Skip to content

chore(ci): bump the github-actions group across 1 directory with 5 updates - #433

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-47c9d752ac
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-47c9d752ac

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 5 updates in the / directory:

Package From To
actions/setup-python 6 7
astral-sh/setup-uv 8.2.0 10.0.1
CodSpeedHQ/action 4 5
python-semantic-release/python-semantic-release 10.5.3 10.6.2
browniebroke/hacktoberfest-labeler-action 2.6.0 2.7.0

Updates actions/setup-python from 6 to 7

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

... (truncated)

Commits

Updates astral-sh/setup-uv from 8.2.0 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

Updates CodSpeedHQ/action from 4 to 5

Release notes

Sourced from CodSpeedHQ/action's releases.

v4.19.1

Release Notes

This release ships improvements for the memory instrument.

The memory instrument now lazily attaches to allocators, which lowers the startup time to a few seconds (down from minutes on certain systems). Additionally, we shipped a series of serialization improvements, removing in some large benchmarks 3+ minutes of extra CI time.

🐛 Bug Fixes

⚙️ Internals

💼 Other

Install codspeed-runner 4.19.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.19.1/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.19.1

File Platform Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.19.0...v4.19.1

v4.19.0

Release Notes

This release adds a new --experimental-exclude-allocations feature to remove allocator time from Simulation benchmarks.

🚀 Features

... (truncated)

Commits

Updates python-semantic-release/python-semantic-release from 10.5.3 to 10.6.2

Release notes

Sourced from python-semantic-release/python-semantic-release's releases.

v10.6.2 (2026-08-28)

This release is published under the MIT License.

🪲 Bug Fixes

  • cmd-changelog: Fix reading of TOML when file was created on Windows (9a56ace)

  • config: Validate commit author in config internally (PR#1477, 10afa8e)

⚙️ Build System

  • deps: Adjust importlib use to maintain 3.8 support (59fea4f)

  • deps: Bump rich requirement from v14.0+ to v15.0+ (PR#1464, abd942d)

  • deps: Bump tomlkit requirement to ~=0.15.0 (PR#1463, 429588d)

✅ Resolved Issues

  • #1476: Bug: GitPython v3.1.60 removed Actor.name_email_regex, breaking every config load

Detailed Changes: v10.6.1...v10.6.2


Installable artifacts are available from:

v10.6.1 (2026-07-06)

This release is published under the MIT License.

🪲 Bug Fixes

  • changelog: Fix handling of whitespace commit bodies in changelog template filter (PR#1457, d95e46e)

  • cmd-version: Fix non-styled error msg when strict & no new version (PR#1437, 5e8f94c)

  • config: Eliminate .git/ in parent dir warnings for monorepos configured with .. (PR#1444, 7a1f822)

📖 Documentation

  • CHANGELOG: Add v9.21.2 changelog details for website (a4115cf)

... (truncated)

Changelog

Sourced from python-semantic-release/python-semantic-release's changelog.

v10.6.2 (2026-08-28)

🪲 Bug Fixes

  • cmd-changelog: Fix reading of TOML when file was created on Windows (9a56ace_)

  • config: Validate commit author in config internally, closes [#1476](https://github.com/python-semantic-release/python-semantic-release/issues/1476)_ (PR#1477, 10afa8e)

⚙️ Build System

  • deps: Adjust importlib use to maintain 3.8 support (59fea4f_)

  • deps: Bump rich requirement from v14.0+ to v15.0+ (PR#1464, abd942d)

  • deps: Bump tomlkit requirement to ~=0.15.0 (PR#1463, 429588d)

.. _#1476: python-semantic-release/python-semantic-release#1476 .. _10afa8e: python-semantic-release/python-semantic-release@10afa8e .. _429588d: python-semantic-release/python-semantic-release@429588d .. _59fea4f: python-semantic-release/python-semantic-release@59fea4f .. _9a56ace: python-semantic-release/python-semantic-release@9a56ace .. _abd942d: python-semantic-release/python-semantic-release@abd942d .. _PR#1463: python-semantic-release/python-semantic-release#1463 .. _PR#1464: python-semantic-release/python-semantic-release#1464 .. _PR#1477: python-semantic-release/python-semantic-release#1477

.. _changelog-v10.6.1:

v10.6.1 (2026-07-06)

🪲 Bug Fixes

  • changelog: Fix handling of whitespace commit bodies in changelog template filter (PR#1457, d95e46e)

  • cmd-version: Fix non-styled error msg when strict & no new version, closes [#1423](https://github.com/python-semantic-release/python-semantic-release/issues/1423)_ (PR#1437, 5e8f94c)

  • config: Eliminate .git/ in parent dir warnings for monorepos configured with .., closes [#1418](https://github.com/python-semantic-release/python-semantic-release/issues/1418)_ (PR#1444, 7a1f822)

