Repository navigation
fix: bump astral-sh/setup-uv from 10.2.0 to 10.3.1 - #2466
dependabot[bot] wants to merge 3 commits into
Conversation
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.2.0 to 10.3.1. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@c18668a...18d369b) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.3.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
groupthinking
left a comment
There was a problem hiding this comment.
Review status at head dbb0e016: the Closing keyword to open issue check fails on this dependency PR. I am holding approval until the canonical issue linkage or workflow policy is resolved and the check is green. No merge decision is implied by this review.
groupthinking
left a comment
There was a problem hiding this comment.
Reviewed head f1e0ce2e31243ae8f750df4cf1f92fea32196b35. The PR changes only the pinned astral-sh/setup-uv action from v10.2.0 to the verified v10.3.1 release SHA, preserving uv 0.12.1 and disabled cache. Current checks are 27 passed and 3 skipped, and no review threads remain open. This approves the code change at this head; the separate decision to merge remains pending.
|
A newer version of astral-sh/setup-uv exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
Preserve uv 0.12.1 and disabled caching. Exclude this exact review branch from Vercel deployments at both config roots.
Current review — November 12, 2026
Refreshed this existing PR with current main
512a2558f73d6281b6a880548bedf140b7e30292in merge commitfe8fb4dba8ec287d9c7c91612a55c7a4d1eee4dc. GitHub reports the new head mergeable. This PR is now a draft to preserve the no-merge scope and prevent the repository's Dependabot auto-merge jobs from acting.The effective change against that main is the original one-line setup-uv action update plus exact-branch Vercel exclusions in
vercel.jsonandapps/web/vercel.json. Both exclude onlydependabot/github_actions/astral-sh/setup-uv-10.3.1. No app manifest, lockfile, uv version, cache setting, CI permission, or test gate changes. Official upstream tagastral-sh/setup-uv@v10.3.1was fetched and resolves to18d369b23da25a81e9458561248e1aafff6a70fa.Validation: CPython 3.12.14, pytest 9.2.0;
python -m pytest tests/unit/test_workflow_pr_gate_coverage.py tests/unit/test_dependabot_automation_workflow.py -q -o addopts='' --confcutdir=tests/unitpassed 40 tests (exit 0). YAML comparison confirmed the action pin is the only changed CI setting and uv0.12.1/enable-cache: falseare unchanged. Both deployment configurations parsed with the exact branch set false. Whitespace checks passed. GitHub-created tree47580e0034efe6f29310592844295ee5208e8dd7exactly matches the tested local index tree.Current-head hosted results: CI, Security Scan, Coverage, CodeQL, Dependency Review, and Secret Scan all completed successfully. Both Python matrix jobs, frontend tests, and web/image build passed. E2E run 43345900697 failed at preview discovery:
No Vercel preview deployment became available for PR SHA fe8fb4dba8ec287d9c7c91612a55c7a4d1eee4dc.Both exact-head configuration files were re-fetched and use validgit.deploymentEnabledbranch maps, with nogithub.enabledfield. The preview-dependent gate remains unchanged and the PR remains on HOLD for full acceptance. A successful report-only security job is not a clean vulnerability finding. Earlier results below apply only to old heads. No merge, paid/provider call, or deployment was executed. Rollback before merge: keep this draft or revert the new branch commit; no production rollback is needed.Review update — 2026-10-28
Current head
f1e0ce2e31243ae8f750df4cf1f92fea32196b35merges currentmain(ba2777d1b008c2148d413e07cc497791966310e0). Its effective diff is one line in.github/workflows/ci.yml: theastral-sh/setup-uvaction pin changes from v10.2.0 to the official v10.3.1 tag commit18d369b23da25a81e9458561248e1aafff6a70fa. The workflow still installs uv0.12.1with caching disabled.Validation: the CI YAML parsed locally with 7 jobs; the action pin and unchanged uv/cache settings were checked;
git diff --checkpassed. All hosted checks finished 26 passed, 3 skipped, and no review threads remain open at this head. This PR has not been merged. The original generated Dependabot notes follow for provenance.Original Dependabot notes
Bumps astral-sh/setup-uv from 10.2.0 to 10.3.1.
Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
18d369bchore(deps): roll up Dependabot updates (#1101)4ad2329chore: update known checksums for 0.13.4 (#1099)4bc6759chore: update known checksums for 0.13.2/0.13.3 (#1098)c97f06efix: preserve cache error class names in save-cache bundle (#1093)8ca4be0chore: update known checksums for 0.13.1 (#1094)b627d85docs: cache-dependency-glob matches relative to the working directory (#1092)f8c8897Verify npm dependency signatures before builds (#1027)f64d32bdocs: update version references to v10.3.0 (#1090)1c37ad0chore: update known checksums for 0.13.0 (#1089)b3c9b5fchore: update known checksums for 0.12.24 (#1084)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)