[cursor]

Summary

Consolidates 5 open Dependabot singles (all GitHub Actions version bumps outside envs/) into one maintainer-friendly PR, per the daily Dependabot triage automation.

Type of Change

• Refactoring (dependency/CI maintenance, no behavior change)

Alignment Checklist

• I have read .claude/docs/PRINCIPLES.md and this PR aligns with our principles
• I have checked .claude/docs/INVARIANTS.md and no invariants are violated
• I have run /pre-submit-pr (or bash .claude/hooks/lint.sh and tests) and addressed all issues — not applicable: this PR only touches .github/workflows/*.yml pinned action versions/SHAs, no Python source changed, so lint/tests are a no-op and CI is green across the board.

RFC Status

• Not required (bug fix, docs, minor refactoring) — pure CI/action version bumps

Test Plan

Each folded single was individually green (all CI checks passing) before being folded in here. CI on this consolidated branch is also green. No manual test plan needed — these are GitHub Actions pin bumps only.

Claude Code Review

N/A

---

Folded Dependabot PRs (all GitHub Actions bumps, outside envs/)

• chore(deps): bump astral-sh/setup-uv from 10.3.0 to 10.3.3 #1583 — bump astral-sh/setup-uv from 10.3.0 to 10.3.3
• chore(deps): bump huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from 1d2fd4ce6230951d654b5ec9b5cdb2b8175dbe8c to 9b0e5b334b65d006b59e0b1a022a33122f7e12aa #1584 — bump huggingface/doc-builder .github/workflows/build_pr_documentation.yml ref
• chore(deps): bump docker/login-action from 4.7.0 to 4.8.0 #1585 — bump docker/login-action from 4.7.0 to 4.8.0
• chore(deps): bump huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from 1d2fd4ce6230951d654b5ec9b5cdb2b8175dbe8c to 9b0e5b334b65d006b59e0b1a022a33122f7e12aa #1586 — bump huggingface/doc-builder .github/workflows/upload_pr_documentation.yml ref
• chore(deps): bump huggingface/doc-builder/.github/workflows/build_main_documentation.yml from 1d2fd4ce6230951d654b5ec9b5cdb2b8175dbe8c to 9b0e5b334b65d006b59e0b1a022a33122f7e12aa #1587 — bump huggingface/doc-builder .github/workflows/build_main_documentation.yml ref

All 5 merged cleanly with zero conflicts (non-overlapping workflow-file lines). Final diff vs main is exactly the union of the 5 bumps: 6 .github/workflows/*.yml files, 8 insertions / 8 deletions.

After this merges, please close the 5 PRs above directly (do not merge them individually — their content is already included here).

Excluded from this core bucket

• chore(deps): update fastmcp requirement from <4.0.0,>=3.0.0 to >=3.0.0,<5.0.0 #1331 — fastmcp >=3.0.0,<4.0.0 → >=3.0.0,<5.0.0. Still excluded: FastMCP 4.x (now at 4.1.7) still breaks TestMCPSessionTransportPersistence::test_http_session_mcp_state_persists_across_calls / test_websocket_mcp_state_persists_across_calls (ctx.set_state is request-scoped on the new MCP SDK session model; OpenEnv relies on cross-call state persistence). test (3.11)/test (3.12) fail on chore(deps): update fastmcp requirement from <4.0.0,>=3.0.0 to >=3.0.0,<5.0.0 #1331 as of this run. None of the 4.1.x release notes since the pin was opened mention session-persistence changes. Leave chore(deps): update fastmcp requirement from <4.0.0,>=3.0.0 to >=3.0.0,<5.0.0 #1331 open/unmerged until FastMCP restores (or OpenEnv adapts to) cross-call session state.

Stale/redundant aggregate PRs to close (no unique content left — already verified empty-diff vs main via a scratch merge)

• chore(deps): consolidate core Dependabot bumps (2026-11-03) #1553 — automation/dependabot-core-2026-11-03 (superseded by this PR)
• chore(deps): consolidate core Dependabot bumps (2026-10-31) #1540 — automation/dependabot-core-2026-10-31
• chore(deps): consolidate core Dependabot bumps (2026-10-28) #1516 — automation/dependabot-core-2026-10-28

Note on "close all single Dependabot PRs"

This automation only has write access to open/update PRs (via this tool) and read-only gh; it has no PR-close capability. Maintainers need to manually close the 5 folded singles above plus the 3 stale core aggregates once this PR merges.

  

---

Note

Low Risk
CI-only action SHA/version bumps with no changes to secrets handling logic beyond upstream action releases.

Overview
Updates pinned GitHub Actions across six workflow files—no application or runtime logic changes.

Documentation pipelines now reference huggingface/doc-builder at commit 9b0e5b33… instead of 1d2fd4ce… in build_documentation.yml, build_pr_documentation.yml, and upload_pr_documentation.yml.

Docker publish jobs in docker-build.yml and openspiel_base_build.yml upgrade docker/login-action from v4.7.0 to v4.8.0 for GHCR login steps.

The OR-Tools test job in test.yml bumps astral-sh/setup-uv from v10.3.0 to v10.3.3.

^{Reviewed by Cursor Bugbot for commit 3cb64b6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f31a751. Configure here.}

[burtenshaw]

I reverted the #1598 merge (a515688), so this PR now carries only the five GitHub Actions bumps (#1583 to #1587): 6 workflow files, 8 lines changed. I checked each new pin against its upstream release: docker/login-action v4.8.0, astral-sh/setup-uv v10.3.3 and the huggingface/doc-builder commit on its main.

The pillow 13 bump is on hold. Every stable gradio (up to 6.31.0) caps pillow below 13, so the bump also moved tests/validation_runtime/uv.lock to gradio 7.0.0.dev0 and gradio-client 2.8.0.dev0, a pre-release published on 9 Nov. #1598 stays open until a stable gradio allows pillow 13.