From 34371bb245c949716c1200fc7f98031140287ed7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 12:02:50 +0000 Subject: [PATCH] build(deps): bump the actions group across 1 directory with 8 updates Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.3.1` | `10.0.1` | | [google/osv-scanner-action/osv-scanner-action](https://github.com/google/osv-scanner-action) | `8dc09193bb540e09b23da07ad7e30bd33bf87018` | `8e5cf47b818121e8b405931c82126c2630b0b20d` | | [google/osv-scanner-action/osv-reporter-action](https://github.com/google/osv-scanner-action) | `8dc09193bb540e09b23da07ad7e30bd33bf87018` | `8e5cf47b818121e8b405931c82126c2630b0b20d` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.31.10` | `4.37.8` | | [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) | `2.3.8` | `2.5.1` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `astral-sh/setup-uv` from 8.3.1 to 10.0.1 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/f98e06938123ccabd21905ea5d0069192241f9f1...20cfd1bf945f4377ade1205e4dbc17946fc9a30d) Updates `google/osv-scanner-action/osv-scanner-action` from 8dc09193bb540e09b23da07ad7e30bd33bf87018 to 8e5cf47b818121e8b405931c82126c2630b0b20d - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](https://github.com/google/osv-scanner-action/compare/8dc09193bb540e09b23da07ad7e30bd33bf87018...8e5cf47b818121e8b405931c82126c2630b0b20d) Updates `google/osv-scanner-action/osv-reporter-action` from 8dc09193bb540e09b23da07ad7e30bd33bf87018 to 8e5cf47b818121e8b405931c82126c2630b0b20d - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](https://github.com/google/osv-scanner-action/compare/8dc09193bb540e09b23da07ad7e30bd33bf87018...8e5cf47b818121e8b405931c82126c2630b0b20d) Updates `github/codeql-action/upload-sarif` from 4.31.10 to 4.37.8 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.31.10...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 2.3.8 to 2.5.1 - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](https://github.com/google/osv-scanner-action/compare/9a498708959aeaef5ef730655706c5a1df1edbc2...6e4298ebc4db23e847df9b2e2de2939d6f066c67) Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/cef221092ed1bacb1cc03d23a2d87d1d172e277b...dc37677b2e1c63e2034f94d8a5b11f265b73ba33) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml dependency-version: 2.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: google/osv-scanner-action/osv-reporter-action dependency-version: ffa0a5f39214d80778c9b494822d94d0d9668458 dependency-type: direct:production dependency-group: actions - dependency-name: google/osv-scanner-action/osv-scanner-action dependency-version: ffa0a5f39214d80778c9b494822d94d0d9668458 dependency-type: direct:production dependency-group: actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/CI.yml | 24 +++++++++++------------ .github/workflows/mcp-publish.yml | 2 +- .github/workflows/mutation.yml | 4 ++-- .github/workflows/osv-scanner.yml | 12 ++++++------ .github/workflows/release-branch-sync.yml | 4 ++-- .github/workflows/release.yml | 14 ++++++------- .github/workflows/scorecard.yml | 6 +++--- 7 files changed, 33 insertions(+), 33 deletions(-) diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml index 61a0b15a..a3b6e25e 100644 --- a/.github/workflows/CI.yml +++ b/.github/workflows/CI.yml @@ -42,12 +42,12 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up uv and Python 3.11 - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true python-version: '3.11' @@ -66,12 +66,12 @@ jobs: name: Types (mypy + pyright) runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up uv and Python 3.12 - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true python-version: '3.12' @@ -100,13 +100,13 @@ jobs: # - windows-latest: Windows Server 2022 os: [ubuntu-latest, macos-latest, windows-latest] steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 - name: Set up uv and Python ${{ matrix.python-version }} - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true python-version: ${{ matrix.python-version }} @@ -150,13 +150,13 @@ jobs: name: Per-file coverage gate runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 - name: Set up uv and Python 3.12 - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true python-version: '3.12' @@ -188,12 +188,12 @@ jobs: name: Execute tutorial notebooks runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up uv and Python 3.11 - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true python-version: '3.11' @@ -215,13 +215,13 @@ jobs: name: Test Docs Build runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 - name: Set up uv and Python 3.11 - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true python-version: '3.11' diff --git a/.github/workflows/mcp-publish.yml b/.github/workflows/mcp-publish.yml index bf3d022e..7608af23 100644 --- a/.github/workflows/mcp-publish.yml +++ b/.github/workflows/mcp-publish.yml @@ -28,7 +28,7 @@ jobs: contents: read # checkout of server.json and the version stamp steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index f1593d2b..d8177a29 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -29,12 +29,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 420 # 2,723 mutants at 4 workers measured ~5h05m on the standard runner (2026-07-11 run reached 97% at the old 300m cap); 420 leaves headroom for slow-tail variance steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up uv and Python 3.12 - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true python-version: '3.12' diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 4622a90c..55aff6f3 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -39,7 +39,7 @@ jobs: contents: read # checkout for the lockfile scan actions: read # the reporter reads workflow metadata steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 # both branches must be local; the checkouts below are offline @@ -48,7 +48,7 @@ jobs: run: git checkout "$GITHUB_BASE_REF" - name: Scan the base branch - uses: google/osv-scanner-action/osv-scanner-action@8dc09193bb540e09b23da07ad7e30bd33bf87018 # v2.3.8 + uses: google/osv-scanner-action/osv-scanner-action@8e5cf47b818121e8b405931c82126c2630b0b20d # v2.3.8 continue-on-error: true with: scan-args: |- @@ -60,7 +60,7 @@ jobs: run: git checkout -f "$GITHUB_SHA" - name: Scan the pull request head - uses: google/osv-scanner-action/osv-scanner-action@8dc09193bb540e09b23da07ad7e30bd33bf87018 # v2.3.8 + uses: google/osv-scanner-action/osv-scanner-action@8e5cf47b818121e8b405931c82126c2630b0b20d # v2.3.8 continue-on-error: true with: scan-args: |- @@ -69,7 +69,7 @@ jobs: --lockfile=./uv.lock - name: Fail only on a newly introduced vulnerability - uses: google/osv-scanner-action/osv-reporter-action@8dc09193bb540e09b23da07ad7e30bd33bf87018 # v2.3.8 + uses: google/osv-scanner-action/osv-reporter-action@8e5cf47b818121e8b405931c82126c2630b0b20d # v2.3.8 with: scan-args: |- --output=results.sarif @@ -80,13 +80,13 @@ jobs: - name: Upload SARIF to code scanning if: ${{ !cancelled() }} - uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: results.sarif scan-scheduled: if: github.event_name != 'pull_request' - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1 permissions: security-events: write # upload SARIF to code scanning contents: read # checkout for the lockfile scan diff --git a/.github/workflows/release-branch-sync.yml b/.github/workflows/release-branch-sync.yml index 3e21e48b..d28a9fa5 100644 --- a/.github/workflows/release-branch-sync.yml +++ b/.github/workflows/release-branch-sync.yml @@ -25,7 +25,7 @@ jobs: # The bot's own sync commit also triggers this workflow; the diff check # below makes that second run a no-op rather than a loop. steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Push with the PAT, not the default GITHUB_TOKEN: a push made with # the default token does not retrigger the pull request checks, and @@ -33,7 +33,7 @@ jobs: token: ${{ secrets.RELEASE_PLEASE_TOKEN }} persist-credentials: true - - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: # Matches the required-version pin in pyproject.toml. version: "0.11.28" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 84c1e647..e55d6d23 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,12 +24,12 @@ jobs: contents: read # checkout steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up uv and Python 3.10 - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: false python-version: '3.10' @@ -58,11 +58,11 @@ jobs: python-version: ['3.10', '3.11', '3.12', '3.13'] steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up uv and Python ${{ matrix.python-version }} - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: false python-version: ${{ matrix.python-version }} @@ -99,11 +99,11 @@ jobs: python-version: ['3.10', '3.11', '3.12', '3.13'] steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up uv and Python ${{ matrix.python-version }} - uses: astral-sh/setup-uv@f98e06938123ccabd21905ea5d0069192241f9f1 # v8.3.1 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: false python-version: ${{ matrix.python-version }} @@ -145,7 +145,7 @@ jobs: path: wheelhouse - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 with: packages-dir: wheelhouse/ skip-existing: true diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b6d84636..676eb571 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -30,18 +30,18 @@ jobs: steps: - name: Check out the repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run the Scorecard analysis - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload the SARIF results to code scanning - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: results.sarif