Skip to content

chore(deps): update astral-sh/setup-uv action to v10 - #401

Open
koalabot-rt[bot] wants to merge 1 commit into
devfrom
renovate/astral-sh-setup-uv-10.x
Open

chore(deps): update astral-sh/setup-uv action to v10#401
koalabot-rt[bot] wants to merge 1 commit into
devfrom
renovate/astral-sh-setup-uv-10.x

Conversation

@koalabot-rt

@koalabot-rt koalabot-rt Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
astral-sh/setup-uv action major v9.0.0 → v10.3.0

Release Notes

astral-sh/setup-uv

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in #​984

version: latest-known
- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions
- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@koalabot-rt koalabot-rt Bot added dependencies Pull requests that update a dependency file major renovate labels Oct 15, 2026
@github-actions

github-actions Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Coverage

Coverage Report
FileStmtsMissCoverMissing
src
   downloader.py2601993%97–98, 205, 232–233, 250, 263–274, 277–278, 317, 380
   importer.py57296%19, 30
   index.py103199%145
   process_manager.py2541395%155–156, 207–208, 232, 274–275, 284–286, 357–359
   update.py131298%93, 172
src/jsonl
   decompressor.py5340%5–7
   downloader.py311455%14, 18, 23, 25, 32–46
src/utils
   config.py55395%71–73
   regions.py105892%407, 420, 428, 432, 435, 448, 459, 474
   validate_config.py50492%33, 35, 41–42
TOTAL12806995% 

Tests Skipped Failures Errors Time
290 0 💤 0 ❌ 0 🔥 1.761s ⏱️

@coderabbitai

coderabbitai Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 82e1d6de-b97a-4af4-9690-99e3d6b775e5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@koalabot-rt
koalabot-rt Bot force-pushed the renovate/astral-sh-setup-uv-10.x branch from c3b3a97 to 629a5db Compare October 17, 2026 00:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file major renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants