Skip to content

chore(deps): bump the github-actions group across 1 directory with 3 updates - #914

Merged
nealrichardson merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-839d238649
Nov 6, 2026
Merged

nealrichardson merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-839d238649

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 3 updates in the / directory: astral-sh/setup-uv, pypa/gh-action-pypi-publish and rossjrw/pr-preview-action.

Updates astral-sh/setup-uv from 10.3.0 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

📚 Documentation

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

🧰 Maintenance

... (truncated)

Commits
  • 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
  • 0192b69 chore: update known checksums for 0.13.6 (#1117)
  • 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
  • 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
  • 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
  • 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
  • 56618ca docs: update version references to v10.3.2 (#1104)
  • 07a047e chore: update known checksums for 0.13.5 (#1103)
  • e1b8536 docs: update version references to v10.3.1 (#1102)
  • 18d369b chore(deps): roll up Dependabot updates (#1101)
  • Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

Commits
  • 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
  • 331eccb Upgrade certifi and sigstore
  • f68fee4 💰 Sync the FUNDING config
  • c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
  • 9090099 🧪 Make smoke test deps hash-pinned in CI
  • 34e40c2 📌 Bump pip-tools managed transitive deptrees
  • e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
  • dd8c5f4 🔧 Make pip-tools config available in container
  • See full diff in compare view

Updates rossjrw/pr-preview-action from 1.8.1 to 1.8.2

Release notes

Sourced from rossjrw/pr-preview-action's releases.

v1.8.2

Bugfixes

Full Changelog: rossjrw/pr-preview-action@v1.8.1...v1.8.2

Commits
  • 873417d Merge pull request #141 from dagassmann/fix/wait-ghes-urls
  • 4c79002 Fix remaining hardcoded github.com URLs in wait script
  • 6ad689f Restrict test workflow permissions
  • 6f3a89d Update screenshot
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 30, 2026
@github-actions

github-actions Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines Covered Coverage Threshold Status
11187 9961 89% 0% 🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: 255f63d by action🐍

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-839d238649 branch from 574ac39 to 9abe68e Compare November 6, 2026 19:56
…updates

Bumps the github-actions group with 3 updates in the / directory: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) and [rossjrw/pr-preview-action](https://github.com/rossjrw/pr-preview-action).


Updates `astral-sh/setup-uv` from 10.3.0 to 10.3.3
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@1c37ad0...68559e9)

Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@dc37677...7245906)

Updates `rossjrw/pr-preview-action` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/rossjrw/pr-preview-action/releases)
- [Commits](rossjrw/pr-preview-action@ffa7509...873417d)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: rossjrw/pr-preview-action
  dependency-version: 1.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-839d238649 branch from 9abe68e to 255f63d Compare November 6, 2026 20:35

@nealrichardson nealrichardson left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI failures are expected

@nealrichardson
nealrichardson merged commit e60a14b into main Nov 6, 2026
17 of 29 checks passed
@nealrichardson
nealrichardson deleted the dependabot/github_actions/github-actions-839d238649 branch November 6, 2026 21:04
@github-actions

github-actions Bot commented Nov 6, 2026

Copy link
Copy Markdown
PR Preview Action v1.8.2
Preview removed because the pull request was closed.
2026-11-06 21:04 UTC

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant