chore(deps): update non-major (github-actions)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
anchore/sbom-action	action	patch	v0.24.0 → v0.24.2
astral-sh/setup-uv	action	minor	v10.0.1 → v10.1.0	v10.2.0
astral-sh/uv	uses-with	patch	0.12.5 → 0.12.13	0.12.19 (+5)
github/codeql-action	action	minor	v4.37.7 → v4.38.0	v4.38.2 (+1)
step-security/harden-runner	action	patch	v2.21.0 → v2.21.1

---

Release Notes

anchore/sbom-action (anchore/sbom-action)

v0.24.2

Compare Source

Added Features

• bump eslint from 10.8.1 to 10.9.0 [#​724 @​dependabot]

Additional Changes

• add makefile target to bump syft [#​620 @​willmurphyscode]
• update zizmor workflow triggers [#​624 @​wagoodman]
• require zizmor security events [#​621 @​wagoodman]

(Full Changelog)

v0.24.1

Compare Source

astral-sh/setup-uv (astral-sh/setup-uv)

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @​mj0nez (#​1037)
• Use JSON + a typed wrapper instead of TS codegen @​woodruffw (#​1025)

🚀 Enhancements

• Expose a Python "identity" output @​woodruffw (#​1036)
• Verify downloads with astral-sh/versions checksums @​zaniebot (#​1033)

🧰 Maintenance

• chore: update known checksums for 0.12.12 @​github-actions[bot] (#​1041)
• chore: update known checksums for 0.12.10/0.12.11 @​github-actions[bot] (#​1038)
• chore: update known checksums for 0.12.9 @​github-actions[bot] (#​1035)
• chore: update known checksums for 0.12.7/0.12.8 @​github-actions[bot] (#​1031)
• chore: update known checksums for 0.12.6 @​github-actions[bot] (#​1030)
• chore: update known checksums for 0.12.5 @​github-actions[bot] (#​1020)
• Use self-repo syntax for all in-repo actions/reusable workflows @​woodruffw (#​1024)
• Pin one-shot tools @​woodruffw (#​1022)
• ci: remove obsolete direct push attempts @​eifinger (#​1019)

📚 Documentation

• docs: update version references to v10.0.1 @​github-actions[bot] (#​1018)

⬆️ Dependency updates

• chore(deps-dev): roll up Dependabot updates @​eifinger (#​1043)
• Harden npm install defaults @​zaniebot (#​1026)
• Add dependency cooldowns @​woodruffw (#​1021)

astral-sh/uv (astral-sh/uv)

v0.12.13

Compare Source

Released on 2026-09-10.

Python

• Add GraalPy 3.13.0 (#​21431)

Enhancements

• Verify hashes when downloading PEP 658 metadata sidecars (#​21563)

Preview features

• Respect ty exclusions when uv check automatically selects members of a virtual workspace (#​21555)

Performance

• Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (#​21279)

Bug fixes

• Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (#​18713)
• Prefer core-metadata over legacy aliases in JSON index responses (#​21563)

v0.12.12

Compare Source

Released on 2026-09-09.

The executables in our macOS and Windows release archives and uv and uv_build wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

• Exclude distributions uploaded after the exclude-newer cutoff from lockfiles and generated requirement hashes (#​21539)

v0.12.11

Compare Source

Released on 2026-09-08.

Preview features

• Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#​20146)
• Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#​21462)

Performance

• Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#​21478)
• Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#​21468)
• Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#​21500)
• Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#​21499)
• Avoid transitive dependency checks and unnecessary resolution when uv pip install --no-deps finds the requested packages already installed (#​21523)

Bug fixes

• Verify source archives against hashes recorded in uv.lock before reading their metadata or running their build backends (#​21223)
• Verify supplied hashes for registry requirements pinned with === under both --verify-hashes and --require-hashes (#​21543)
• Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided (#​21544)
• Support PowerShell virtual environment activation from UNC paths, including WSL paths (#​19159)
• Trim surrounding whitespace from entries in .python-version and .python-versions files (#​21529)
• Suppress VIRTUAL_ENV mismatch warnings for uv add --no-sync, uv remove --no-sync, and uv add --frozen (#​21496)
• Warn and continue when uv python list cannot query an interpreter (#​21498)

Documentation

• Restore TOML syntax highlighting for exclude-newer examples (#​21534)

v0.12.10

Compare Source

Released on 2026-09-04.

Enhancements

• Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#​21423)

Preview features

• Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#​21455)
• Show terminal dependency cycles in uv tree --invert output (#​21404)

Performance

• Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#​21399)
• Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#​21389)

Bug fixes

• Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#​21454)
• Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#​19571)
• Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#​21450)
• Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#​21395)
• Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#​21453)

v0.12.9

Compare Source

Released on 2026-09-01.

Python

• Add CPython 3.15.0rc2 (#​21413, #​21415)

Enhancements

• Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#​21408)
• Report the exact command-line lock-mode flag in warnings and errors (#​21402)

Performance

• Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#​21372)

Bug fixes

• Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#​21401)
• Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#​21382)
• Redact secrets in signed URLs from retry diagnostics, including nested request errors (#​21381)
• Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#​21396)
• Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#​21400)

v0.12.8

Compare Source

Released on 2026-08-31.

Enhancements

• Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#​21368)

Preview features

• Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#​21327)
• Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#​21340)
• Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#​21344)

Performance

• Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#​21379)
• Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#​21373)
• Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#​21377)
• Speed up warm resolutions by reducing repeated marker interner work (#​21300)

Bug fixes

• Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#​21348)
• Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#​21366)
• Redact Azure shared access signature (sig) query parameters from displayed URLs (#​21360)
• Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#​21341)

Other changes

• Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#​21346)

v0.12.7

Compare Source

Released on 2026-08-27.

Python

• Replace managed Python installations when upgrading to a newer build of the same version (#​21323)

Enhancements

• Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#​21313)
• Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#​21318)

Preview features

• Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#​19693)

Bug fixes

• Reject source archives with hash mismatches before persisting their extracted contents to the cache (#​21248)

Other changes

• remove pyx specific features (#​21182, #​21183, #​21184, #​21185, #​21186)

v0.12.6

Compare Source

Released on 2026-08-25.

Python

• Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #​21295)

Enhancements

• Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#​21261)
• Limit warnings about unbounded uv_build requirements to source-distribution builds (#​21078)
• Display byte counts below 1 KiB without a fractional part (#​21237)

Preview features

• Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#​21117)
• Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#​21235)
• Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#​21227)
• Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#​21146)

Performance

• Enable profile-guided optimization for Linux x86-64 release binaries (#​21001)
• Enable profile-guided optimization for Windows x86-64 release binaries (#​21003)
• Enable profile-guided optimization for macOS ARM64 release binaries (#​21002)
• Enable profile-guided optimization for Linux ARM64 release binaries (#​21004)
• Speed up syncing projects with many activated conflict items by reusing their encoded representation (#​21148)

Bug fixes

• Allow explicit uv build and non-editable first-party workspace packages when no-build is enabled (#​21294)
• Reuse configured index credentials during uv tool upgrade when the tool receipt references the same index (#​21275)
• Ensure full 40-character Git commit pins resolve to the requested object instead of a SHA-named branch (#​21224)
• Prevent TLS segfaults in riscv64 musl release binaries (#​21158)
• Preserve dependencies selected by recursive extras when markers mix production and extra conditions (#​21181)
• Preserve version constraints from transitively referenced recursive extras (#​21209)
• Resolve repository-relative Git archive dependencies inside the checkout during the initial uv sync (#​21264)
• Return an error instead of panicking when a bearer token cannot be encoded as an HTTP header (#​21282)
• Do not misclassify package URLs ending in .py as local script paths (#​21144)
• Use directory creation times consistently across libc implementations for directory cache-keys entries (#​21137)
• Promote human-readable sizes to the next unit at rounding boundaries (#​21136)

Other changes

• Add Python 3.15 release-candidate Docker images (#​21293)
• Raise the minimum supported Rust version to 1.96 and update the repository toolchain to Rust 1.98 (#​21258)

github/codeql-action (github/codeql-action)

v4.38.0

Compare Source

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
• Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

step-security/harden-runner (step-security/harden-runner)

v2.21.1

Compare Source

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
careerrat-website	Ready	Preview	Sep 24, 2026 9:03pm UTC

[vercel]

Deployment failed for project careerrat-website with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/codeswhat?upgradeToPro=build-rate-limit

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: CodesWhat/careerrat/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: e1b0c43e-cf4d-43b4-b397-eed2115919be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}