Bump astral-sh/setup-uv from 5 to 7 - #143
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 5 to 7. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v5...v7) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.
Graphify review — findings
Bumps setup-uv from v5 to v7 in the safety-lint and tools-check workflows.
Worth a look
- Third-party GitHub Action is not pinned to an immutable commit —
.github/workflows/safety-lint.yml:25· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 4 functions depend on the 4 functions this change touches.
Health — grade A; no new coupling hotspots.
Verification — 4 functions in the blast radius were not formally verified this run (proofs are advisory here).
Health delta baseline: last indexed commit df2d0d5, 1 commit(s) behind this PR's base.
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 4 function(s) in the blast radius were not formally verified this run
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — straightforward CI dependency bump.
What was reviewed: confirmed the diff is limited to two lines, astral-sh/setup-uv@ v5 → @ v7 in .github/workflows/safety-lint.yml and .github/workflows/tools-check.yml. Checked no other steps, inputs, or permissions in either workflow were touched. No application, firmware, or docs/safety/ content is affected — this is CI-only tooling (Class A per the repo's classification).
Extended reasoning...
Overview
The diff touches only .github/workflows/safety-lint.yml and .github/workflows/tools-check.yml, each with a single-line change bumping the pinned astral-sh/setup-uv action from v5 to v7. Both usages are the "Install uv" step feeding a subsequent uv sync/lint run in tooling-only CI jobs. No workflow permissions, triggers, secrets handling, or job structure changed.
Security risks
None material. This is a version bump of a well-known, widely-used third-party action pinned to a tag (not a mutable branch or SHA-less reference, consistent with prior pinning style). The action's own release notes (from the PR description, treated as untrusted claims) describe bug fixes and a node20→node24 runtime bump — nothing that changes what the workflow does functionally. There's no new secret exposure, no new network call added beyond what the action itself already performs (installing the uv tool), and no change to what commands run once uv is installed.
Level of scrutiny
Low. Per the repo's CLAUDE.md §3 classification, changes limited to .github/workflows/ are Class A (non-shipped tooling, no safety impact) requiring one authorizer and targeted tests + pre-commit — not Class C. Nothing in pstop_c/, firmware/, machn/, host/, ros2/, common/, or docs/safety/ is touched, so none of the Class C triggers apply. This is exactly the kind of mechanical, well-specified, low-blast-radius change suited for quick approval.
Other factors
Dependabot-authored PRs of this shape (single pinned-action version bump, tag-to-tag) are routine and low-risk; the bug-hunting pass reported no findings, and my own read of the diff confirms it is a pure two-line version bump with no other changes hiding in the same commit. No CODEOWNERS conflict is apparent for .github/workflows/, and no prior review or objection exists on this PR to weigh against approval.
Bumps astral-sh/setup-uv from 5 to 7.
Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
37802adFetch uv from Astral's mirror by default (#809)9f00d18chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 (#808)fd8f376Switch to ESM for source and test, use CommonJS for dist (#806)f9070deBump deps (#805)cadb67bchore: update known checksums for 0.10.10 (#804)e06108dUse astral-sh/versions as primary version provider (#802)0f6ec07docs: replace copilot instructions with AGENTS.md (#794)821e5c9docs: add cross-client dependabot rollup skill (#793)6ee6290chore(deps): bump versions (#792)9f332a1Add riscv64 architecture support to platform detection (#791)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)