chore(deps): bump the gha-updates group across 1 directory with 6 updates by dependabot[bot] · Pull Request #219 · Lightning-AI/sdk

dependabot · 2026-10-29T10:35:31Z

Bumps the gha-updates group with 6 updates in the / directory:

Package	From	To
astral-sh/setup-uv	`10.2.0`	`10.3.3`
actions/upload-artifact	`7.0.1`	`7.0.2`
actions/setup-python	`7.0.0`	`7.1.0`
actions/setup-node	`7.0.0`	`7.1.0`
actions/download-artifact	`8.0.1`	`8.0.2`
pypa/gh-action-pypi-publish	`1.14.2`	`1.14.3`

Updates astral-sh/setup-uv from 10.2.0 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @soujasK for a set of bugfixes 👏

🐛 Bug fixes

Use Astral mirror for version manifests with GitHub fallback @eifinger (#1119)

fix: allow whitespace in uv requirement specifiers @soujasK (#1112)

fix: resolve ~= specifiers with PEP 440 semantics @soujasK (#1111)

fix: only report a saved cache when saving succeeded @soujasK (#1110)

🧰 Maintenance

chore: update known checksums for 0.13.6 @github-actions[bot] (#1117)

📚 Documentation

docs: use JSDoc for compatible release specifier comment @eifinger (#1113)

docs: update version references to v10.3.2 @github-actions[bot] (#1104)

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

chore: update known checksums for 0.13.5 @github-actions[bot] (#1103)

📚 Documentation

docs: update version references to v10.3.1 @github-actions[bot] (#1102)

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

fix: preserve cache error class names in save-cache bundle @dannyward630 (#1093)

🧰 Maintenance

... (truncated)

Commits

68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
0192b69 chore: update known checksums for 0.13.6 (#1117)
2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
36b7b57 fix: only report a saved cache when saving succeeded (#1110)
56618ca docs: update version references to v10.3.2 (#1104)
07a047e chore: update known checksums for 0.13.5 (#1103)
e1b8536 docs: update version references to v10.3.1 (#1102)
18d369b chore(deps): roll up Dependabot updates (#1101)
Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
c2acded chore: prepare v7.0.2 release
4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
8cbe1be Bump @actions/artifact to 6.3.1
See full diff in compare view

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

Add mirror and mirror-token inputs for custom Python distribution sources by @luhenry in actions/setup-python#1302

Improve error message clarity by @v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

Upgrade browserslist from 4.28.2 to 4.28.9 by @dependabot in actions/setup-python#1353

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-python#1343

Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in actions/setup-python#1342

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-python#1357

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-python#1359

Upgrade undici from 6.28.0 to 6.29.0 by @dependabot in actions/setup-python#1364

Upgrade ts-jest from 29.4.11 to 29.4.14 by @dependabot in actions/setup-python#1361

Upgrade brace-expansion from 5.0.9 to 5.0.12 by @dependabot in actions/setup-python#1365

Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-python#1363

Upgrade @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @dependabot in actions/setup-python#1369

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-python#1345

Upgrade cache to 6.3.0 by @v-HarithaVattikuti in actions/setup-python#1370

Resolve Basic Validation audit failures by @v-HarithaVattikuti in actions/setup-python#1347

Resolve npm audit failures by @v-HarithaVattikuti in actions/setup-python#1350

New Contributors

@luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

6d4fd22 Cache upgrade to 6.3.0 (#1370)
ec52d0a Bump @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
e1be392 Bump @types/semver from 7.7.1 to 7.8.0 (#1359)
06da627 Bump @vercel/ncc from 0.44.0 to 0.45.0 (#1357)
af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
7aeabeb Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
Additional commits viewable in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in actions/setup-node#1421

Support absolute paths in node-version-file by @v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in actions/setup-node#1578

docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in actions/setup-node#1593

Fixed cache recommendation syntax by @SubJunk in actions/setup-node#1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in actions/setup-node#1583

Upgrade @actions/cache to 6.2.0 by @philip-gai in actions/setup-node#1584

Pin @types/node to v24 by @v-priyagupta108 in actions/setup-node#1585

Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in actions/setup-node#1599

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-node#1598

Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in actions/setup-node#1590

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-node#1610

Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in actions/setup-node#1602

Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in actions/setup-node#1629

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-node#1616

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-node#1615

Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in actions/setup-node#1631

Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in actions/setup-node#1636

Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in actions/setup-node#1638

Update dependencies and add license files by @v-HarithaVattikuti in actions/setup-node#1642

Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-node#1635

New Contributors

@v-jitenderpalsingh made their first contribution in actions/setup-node#1580

@philip-gai made their first contribution in actions/setup-node#1584

@gperdomor made their first contribution in actions/setup-node#1421

@SubJunk made their first contribution in actions/setup-node#1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits

949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
7207c4f chore: update dependencies and add license files (#1642)
54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
0c54c7b Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
a829419 Bump @types/semver from 7.7.1 to 7.8.0 (#1616)
680d1e4 Support absolute paths in node-version-file (#1633)
db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
Additional commits viewable in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

Update the readme by @danwkennedy in actions/download-artifact#473

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Update @actions/artifact to 6.3.1 by @tunc-d in actions/download-artifact#492

Prepare download-artifact v8.0.2 by @tunc-d in actions/download-artifact#493

New Contributors

@tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
e455989 Prepare download-artifact v8.0.2
a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
29bb7ce Update @actions/artifact to 6.3.1
484a0b5 Update the readme (#473)
See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
331eccb Upgrade certifi and sigstore
f68fee4 💰 Sync the FUNDING config
c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
9090099 🧪 Make smoke test deps hash-pinned in CI
34e40c2 📌 Bump pip-tools managed transitive deptrees
e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
dd8c5f4 🔧 Make pip-tools config available in container
See full diff in compare view

dependabot · 2026-10-29T10:35:34Z

Labels

The following labels could not be found: CI / actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

…ates Bumps the gha-updates group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` | Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.3 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@c18668a...68559e9) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@043fb46...cf430e0) Updates `actions/setup-python` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@5fda3b9...6d4fd22) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@3e5f45b...9000827) Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@dc37677...7245906) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-updates - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-updates - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-updates - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-updates - dependency-name: astral-sh/setup-uv dependency-version: 10.3.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-updates - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested review from ethanwharris, justusschock, owbone and rusenask as code owners October 29, 2026 10:35

ethanwharris approved these changes Oct 29, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot-github_actions-gha-updates-2344c710f2 branch from cafcc96 to d0ef8c8 Compare November 5, 2026 10:35

dependabot Bot force-pushed the dependabot-github_actions-gha-updates-2344c710f2 branch from d0ef8c8 to 6e88384 Compare November 12, 2026 10:35

Navigation Menu

Repository navigation

chore(deps): bump the gha-updates group across 1 directory with 6 updates - #219

chore(deps): bump the gha-updates group across 1 directory with 6 updates#219
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot-github_actions-gha-updates-2344c710f2

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

📚 Documentation

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

🐛 Bug fixes

🧰 Maintenance

v7.0.2

What's Changed

New Contributors

v7.1.0

What's Changed

Enhancements

Dependency Upgrade

New Contributors

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

v8.0.2

What's Changed

New Contributors

v1.14.3

🛠️ Security Tightening

Uh oh!

dependabot Bot commented on behalf of github Oct 29, 2026

Labels

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited

Loading