chore(deps): bump the actions-version-updates group across 1 directory with 16 updates by dependabot[bot] · Pull Request #90 · zitadel/client-python

dependabot · 2026-01-12T18:07:11Z

Bumps the actions-version-updates group with 16 updates in the / directory:

Package	From	To
step-security/harden-runner	`2.12.0`	`2.14.0`
actions/checkout	`4.2.2`	`6.0.1`
actions/dependency-review-action	`4.7.1`	`4.8.2`
docker/setup-buildx-action	`3.10.0`	`3.12.0`
docker/build-push-action	`6.17.0`	`6.18.0`
astral-sh/setup-uv	`4`	`7`
stefanzweifel/git-auto-commit-action	`5.2.0`	`7.1.0`
actions/download-artifact	`4.3.0`	`7.0.0`
JetBrains/qodana-action	`201551778d1453e36c5c0aa26f89a94775cb1acc`	`f5aa2889b113c16bd6aee47817b027537ee33ac7`
actions/setup-node	`4.4.0`	`6.1.0`
mridang/action-semantic-release	`1`	`2`
ossf/scorecard-action	`2.4.1`	`2.4.3`
github/codeql-action	`3.28.18`	`4.31.10`
mridang/action-test-reporter	`1`	`3`
actions/upload-artifact	`4.6.2`	`6.0.0`
dorny/test-reporter	`2.0.0`	`2.5.0`

Updates step-security/harden-runner from 2.12.0 to 2.14.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.14.0

What's Changed

Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.

Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

What's Changed

Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

v2.13.2

What's Changed

Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.

Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

v2.13.1

What's Changed

Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog: step-security/harden-runner@v2.13.0...v2.13.1

v2.13.0

What's Changed

Improved job markdown summary

Https monitoring for all domains (included with the enterprise tier)

Full Changelog: step-security/harden-runner@v2...v2.13.0

v2.12.2

What's Changed

Added HTTPS Monitoring for additional destinations - *.githubusercontent.com Bug fixes:

Implicitly allow local multicast, local unicast and broadcast IP addresses in block mode

Increased policy map size for block mode

... (truncated)

Commits

20cf305 Merge pull request #622 from step-security/feature/custom-property-skip
c51e8ee feat: skip agent install and post step on subsequent runs for GitHub-hosted r...
e152b90 feat: skip harden-runner based on repository custom property
ee1faec feat: replace skip-harden-runner with skip-on-custom-property input
1dc7c17 feat: add skip-harden-runner input to conditionally skip execution
df199fb Merge pull request #620 from step-security/rc-29
03d096a update agent
4090107 fix: update agent
95d9a5d Merge pull request #606 from step-security/rc-28
87e429d Update limitations.md
Additional commits viewable in compare view

Updates actions/checkout from 4.2.2 to 6.0.1

Release notes

Sourced from actions/checkout's releases.

v6.0.1

What's Changed

Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

Clarify v6 README by @ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

Persist creds to a separate file by @ericsciple in actions/checkout#2286

v6-beta by @ericsciple in actions/checkout#2298

update readme/changelog for v6 by @ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

Prepare v5.0.0 release by @salmanmkc in actions/checkout#2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.1

What's Changed

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776

v4.1.6

Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732

... (truncated)

Commits

8e8c483 Clarify v6 README (#2328)
033fa0d Add worktree support for persist-credentials includeIf (#2327)
c2d88d3 Update all references from v5 and v4 to v6 (#2314)
1af3b93 update readme/changelog for v6 (#2311)
71cf226 v6-beta (#2298)
069c695 Persist creds to a separate file (#2286)
ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
08c6903 Prepare v5.0.0 release (#2238)
9f26565 Update actions checkout to use node 24 (#2226)
08eba0b Prepare release v4.3.0 (#2237)
Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.7.1 to 4.8.2

Release notes

Sourced from actions/dependency-review-action's releases.

v4.8.2

Minor fixes:

Fix PURL parsing for scoped packages (#1008 from @danielhardej)

Fix for large summaries (#1007 from @gitulisca)

README includes a working example for allow-dependencies-licenses (#1009 from @danielhardej)

Dependency Review Action v4.8.1

What's Changed

(bug) Fix spamming link test in deprecation warning (again) by @ahpook in actions/dependency-review-action#1000

