Skip to content

ci: bump astral-sh/setup-uv from 10.3.2 to 10.3.3 in the actions-minor-and-patch group - #24

Merged
gorandodig merged 1 commit into
mainfrom
dependabot/github_actions/actions-minor-and-patch-7313d4f700
Nov 3, 2026
Merged

gorandodig merged 1 commit into
mainfrom
dependabot/github_actions/actions-minor-and-patch-7313d4f700

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the actions-minor-and-patch group with 1 update: astral-sh/setup-uv.

Updates astral-sh/setup-uv from 10.3.2 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

Commits
  • 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
  • 0192b69 chore: update known checksums for 0.13.6 (#1117)
  • 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
  • 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
  • 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
  • 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
  • 56618ca docs: update version references to v10.3.2 (#1104)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

  • Chores
    • Updated the tooling used by package-publishing automation. This is a maintenance change; it does not alter product functionality or the package-publishing workflow. No user-facing features, behavior, or settings have changed.

Bumps the actions-minor-and-patch group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).


Updates `astral-sh/setup-uv` from 10.3.2 to 10.3.3
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@07a047e...68559e9)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@coderabbitai

coderabbitai Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 835d3b7b-c8db-4bd0-928f-51baef1c1a75
Commits

Reviewing files that changed from the base of the PR and between 00e517d and 19b0ccf.

Files selected for processing: 2
  • .github/workflows/publish-dev-to-pypi.yml
  • .github/workflows/publish-to-pypi.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

Both PyPI publishing workflows update the pinned astral-sh/setup-uv action from v10.3.2 to v10.3.3. No other workflow behavior changes.

Changes: PyPI publishing workflows

Layer / File(s) Summary
Update setup-uv pins
.github/workflows/publish-dev-to-pypi.yml, .github/workflows/publish-to-pypi.yml
Both workflows now pin astral-sh/setup-uv to v10.3.3.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related PRs

Suggested labels: dependencies

Suggested reviewers: gorandodig

Merge Risk: Minimal · up to 19b0c

The PR is limited to the intended dependency patch updates and is mergeable with normal checks.

Architecture risk: Low · up to 19b0c

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

  • observed — Modified behavior in .github/workflows/publish-dev-to-pypi.yml: The setup-uv action reference changes from the v10.3.2 commit to the v10.3.3 commit.
  • observed — Modified behavior in .github/workflows/publish-to-pypi.yml: The setup-uv action reference changes from the commit pinned to v10.3.2 to the commit pinned to v10.3.3.
Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title names the change: a dependency bump of astral-sh/setup-uv from 10.3.2 to 10.3.3 in the actions-minor-and-patch group. The raw summary and objectives confirm that both workflow files change o…
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Title check

Explanation

The title names the change: a dependency bump of astral-sh/setup-uv from 10.3.2 to 10.3.3 in the actions-minor-and-patch group. The raw summary and objectives confirm that both workflow files change only this pinned action version. The title is specific, concise, and matches the main change. The 'ci:' prefix is a conventional commit type and fits a workflow-only change.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches
Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

@gorandodig
gorandodig merged commit be785b6 into main Nov 3, 2026
2 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-minor-and-patch-7313d4f700 branch November 3, 2026 09:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant