Sandbox::https://github.com/astral-sh/setup-uv/pull/1101

eifinger · 2026-10-21T14:11:19Z

Summary

Roll up the remaining dependency changes from eight open Dependabot PRs against current main, without reverting newer workflow settings:

CodeQL init, analyze, and autobuild: 4.37.7 → 4.38.1 (chore(deps): bump github/codeql-action/init from 4.37.7 to 4.38.1 #1097, chore(deps): bump github/codeql-action/analyze from 4.37.7 to 4.38.1 #1096, chore(deps): bump github/codeql-action/autobuild from 4.37.7 to 4.38.1 #1095)
zizmor-action: 0.6.3 → 0.6.4 (chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 #1085)
@biomejs/biome: 2.5.9 → 2.5.11, including its schema URL (chore(deps-dev): bump @biomejs/biome from 2.5.9 to 2.5.11 #1075)
@types/node: 26.2.0 → 26.4.0 (chore(deps-dev): bump @types/node from 26.2.0 to 26.4.0 #1074)
Jest: 30.4.2 → 30.5.0 (chore(deps-dev): bump jest from 30.4.2 to 30.5.0 #1073)
js-yaml: 5.3.0 → 5.4.1 (chore(deps-dev): bump js-yaml from 5.3.0 to 5.4.1 #1072)

All nine open Dependabot PRs had remaining dependency changes; none was a no-op. TypeScript 7.0.2 (#1029) is intentionally deferred with maintainer approval: ts-jest 29.4.11 requires TypeScript <7, and applying the update caused all 15 test suites to fail before running with Cannot read properties of undefined (reading 'readFile').

The lockfile was regenerated using npm install with scripts disabled. No runtime dependency entries changed, and repackaging produced no dist/ changes.

Validation

Using Node 24.19.0 and npm 11.10.0:

npm ci --ignore-scripts
npm run all — passed; 15 test suites, 159 tests; Biome applied no fixes
npm audit signatures — all 353 audited packages have verified registry signatures; 38 have verified attestations
actionlint .github/workflows/codeql-analysis.yml .github/workflows/test.yml — passed
uvx zizmor --no-progress --offline .github/workflows/codeql-analysis.yml .github/workflows/test.yml — no findings
git diff --check — passed

Refs: pi-session 01a15ec2-de1a-7557-a0bb-00369b0a4a10

Update CodeQL, zizmor-action, Biome, Node types, Jest, and js-yaml. Keep TypeScript 6 because ts-jest does not support TypeScript 7. Refs: pi-session 01a15ec2-de1a-7557-a0bb-00369b0a4a10

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | action | patch | `v10.3.0` → `v10.3.1` | --- ### Release Notes <details> <summary>astral-sh/setup-uv (https://github.com/astral-sh/setup-uv)</summary> ### [`v10.3.1`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](astral-sh/setup-uv@v10.3.0...v10.3.1) #### Changes This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn `##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.` #### 🐛 Bug fixes - fix: preserve cache error class names in save-cache bundle [@dannyward630](https://github.com/dannyward630) ([#1093](astral-sh/setup-uv#1093)) #### 🧰 Maintenance - chore: update known checksums for 0.13.4 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1099](astral-sh/setup-uv#1099)) - chore: update known checksums for 0.13.2/0.13.3 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1098](astral-sh/setup-uv#1098)) - chore: update known checksums for 0.13.1 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1094](astral-sh/setup-uv#1094)) - Verify npm dependency signatures before builds [@zaniebot](https://github.com/zaniebot) ([#1027](astral-sh/setup-uv#1027)) #### 📚 Documentation - docs: cache-dependency-glob matches relative to the working directory [@flange-ipb](https://github.com/flange-ipb) ([#1092](astral-sh/setup-uv#1092)) - docs: update version references to v10.3.0 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1090](astral-sh/setup-uv#1090)) #### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@eifinger](https://github.com/eifinger) ([#1101](astral-sh/setup-uv#1101)) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Los_Angeles) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.foxden.network/FoxDen/core/pulls/233

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | action | patch | `v10.3.0` → `v10.3.2` | --- ### Release Notes <details> <summary>astral-sh/setup-uv</summary> ### [`v10.3.2`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5 [Compare Source](astral-sh/setup-uv@v10.3.1...v10.3.2) #### Changes #### 🧰 Maintenance - chore: update known checksums for 0.13.5 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1103](astral-sh/setup-uv#1103)) #### 📚 Documentation - docs: update version references to v10.3.1 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1102](astral-sh/setup-uv#1102)) ### [`v10.3.1`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](astral-sh/setup-uv@v10.3.0...v10.3.1) #### Changes This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn `##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.` #### 🐛 Bug fixes - fix: preserve cache error class names in save-cache bundle [@dannyward630](https://github.com/dannyward630) ([#1093](astral-sh/setup-uv#1093)) #### 🧰 Maintenance - chore: update known checksums for 0.13.4 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1099](astral-sh/setup-uv#1099)) - chore: update known checksums for 0.13.2/0.13.3 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1098](astral-sh/setup-uv#1098)) - chore: update known checksums for 0.13.1 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1094](astral-sh/setup-uv#1094)) - Verify npm dependency signatures before builds [@zaniebot](https://github.com/zaniebot) ([#1027](astral-sh/setup-uv#1027)) #### 📚 Documentation - docs: cache-dependency-glob matches relative to the working directory [@flange-ipb](https://github.com/flange-ipb) ([#1092](astral-sh/setup-uv#1092)) - docs: update version references to v10.3.0 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1090](astral-sh/setup-uv#1090)) #### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@eifinger](https://github.com/eifinger) ([#1101](astral-sh/setup-uv#1101)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/60 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | action | patch | `v10.3.0` → `v10.3.2` | --- ### Release Notes <details> <summary>astral-sh/setup-uv</summary> ### [`v10.3.2`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5 [Compare Source](astral-sh/setup-uv@v10.3.1...v10.3.2) #### Changes #### 🧰 Maintenance - chore: update known checksums for 0.13.5 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1103](astral-sh/setup-uv#1103)) #### 📚 Documentation - docs: update version references to v10.3.1 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1102](astral-sh/setup-uv#1102)) ### [`v10.3.1`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](astral-sh/setup-uv@v10.3.0...v10.3.1) #### Changes This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn `##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.` #### 🐛 Bug fixes - fix: preserve cache error class names in save-cache bundle [@dannyward630](https://github.com/dannyward630) ([#1093](astral-sh/setup-uv#1093)) #### 🧰 Maintenance - chore: update known checksums for 0.13.4 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1099](astral-sh/setup-uv#1099)) - chore: update known checksums for 0.13.2/0.13.3 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1098](astral-sh/setup-uv#1098)) - chore: update known checksums for 0.13.1 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1094](astral-sh/setup-uv#1094)) - Verify npm dependency signatures before builds [@zaniebot](https://github.com/zaniebot) ([#1027](astral-sh/setup-uv#1027)) #### 📚 Documentation - docs: cache-dependency-glob matches relative to the working directory [@flange-ipb](https://github.com/flange-ipb) ([#1092](astral-sh/setup-uv#1092)) - docs: update version references to v10.3.0 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1090](astral-sh/setup-uv#1090)) #### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@eifinger](https://github.com/eifinger) ([#1101](astral-sh/setup-uv#1101)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/80 Reviewed-by: Luke Tainton <luke@tainton.uk> Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | | patch | `v10.3.0` → `v10.3.2` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | action | patch | `v10.3.0` → `v10.3.2` | --- ### Release Notes <details> <summary>astral-sh/setup-uv</summary> ### [`v10.3.2`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5 [Compare Source](astral-sh/setup-uv@v10.3.1...v10.3.2) ##### Changes ##### 🧰 Maintenance - chore: update known checksums for 0.13.5 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1103](astral-sh/setup-uv#1103)) ##### 📚 Documentation - docs: update version references to v10.3.1 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1102](astral-sh/setup-uv#1102)) ### [`v10.3.1`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](astral-sh/setup-uv@v10.3.0...v10.3.1) ##### Changes This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn `##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.` ##### 🐛 Bug fixes - fix: preserve cache error class names in save-cache bundle [@dannyward630](https://github.com/dannyward630) ([#1093](astral-sh/setup-uv#1093)) ##### 🧰 Maintenance - chore: update known checksums for 0.13.4 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1099](astral-sh/setup-uv#1099)) - chore: update known checksums for 0.13.2/0.13.3 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1098](astral-sh/setup-uv#1098)) - chore: update known checksums for 0.13.1 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1094](astral-sh/setup-uv#1094)) - Verify npm dependency signatures before builds [@zaniebot](https://github.com/zaniebot) ([#1027](astral-sh/setup-uv#1027)) ##### 📚 Documentation - docs: cache-dependency-glob matches relative to the working directory [@flange-ipb](https://github.com/flange-ipb) ([#1092](astral-sh/setup-uv#1092)) - docs: update version references to v10.3.0 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1090](astral-sh/setup-uv#1090)) ##### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@eifinger](https://github.com/eifinger) ([#1101](astral-sh/setup-uv#1101)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | | patch | `v10.3.0` → `v10.3.2` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | action | patch | `v10.3.0` → `v10.3.2` | --- ### Release Notes <details> <summary>astral-sh/setup-uv</summary> ### [`v10.3.2`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5 [Compare Source](astral-sh/setup-uv@v10.3.1...v10.3.2) ##### Changes ##### 🧰 Maintenance - chore: update known checksums for 0.13.5 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1103](astral-sh/setup-uv#1103)) ##### 📚 Documentation - docs: update version references to v10.3.1 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1102](astral-sh/setup-uv#1102)) ### [`v10.3.1`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](astral-sh/setup-uv@v10.3.0...v10.3.1) ##### Changes This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn `##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.` ##### 🐛 Bug fixes - fix: preserve cache error class names in save-cache bundle [@dannyward630](https://github.com/dannyward630) ([#1093](astral-sh/setup-uv#1093)) ##### 🧰 Maintenance - chore: update known checksums for 0.13.4 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1099](astral-sh/setup-uv#1099)) - chore: update known checksums for 0.13.2/0.13.3 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1098](astral-sh/setup-uv#1098)) - chore: update known checksums for 0.13.1 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1094](astral-sh/setup-uv#1094)) - Verify npm dependency signatures before builds [@zaniebot](https://github.com/zaniebot) ([#1027](astral-sh/setup-uv#1027)) ##### 📚 Documentation - docs: cache-dependency-glob matches relative to the working directory [@flange-ipb](https://github.com/flange-ipb) ([#1092](astral-sh/setup-uv#1092)) - docs: update version references to v10.3.0 @[github-actions\[bot\]](https://github.com/apps/github-actions) ([#1090](astral-sh/setup-uv#1090)) ##### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@eifinger](https://github.com/eifinger) ([#1101](astral-sh/setup-uv#1101)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

chore(deps): roll up Dependabot updates

1dadde1

Update CodeQL, zizmor-action, Biome, Node types, Jest, and js-yaml. Keep TypeScript 6 because ts-jest does not support TypeScript 7. Refs: pi-session 01a15ec2-de1a-7557-a0bb-00369b0a4a10

eifinger added the dependencies Pull requests that update a dependency file label Oct 21, 2026

eifinger merged commit 18d369b into main Oct 21, 2026
91 checks passed

eifinger deleted the chore/dependabot-rollup-20261021-160049 branch October 21, 2026 14:17

ryokaneoka0406 mentioned this pull request Oct 26, 2026

Bump astral-sh/setup-uv from 8.1.0 to 10.3.2 ryokaneoka0406/robopen-agent-py#21

Closed

Navigation Menu

Repository navigation

chore(deps): roll up Dependabot updates - #1101

chore(deps): roll up Dependabot updates#1101
eifinger merged 1 commit into
mainfrom
chore/dependabot-rollup-20261021-160049

eifinger commented Oct 21, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

eifinger commented Oct 21, 2026

Summary

Validation

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant