Repository navigation
chore(deps): bump astral-sh/setup-uv from 7.6.0 to 10.2.0 - #1266
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 7.6.0 to 10.2.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@37802ad...c18668a) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
github_actions
burtenshaw
added
enhancement
Cursor
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Automated Checks
- Lint: N/A — no Python files are touched by this diff (only
.github/workflows/*.yml), sousort/ruffhave nothing to check. (Note:bash .claude/hooks/lint.shcouldn't run in this review sandbox becauseuvisn't installed there — unrelated to the PR content, since the hook only lintssrc//tests/Python anyway.) - Debug code: CLEAN for this diff —
check-debug.shonly surfaces pre-existingprint()/TODOoccurrences elsewhere insrc/(e.g.containers/test_local_docker_provider.py,cli/commands/serve.py); none are introduced by this change.
Change Summary
Pure dependabot CI bump: astral-sh/setup-uv pinned SHA 37802ad… (v7.6.0) → c18668a… (v10.2.0) across test.yml (4 occurrences), discovery-catalog.yml, and validation-runtime.yml. No application code, API, or environment changes.
- SHA verification: confirmed via GitHub API that
c18668ad3cf93ea998bef934396af7bb5c839dc7is indeed the commit taggedv10.2.0inastral-sh/setup-uv— the pin is legitimate, not a supply-chain substitution. - Breaking changes v7→v10 reviewed (checked upstream release notes for v8.0.0, v9.0.0, v10.0.0):
- v8.0.0 removed the deprecated custom
manifest-fileformat and major/minor floating tags — not used anywhere in this repo's workflows (already SHA-pinned). - v9.0.0 changed
prune-cachedefault tofalse(larger/slower Actions caches, no correctness impact) — not configured explicitly here, so behavior will shift slightly but harmlessly. - v10.0.0 disables automatic caching for
pull_request_target/workflow_run/releasetriggers whenenable-cache: auto— none of this repo's workflows use those trigger types, andvalidation-runtime.ymlsetsenable-cache: trueexplicitly (notauto), so this security change is a no-op here.
- v8.0.0 removed the deprecated custom
- No
manifest-file,version-file, or other new/changed inputs are used, so no follow-up config changes are needed.
Open RFCs Context
Scanned rfcs/ (000, 001, 002, 003, 004, 005, 008, 010, 011, 012). None govern CI/CD tooling or GitHub Actions infrastructure, so no RFC is directly relevant to this change.
Tier 1: Fixes Required
None — no mechanical issues found. The version bump is correctly SHA-pinned with an accurate version comment on every occurrence.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. This change doesn't touch the Gym-like API, MCP boundary, reward computation, client/server code, or any area covered by .claude/docs/PRINCIPLES.md / INVARIANTS.md.
RFC Conflicts
None identified. No open RFC (Draft/In Review or otherwise) addresses CI dependency versions.
Summary
- 0 mechanical issues to fix
- 0 alignment points for human review
- 0 RFC conflicts to discuss
This is a low-risk, mechanically verified CI dependency bump. Safe to merge from an alignment/correctness standpoint.
Sent by Cursor Automation: Pre-review
|
Looks like astral-sh/setup-uv is up-to-date now, so this is no longer needed. |
Bumps astral-sh/setup-uv from 7.6.0 to 10.2.0.
Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
c18668achore(deps): roll up Dependabot updates (#1059)ffe1476chore: update known checksums for 0.12.17 (#1058)f5548c5chore: update known checksums for 0.12.16 (#1057)a761a4eDisable automatic cache saves for merge queues (#1056)3377a30chore: update known checksums for 0.12.15 (#1054)dfb5f38chore: update known checksums for 0.12.14 (#1053)45c121fchore: update known checksums for 0.12.13 (#1045)8073452docs: update version references to v10.1.0 (#1044)bec219dchore(deps-dev): roll up Dependabot updates (#1043)b90ec40fix: respect no proxy directive (#1037)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
CI-only action pin bump with no application or lockfile changes; main risk is a regression in how uv is installed or cached in workflows.
Overview
Updates the pinned
astral-sh/setup-uvGitHub Action from v7.6.0 to v10.2.0 (commitc18668a…) everywhere CI installs uv.The change is limited to workflow YAML: discovery-catalog, Tests (validate-env-locks, test, test-thinkingbox-env, lint), and validation-runtime. Steps still use the same
UV_VERSION/ uv0.9.3where already configured; only the setup action reference changes.Reviewed by Cursor Bugbot for commit 18488c1. Bugbot is set up for automated code reviews on this repo. Configure here.