📖 Documentation

... (truncated)

Commits
  • 9a026e9 chore: release v10.6.2
  • 10afa8e fix(config): validate commit author in config internally (#1477)
  • 414e8fb ci(validate): improve Windows e2e test reliability
  • 9a56ace fix(cmd-changelog): fix reading of TOML when file was created on Windows
  • 7df3d73 test(util): add additional clarity for e2e test failure
  • c74aa3b refactor(deps): adjust dependency paradigm to maximize compatibility (#1466)
  • abd942d build(deps): bump rich requirement from v14.0+ to v15.0+ (#1464)
  • de32322 refactor(cmd-changelog): adjust import to chosing appropriate importlib when ...
  • df34b89 test: refactor for chosing correct importlib when needed
  • 59fea4f build(deps): adjust importlib use to maintain 3.8 support
  • Additional commits viewable in compare view

Updates browniebroke/hacktoberfest-labeler-action from 2.6.0 to 2.7.0

Release notes

Sourced from browniebroke/hacktoberfest-labeler-action's releases.

v2.7.0 (2026-08-07)

This release is published under the MIT License.

Features


Detailed Changes: v2.6.0...v2.7.0

Changelog

Sourced from browniebroke/hacktoberfest-labeler-action's changelog.

v2.7.0 (2026-08-07)

Features

  • Add support for python 3.15 (434aa9f)
Commits
  • 2f6920d 2.7.0
  • 434aa9f feat: add support for Python 3.15 (#1040)
  • 69f6c1a chore(deps): update pre-commit hook astral-sh/uv-pre-commit to v0.12.2 (#1039)
  • 411c36f chore(deps): update actions/attest action to v4.2.2 (#1038)
  • 7f7361b chore(deps): update pre-commit hook tox-dev/pyproject-fmt to v2.27.0 (#1037)
  • 822ed61 chore(deps): update pre-commit hook astral-sh/uv-pre-commit to v0.12.1 (#1036)
  • f3cfc16 chore(deps): update j178/prek-action action to v3 (#1034)
  • fe3c60d chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.16.1 (#1035)
  • 710ba55 chore(deps): update actions/attest action to v4.2.1 (#1033)
  • ffe73da chore(deps): update pre-commit hook commitizen-tools/commitizen to v4.17.0 (#...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates

Bumps the github-actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-python](https://github.com/actions/setup-python) | `6` | `7` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.2.0` | `10.0.1` |
| [CodSpeedHQ/action](https://github.com/codspeedhq/action) | `4` | `5` |
| [python-semantic-release/python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) | `10.5.3` | `10.6.2` |
| [browniebroke/hacktoberfest-labeler-action](https://github.com/browniebroke/hacktoberfest-labeler-action) | `2.6.0` | `2.7.0` |



Updates `actions/setup-python` from 6 to 7
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v6...v7)

Updates `astral-sh/setup-uv` from 8.2.0 to 10.0.1
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@v8.2.0...v10.0.1)

Updates `CodSpeedHQ/action` from 4 to 5
- [Release notes](https://github.com/codspeedhq/action/releases)
- [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md)
- [Commits](CodSpeedHQ/action@v4...v5)

Updates `python-semantic-release/python-semantic-release` from 10.5.3 to 10.6.2
- [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases)
- [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.rst)
- [Commits](python-semantic-release/python-semantic-release@v10.5.3...v10.6.2)

Updates `browniebroke/hacktoberfest-labeler-action` from 2.6.0 to 2.7.0
- [Release notes](https://github.com/browniebroke/hacktoberfest-labeler-action/releases)
- [Changelog](https://github.com/browniebroke/hacktoberfest-labeler-action/blob/main/CHANGELOG.md)
- [Commits](browniebroke/hacktoberfest-labeler-action@v2.6.0...v2.7.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: CodSpeedHQ/action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: python-semantic-release/python-semantic-release
  dependency-version: 10.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: browniebroke/hacktoberfest-labeler-action
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026
@codecov

codecov Bot commented Sep 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e2e9942) to head (18a92cb).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff            @@
##              main      #433   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            8         8           
  Lines          816       816           
  Branches        90        90           
=========================================
  Hits           816       816           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@codspeed

codspeed Bot commented Sep 1, 2026

Copy link
Copy Markdown

Hooray! CodSpeed harness just leveled up!

The base and head of this comparison were measured with different runner settings, so their benchmark values are not directly comparable.

What changed between base and head:

Re-run the base with the same settings to get a valid performance comparison.


Comparing dependabot/github_actions/github-actions-47c9d752ac (18a92cb) with main (e2e9942)1

Open in CodSpeed

Footnotes

  1. No successful run was found on main (d942377) during the generation of this report, so e2e9942 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants