Skip to content

Bump the "workflows" group with 1 update across multiple ecosystems#75

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/workflows-9805eb56ae
Open

Bump the "workflows" group with 1 update across multiple ecosystems#75
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/workflows-9805eb56ae

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 16, 2026 •
edited
Loading

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the workflows group with 3 updates: release-drafter/release-drafter, astral-sh/setup-uv and MishaKav/pytest-coverage-comment.

Updates release-drafter/release-drafter from 6.4.0 to 7.0.0

Release notes

Sourced from release-drafter/release-drafter's releases.

v7.0.0

What's Changed

Breaking

Bug Fixes

Maintenance

Documentation

Other changes

Dependency Updates

Full Changelog: release-drafter/release-drafter@v6.4.0...v7.0.0

Commits
  • 3a7fb5c chore: release v7.0.0
  • 1bba8e8 docs: broken link in contributing guide
  • 90c8b30 docs(copilot): update instructions for Biome
  • ea57e4c ci: replace shell scripts with cross-platform TypeScript and simplify workflows
  • 5ed1f8c chore: update editor and devcontainer config for Biome
  • 68e853e chore: reformat codebase with Biome and fix code smells
  • 720e969 chore: migrate from ESLint + Prettier to Biome
  • ee6226d fix(deps): update dependency compare-versions to 6.1.1 (#1547)
  • 9a48bb9 chore(deps): update vitest to 4.1.0 (#1544)
  • f62bd72 chore(build): rebuild artifacts
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 7.3.1 to 7.5.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.5.0 🌈 Use astral-sh/versions as version provider

No more rate-limits

This release addresses a long-standing source of timeouts and rate-limit failures in setup-uv.

Previously, the action resolved version identifiers like 0.5.x by iterating over available uv releases via the GitHub API to find the best match. In contrast, latest and exact versions such as 0.5.0 skipped version resolution entirely and downloaded uv directly.

The manifest-file input was an earlier attempt to improve this. It allows providing an url to a file that lists available versions, checksums, and even custom download URLs. The action also shipped with such a manifest. However, because that bundled file could become outdated whenever new uv releases were published, the action still had to fall back to the GitHub API in many cases.

This release solves the problem by sourcing version data from Astral’s versions repository via the raw content endpoint:

https://raw.githubusercontent.com/astral-sh/versions/refs/heads/main/v1/uv.ndjson

By using the raw endpoint instead of the GitHub API, version resolution no longer depends on API authentication and is much less likely to run into rate limits or timeouts.

[!TIP] The next section is only interesting for users of the manifest-file input

The manifest-file input lets you override that source with your own URL, for example to test custom uv builds or alternate download locations.

The manifest file must be in NDJSON format, where each line is a JSON object representing a version and its artifacts. For example:

{"version":"0.10.7","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]}
{"version":"0.10.6","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]}

[!WARNING]
The old format still works but is deprecated. A warning will be logged when you use it.

Changes

🚀 Enhancements

📚 Documentation

v7.4.0 🌈 Add riscv64 architecture support to platform detection

Changes

Thank you @​luhenry for adding support for riscv64 arch

... (truncated)

Commits
  • e06108d Use astral-sh/versions as primary version provider (#802)
  • 0f6ec07 docs: replace copilot instructions with AGENTS.md (#794)
  • 821e5c9 docs: add cross-client dependabot rollup skill (#793)
  • 6ee6290 chore(deps): bump versions (#792)
  • 9f332a1 Add riscv64 architecture support to platform detection (#791)
  • 0acf970 Bump actions/setup-node from 6.2.0 to 6.3.0 (#790)
  • fe3617d Delete .github/workflows/dependabot-build.yml (#789)
  • 2ff70ee Harden Dependabot build workflow (#788)
  • 5ba8a7e Fix: check PR author instead of event sender for Dependabot detection (#787)
  • 4bc8fab chore: update known checksums for 0.10.9 (#783)
  • Additional commits viewable in compare view

Updates MishaKav/pytest-coverage-comment from 1.6.0 to 1.7.1

Release notes

Sourced from MishaKav/pytest-coverage-comment's releases.

v1.7.1

What's Changed

  • fix 5 security vulnerabilities in undici (6.23.0 → 6.24.1) (#260)
  • bump dev dependencies

Full Changelog: MishaKav/pytest-coverage-comment@v1.7.0...v1.7.1

v1.7.0

What's Changed

  • enable immutable releases for supply chain security (#256)
  • bump flatted from 3.3.3 to 3.4.1 to fix security vulnerability

Note: No changes to action inputs, outputs, or behavior. This improves release security following GitHub's immutable releases feature.

Full Changelog: MishaKav/pytest-coverage-comment@v1.6.0...v1.7.0

Changelog

Sourced from MishaKav/pytest-coverage-comment's changelog.

Changelog of the Pytest Coverage Comment

Pytest Coverage Comment 1.7.1

Release Date: 2026-03-14

Changes

  • fix 5 security vulnerabilities in undici (6.23.0 → 6.24.1) (#260)
  • bump dev dependencies

Pytest Coverage Comment 1.7.0

Release Date: 2026-03-13

Changes

  • enable immutable releases for supply chain security (#256)
  • bump flatted from 3.3.3 to 3.4.1 to fix security vulnerability

Note: No changes to action inputs, outputs, or behavior. This improves release security following GitHub's immutable releases feature.

Pytest Coverage Comment 1.6.0

Release Date: 2026-03-06

Changes

  • migrate codebase from JavaScript to TypeScript
  • add unit tests (91 tests) using Vitest with V8 coverage

Note: This is an internal rewrite — no changes to action inputs, outputs, or behavior. Fully backward compatible.

Pytest Coverage Comment 1.5.0

Release Date: 2026-02-28

Changes

  • feat: add hide-emoji option to hide emoji shortcodes from the test summary table (#251)
  • docs: update README examples to use @v1 tag and latest action versions (checkout@v6, setup-python@v6)

Pytest Coverage Comment 1.4.0

Release Date: 2026-02-22

Changes

  • feat: auto-detect and display branch coverage columns (Branch, BrPart) in coverage table (#110)
  • supported for both text format (pytest --cov --cov-branch) and XML format (coverage.xml)

... (truncated)

Commits
  • 2872928 Remove publish-immutable-actions workflow, bump deps, fix vulnerabilities (#2...
  • 6b219ea Enable immutable releases for supply chain security (#256) (#258)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the workflows group with 3 updates
2e6c59b 
Bumps the workflows group with 3 updates: [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter), [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) and [MishaKav/pytest-coverage-comment](https://github.com/mishakav/pytest-coverage-comment).


Updates `release-drafter/release-drafter` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/release-drafter/release-drafter/releases)
- [Commits](release-drafter/release-drafter@6a93d82...3a7fb5c)

Updates `astral-sh/setup-uv` from 7.3.1 to 7.5.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@5a095e7...e06108d)

Updates `MishaKav/pytest-coverage-comment` from 1.6.0 to 1.7.1
- [Release notes](https://github.com/mishakav/pytest-coverage-comment/releases)
- [Changelog](https://github.com/MishaKav/pytest-coverage-comment/blob/main/CHANGELOG.md)
- [Commits](MishaKav/pytest-coverage-comment@26f986d...2872928)

---
updated-dependencies:
- dependency-name: release-drafter/release-drafter
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: workflows
- dependency-name: astral-sh/setup-uv
  dependency-version: 7.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workflows
- dependency-name: MishaKav/pytest-coverage-comment
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: workflows
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code major labels Mar 16, 2026
@chris11-taylor-nttd
Copy link
Copy Markdown
Contributor

chris11-taylor-nttd commented Mar 27, 2026

Several breaking changes to release-drafter in this one. We need to do some work to consume that update, so let's not merge this just yet.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chris11-taylor-nttd