Skip to content

deps(actions): bump astral-sh/setup-uv from 6 to 7 - #1599

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/astral-sh/setup-uv-7
Open

deps(actions): bump astral-sh/setup-uv from 6 to 7#1599
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/astral-sh/setup-uv-7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps astral-sh/setup-uv from 6 to 7.

Release notes

Sourced from astral-sh/setup-uv's releases.

v7.0.0 🌈 node24 and a lot of bugfixes

Changes

This release comes with a load of bug fixes and a speed up. Because of switching from node20 to node24 it is also a breaking change. If you are running on GitHub hosted runners this will just work, if you are using self-hosted runners make sure, that your runners are up to date. If you followed the normal installation instructions your self-hosted runner will keep itself updated.

This release also removes the deprecated input server-url which was used to download uv releases from a different server. The manifest-file input supersedes that functionality by adding a flexible way to define available versions and where they should be downloaded from.

Fixes

  • The action now respects when the environment variable UV_CACHE_DIR is already set and does not overwrite it. It now also finds cache-dir settings in config files if you set them.
  • Some users encountered problems that cache pruning took forever because they had some uv processes running in the background. Starting with uv version 0.8.24 this action uses uv cache prune --ci --force to ignore the running processes
  • If you just want to install uv but not have it available in path, this action now respects UV_NO_MODIFY_PATH
  • Some other actions also set the env var UV_CACHE_DIR. This action can now deal with that but as this could lead to unwanted behavior in some edgecases a warning is now displayed.

Improvements

If you are using minimum version specifiers for the version of uv to install for example

[tool.uv]
required-version = ">=0.8.17"

This action now detects that and directly uses the latest version. Previously it would download all available releases from the uv repo to determine the highest matching candidate for the version specifier, which took much more time.

If you are using other specifiers like 0.8.x this action still needs to download all available releases because the specifier defines an upper bound (not 0.9.0 or later) and "latest" would possibly not satisfy that.

🚨 Breaking changes

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

... (truncated)

Commits
  • 37802ad Fetch uv from Astral's mirror by default (#809)
  • 9f00d18 chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 (#808)
  • fd8f376 Switch to ESM for source and test, use CommonJS for dist (#806)
  • f9070de Bump deps (#805)
  • cadb67b chore: update known checksums for 0.10.10 (#804)
  • e06108d Use astral-sh/versions as primary version provider (#802)
  • 0f6ec07 docs: replace copilot instructions with AGENTS.md (#794)
  • 821e5c9 docs: add cross-client dependabot rollup skill (#793)
  • 6ee6290 chore(deps): bump versions (#792)
  • 9f332a1 Add riscv64 architecture support to platform detection (#791)
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github-actions Pull requests that update GitHub Actions workflows labels Jul 16, 2026
@greptile-apps

greptile-apps Bot commented Jul 16, 2026

Copy link
Copy Markdown

PR author is not in the allowed authors list.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from efcf696 to 26272d2 Compare July 18, 2026 15:21
@kilo-code-bot

kilo-code-bot Bot commented Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity Count
CRITICAL 0
WARNING 0
SUGGESTION 1
Issue Details (click to expand)

SUGGESTION

File Line Issue
.github/workflows/mdm-artifacts.yml 23 Inconsistent astral-sh/setup-uv pinning: this file uses the floating @v7 tag while all other workflows pin the full commit SHA; pin to the same SHA for supply-chain consistency.
Files Reviewed (6 files)
  • .github/workflows/ci.yml - 0 issues
  • .github/workflows/dependabot-uv-lock.yml - 0 issues
  • .github/workflows/harness-smoke.yml - 0 issues
  • .github/workflows/mdm-artifacts.yml - 1 issue
  • .github/workflows/publish.yml - 0 issues
  • .github/workflows/security-gates.yml - 0 issues

Fix these issues in Kilo Cloud

Previous Review Summaries (2 snapshots, latest commit a98354b)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit a98354b)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (6 files)
  • .github/workflows/ci.yml
  • .github/workflows/dependabot-uv-lock.yml
  • .github/workflows/harness-smoke.yml
  • .github/workflows/mdm-artifacts.yml
  • .github/workflows/publish.yml
  • .github/workflows/security-gates.yml

Previous review (commit 26272d2)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (6 files)
  • .github/workflows/ci.yml
  • .github/workflows/dependabot-uv-lock.yml
  • .github/workflows/harness-smoke.yml
  • .github/workflows/mdm-artifacts.yml
  • .github/workflows/publish.yml
  • .github/workflows/security-gates.yml

Reviewed by hy3:free · Input: 39.8K · Output: 2.2K · Cached: 145.9K

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from 26272d2 to 7efedf4 Compare July 18, 2026 17:10
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from 7efedf4 to 2fbabbc Compare July 18, 2026 17:44
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from 2fbabbc to 51dc673 Compare July 18, 2026 18:41
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from 51dc673 to e2e8489 Compare July 19, 2026 01:11
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from e2e8489 to 2ce4908 Compare July 19, 2026 01:39
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from 2ce4908 to 89a5c68 Compare July 19, 2026 01:59
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from 89a5c68 to 57a9c78 Compare July 19, 2026 02:31
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from 57a9c78 to a98354b Compare July 19, 2026 11:01
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from a98354b to 5884dd7 Compare July 19, 2026 14:18
kilo-code-bot[bot]
kilo-code-bot Bot reviewed Jul 19, 2026
View reviewed changes
Comment thread .github/workflows/mdm-artifacts.yml
steps:
- uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v6
- uses: astral-sh/setup-uv@v7

@kilo-code-bot kilo-code-bot Bot Jul 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SUGGESTION: Inconsistent pinning — this file uses the floating tag @v7 while every other workflow pins astral-sh/setup-uv to a full commit SHA (37802adc94f370d6bfd71619e3f0bf239e1f3b78).

Floating major-version tags are mutable and weaken supply-chain integrity guarantees. For consistency and reproducibility, pin to the same full commit SHA used elsewhere.

Suggested change
- uses: astral-sh/setup-uv@v7
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from 5884dd7 to 0158fff Compare July 19, 2026 14:41
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from 0158fff to 6be8c51 Compare July 22, 2026 21:00
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch 18 times, most recently from ca8a4d7 to 7cf17fd Compare August 10, 2026 19:03
@dependabot
deps(actions): bump astral-sh/setup-uv from 6 to 7
879ac41 
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 6 to 7.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@v6...v7)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/astral-sh/setup-uv-7 branch from 7cf17fd to 879ac41 Compare August 13, 2026 22:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kilo-code-bot kilo-code-bot[bot] kilo-code-bot[bot] left review comments
@kantorcodes kantorcodes Awaiting requested review from kantorcodes kantorcodes is a code owner
@deep-purple-boots deep-purple-boots Awaiting requested review from deep-purple-boots deep-purple-boots is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github-actions Pull requests that update GitHub Actions workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants