build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.2 - #1430
Conversation
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.0 to 8.3.2. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v8.3.0...v8.3.2) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.3.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #1430 +/- ##
========================================
Coverage 92.58% 92.58%
========================================
Files 211 211
Lines 33224 33224
========================================
Hits 30760 30760
Misses 2464 2464 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
…sh/setup-uv-8.3.2
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
| - uses: actions/checkout@v6.0.2 | ||
| - name: Install the latest version of uv | ||
| uses: astral-sh/setup-uv@v8.3.0 | ||
| uses: astral-sh/setup-uv@v8.3.2 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🚀 Fixed in commit cf0c0d7 🚀
…sh/setup-uv-8.3.2
Co-authored-by: Grzegorz Bokota <bokota+github@gmail.com>
|
1 participant
Bumps astral-sh/setup-uv from 8.3.0 to 8.3.2.
Commits
11f9893chore: roll up Dependabot updates (#948)f798556docs: update version references to v8.3.1 (#946)e80544dchore: update known checksums for 0.11.28 (#947)f98e069Change update-docs PR labels from 'update-docs' to 'documentation' (#945)cd46263chore: update known checksums for 0.11.27 (#944)11245c7docs: update version references to v8.3.0 (#939)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)