Skip to content

chore(deps): update all major dependencies (major) - #80

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-all-major
Open

chore(deps): update all major dependencies (major)#80
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-all-major

Conversation

@renovate

@renovate renovate Bot commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/cache action major v5 → v6
actions/checkout action major v6 → v7
actions/setup-python action major v6 → v7
astral-sh/setup-uv action major v8.1.0 → v10.3.3

Release Notes

actions/cache

v6.1.0

Compare Source

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

actions/checkout

v7.0.1

Compare Source

v7.0.0

Compare Source

  • Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
  • Various dependency updates
actions/setup-python

v7.1.0

Compare Source

What's Changed

Enhancements
Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

v7.0.0

Compare Source

What's Changed
Enhancements
Bug Fix
Dependency Upgrade
New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

astral-sh/setup-uv

v10.3.3: 🌈 Use Astral mirror for version manifests with GitHub fallback

Compare Source

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable.
(Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes

🧰 Maintenance

📚 Documentation

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in #​984

version: latest-known
- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions
- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v9.0.0: 🌈 Change prune-cache default to false

Compare Source

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #​967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes
🐛 Bug fixes
  • fix: fall back to distribution ID when os-release has no version field @​cxzhong (#​961)
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v8.3.2: 🌈 update known checksums for 0.11.28

Compare Source

Changes

Just a maintenance release

🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v8.3.1: 🌈 update known checksums for 0.11.27

Compare Source

Changes

Just a maintenance release

🧰 Maintenance
📚 Documentation

v8.3.0: 🌈 Support uv.lock as a version-file source

Compare Source

Changes

Thanks to @​somaz94 you can now use the pinned version of uv itself in uv.lock. It gets picked up automatically.
If you have pinned another version of uv in your uv.lock you can use the inputs version or version-source to override this.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v8.2.0: 🌈 New inputs quiet and download-from-astral-mirror

Compare Source

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details.
In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title chore(deps): update all major dependencies to v7 chore(deps): update all major dependencies (major) Jun 22, 2026
@renovate
renovate Bot force-pushed the renovate/major-all-major branch from fa4edfd to eac2d8b Compare June 23, 2026 15:39
@renovate
renovate Bot force-pushed the renovate/major-all-major branch 2 times, most recently from a6776fe to 433b74f Compare July 21, 2026 18:53
@renovate
renovate Bot force-pushed the renovate/major-all-major branch 2 times, most recently from b48d32d to 352997c Compare August 14, 2026 19:49
@renovate
renovate Bot force-pushed the renovate/major-all-major branch from 352997c to ae94ba5 Compare September 10, 2026 20:37
@renovate
renovate Bot force-pushed the renovate/major-all-major branch from ae94ba5 to 019df1a Compare September 21, 2026 20:39
@renovate
renovate Bot force-pushed the renovate/major-all-major branch from 019df1a to 1271d18 Compare October 10, 2026 00:42
@renovate
renovate Bot force-pushed the renovate/major-all-major branch from 1271d18 to aa80991 Compare October 21, 2026 20:42
Copilot AI balanced review requested due to automatic review settings October 22, 2026 11:25
@renovate
renovate Bot force-pushed the renovate/major-all-major branch from aa80991 to 20343ab Compare October 22, 2026 11:25
Copilot AI reviewed Oct 22, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No incompatibilities were identified between the documented breaking changes and the existing workflow inputs, triggers, or hosted runners.

No open issues 🎉

What changed in this PR

Updates GitHub Actions dependencies used by RAJA’s CI and release workflows without changing application code.

Changes:

  • Upgrades checkout to v7 in CI, release, and shared setup steps.
  • Updates the shared setup action to setup-python v7, cache v6, and setup-uv v10.3.2.
File Description
.github/​workflows/​release.yml Upgrades checkout for publishing and release jobs.
.github/​workflows/​ci.yml Upgrades checkout for quality checks, tests, and builds.
.github/​actions/​setup-raja/​action.yml Updates shared checkout, Python setup, uv setup, and caching actions.

Review effort: Balanced

@renovate
renovate Bot force-pushed the renovate/major-all-major branch from 20343ab to 877f5d2 Compare October 28, 2026 18:01
Copilot AI balanced review requested due to automatic review settings October 28, 2026 18:01
Copilot AI reviewed Oct 28, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues block the GitHub Actions dependency updates.

No open issues 🎉

Review effort: Balanced

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant