#558 chore(deps): update astral-sh/setup-uv action to v10 - autoclosed

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

• Disable automatic cache saves for merge queues @​eifinger (#​1056)

🧰 Maintenance

• chore: update known checksums for 0.12.17 @​github-actions[bot] (#​1058)
• chore: update known checksums for 0.12.16 @​github-actions[bot] (#​1057)
• chore: update known checksums for 0.12.15 @​github-actions[bot] (#​1054)
• chore: update known checksums for 0.12.14 @​github-actions[bot] (#​1053)
• chore: update known checksums for 0.12.13 @​github-actions[bot] (#​1045)

📚 Documentation

• docs: update version references to v10.1.0 @​github-actions[bot] (#​1044)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#​1059)

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @​mj0nez (#​1037)
• Use JSON + a typed wrapper instead of TS codegen @​woodruffw (#​1025)

🚀 Enhancements

• Expose a Python "identity" output @​woodruffw (#​1036)
• Verify downloads with astral-sh/versions checksums @​zaniebot (#​1033)

🧰 Maintenance

• chore: update known checksums for 0.12.12 @​github-actions[bot] (#​1041)
• chore: update known checksums for 0.12.10/0.12.11 @​github-actions[bot] (#​1038)
• chore: update known checksums for 0.12.9 @​github-actions[bot] (#​1035)
• chore: update known checksums for 0.12.7/0.12.8 @​github-actions[bot] (#​1031)
• chore: update known checksums for 0.12.6 @​github-actions[bot] (#​1030)
• chore: update known checksums for 0.12.5 @​github-actions[bot] (#​1020)
• Use self-repo syntax for all in-repo actions/reusable workflows @​woodruffw (#​1024)
• Pin one-shot tools @​woodruffw (#​1022)
• ci: remove obsolete direct push attempts @​eifinger (#​1019)

📚 Documentation

• docs: update version references to v10.0.1 @​github-actions[bot] (#​1018)

⬆️ Dependency updates

• chore(deps-dev): roll up Dependabot updates @​eifinger (#​1043)
• Harden npm install defaults @​zaniebot (#​1026)
• Add dependency cooldowns @​woodruffw (#​1021)

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#​1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @​github-actions[bot] (#​1017)

📚 Documentation

• docs: update version references to v10.0.0 @​github-actions[bot] (#​1014)

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in #​984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

• Disable automatic caching for sensitive events @​eifinger (#​992)

🐛 Bug fixes

• Reject paths in .tool-versions @​eifinger (#​1007)

🚀 Enhancements

• Read Python version from .tool-versions @​eifinger (#​996)
• Add latest-known version selector @​eifinger (#​993)

🧰 Maintenance

• Require pull requests for Dependabot rollups @​eifinger (#​1005)
• ci: pin Alpine container image @​eifinger (#​995)
• chore: update known checksums for 0.12.3 @​github-actions[bot] (#​991)
• chore: update known checksums for 0.12.2 @​github-actions[bot] (#​985)
• chore: update known checksums for 0.12.1 @​github-actions[bot] (#​982)
• chore: update known checksums for 0.12.0 @​github-actions[bot] (#​981)
• chore: update known checksums for 0.11.31/0.11.32 @​github-actions[bot] (#​972)

📚 Documentation

• docs: update version references to v9.0.0 @​github-actions[bot] (#​971)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#​1013)
• chore(deps): roll up Dependabot updates @​eifinger (#​1004)
• chore(deps): roll up Dependabot updates @​eifinger (#​994)
• chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @​dependabot[bot] (#​976)
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @​dependabot[bot] (#​980)