Skip to content

chore(deps): bump the gha-minor-patch group across 2 directories with 4 updates - #137

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/gha-minor-patch-809ccd7a12
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/gha-minor-patch-809ccd7a12

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the gha-minor-patch group with 4 updates in the / directory: astral-sh/setup-uv, reviewdog/action-black, zizmorcore/zizmor-action and lfit/releng-reusable-workflows/.github/workflows/reuse-semantic-pull-request.yaml.
Bumps the gha-minor-patch group with 1 update in the /.github/actions/generate-schema-docs directory: astral-sh/setup-uv.

Updates astral-sh/setup-uv from 10.3.2 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

Commits
  • 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
  • 0192b69 chore: update known checksums for 0.13.6 (#1117)
  • 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
  • 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
  • 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
  • 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
  • 56618ca docs: update version references to v10.3.2 (#1104)
  • See full diff in compare view

Updates reviewdog/action-black from 3.24.0 to 3.25.0

Release notes

Sourced from reviewdog/action-black's releases.

v3.25.0: PR #124 - chore(deps): update reviewdog to 0.21.2

Commits
  • 7e1c3d9 Merge pull request #124 from reviewdog/depup/reviewdog
  • d304848 Merge pull request #131 from reviewdog/renovate/reviewdog-action-misspell-1.x
  • 0f62df4 Merge pull request #127 from reviewdog/renovate/reviewdog-action-shellcheck-1.x
  • 0e1789e Merge pull request #132 from reviewdog/renovate-no-label-for-workflows
  • 26be5fa Do not add bump:patch label to Renovate updates under .github/workflows
  • 593eac8 chore(deps): update reviewdog/action-misspell action to v1.30.4
  • 5add7a8 chore(deps): update reviewdog to 0.21.2
  • f8e9794 chore(deps): update reviewdog/action-shellcheck action to v1.34.1
  • 641db5f Merge pull request #130 from reviewdog/renovate/reviewdog-action-misspell-1.x
  • 87d1000 chore(deps): update reviewdog/action-misspell action to v1.30.3
  • Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.8.0 to 0.8.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.8.1

Sponsorship is appreciated!

zizmor 1.32 is now the default version used by this action.

Full release notes: zizmorcore/zizmor-action#1320

Full Changelog: zizmorcore/zizmor-action@v0.8.0...v0.8.1

Commits

Updates lfit/releng-reusable-workflows/.github/workflows/reuse-semantic-pull-request.yaml from 0.11.0 to 0.11.1

Release notes

Sourced from lfit/releng-reusable-workflows/.github/workflows/reuse-semantic-pull-request.yaml's releases.

v0.11.1

Downloads for this release

🐛 Bug Fixes 🐛

🔧 Maintenance 🔧

  • Chore: Bump release-drafter/release-drafter from 7.9.0 to 7.10.0 @dependabot[bot] (#933)
  • Chore: Bump lfreleng-actions/maven-build-action from 0.5.3 to 0.5.4 @dependabot[bot] (#934)
  • Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml from 0.10.3 to 0.10.4 @dependabot[bot] (#935)
  • Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-repo-linting.yaml from 0.10.3 to 0.10.4 @dependabot[bot] (#936)
  • Chore: Bump lfreleng-actions/credential-load-action from 2.0.4 to 2.1.0 @dependabot[bot] (#937)
  • Chore: Bump github/codeql-action/analyze from 4.38.2 to 4.38.3 @dependabot[bot] (#938)
  • Chore: Bump lfreleng-actions/harden-runner-block-action from 0.12.2 to 0.13.1 @dependabot[bot] (#939)
  • Chore: Bump actions/download-artifact from 8.0.1 to 8.0.2 @dependabot[bot] (#940)
  • Chore: Bump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3 @dependabot[bot] (#941)
  • Chore: Bump github/codeql-action/analyze from 4.38.3 to 4.39.0 @dependabot[bot] (#943)
  • Chore: Bump ossf/scorecard-action from 2.4.4 to 2.5.0 @dependabot[bot] (#945)
  • Chore: Bump lfreleng-actions/change-isolation-action from 0.2.2 to 0.3.0 @dependabot[bot] (#946)
  • Chore: Bump lfreleng-actions/maven-build-action from 0.5.4 to 0.5.5 @dependabot[bot] (#947)
  • Chore: Bump lfreleng-actions/maven-make-build-action from 0.4.2 to 0.4.3 @dependabot[bot] (#944)
  • Chore: Bump lfreleng-actions/node-build-action from 0.2.4 to 0.2.5 @dependabot[bot] (#948)
  • Chore: Bump lfreleng-actions/nexus-publish-action from 1.3.0 to 1.3.2 @dependabot[bot] (#949)
  • Chore: Bump actions/setup-java from 6.0.1 to 6.1.0 @dependabot[bot] (#950)
  • Chore: Bump lfreleng-actions/gerrit-review-action from 1.1.3 to 1.2.0 @dependabot[bot] (#951)
  • Chore: Bump jfrog/setup-jfrog-cli from 5.2.0 to 5.3.0 @dependabot[bot] (#952)
  • Chore: Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 @dependabot[bot] (#953)
  • Chore: Bump step-security/harden-runner from 2.22.0 to 2.22.1 @dependabot[bot] (#954)
  • Chore: Bump lfit/releng-reusable-workflows/.github/workflows/compose-packer-verify.yaml from 0.10.3 to 0.10.4 @dependabot[bot] (#955)
  • Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-sonatype-lifecycle.yaml from 0.10.3 to 0.10.4 @dependabot[bot] (#956)
  • Chore: Bump lfreleng-actions/verify-release-schema-action from 1.0.0 to 1.1.0 @dependabot[bot] (#957)
  • Chore: Bump github/codeql-action/init from 4.38.3 to 4.39.0 @dependabot[bot] (#958)
  • Chore: Bump actions/download-artifact from 8.0.1 to 8.0.2 @dependabot[bot] (#959)
  • Chore: Bump jfrog/setup-jfrog-cli from 5.3.0 to 5.3.1 @dependabot[bot] (#965)
  • Chore: Bump github/codeql-action/init from 4.39.0 to 4.39.1 @dependabot[bot] (#961)
  • Chore: Bump github/codeql-action/analyze from 4.39.0 to 4.39.1 @dependabot[bot] (#962)
  • Chore: Bump lfreleng-actions/harden-runner-block-action from 0.13.1 to 0.14.0 @dependabot[bot] (#964)
  • Chore: Bump lfreleng-actions/node-build-action from 0.2.5 to 0.4.0 @dependabot[bot] (#963)
  • Chore: Bump lfreleng-actions/inject-issue-id-action from 0.1.3 to 0.1.4 @dependabot[bot] (#966)
  • Chore: Bump lfreleng-actions/openssf-scorecard-summary-action from 0.1.2 to 0.1.3 @dependabot[bot] (#967)
  • Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-verify-github-actions.yaml from 0.10.4 to 0.11.0 @dependabot[bot] (#969)
  • Chore: Bump lfreleng-actions/draft-release-promote-action from 0.1.5 to 0.1.7 @dependabot[bot] (#970)
  • Chore: Bump lfreleng-actions/docker-save-images-action from 0.2.0 to 0.2.1 @dependabot[bot] (#971)
  • Chore: Bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 @dependabot[bot] (#968)
  • Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml from 0.10.4 to 0.11.0 @dependabot[bot] (#972)
  • Chore: Bump lfreleng-actions/verify-release-schema-action from 1.1.0 to 1.1.2 @dependabot[bot] (#973)
  • Chore: Bump step-security/harden-runner from 2.22.1 to 2.22.2 @dependabot[bot] (#975)
  • Chore: Bump actions/setup-python from 7.0.0 to 7.1.0 @dependabot[bot] (#974)

... (truncated)

Commits
  • fc3aea6 Merge pull request #991 from lfit/dependabot/github_actions/lfreleng-actions/...
  • 97cb707 Merge pull request #990 from lfit/dependabot/github_actions/lfit/sigul-sign-a...
  • 58e658a Merge pull request #992 from lfit/dependabot/github_actions/lfreleng-actions/...
  • c9fe535 Merge pull request #989 from lfit/dependabot/github_actions/lfit/releng-reusa...
  • dff3bed Chore: Bump lfreleng-actions/openssf-scorecard-summary-action
  • 36559fb Chore: Bump lfreleng-actions/sonarqube-cloud-scan-action
  • f0781bf Merge pull request #985 from lfit/dependabot/github_actions/lfreleng-actions/...
  • 980d82a Chore: Bump lfit/sigul-sign-action from 2.0.0 to 2.0.1
  • ad45f06 Merge pull request #988 from lfit/dependabot/github_actions/lfreleng-actions/...
  • 1db39bf Merge pull request #986 from lfit/dependabot/github_actions/lfreleng-actions/...
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 10.3.2 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

Commits
  • 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
  • 0192b69 chore: update known checksums for 0.13.6 (#1117)
  • 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
  • 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
  • 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
  • 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
  • 56618ca docs: update version references to v10.3.2 (#1104)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… 4 updates

Bumps the gha-minor-patch group with 4 updates in the / directory: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [reviewdog/action-black](https://github.com/reviewdog/action-black), [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) and [lfit/releng-reusable-workflows/.github/workflows/reuse-semantic-pull-request.yaml](https://github.com/lfit/releng-reusable-workflows).
Bumps the gha-minor-patch group with 1 update in the /.github/actions/generate-schema-docs directory: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).


Updates `astral-sh/setup-uv` from 10.3.2 to 10.3.3
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@07a047e...68559e9)

Updates `reviewdog/action-black` from 3.24.0 to 3.25.0
- [Release notes](https://github.com/reviewdog/action-black/releases)
- [Changelog](https://github.com/reviewdog/action-black/blob/master/CHANGELOG.md)
- [Commits](reviewdog/action-black@5059d92...7e1c3d9)

Updates `zizmorcore/zizmor-action` from 0.8.0 to 0.8.1
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@53290ba...45d7276)

Updates `lfit/releng-reusable-workflows/.github/workflows/reuse-semantic-pull-request.yaml` from 0.11.0 to 0.11.1
- [Release notes](https://github.com/lfit/releng-reusable-workflows/releases)
- [Commits](lfit/releng-reusable-workflows@e3bb02d...fc3aea6)

Updates `astral-sh/setup-uv` from 10.3.2 to 10.3.3
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@07a047e...68559e9)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-minor-patch
- dependency-name: reviewdog/action-black
  dependency-version: 3.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha-minor-patch
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-minor-patch
- dependency-name: lfit/releng-reusable-workflows/.github/workflows/reuse-semantic-pull-request.yaml
  dependency-version: 0.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-minor-patch
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner November 10, 2026 10:15
@dependabot dependabot Bot added the bot Automated bot pull requests label Nov 10, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bot Automated bot pull requests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant