Skip to content

Bump the actions group across 1 directory with 4 updates - #64

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-4a7b405148
Open

Bump the actions group across 1 directory with 4 updates#64
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-4a7b405148

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 4 updates in the / directory: astral-sh/setup-uv, pypa/cibuildwheel, astral-sh/ruff-action and actions/setup-python.

Updates astral-sh/setup-uv from 8.2.0 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table>

... (truncated)

Commits

Updates pypa/cibuildwheel from 4.1.0 to 4.2.0

Release notes

Sourced from pypa/cibuildwheel's releases.

v4.2.0

  • 🌟 CPython 3.15 wheels are now built by default - without the "cpython-prerelease" enable set. It's time to build and upload these wheels to PyPI! This release includes CPython 3.15.0rc1, which is guaranteed to be ABI compatible with the final release. (#2944)
  • ✨ Adds Pyodide 3.15 support with the cp315-pyodide_wasm32 build identifier, using Pyodide 315.0.0a2. These are also stable wrt. the final release. (#2958)
  • 🐛 Retries a failed download six times with exponential backoff, so short network outages no longer stop a build. A 4xx response is still reported at once. (#2953)
  • 🐛 Accepts default as a build-frontend value on Pyodide, and accepts pyodide-build in the top-level table and in overrides (#2951)
  • 🛠 Holds pip back on GraalPy, where newer pip breaks the build (#2955)
  • 🛠 Updates Pyodide to 314.0.4 (#2949, #2952)
  • 🛠 Updates dependencies and container pins (#2952, #2960)
  • 💼 Updates CI action pins (#2948, #2954)
  • 🧪 Uses pp311 for the abi3 test, and deletes test_overridden_pip_constraint, which is not necessary since #2583 (#2956, #2957)

v4.1.1

  • ✨ Adds pyodide-build as a separate build-frontend, now the default frontend for Pyodide, with verbosity flags handling. Any other frontend is ignored with a warning on Pyodide. (#2609, #2945)
  • 🔐 Uses digests instead of tags for pinned container images, strengthening supply-chain security. The human-readable tags remain as comments in pinned_docker_images.cfg. (#2915)
  • 🐛 Fixes platform-specific test-runtime environment variables (e.g. CIBW_TEST_RUNTIME_ANDROID) not being honored (#2941)
  • 🐛 Fixes quoting of test-requires and audit-requires so PEP 508 specifiers containing spaces work (#2913)
  • 🐛 Makes archs parsing case-insensitive and platform-aware, so e.g. arm64 works on Windows (#2920)
  • 🐛 Uses an absolute path for the {project} placeholder in config-settings (#2934)
  • 🐛 Validates the pyodide-version option against the build identifier with a clear error (#2925)
  • 🐛 Fixes PyPy installs on macOS after PyPy switched its downloads from .tar.bz2 to .tar.gz (#2939)
  • 🐛 Makes a matching python3-config available in the build and test venvs on macOS (#2922)
  • 🛠 Updates dependencies and container pins (#2917, #2935, #2939)
  • 🛠 Updates Android tests to current Python versions and the new test repository URL (#2933)
  • 🛠 Drops the orjson dependency, no longer used by mypy 2+ (#2923)
  • 📚 Builds the docs with properdocs, a MkDocs fork (#2946)
  • 📚 Adds the missing cp314-pyodide_wasm32 entry to the build identifier table (#2947)
  • 📚 Removes outdated notes about the pip wheel build frontend and ClearLinux (#2926)
  • 💼 Adds a "CI: PyPy EoL" PR label to run PyPy EoL tests on PRs (#2930)
  • 💼 Updates CI action pins and pre-commit hooks (#2914, #2932, #2938, #2940, #2942, #2943)
Changelog

Sourced from pypa/cibuildwheel's changelog.

v4.2.0

4 August 2026

  • 🌟 CPython 3.15 wheels are now built by default - without the "cpython-prerelease" enable set. It's time to build and upload these wheels to PyPI! This release includes CPython 3.15.0rc1, which is guaranteed to be ABI compatible with the final release. (#2944)
  • ✨ Adds Pyodide 3.15 support with the cp315-pyodide_wasm32 build identifier, using Pyodide 315.0.0a2. These are also stable wrt. the final release. (#2958)
  • 🐛 Retries a failed download six times with exponential backoff, so short network outages no longer stop a build. A 4xx response is still reported at once. (#2953)
  • 🐛 Accepts default as a build-frontend value on Pyodide, and accepts pyodide-build in the top-level table and in overrides (#2951)
  • 🛠 Holds pip back on GraalPy, where newer pip breaks the build (#2955)
  • 🛠 Updates Pyodide to 314.0.4 (#2949, #2952)
  • 🛠 Updates dependencies and container pins (#2952, #2960)
  • 💼 Updates CI action pins (#2948, #2954)
  • 🧪 Uses pp311 for the abi3 test, and deletes test_overridden_pip_constraint, which is not necessary since #2583 (#2956, #2957)

v4.1.1

24 July 2026

  • ✨ Adds pyodide-build as a separate build-frontend, now the default frontend for Pyodide, with verbosity flags handling. Any other frontend is ignored with a warning on Pyodide. (#2609, #2945)
  • 🔐 Uses digests instead of tags for pinned container images, strengthening supply-chain security. The human-readable tags remain as comments in pinned_docker_images.cfg. (#2915)
  • 🐛 Fixes platform-specific test-runtime environment variables (e.g. CIBW_TEST_RUNTIME_ANDROID) not being honored (#2941)
  • 🐛 Fixes quoting of test-requires and audit-requires so PEP 508 specifiers containing spaces work (#2913)
  • 🐛 Makes archs parsing case-insensitive and platform-aware, so e.g. arm64 works on Windows (#2920)
  • 🐛 Uses an absolute path for the {project} placeholder in config-settings (#2934)
  • 🐛 Validates the pyodide-version option against the build identifier with a clear error (#2925)
  • 🐛 Fixes PyPy installs on macOS after PyPy switched its downloads from .tar.bz2 to .tar.gz (#2939)
  • 🐛 Makes a matching python3-config available in the build and test venvs on macOS (#2922)
  • 🛠 Updates dependencies and container pins (#2917, #2935, #2939)
  • 🛠 Updates Android tests to current Python versions and the new test repository URL (#2933)
  • 🛠 Drops the orjson dependency, no longer used by mypy 2+ (#2923)
  • 📚 Builds the docs with properdocs, a MkDocs fork (#2946)
  • 📚 Adds the missing cp314-pyodide_wasm32 entry to the build identifier table (#2947)
  • 📚 Removes outdated notes about the pip wheel build frontend and ClearLinux (#2926)
  • 💼 Adds a "CI: PyPy EoL" PR label to run PyPy EoL tests on PRs (#2930)
  • 💼 Updates CI action pins and pre-commit hooks (#2914, #2932, #2938, #2940, #2942, #2943)
Commits

Updates astral-sh/ruff-action from 4.0.0 to 4.1.0

Release notes

Sourced from astral-sh/ruff-action's releases.

v4.1.0 🌈 Skip Astral mirror and support uv.lock

Changes

Among some minor bugfixes this release adds the option to skip the astral-sh mirror and download directly from GitHub releases. Useful if the Astral mirror can't or shouldn't be used.

Also big thanks to @​somaz94 for adding support for reading the desired ruff version from uv.lock. This works automatically if you haven't overridden the version discovery by using the inputs version or version-file

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

Commits

Updates actions/setup-python from 6 to 7

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 1, 2026
@dependabot
Bump the actions group across 1 directory with 4 updates
90e206f 
Bumps the actions group with 4 updates in the / directory: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel), [astral-sh/ruff-action](https://github.com/astral-sh/ruff-action) and [actions/setup-python](https://github.com/actions/setup-python).


Updates `astral-sh/setup-uv` from 8.2.0 to 10.0.1
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@v8.2.0...v10.0.1)

Updates `pypa/cibuildwheel` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/pypa/cibuildwheel/releases)
- [Changelog](https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md)
- [Commits](pypa/cibuildwheel@v4.1.0...v4.2.0)

Updates `astral-sh/ruff-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/astral-sh/ruff-action/releases)
- [Commits](astral-sh/ruff-action@v4.0.0...v4.1.0)

Updates `actions/setup-python` from 6 to 7
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: astral-sh/ruff-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: pypa/cibuildwheel
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the actions group with 4 updates Bump the actions group across 1 directory with 4 updates Sep 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-4a7b405148 branch from d9aeb28 to 90e206f Compare September 1, 2026 17:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants