Bump the actions group with 3 updates (#1090)

dependabot[bot] · HDembinski · web-flow · commit eda288b74556 · 2025-05-17T18:04:27.000+02:00
Bumps the actions group with 3 updates: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) and [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance). Updates `astral-sh/setup-uv` from 4 to 6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v6.0.0 🌈 activate-environment and working-directory</h2> <h2>Changes</h2> <p>This version contains some breaking changes which have been gathering up for a while. Lets dive into them:</p> <ul> <li><a href="https://github.com/astral-sh/setup-uv/blob/HEAD/#activate-environment">Activate environment</a></li> <li><a href="https://github.com/astral-sh/setup-uv/blob/HEAD/#working-directory">Working Directory</a></li> <li><a href="https://github.com/astral-sh/setup-uv/blob/HEAD/#default-cache-dependency-glob">Default <code>cache-dependency-glob</code></a></li> <li><a href="https://github.com/astral-sh/setup-uv/blob/HEAD/#use-default-cache-dir-on-self-hosted-runners">Use default cache dir on self hosted runners</a></li> </ul> <h3>Activate environment</h3> <p>In previous versions using the input <code>python-version</code> automatically activated a venv at the repository root. This led to some unwanted side-effects, was sometimes unexpected and not flexible enough.</p> <p>The venv activation is now explicitly controlled with the new input <code>activate-environment</code> (false by default):</p> <pre lang="yaml"><code>- name: Install the latest version of uv and activate the environment uses: astral-sh/setup-uv@v6 with: activate-environment: true - run: uv pip install pip </code></pre> <p>The venv gets created by the <a href="https://docs.astral.sh/uv/pip/environments/"><code>uv venv</code></a> command so the python version is controlled by the <code>python-version</code> input or the files <code>pyproject.toml</code>, <code>uv.toml</code>, <code>.python-version</code> in the <code>working-directory</code>.</p> <h3>Working Directory</h3> <p>The new input <code>working-directory</code> controls where we look for <code>pyproject.toml</code>, <code>uv.toml</code> and <code>.python-version</code> files which are used to determine the version of uv and python to install.</p> <p>It can also be used to control where the venv gets created.</p> <pre lang="yaml"><code>- name: Install uv based on the config files in the working-directory uses: astral-sh/setup-uv@v6 with: working-directory: my/subproject/dir </code></pre> <blockquote> <p>[!CAUTION]</p> <p>The inputs <code>pyproject-file</code> and <code>uv-file</code> have been removed.</p> </blockquote> <h3>Default <code>cache-dependency-glob</code></h3> <p><a href="https://github.com/ssbarnea"><code>@​ssbarnea</code></a> found out that the default <code>cache-dependency-glob</code> was not suitable for a lot of users.</p> <p>The old default</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/6b9c6063abd6010835644d4c2e1bef4cf5cd0fca"><code>6b9c606</code></a> Bump dependencies (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/389">#389</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ef6bcdff59f18584d3ff2d6733fe1ffb9b7545c1"><code>ef6bcdf</code></a> Fix default cache dependency glob (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/388">#388</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/9a311713f4acad0acceb25fb016307e47c3887b6"><code>9a31171</code></a> chore: update known checksums for 0.6.17 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/384">#384</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/c7f87aa956e4c323abf06d5dec078e358f6b4d04"><code>c7f87aa</code></a> bump to v6 in README (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/382">#382</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/aadfaf08d64f83cdd98eea14fdab8eb08f73656c"><code>aadfaf0</code></a> Change default cache-dependency-glob (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/352">#352</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/a0f9da6273a171f2d94cce2036eaf5a07fefa23c"><code>a0f9da6</code></a> No default UV_CACHE_DIR on selfhosted runners (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/380">#380</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ec4c6916287cf1471f9f803d79ef6a0a04520e81"><code>ec4c691</code></a> new inputs activate-environment and working-directory (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/381">#381</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/aa1290542ebcd3b6932d825ed2b40807f82b2fdd"><code>aa12905</code></a> chore: update known checksums for 0.6.16 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/378">#378</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/fcaddda076a8158a712b6d64986baf606c446694"><code>fcaddda</code></a> chore: update known checksums for 0.6.15 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/377">#377</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/fb3a0a97fac846cb3395265a3087ab94ad3ca2a0"><code>fb3a0a9</code></a> log info on venv activation (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/375">#375</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/v4...v6">compare view</a></li> </ul> </details> <br /> Updates `pypa/cibuildwheel` from 2.22 to 2.23 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/cibuildwheel/releases">pypa/cibuildwheel's releases</a>.</em></p> <blockquote> <h2>v2.23.0</h2> <ul> <li>✨ Adds official support for the new GitHub Actions Arm runners. In fact these worked out-of-the-box, now we include them in our tests and example configs. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2135">#2135</a> via <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2281">#2281</a>)</li> <li>✨ Adds support for building PyPy 3.11 wheels (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2268">#2268</a> via <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2281">#2281</a>)</li> <li>🛠 Adopts the beta pypa/manylinux image for armv7l builds (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2269">#2269</a> via <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2281">#2281</a>)</li> <li>🛠 Dependency updates, including Pyodide 0.27 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2117">#2117</a> and <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2281">#2281</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md">pypa/cibuildwheel's changelog</a>.</em></p> <blockquote> <hr /> <h2>title: Changelog</h2> <h1>Changelog</h1> <h3>v2.23.3</h3> <p><em>26 April 2025</em></p> <ul> <li>🛠 Dependency updates, including Python 3.13.3 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2371">#2371</a>)</li> </ul> <h3>v2.23.2</h3> <p><em>24 March 2025</em></p> <ul> <li>🐛 Workaround an issue with pyodide builds when running cibuildwheel with a Python that was installed via UV (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2328">#2328</a> via <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2331">#2331</a>)</li> <li>🛠 Dependency updates, including a manylinux update that fixes an <a href="https://redirect.github.com/pypa/manylinux/issues/1760">'undefined symbol' error</a> in gcc-toolset (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2334">#2334</a>)</li> </ul> <h3>v2.23.1</h3> <p><em>15 March 2025</em></p> <ul> <li>⚠️ Added warnings when the shorthand values <code>manylinux1</code>, <code>manylinux2010</code>, <code>manylinux_2_24</code>, and <code>musllinux_1_1</code> are used to specify the images in linux builds. The shorthand to these (unmaintainted) images will be removed in v3.0. If you want to keep using these images, explicitly opt-in using the full image URL, which can be found in <a href="https://github.com/pypa/cibuildwheel/blob/v2.23.1/cibuildwheel/resources/pinned_docker_images.cfg">this file</a>. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2312">#2312</a>)</li> <li>🛠 Dependency updates, including a manylinux update which fixes an <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2303">issue with rustup</a>. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2315">#2315</a>)</li> </ul> <h3>v2.23.0</h3> <p><em>1 March 2025</em></p> <ul> <li>✨ Adds official support for the new GitHub Actions Arm runners. In fact these worked out-of-the-box, now we include them in our tests and example configs. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2135">#2135</a> via <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2281">#2281</a>)</li> <li>✨ Adds support for building PyPy 3.11 wheels (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2268">#2268</a> via <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2281">#2281</a>)</li> <li>🛠 Adopts the beta pypa/manylinux image for armv7l builds (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2269">#2269</a> via <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2281">#2281</a>)</li> <li>🛠 Dependency updates, including Pyodide 0.27 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2117">#2117</a> and <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2281">#2281</a>)</li> </ul> <h3>v2.22.0</h3> <p><em>23 November 2024</em></p> <ul> <li>🌟 Added a new <code>CIBW_ENABLE</code>/<code>enable</code> feature that replaces <code>CIBW_FREETHREADED_SUPPORT</code>/<code>free-threaded-support</code> and <code>CIBW_PRERELEASE_PYTHONS</code> with a system that supports both. In cibuildwheel 3, this will also include a PyPy setting and the deprecated options will be removed. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2048">#2048</a>)</li> <li>🌟 <a href="https://peps.python.org/pep-0735/">Dependency groups</a> are now supported for tests. Use <code>CIBW_TEST_GROUPS</code>/<code>test-groups</code> to specify groups in <code>[dependency-groups]</code> for testing. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2063">#2063</a>)</li> <li>🌟 Support for the experimental Ubuntu-based ARMv7l manylinux image (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2052">#2052</a>)</li> <li>✨ Show a warning when cibuildwheel is run from Python 3.10 or older; cibuildwheel 3.0 will require Python 3.11 or newer as host (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2050">#2050</a>)</li> <li>🐛 Fix issue with stderr interfering with checking the docker version (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2074">#2074</a>)</li> <li>🛠 Python 3.9 is now used in <code>CIBW_BEFORE_ALL</code>/<code>before-all</code> on linux, replacing 3.8, which is now EoL (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2043">#2043</a>)</li> <li>🛠 Error messages for producing a pure-Python wheel are slightly more informative (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2044">#2044</a>)</li> <li>🛠 Better error when <code>uname -m</code> fails on ARM (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2049">#2049</a>)</li> <li>🛠 Better error when repair fails and docs for abi3audit on Windows (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2058">#2058</a>)</li> <li>🛠 Better error when <code>manylinux-interpreters ensure</code> fails (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2066">#2066</a>)</li> <li>🛠 Update Pyodide to 0.26.4, and adapt to the unbundled pyodide-build (now 0.29) (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2090">#2090</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/cibuildwheel/commit/faf86a6ed7efa889faf6996aa23820831055001a"><code>faf86a6</code></a> Bump version: v2.23.3</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/4241f37b2c5be7f7ed96214b83f8cfbe1496cc28"><code>4241f37</code></a> [2.x] Update dependencies (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2371">#2371</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/d04cacbc9866d432033b1d09142936e6a0e2121a"><code>d04cacb</code></a> Bump version: v2.23.2</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/5f4e019684661085adb6558969c7fd389a532174"><code>5f4e019</code></a> [2.x] Update dependencies (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2334">#2334</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/2efa648f38e83a421aae82bc80002f8cabf92be7"><code>2efa648</code></a> fix: always resolve --python argument (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2328">#2328</a>) (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2331">#2331</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/42728e866bbc80d544a70825bd9990b9a26f1a50"><code>42728e8</code></a> Bump version: v2.23.1</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/6e1527b153c481c51f987a5e3a1bed216b16a260"><code>6e1527b</code></a> Fix unit test when other warnings are present</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/c25fe603855d4d4dbbb013375765345f346aece0"><code>c25fe60</code></a> fix: image deprecation warning (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2314">#2314</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/a880bf5105e70f0add65d840db82a7cc6c1555e4"><code>a880bf5</code></a> fix: warn on deprecated images being set (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2312">#2312</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/c087d85b69012f624e0321468b40345d921c72e5"><code>c087d85</code></a> Update dependencies</li> <li>Additional commits viewable in <a href="https://github.com/pypa/cibuildwheel/compare/v2.22...v2.23">compare view</a></li> </ul> </details> <br /> Updates `actions/attest-build-provenance` from 1.4.4 to 2.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/attest-build-provenance/releases">actions/attest-build-provenance's releases</a>.</em></p> <blockquote> <h2>v2.3.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>actions/attest</code> from 2.2.1 to 2.3.0 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/615">actions/attest-build-provenance#615</a> <ul> <li>Updates <code>@sigstore/oci</code> from 0.4.0 to 0.5.0</li> </ul> </li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0">https://github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0</a></p> <h2>v2.2.3</h2> <h2>What's Changed</h2> <ul> <li>Pin actions/attest reference by commit SHA by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/493">actions/attest-build-provenance#493</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3">https://github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3</a></p> <h2>v2.2.2</h2> <h2>What's Changed</h2> <ul> <li>Bump predicate action from 1.1.4 to 1.1.5 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/485">actions/attest-build-provenance#485</a> <ul> <li>Bump <code>@​actions/attest</code> from 1.5.0 to 1.6.0 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/484">actions/attest-build-provenance#484</a> <ul> <li>Update buildSLSAProvenancePredicate to populate <code>workflow.ref</code> field from the <code>ref</code> claim in the OIDC token (<a href="https://redirect.github.com/actions/toolkit/pull/1969">actions/toolkit#1969</a>)</li> </ul> </li> </ul> </li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2">https://github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2</a></p> <h2>v2.2.1</h2> <h2>What's Changed</h2> <ul> <li>Bump undici from 5.28.4 to 5.28.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/457">actions/attest-build-provenance#457</a></li> <li>Bump <code>@​octokit/request-error</code> from 5.0.1 to 5.1.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/469">actions/attest-build-provenance#469</a></li> <li>Bump <code>@​octokit/request</code> from 8.2.0 to 8.4.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/478">actions/attest-build-provenance#478</a></li> <li>Bump actions/attest from 2.2.0 to 2.2.1 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/481">actions/attest-build-provenance#481</a> <ul> <li>Includes <code>@actions/attest</code> <a href="https://github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160">v1.6.0</a></li> </ul> </li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1">https://github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1</a></p> <h2>v2.2.0</h2> <h2>What's Changed</h2> <ul> <li>Bump actions/attest from v2.1.0 to v2.2.0 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/449">actions/attest-build-provenance#449</a> <ul> <li>Includes support for now <code>subject-checksums</code> input parameter</li> </ul> </li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0">https://github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0</a></p> <h2>v2.1.0</h2> <h2>What's Changed</h2> <ul> <li>Update README w/ note about GH plans supporting attestations by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/414">actions/attest-build-provenance#414</a></li> <li>Add <code>attestation-id</code> and <code>attestation-url</code> outputs by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/415">actions/attest-build-provenance#415</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0">https://github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0</a></p> <h2>v2.0.1</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/attest-build-provenance/commit/db473fddc028af60658334401dc6fa3ffd8669fd"><code>db473fd</code></a> bump actions/attest from 2.2.1 to 2.3.0 (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/615">#615</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/d3b713ade6128010830a9be91a036ed11e065550"><code>d3b713a</code></a> Bump the actions-minor group with 2 updates (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/566">#566</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/e042adb3340da975a8e67c7633c90c38a3b731a3"><code>e042adb</code></a> Bump the npm-development group with 4 updates (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/567">#567</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/9d3beef6515cb82652d066f999b94affc15acfac"><code>9d3beef</code></a> Bump the npm-development group with 4 updates (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/554">#554</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/877f50d98cebe5a52282b5e1da711c99c7860b66"><code>877f50d</code></a> Bump typescript-eslint in the npm-development group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/516">#516</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/b7ab74091b8e849c9b5a937eebfd372e685467ce"><code>b7ab740</code></a> Bump the npm-development group across 1 directory with 6 updates (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/506">#506</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/c074443f1aee8d4aeeae555aebba3282517141b2"><code>c074443</code></a> pin actions/attest reference by commit sha (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/493">#493</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/bd77c077858b8d561b7a36cbe48ef4cc642ca39d"><code>bd77c07</code></a> bump predicate from 1.1.4 to 1.1.5 (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/485">#485</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/1176ef556905f349f669722abf30bce1a6e16e01"><code>1176ef5</code></a> bump <code>@​actions/attest</code> from 1.5.0 to 1.6.0 (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/484">#484</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/f9eaf234fc1c2e333c1eca18177db0f44fa6ba52"><code>f9eaf23</code></a> Bump actions/attest from 2.2.0 to 2.2.1 (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/481">#481</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/attest-build-provenance/compare/ef244123eb79f2f7a7e75d99086184180e6d0018...db473fddc028af60658334401dc6fa3ffd8669fd">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hans Dembinski <HDembinski@users.noreply.github.com>
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
@@ -45,7 +45,7 @@ jobs:
         python-version: "3.12"
     # without this, the Qt tests abort because a lib is missing
     - uses: tlambert03/setup-qt-libs@v1
-    - uses: astral-sh/setup-uv@v4
+    - uses: astral-sh/setup-uv@v6
     - run: uv pip install --system nox
     - run: nox -s cov
     - uses: AndreMiras/coveralls-python-action@develop
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -32,7 +32,7 @@ jobs:
       with:
         python-version: "3.11"
     - run: sudo apt-get install pandoc
-    - uses: astral-sh/setup-uv@v4
+    - uses: astral-sh/setup-uv@v6
     - run: uv pip install --system nox
     - run: nox -s doc
     - uses: actions/upload-pages-artifact@v3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -65,9 +65,9 @@ jobs:
       - if: ${{ matrix.arch == 'aarch64' }}
         uses: docker/setup-qemu-action@v3
 
-      - uses: astral-sh/setup-uv@v4
+      - uses: astral-sh/setup-uv@v6
 
-      - uses: pypa/cibuildwheel@v2.22
+      - uses: pypa/cibuildwheel@v2.23
         env:
           CIBW_BUILD: ${{ matrix.py }}-*
           CIBW_ARCHS: ${{ matrix.arch }}
@@ -120,7 +120,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation for sdist and wheels
-        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
+        uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3.0
         with:
           subject-path: "dist/iminuit-*"
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -45,7 +45,7 @@ jobs:
         key: ${{ github.job }}-${{ matrix.os }}-${{ matrix.python-version }}
     - uses: rui314/setup-mold@v1
       if: runner.os == 'Linux'
-    - uses: astral-sh/setup-uv@v4
+    - uses: astral-sh/setup-uv@v6
     - uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
