

jonathannorris enabled auto-merge (squash) July 27, 2026 20:08

renovate Bot force-pushed the renovate/actions-setup-python-7.x branch 3 times, most recently from b7d2c77 to 25e1dd0 Compare August 8, 2026 20:24

renovate Bot force-pushed the renovate/actions-setup-python-7.x branch from 25e1dd0 to 2fc13b5 Compare August 24, 2026 12:44

aepfli mentioned this pull request Sep 11, 2026

[Tracking] A cross-language conformance suite for OpenFeature providers #417

Open

renovate Bot force-pushed the renovate/actions-setup-python-7.x branch from 2fc13b5 to e9c9358 Compare September 15, 2026 18:32

renovate Bot force-pushed the renovate/actions-setup-python-7.x branch 3 times, most recently from 53b4bc1 to 95ca779 Compare September 21, 2026 00:25

renovate Bot force-pushed the renovate/actions-setup-python-7.x branch 2 times, most recently from 1bb0ca5 to 72c5ca6 Compare September 26, 2026 12:39

renovate Bot force-pushed the renovate/actions-setup-python-7.x branch 4 times, most recently from eafa232 to f1c5284 Compare October 13, 2026 18:33

renovate Bot force-pushed the renovate/actions-setup-python-7.x branch 3 times, most recently from eafc4fe to 5d35cbb Compare October 16, 2026 15:12

chore(deps): update actions/setup-python action to v7

13e65e6

renovate Bot force-pushed the renovate/actions-setup-python-7.x branch from 5d35cbb to 13e65e6 Compare October 23, 2026 23:11

Navigation Menu

Repository navigation

chore(deps): update actions/setup-python action to v7 - #411

chore(deps): update actions/setup-python action to v7#411
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/actions-setup-python-7.x

renovate Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 15, 2026 •

edited

Loading

Review skipped

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v7.1.0

What's Changed

Enhancements

Dependency Upgrade

New Contributors

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

v6.2.0

What's Changed

Dependency Upgrades

v6.1.0

What's Changed

Enhancements:

Dependency and Documentation updates:

New Contributors

v6.0.0

What's Changed

Breaking Changes

Enhancements:

Bug fixes:

Dependency updates:

New Contributors

Configuration

Uh oh!

coderabbitai Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jul 20, 2026 •

edited

Loading

`v7.1.0`

`v7.0.0`

`v6.3.0`

`v6.2.0`

`v6.1.0`

`v6.0.0`

coderabbitai Bot commented Sep 15, 2026 •

edited

Loading