Bump version for 4.8.1 release by @ahpook in actions/dependency-review-action#1001

Full Changelog: actions/dependency-review-action@v4...v4.8.1

v4.8.0

What's Changed

Make Ruby Code Scannable by @ljones140 in actions/dependency-review-action#978

Batch some contributions for release by @brrygrdn in actions/dependency-review-action#986

Make license lists collapsable by @jasperkamerling

feat: add large summary handling with artifact upload by @MattMencel

New Contributors

@ljones140 made their first contribution in actions/dependency-review-action#978

@jasperkamerling made their first contribution in actions/dependency-review-action#986

@MattMencel made their first contribution in actions/dependency-review-action#986

Full Changelog: actions/dependency-review-action@v4...v4.8.0

4.7.3

What's Changed

Add explicit permissions to workflow files by @AshelyTC in actions/dependency-review-action#966

Claire153/fix spamming mentioned issue by @claire153 in actions/dependency-review-action#974

Full Changelog: actions/dependency-review-action@v4...v4.7.3

4.7.2

What's Changed

Add Missing Languages to CodeQL Advanced Configuration by @KyFaSt in actions/dependency-review-action#945

Deprecate deny lists by @claire153 in actions/dependency-review-action#958

Address discrepancy between docs and reality by @ahpook in actions/dependency-review-action#960

New Contributors

@KyFaSt made their first contribution in actions/dependency-review-action#945

@claire153 made their first contribution in actions/dependency-review-action#958

@ahpook made their first contribution in actions/dependency-review-action#960

Full Changelog: actions/dependency-review-action@v4...v4.7.2

Commits

3c4e3dc Merge pull request #1016 from actions/dra-release
02930b2 Update CONTRIBUTING to reflect new guidelines
49ffd9f Update CONTRIBUTING to reflect the need to build
70cb25e 4.8.2 release
ebabd31 Merge pull request #1008 from danielhardej/danielhardej-patch-20251023
19f9360 Update package-lock.json
5fd2f98 Bump @types/jest to version 29.5.14
28647f4 Fix PURL parsing by removing encodeURI
f620fd1 Merge pull request #1013 from actions/dangoor/token-fix
9b42b7e Remove bad token reference
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.10.0 to 3.12.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.12.0

Deprecate install input by @crazy-max in docker/setup-buildx-action#455

Bump @docker/actions-toolkit from 0.62.1 to 0.63.0 in docker/setup-buildx-action#434

Bump brace-expansion from 1.1.11 to 1.1.12 in docker/setup-buildx-action#436

Bump form-data from 2.5.1 to 2.5.5 in docker/setup-buildx-action#432

Bump undici from 5.28.4 to 5.29.0 in docker/setup-buildx-action#435

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

v3.11.1

Fix keep-state not being respected by @crazy-max in docker/setup-buildx-action#429

Full Changelog: docker/setup-buildx-action@v3.11.0...v3.11.1

v3.11.0

Keep BuildKit state support by @crazy-max in docker/setup-buildx-action#427

Remove aliases created when installing by default by @hashhar in docker/setup-buildx-action#139

Bump @docker/actions-toolkit from 0.56.0 to 0.62.1 in docker/setup-buildx-action#422 docker/setup-buildx-action#425

Full Changelog: docker/setup-buildx-action@v3.10.0...v3.11.0

Commits

8d2750c Merge pull request #455 from crazy-max/install-deprecated
e81846b deprecate install input
65d18f8 Merge pull request #454 from docker/dependabot/github_actions/actions/checkout-6
000d75d build(deps): bump actions/checkout from 5 to 6
1583c0f Merge pull request #443 from nicolasleger/patch-1
ed158e7 doc: bump actions/checkout from 4 to 5
4cc794f Merge pull request #441 from docker/dependabot/github_actions/actions/checkout-5
4dfc3d6 build(deps): bump actions/checkout from 4 to 5
af1b253 Merge pull request #440 from crazy-max/k3s-build
3c6ab92 ci: k3s test with latest buildx
Additional commits viewable in compare view

Updates docker/build-push-action from 6.17.0 to 6.18.0

Release notes

Sourced from docker/build-push-action's releases.

v6.18.0

Bump @docker/actions-toolkit from 0.61.0 to 0.62.1 in docker/build-push-action#1381

[!NOTE] Build summary is now supported with Docker Build Cloud.

Full Changelog: docker/build-push-action@v6.17.0...v6.18.0

Commits

2634353 Merge pull request #1381 from docker/dependabot/npm_and_yarn/docker/actions-t...
c0432d2 chore: update generated content
0bb1f27 set builder driver and endpoint attributes for dbc summary support
5f9dbf9 chore(deps): Bump @docker/actions-toolkit from 0.61.0 to 0.62.1
0788c44 Merge pull request #1375 from crazy-max/remove-gcr
aa179ca e2e: remove GCR
See full diff in compare view

Updates astral-sh/setup-uv from 4 to 7

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.0.0 🌈 node24 and a lot of bugfixes

Changes

This release comes with a load of bug fixes and a speed up. Because of switching from node20 to node24 it is also a breaking change. If you are running on GitHub hosted runners this will just work, if you are using self-hosted runners make sure, that your runners are up to date. If you followed the normal installation instructions your self-hosted runner will keep itself updated.

This release also removes the deprecated input server-url which was used to download uv releases from a different server. The manifest-file input supersedes that functionality by adding a flexible way to define available versions and where they should be downloaded from.

Fixes

The action now respects when the environment variable UV_CACHE_DIR is already set and does not overwrite it. It now also finds cache-dir settings in config files if you set them.

Some users encountered problems that cache pruning took forever because they had some uv processes running in the background. Starting with uv version 0.8.24 this action uses uv cache prune --ci --force to ignore the running processes

If you just want to install uv but not have it available in path, this action now respects UV_NO_MODIFY_PATH

Some other actions also set the env var UV_CACHE_DIR. This action can now deal with that but as this could lead to unwanted behavior in some edgecases a warning is now displayed.

Improvements

If you are using minimum version specifiers for the version of uv to install for example
[tool.uv]
required-version = ">=0.8.17"
This action now detects that and directly uses the latest version. Previously it would download all available releases from the uv repo to determine the highest matching candidate for the version specifier, which took much more time.

If you are using other specifiers like 0.8.x this action still needs to download all available releases because the specifier defines an upper bound (not 0.9.0 or later) and "latest" would possibly not satisfy that.

🚨 Breaking changes

Use node24 instead of node20 @eifinger (#608)

Remove deprecated input server-url @eifinger (#607)

🐛 Bug fixes

Respect UV_CACHE_DIR and cache-dir @eifinger (#612)

Use --force when pruning cache @eifinger (#611)

Respect UV_NO_MODIFY_PATH @eifinger (#603)

Warn when UV_CACHE_DIR has changed @jamesbraza (#601)

🚀 Enhancements

Shortcut to latest version for minimum version specifier @eifinger (#598)

🧰 Maintenance

Bump dependencies @eifinger (#613)

Fix test-uv-no-modify-path @eifinger (#604)

... (truncated)

Commits

61cb8a9 add outputs python-version and python-cache-hit (#728)
11050ed fix: use uv_build backend for old-python-constraint-project (#729)
1d22faf Bump peter-evans/create-pull-request from 7.0.9 to 8.0.0 (#719)
f4ed82a Bump github/codeql-action from 4.31.6 to 4.31.9 (#723)
e0409b4 chore: update known checksums for 0.9.22 (#727)
702b425 chore: update known checksums for 0.9.21 (#726)
2630c86 chore: update known checksums for 0.9.20 (#725)
45cfcb3 Add action typings with validation (#721)
ce0a899 chore: update known checksums for 0.9.18 (#718)
9c8d030 chore: remove stray space from UV_PYTHON_INSTALL_DIR message (#720)
Additional commits viewable in compare view

Updates stefanzweifel/git-auto-commit-action from 5.2.0 to 7.1.0

Release notes

Sourced from stefanzweifel/git-auto-commit-action's releases.

v7.1.0

Added

Add skip_push input option (#401) @kvanzuijlen

Changes

docs: fix typo in README.md (#400) @GideonBear

Dependency Updates

Bump actions/checkout from 5 to 6 (#399) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

Bump bats from 1.12.0 to 1.13.0 (#398) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v7.0.0

Added

Restore skip_fetch, skip_checkout, create_branch (#388) @stefanzweifel

Restore Detached State Detection (#393) @stefanzweifel

Add Support for Tag Messages (#391) @EliasBoulharts

Changed

Run Action on Node 24 (#389) @stefanzweifel

Dependency Updates

Bump actions/checkout from 4 to 5 (#386) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v6.0.1

Fixed

Disable Check if Repo is in Detached State (#379) @stefanzweifel

v6.0.0

Added

Throw error early if repository is in a detached state (#357)

Fixed

Fix PAT instructions with Dependabot (#376) @Dreamsorcerer

Removed

Remove support for create_branch, skip_checkout, skip_Fetch (#314)

Changelog

Sourced from stefanzweifel/git-auto-commit-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Unreleased

TBD

v7.1.0 - 2025-12-17

Added

Add skip_push input option (#401) @kvanzuijlen

Changes

docs: fix typo in README.md (#400) @GideonBear

Dependency Updates

Bump actions/checkout from 5 to 6 (#399) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

Bump bats from 1.12.0 to 1.13.0 (#398) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v7.0.0 - 2025-10-12

Added

Restore skip_fetch, skip_checkout, create_branch (#388) @stefanzweifel

Restore Detached State Detection (#393) @stefanzweifel

Add Support for Tag Messages (#391) @EliasBoulharts

Changed

Run Action on Node 24 (#389) @stefanzweifel

Dependency Updates

Bump actions/checkout from 4 to 5 (#386) [@dependabot[bot]](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))

v6.0.1 - 2025-06-11

Fixed

Disable Check if Repo is in Detached State (#379) @stefanzweifel

v6.0.0 - 2025-06-10

... (truncated)

Commits

04702ed Bump actions/checkout from 5 to 6 (#399)
1e49d50 Add skip_push input option (#401)
65c5677 docs: fix typo in README.md (#400)
547c140 Bump bats from 1.12.0 to 1.13.0 (#398)
8fa7f5a Update CHANGELOG
28e16e8 Release preparations for v7 (#394)
698fd76 Merge pull request #391 from EliasBoulharts/custom-tag-message
c40819a Update README
d7ee275 Change internal variable names
e8684eb Fix Tests
Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 7.0.0

Release notes

Sourced from actions/download-artifact's releases.

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in actions/download-artifact#440

Download Artifact Node24 support by @salmanmkc in actions/download-artifact#415

fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in actions/download-artifact#451

prepare release v7.0.0 for Node.js 24 support by @salmanmkc in actions/download-artifact#452

New Contributors

@patrikpolyak made their first contribution in actions/download-artifact#440

@salmanmkc made their first contribution in actions/download-artifact#415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

Update README for download-artifact v5 changes by @yacaovsnc in actions/download-artifact#417

Update README with artifact extraction details by @yacaovsnc in actions/download-artifact#424

Readme: spell out the first use of GHES by @danwkennedy in actions/download-artifact#431

Bump @actions/artifact to v4.0.0

Prepare v6.0.0 by @danwkennedy in actions/download-artifact#438

New Contributors

@danwkennedy made their first contribution in actions/download-artifact#431

Full Changelog: actions/download-artifact@v5...v6.0.0

v5.0.0

What's Changed

Update README.md by @nebuk89 in actions/download-artifact#407

BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @GrantBirki in actions/download-artifact#416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

... (truncated)

Commits

37930b1 Merge pull request #452 from actions/download-artifact-v7-release
72582b9 doc: update readme
0d2ec9d chore: release v7.0.0 for Node.js 24 support
fd7ae8f Merge pull request #451 from actions/fix-storage-blob
d484700 chore: restore minimatch.dep.yml license file
03a8080 chore: remove obsolete dependency license files
56fe6d9 chore: update @actions/artifact license file to 5.0.1
8e3ebc4 chore: update package-lock.json with @actions/artifact@5.0.1
1e3c4b4 fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix
458627d chore: use local @actions/artifact package for Node.js 24 testing
Additional commits viewable in compare view

Updates JetBrains/qodana-action from 201551778d1453e36c5c0aa26f89a94775cb1acc to f5aa2889b113c16bd6aee47817b027537ee33ac7

Commits

f5aa288 🐛 QD-11047 fix issue with quick-fixes: pull-request (#490)
26b380e 🐛 QD-11047 fix issue with quick-fixes in gitlab in branch mode (#482)
See full diff in compare view

Updates actions/setup-node from 4.4.0 to 6.1.0

Release notes

Sourced from actions/setup-node's releases.

v6.1.0

What's Changed

Enhancement:

Remove always-auth configuration handling by @priyagupta108 in actions/setup-node#1436

Dependency updates:

Upgrade @actions/cache from 4.0.3 to 4.1.0 by @dependabot[bot] in actions/setup-node#1384

Upgrade actions/checkout from 5 to 6 by @dependabot[bot] in actions/setup-node#1439

Upgrade js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in actions/setup-node#1435

Documentation update:

Add example for restore-only cache in documentation by @aparnajyothi-y in actions/setup-node#1419

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Limit automatic caching to npm, update workflows and documentation by @priyagupta108 in actions/setup-node#1374

Dependency Upgrades

Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @dependabot[bot] in #1336

Upgrade prettier from 2.8.8 to 3.6.2 by @dependabot[bot] in #1334
Description has been truncated

Replaced Poetry with uv for dependency management and mypy with ty for type checking. Updated build backend to setuptools with uv lockfile support. Modified all development tooling including devbox, lefthook, Dockerfile, README, and CI workflows to use the new Astral ecosystem tools. uv's Rust-based resolver provides significantly faster dependency resolution and installation compared to Poetry. ty offers substantial performance improvements over mypy while maintaining type safety. This migration creates consistency across all Python tooling (ruff, uv, ty) within the Astral ecosystem. Switched from semantic-release-pypi to semantic-release-uv for native uv support in the release pipeline. Updated Dependabot to use the uv package ecosystem.

…m mypy to ty (#91)

…y with 16 updates Bumps the actions-version-updates group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.0` | `2.14.0` | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `6.0.1` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.7.1` | `4.8.2` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.10.0` | `3.12.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.17.0` | `6.18.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `4` | `7` | | [stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action) | `5.2.0` | `7.1.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `7.0.0` | | [JetBrains/qodana-action](https://github.com/jetbrains/qodana-action) | `201551778d1453e36c5c0aa26f89a94775cb1acc` | `f5aa2889b113c16bd6aee47817b027537ee33ac7` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `6.1.0` | | [mridang/action-semantic-release](https://github.com/mridang/action-semantic-release) | `1` | `2` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.3` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.28.18` | `4.31.10` | | [mridang/action-test-reporter](https://github.com/mridang/action-test-reporter) | `1` | `3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `6.0.0` | | [dorny/test-reporter](https://github.com/dorny/test-reporter) | `2.0.0` | `2.5.0` | Updates `step-security/harden-runner` from 2.12.0 to 2.14.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@0634a26...20cf305) Updates `actions/checkout` from 4.2.2 to 6.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11bd719...8e8c483) Updates `actions/dependency-review-action` from 4.7.1 to 4.8.2 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@da24556...3c4e3dc) Updates `docker/setup-buildx-action` from 3.10.0 to 3.12.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@b5ca514...8d2750c) Updates `docker/build-push-action` from 6.17.0 to 6.18.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@1dc7386...2634353) Updates `astral-sh/setup-uv` from 4 to 7 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v4...v7) Updates `stefanzweifel/git-auto-commit-action` from 5.2.0 to 7.1.0 - [Release notes](https://github.com/stefanzweifel/git-auto-commit-action/releases) - [Changelog](https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md) - [Commits](stefanzweifel/git-auto-commit-action@b863ae1...04702ed) Updates `actions/download-artifact` from 4.3.0 to 7.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@d3f86a1...37930b1) Updates `JetBrains/qodana-action` from 201551778d1453e36c5c0aa26f89a94775cb1acc to f5aa2889b113c16bd6aee47817b027537ee33ac7 - [Release notes](https://github.com/jetbrains/qodana-action/releases) - [Commits](JetBrains/qodana-action@2015517...f5aa288) Updates `actions/setup-node` from 4.4.0 to 6.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@49933ea...395ad32) Updates `mridang/action-semantic-release` from 1 to 2 - [Release notes](https://github.com/mridang/action-semantic-release/releases) - [Changelog](https://github.com/mridang/action-semantic-release/blob/master/release.config.mjs) - [Commits](mridang/action-semantic-release@v1...v2) Updates `ossf/scorecard-action` from 2.4.1 to 2.4.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@f49aabe...4eaacf0) Updates `github/codeql-action` from 3.28.18 to 4.31.10 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff0a06e...cdefb33) Updates `mridang/action-test-reporter` from 1 to 3 - [Release notes](https://github.com/mridang/action-test-reporter/releases) - [Changelog](https://github.com/mridang/action-test-reporter/blob/master/release.config.mjs) - [Commits](mridang/action-test-reporter@v1...v3) Updates `actions/upload-artifact` from 4.6.2 to 6.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...b7c566a) Updates `dorny/test-reporter` from 2.0.0 to 2.5.0 - [Release notes](https://github.com/dorny/test-reporter/releases) - [Changelog](https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md) - [Commits](dorny/test-reporter@6e6a65b...b082adf) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: actions/checkout dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: actions/dependency-review-action dependency-version: 4.8.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: docker/setup-buildx-action dependency-version: 3.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: docker/build-push-action dependency-version: 6.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates - dependency-name: astral-sh/setup-uv dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: stefanzweifel/git-auto-commit-action dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: actions/download-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: JetBrains/qodana-action dependency-version: f5aa2889b113c16bd6aee47817b027537ee33ac7 dependency-type: direct:production dependency-group: actions-version-updates - dependency-name: actions/setup-node dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: mridang/action-semantic-release dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-version-updates - dependency-name: github/codeql-action dependency-version: 4.31.10 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: mridang/action-test-reporter dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-version-updates - dependency-name: dorny/test-reporter dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 12, 2026

dependabot bot force-pushed the dependabot/github_actions/actions-version-updates-ea9a8f84bf branch from 5fe237f to 5ee1f13 Compare January 26, 2026 15:46

mridang force-pushed the beta branch 3 times, most recently from 86d735e to d23b913 Compare January 29, 2026 11:50

dependabot bot force-pushed the dependabot/github_actions/actions-version-updates-ea9a8f84bf branch from 5ee1f13 to 3c57bdc Compare January 29, 2026 11:54

mridang added 2 commits January 29, 2026 22:54

chore(tooling): configure and update cache directories and switch fro…

6eda40e

…m mypy to ty (#91)

mridang force-pushed the beta branch from d23b913 to 6eda40e Compare January 29, 2026 11:55

dependabot bot force-pushed the dependabot/github_actions/actions-version-updates-ea9a8f84bf branch from 3c57bdc to 2afdb3c Compare January 29, 2026 11:58

dependabot bot force-pushed the dependabot/github_actions/actions-version-updates-ea9a8f84bf branch from 2afdb3c to c50b9a0 Compare January 29, 2026 12:02

mridang force-pushed the beta branch from 6eda40e to 4b498d8 Compare January 30, 2026 00:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the actions-version-updates group across 1 directory with 16 updates#90

chore(deps): bump the actions-version-updates group across 1 directory with 16 updates#90
dependabot[bot] wants to merge 3 commits intobetafrom
dependabot/github_actions/actions-version-updates-ea9a8f84bf

dependabot bot commented on behalf of github Jan 12, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.14.0

What's Changed

v2.13.3

What's Changed

v2.13.2

What's Changed

v2.13.1

What's Changed

v2.13.0

What's Changed

v2.12.2

What's Changed

v6.0.1

What's Changed

v6.0.0

What's Changed

v6-beta

What's Changed

v5.0.1

What's Changed

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v4.3.1

What's Changed

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.8.2

Dependency Review Action v4.8.1

What's Changed

v4.8.0

What's Changed

New Contributors

4.7.3

What's Changed

4.7.2

What's Changed

New Contributors

v3.12.0

v3.11.1

v3.11.0

v6.18.0

v7.0.0 🌈 node24 and a lot of bugfixes

Changes

Fixes

Improvements

🚨 Breaking changes

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

v7.1.0

Added

Changes

Dependency Updates

v7.0.0

Added

Changed

Dependency Updates

v6.0.1

Fixed

v6.0.0

Added

Fixed

Removed

Changelog

Unreleased

dependabot bot commented on behalf of github Jan 12, 2026 •

edited

Loading