chore(deps): Bump astral-sh/setup-uv from 3.2.4 to 10.0.1

[dependabot]

Bumps astral-sh/setup-uv from 3.2.4 to 10.0.1.

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

• docs: update version references to v10.0.0 @github-actions[bot] (#1014)

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

• 20cfd1b chore: update known checksums for 0.12.4 (#1017)
• d73a0ca Tolerate transient manifest timeouts (#1016)
• ae3b92d docs: update version references to v10.0.0 (#1014)
• ae62891 chore(deps): roll up Dependabot updates (#1013)
• f9cdb47 Reject paths in .tool-versions (#1007)
• 4f6036f Require pull requests for Dependabot rollups (#1005)
• 8d6402c chore(deps): roll up Dependabot updates (#1004)
• 46f427b Read Python version from .tool-versions (#996)
• 8ed89c5 ci: pin Alpine container image (#995)
• 8473c7f chore(deps): roll up Dependabot updates (#994)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sentinel-by-digital-frontier]

🛡️ Sentinel PR review

3 file(s) changed · 2 introduced by this diff (secrets+SAST) · dependencies unchanged — SCA/CVE not re-scanned. Advisory — the fail-closed gate is the post-merge pentest.

Findings — ranked by criticality

• 🟡 [MEDIUM · SAST] .github/workflows/release.yml:106 — github actions mutable action tag GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the a scanner-action and a scannera scanner comp (CWE-1357 CWE-353)
• 🟡 [MEDIUM · SAST] .github/workflows/release.yml:128 — github actions mutable action tag GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the a scanner-action and a scannera scanner comp (CWE-1357 CWE-353)

🤖 Code review (Flynn)

• .github/workflows/ci.yml:23 — The uv python install ${{ matrix.python }} command does not validate the Python version before installing it. This could lead to a situation where an incompatible Python version is installed, causing the build to fail. → Validate the Python version before installing it.

• .github/workflows/release.yml:14 — The packaging.version.Version comparison in the Verify tag matches pyproject version step does not handle cases where the tag and version are not in the expected format. This could lead to a situation where a mismatch between the release tag and the version declared in pyproject.toml is not detected. → Add input validation for the tag and version formats.

• .github/workflows/sync-upstream.yml:55 — The ./scripts/refresh-upstream.sh script does not handle cases where the upstream version cannot be determined. This could lead to a situation where an incorrect needs_bump value is output. → Add error handling for cases where the upstream version cannot be determined.

• .github/workflows/ci.yml:25 — The uv sync --all-extras command does not validate whether all dependencies can be synced successfully. This could lead to a situation where some dependencies are not synced, causing issues later on. → Validate whether all dependencies can be synced successfully.

• .github/workflows/sync-upstream.yml:63 — The ./scripts/refresh-upstream.sh script does not handle cases where the current version is already pinned to latest. This could lead to a situation where an incorrect needs_bump value is output. → Add input validation for cases where the current version is already pinned to latest.

• .github/workflows/ci.yml:27 — The uv run mypy src command does not validate whether mypy can run successfully on all files in the src directory. This could lead to a situation where some files are not checked by mypy, causing issues later on. → Validate whether mypy can run successfully on all files in the src directory.

• .github/workflows/sync-upstream.yml:65 — The ./scripts/refresh-upstream.sh script does not handle cases where the current version is not found in pyproject.toml. This could lead to a situation where an incorrect needs_bump value is output. → Add error handling for cases where the current version is not found in pyproject.toml.

No issues found:

• .github/workflows/ci.yml:29
• .github/workflows/release.yml:18
• .github/workflows/sync-upstream.yml:59
• .github/workflows/sync-upstream.yml:67
• .github/workflows/sync-upstream.yml:69
• .github/workflows/sync-upstream.yml:71

Please note that these findings are based on code review and may require additional context or testing to confirm their validity.

Scan summary

Category	Scope	Findings
Secrets	this diff	0
Static analysis	changed files	2
Dependencies + IaC	skipped (no manifest changed)	0
Known CVEs	skipped (no manifest changed)	0

[sentinel-by-digital-frontier]

🛡️ Sentinel review — no actionable issues on changed lines.

📋 Walkthrough

1 file(s) with findings on changed lines.

Signal	Count	Confidence
Tool-proven findings	0	deterministic scanners
Model findings (corroborated)	0	independent panel agreed
Model findings (unverified)	1	shown collapsed, not inline
Nitpicks & observations	0	collapsed, no action needed

Reviewed by flynn · panel requested, not applied — fell back to the single-model gate.

Files

• .github/workflows/ci.yml

🔍 1 unverified / low-confidence finding(s) — not corroborated by the review panel

An independent panel neither reproduced nor refuted these, so they are not posted inline and do not affect the verdict. They are listed rather than dropped: an unverified finding may still be real, and losing a real issue costs more than showing a doubtful one.

• .github/workflows/ci.yml:27 — The 'uv run mypy src' command does not validate whether mypy can run successfully on all files in the src directory. This could lead to a situation where some files are not checked by mypy, causing issues later on. → Validate whether mypy can run successfully on all files in the src directory.

🤖 Prompt for AI agents

Verify each finding against the current code before changing anything. Fix only the
ones that still hold, skip the rest with a one-line reason, keep changes minimal, and
run the test suite. Findings below the 'unverified' heading were NOT corroborated by
an independent panel — treat them as leads, not defects.


unverified (low confidence):
  .github/workflows/ci.yml:27 — The `uv run mypy src` command does not validate whether mypy can run successfully on all files in the src directory. This could lead to a situation where some f

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates GitHub Actions workflows to use a newer pinned revision of astral-sh/setup-uv, aligning CI, release, and upstream sync jobs on the same uv setup action version.

Changes:

• Bumped astral-sh/setup-uv from v3 to v10.0.1 (pinned by commit SHA) in CI workflows.
• Bumped astral-sh/setup-uv from v3 to v10.0.1 (pinned by commit SHA) in release workflow.
• Bumped astral-sh/setup-uv from v3 to v10.0.1 (pinned by commit SHA) in upstream sync workflow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/sync-upstream.yml	Updates the pinned setup-uv action revision used during upstream sync.
.github/workflows/release.yml	Updates the pinned setup-uv action revision used during release builds.
.github/workflows/ci.yml	Updates the pinned setup-uv action revision used across CI jobs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.