Skip to content

Bump the actions group across 1 directory with 5 updates - #2130

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/main/actions-89f4fe4a6e
Open

Bump the actions group across 1 directory with 5 updates#2130
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/main/actions-89f4fe4a6e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 5 updates in the / directory:

Package From To
CodSpeedHQ/action 4.18.5 5.2.1
OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml 3.0.1 3.0.3
j178/prek-action 2.0.6 3.0.0
wntrblm/nox 2026.07.11 2026.08.17
astral-sh/setup-uv 9.0.0 10.0.1

Updates CodSpeedHQ/action from 4.18.5 to 5.2.1

Release notes

Sourced from CodSpeedHQ/action's releases.

v5.2.1

Bumps the CodSpeed runner to v5.2.1.

🚀 Features

  • Add a simulation-track-subprocess input, which enables measuring the subprocesses spawned by the benchmarked process in simulation mode by @​adriencaccia in #235
  • Bump the go-runner to v1.3.0, adding Go 1.26 and 1.27 support by @​adriencaccia in #516

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

Full Changelog: CodSpeedHQ/action@v5.2.0...v5.2.1

v5.2.0

Bumps the CodSpeed runner to v5.2.0, including v5.1.0.

🚀 Features

🐛 Bug Fixes

  • Fix cache behavior that was causing an apt reinstall of the libc debug symbols despite cache restore by @​GuillaumeLagrange in #509

⚙️ Internals

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

Full Changelog: CodSpeedHQ/action@v5.0.3...v5.2.0

v5.0.3

... (truncated)

Commits

Updates OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml from 3.0.1 to 3.0.3

Release notes

Sourced from OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml's releases.

v3.0.3

What's Changed

Full Changelog: OpenAstronomy/github-actions-workflows@v3.0.2...v3.0.3

v3.0.2

What's Changed

Full Changelog: OpenAstronomy/github-actions-workflows@v3...v3.0.2

Commits
  • 22ddf09 Merge pull request #421 from OpenAstronomy/dependabot/github_actions/dot-gith...
  • 1611b98 Bump the actions group across 1 directory with 8 updates
  • 158acf5 Specify name for job which is expected to fail
  • f159b68 DEP: upgrade cibw (4.0.0 -> 4.2.0) (#420)
  • 06db25f [pre-commit.ci] pre-commit autoupdate (#408)
  • d411b3b DEP: upgrade pypa/gh-action-pypi-publish (support Metadata 2.5) (#418)
  • 8db492e MNT: fix a typo in a workflow step name (#415)
  • 2ee1c83 STY: pin ruff version exactly and fix new violations in v0.16.0 (#411)
  • 118a532 DEP: ensure coverage is installed with toml support (#417)
  • 8c8bb6c DEP: allow running python helper scripts with any Python 3.12.x patch version...
  • See full diff in compare view

Updates j178/prek-action from 2.0.6 to 3.0.0

Release notes

Sourced from j178/prek-action's releases.

v3.0.0

prek-action releases are now immutable

Starting with v3, prek-action will no longer publish moving major or minor tags. References such as j178/prek-action@v3 and j178/prek-action@v3.0 will not be available.

Moving tags can be retargeted after users adopt them, creating unnecessary supply-chain risk. Use an exact release tag or, for stronger protection, pin the action to a full commit SHA.

[!TIP] Use an exact release tag:

- uses: j178/prek-action@v3.0.0

Or, even better, pin the full commit SHA:

- uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0

What's Changed

Full Changelog: j178/prek-action@v2...v3.0.0

Commits

Updates wntrblm/nox from 2026.07.11 to 2026.08.17

Release notes

Sourced from wntrblm/nox's releases.

2026.08.17 🪟

This is a small follow-up release to better support running the parallel mode on legacy windows.

We'd like to thank the following folks who contributed to this release:

Fixes:

Internal changes:

2026.08.10 🔀

This release can run sessions in parallel with --parallel/-j (experimental for now, report any bugs!). Requires session opt-in, or use --allow-parallel. Interpreter discovery now uses the python-discovery package, which should be better at finding Python and supports version specifier sets. Using this, script mode reads requires-python. Many bugs were fixed, mostly in Python version handling, conda version specifiers, and option precedence. Unrecognized global options are now an error.

We'd like to thank the following folks who contributed to this release:

Features:

Fixes:

... (truncated)

Changelog

Sourced from wntrblm/nox's changelog.

Changelog

2026.08.17

This is a small follow-up release to better support running the parallel mode on legacy windows.

We'd like to thank the following folks who contributed to this release:

Fixes:

Internal changes:

2026.08.10

This release can run sessions in parallel with --parallel/-j (experimental for now, report any bugs!). Requires session opt-in, or use --allow-parallel. Interpreter discovery now uses the python-discovery package, which should be better at finding Python and supports version specifier sets. Using this, script mode reads requires-python. Many bugs were fixed, mostly in Python version handling, conda version specifiers, and option precedence. Unrecognized global options are now an error.

We'd like to thank the following folks who contributed to this release:

Features:

... (truncated)

Commits
  • a976d7e docs: prepare 2026.08.17 release notes (#1168)
  • ade83de chore: tighten mypy and pytest config (#1167)
  • c699c47 fix: support legacy encodings in parallel reporter (#1160)
  • f85d050 chore(deps): bump pre-commit hooks, hold pyproject-fmt at 2.26.0 (#1163)
  • 4b9d946 chore(deps): bump the github-actions group with 2 updates (#1162)
  • 57f9e10 docs: prepare 2026.08.10 release notes (#1156)
  • c7134d4 fix: isolate script mode from inherited PYTHONPATH (#1157)
  • aad0ea8 fix: require virtualenv 21+ on Python 3.15 (#1158)
  • 00c9566 fix: conda version constraints on Windows (#1146)
  • 1d6b258 fix: drop stale type ignores for argcomplete 3.7.2 (#1155)
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 9.0.0 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table>

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 1, 2026 16:13
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026
@dependabot
Bump the actions group across 1 directory with 5 updates
569589e 
Bumps the actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [CodSpeedHQ/action](https://github.com/codspeedhq/action) | `4.18.5` | `5.2.1` |
| [OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml](https://github.com/openastronomy/github-actions-workflows) | `3.0.1` | `3.0.3` |
| [j178/prek-action](https://github.com/j178/prek-action) | `2.0.6` | `3.0.0` |
| [wntrblm/nox](https://github.com/wntrblm/nox) | `2026.07.11` | `2026.08.17` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `9.0.0` | `10.0.1` |



Updates `CodSpeedHQ/action` from 4.18.5 to 5.2.1
- [Release notes](https://github.com/codspeedhq/action/releases)
- [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md)
- [Commits](CodSpeedHQ/action@f99becd...373d686)

Updates `OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml` from 3.0.1 to 3.0.3
- [Release notes](https://github.com/openastronomy/github-actions-workflows/releases)
- [Commits](OpenAstronomy/github-actions-workflows@e5af21e...22ddf09)

Updates `j178/prek-action` from 2.0.6 to 3.0.0
- [Release notes](https://github.com/j178/prek-action/releases)
- [Commits](j178/prek-action@5337cb9...4e14d07)

Updates `wntrblm/nox` from 2026.07.11 to 2026.08.17
- [Release notes](https://github.com/wntrblm/nox/releases)
- [Changelog](https://github.com/wntrblm/nox/blob/main/CHANGELOG.md)
- [Commits](wntrblm/nox@3284968...a976d7e)

Updates `astral-sh/setup-uv` from 9.0.0 to 10.0.1
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@c771a70...20cfd1b)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: CodSpeedHQ/action
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: j178/prek-action
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: wntrblm/nox
  dependency-version: 2026.08.17
  dependency-type: direct:production
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the actions group with 5 updates Bump the actions group across 1 directory with 5 updates Sep 8, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/actions-89f4fe4a6e branch from 7d8c136 to 569589e Compare September 8, 2026 17:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants