Skip to content

Build(deps): Bump astral-sh/setup-uv from 9.0.0 to 10.0.1 - #22

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/astral-sh/setup-uv-10.0.1
Open

Build(deps): Bump astral-sh/setup-uv from 9.0.0 to 10.0.1#22
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/astral-sh/setup-uv-10.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026

Copy link
Copy Markdown
Contributor

Bumps astral-sh/setup-uv from 9.0.0 to 10.0.1.

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

lodyai Bot and others added 2 commits August 11, 2026 21:16
* Enforce slots for closed dataclasses (#11)

Add binding-aware recognition and conservative safety analysis for
standard-library dataclasses whose instance layout can be closed safely.
Cover open-state evidence, class identity hazards, and inherited layouts
with example, property, plug-in, and PyPy shim tests.

Reserve `R9111` for the issue's new rule and move the existing
`prefer-type-statement` refactor message to `R9112`.

* Document the closed-dataclass slots policy (#11)

Explain the literal slots requirement, evidence-based safety exemptions,
and explicit compatibility suppression path. Record the binding,
decorator-order, and cached layout analysis used by the checker.

Update the public inventory to thirteen messages and identify the
renumbered type-statement rule as `R9112`.

* Fix transitive dataclass layout analysis (#11)

Treat fields from the full inherited lineage as declared state, so safe
grandparent-field assignments remain eligible for generated slots.

Classify manual slots from Astroid's resolved layout rather than from the
presence of an assignment, keeping multiple empty-slot marker bases
layout-neutral.

* Simplify dataclass safety analysis

Extract the open-state, class-hazard, and reverse-inheritance decisions
into focused helpers. This preserves the conservative checker behaviour
while keeping the new analysis within the repository's complexity
thresholds.

* Fix dataclass slot safety analysis (#11)

Restrict declared instance state to real dataclass fields and explicit
slots, and require manual slot declarations to have a runtime value.

Preserve inherited dictionaries through generated-slot bases and limit
reverse multiple-inheritance suppression to genuinely conflicting slot
lineages.

* Harden dataclass slots analysis (#11)

Preserve conservative layout and import-resolution behaviour while fixing
the review findings around declared state, generic extension bases,
inheritance, recursive analysis, and manual slots.

Strengthen diagnostic tests, document the 0.2.0 message migration, and bind
Pylint to the supported major-version range.

* Recognize nested dataclass slot hazards (#11)

Inspect nested executable scopes for replacement-class closures and treat
`typing_extensions` ClassVar and Protocol imports like their standard-library
counterparts.

Document the extracted inference helper and strengthen message-ID coverage.

* Cache inherited dataclass layouts (#11)

Memoize local inherited-layout classifications per module and clear the
provisional cache before final eligibility analysis. Add a structural scaling
regression for deep single-inheritance chains.

Record the conservative analysis and Pylint compatibility decisions in ADR
001 and link them from the developer documentation.

* Fix ADR spelling (#11)

Use the project Oxford spelling required by the documentation gate.

* Bound dataclass analysis traversal (#11)

Stop class-cell scans at nested class boundaries and consume at most two
inference candidates when deciding ambiguity.

Add focused regressions for nested helper classes and unbounded inference
streams.

* Validate manual dataclass slots (#11)

Require manual `__slots__` declarations to resolve unambiguously to a
complete valid slot value before suppressing R9111.

Use the validated names for inherited layout and declared-state analysis,
and document and test the rejected annotation-only, invalid, unresolved,
and ambiguous forms.

* Separate manual slot validation stages (#11)

Split inferred value classification from element validation so each helper
has one decision level while preserving the conservative R9111 behaviour.

* Make dataclass checker returns explicit (#11)

Add terminal bare returns to the checker lifecycle methods and narrowly
suppress the conflicting redundant-return rules where necessary.

* Treat manual __dict__ slots as unsafe (#11)

A manual `__slots__` entry naming `__dict__` keeps the instance dictionary
alive, so the layout is not closed. Classify such a layout as `Layout.UNSAFE`
before it can be read as `SLOTTED`, which stops R9111 firing on a dataclass
child of a local base that declares `__slots__ = ("__dict__",)`.

Mark `DataclassSlotsChecker.__init__` with `typing.override`, keeping the
existing `disable-next` comment immediately before the `def` so it still
applies. The name is bound through a `TYPE_CHECKING` branch: type checkers see
`typing.override` precisely, while the runtime fallback keeps the plugin
importable under the PyPy 3.11 pylint shim, where `typing.override` is absent.

Rewrite the ADR decision statement impersonally, and correct the developer
guide's account of the replacement-class scan: it enters nested executable
scopes but stops at nested `ClassDef` bodies, since a nested helper class owns
its own class cell.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Clarify unsafe manual-slot regression (#11)

* Allow documented external spelling

Accept the `LayoutAnalyzer` identifier and literal external API terms so
the generated spelling configuration validates the documentation.

* Cache inherited dataclass state (#11)

Reuse each class's declared state while analysing local inheritance so
deep dataclass chains avoid repeated ancestor walks.

---------

Co-authored-by: leynos <leynos@rohga>
Co-authored-by: leynos <leynos@troubledskies.net>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 9.0.0 to 10.0.1.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@c771a70...20cfd1b)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency version updates github-actions GitHub Actions workflow dependencies labels Aug 20, 2026

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @dependabot[bot], you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency version updates github-actions GitHub Actions workflow dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants