Skip to content

Verify npm dependency signatures before builds - #1027

Merged
eifinger merged 1 commit into
astral-sh:mainfrom
zaniebot:agent/npm-signature-verification
Oct 14, 2026
Merged

Verify npm dependency signatures before builds#1027
eifinger merged 1 commit into
astral-sh:mainfrom
zaniebot:agent/npm-signature-verification

Conversation

@zaniebot

@zaniebot zaniebot commented Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CI installs the locked npm dependency tree without running lifecycle scripts, but it does not verify registry signatures or available provenance attestations. Run npm audit signatures after installation in both the test and checksum-update workflows, before npm run all executes dependency tooling. The check follows npm's registry-signature support and verifies attestations when present; it does not require every dependency to publish provenance.

Related: astral-sh/ruff-action#402 adds the same signature and provenance verification. #1026 separately hardens npm install defaults.

This was referenced Aug 18, 2026
Closed
Merged
eifinger pushed a commit that referenced this pull request Aug 20, 2026
@zaniebot
Harden npm install defaults (#1026)
19b4d1e 
CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Set `ignore-scripts = true` in `.npmrc`
so developer and maintenance installs use the same default. Keep the
existing seven-day `min-release-age` policy for new resolutions. Require
`npm>=11.10.0` through `engines.npm` and `engine-strict`, while
retaining `devEngines` for newer clients; older installers can otherwise
ignore `devEngines` and the age setting. Pin the build and checksum
workflows to Node.js `24.19.0` so their bundled `npm` supports the
policy. Explicit project commands such as `npm run package` remain
available.

Related: astral-sh/ruff-action#401 applies the matching `npm` defaults,
and astral-sh/ruff-action#411 adds the same legacy-aware version floor.
astral-sh/ruff#27837 applies the install-script default to Ruff's
JavaScript projects. #1027 separately adds
registry-signature and provenance verification.

---------

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
github-actions Bot added a commit to step-security/setup-uv that referenced this pull request Oct 5, 2026
@github-actions @zaniebot
Harden npm install defaults (#1026)
39c639c 
CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Set `ignore-scripts = true` in `.npmrc`
so developer and maintenance installs use the same default. Keep the
existing seven-day `min-release-age` policy for new resolutions. Require
`npm>=11.10.0` through `engines.npm` and `engine-strict`, while
retaining `devEngines` for newer clients; older installers can otherwise
ignore `devEngines` and the age setting. Pin the build and checksum
workflows to Node.js `24.19.0` so their bundled `npm` supports the
policy. Explicit project commands such as `npm run package` remain
available.

Related: astral-sh/ruff-action#401 applies the matching `npm` defaults,
and astral-sh/ruff-action#411 adds the same legacy-aware version floor.
astral-sh/ruff#27837 applies the install-script default to Ruff's
JavaScript projects. astral-sh/setup-uv#1027 separately adds
registry-signature and provenance verification.

---------

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
github-actions Bot added a commit to step-security/setup-uv that referenced this pull request Oct 5, 2026
@github-actions @zaniebot
Harden npm install defaults (#1026)
400a942 
CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Set `ignore-scripts = true` in `.npmrc`
so developer and maintenance installs use the same default. Keep the
existing seven-day `min-release-age` policy for new resolutions. Require
`npm>=11.10.0` through `engines.npm` and `engine-strict`, while
retaining `devEngines` for newer clients; older installers can otherwise
ignore `devEngines` and the age setting. Pin the build and checksum
workflows to Node.js `24.19.0` so their bundled `npm` supports the
policy. Explicit project commands such as `npm run package` remain
available.

Related: astral-sh/ruff-action#401 applies the matching `npm` defaults,
and astral-sh/ruff-action#411 adds the same legacy-aware version floor.
astral-sh/ruff#27837 applies the install-script default to Ruff's
JavaScript projects. astral-sh/setup-uv#1027 separately adds
registry-signature and provenance verification.

---------

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
Raj-StepSecurity pushed a commit to step-security/setup-uv that referenced this pull request Oct 5, 2026
@github-actions @Raj-StepSecurity
Harden npm install defaults (#1026)
12e62f2 
CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Set `ignore-scripts = true` in `.npmrc`
so developer and maintenance installs use the same default. Keep the
existing seven-day `min-release-age` policy for new resolutions. Require
`npm>=11.10.0` through `engines.npm` and `engine-strict`, while
retaining `devEngines` for newer clients; older installers can otherwise
ignore `devEngines` and the age setting. Pin the build and checksum
workflows to Node.js `24.19.0` so their bundled `npm` supports the
policy. Explicit project commands such as `npm run package` remain
available.

Related: astral-sh/ruff-action#401 applies the matching `npm` defaults,
and astral-sh/ruff-action#411 adds the same legacy-aware version floor.
astral-sh/ruff#27837 applies the install-script default to Ruff's
JavaScript projects. astral-sh/setup-uv#1027 separately adds
registry-signature and provenance verification.

---------
Raj-StepSecurity pushed a commit to step-security/setup-uv that referenced this pull request Oct 5, 2026
@github-actions @Raj-StepSecurity
Harden npm install defaults (#1026)
b9630c1 
CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Set `ignore-scripts = true` in `.npmrc`
so developer and maintenance installs use the same default. Keep the
existing seven-day `min-release-age` policy for new resolutions. Require
`npm>=11.10.0` through `engines.npm` and `engine-strict`, while
retaining `devEngines` for newer clients; older installers can otherwise
ignore `devEngines` and the age setting. Pin the build and checksum
workflows to Node.js `24.19.0` so their bundled `npm` supports the
policy. Explicit project commands such as `npm run package` remain
available.

Related: astral-sh/ruff-action#401 applies the matching `npm` defaults,
and astral-sh/ruff-action#411 adds the same legacy-aware version floor.
astral-sh/ruff#27837 applies the install-script default to Ruff's
JavaScript projects. astral-sh/setup-uv#1027 separately adds
registry-signature and provenance verification.

---------
@eifinger
eifinger marked this pull request as ready for review October 14, 2026 08:50
@eifinger
eifinger self-requested a review as a code owner October 14, 2026 08:50
@eifinger eifinger added the ci Pull requests that change the CI workflows label Oct 14, 2026
@eifinger
eifinger merged commit f8c8897 into astral-sh:main Oct 14, 2026
@eifinger eifinger mentioned this pull request Oct 14, 2026
Merged
eifinger added a commit to astral-sh/ruff-action that referenced this pull request Oct 14, 2026
@eifinger @zaniebot
Verify npm dependency signatures before builds (#426)
f2f4668 
## Summary

Supersedes #402 with its changes rebased onto current `main` and the
merge conflict resolved. The original PR is left unchanged.

- Run `npm audit signatures` after installation and before `npm run all`
in the test and checksum-update workflows.
- Preserve the current JSON checksum manifest path
(`src/download/checksum/known-checksums.json`).
- Verify registry signatures and available provenance attestations
without requiring every dependency to publish provenance.

Related: astral-sh/setup-uv#1027 adds the same verification; #401
separately hardens npm installation defaults.

## Validation

Using Node 24.19.0 (matching `.nvmrc`) and npm 11.10.0:
- `npm ci --ignore-scripts` passed (reports existing dependency
vulnerabilities; dependency files are unchanged).
- `npm audit signatures` passed: 547 registry signatures and 97
attestations verified.
- `npm run all` passed: 7 suites, 99 tests; no generated or formatting
changes.
- `actionlint` passed.
- `zizmor` reports the same 26 low-severity findings on this branch and
`main`, with no new findings.
- `git diff --check` passed.

Refs: pi-session 01a1399e-1a99-7314-9573-9a982ea1bb3f

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
Doridian pushed a commit to FoxDenHome/core that referenced this pull request Oct 22, 2026
Renovate @Doridian
Update https://github.com/astral-sh/setup-uv action to v10.3.1 (#233)
794751b 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [https://github.com/astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | action | patch | `v10.3.0` → `v10.3.1` |

---

### Release Notes

<details>
<summary>astral-sh/setup-uv (https://github.com/astral-sh/setup-uv)</summary>

### [`v10.3.1`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle

[Compare Source](astral-sh/setup-uv@v10.3.0...v10.3.1)

#### Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

`##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.`

#### 🐛 Bug fixes

- fix: preserve cache error class names in save-cache bundle [@&#8203;dannyward630](https://github.com/dannyward630) ([#&#8203;1093](astral-sh/setup-uv#1093))

#### 🧰 Maintenance

- chore: update known checksums for 0.13.4 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1099](astral-sh/setup-uv#1099))
- chore: update known checksums for 0.13.2/0.13.3 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1098](astral-sh/setup-uv#1098))
- chore: update known checksums for 0.13.1 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1094](astral-sh/setup-uv#1094))
- Verify npm dependency signatures before builds [@&#8203;zaniebot](https://github.com/zaniebot) ([#&#8203;1027](astral-sh/setup-uv#1027))

#### 📚 Documentation

- docs: cache-dependency-glob matches relative to the working directory [@&#8203;flange-ipb](https://github.com/flange-ipb) ([#&#8203;1092](astral-sh/setup-uv#1092))
- docs: update version references to v10.3.0 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1090](astral-sh/setup-uv#1090))

#### ⬆️ Dependency updates

- chore(deps): roll up Dependabot updates [@&#8203;eifinger](https://github.com/eifinger) ([#&#8203;1101](astral-sh/setup-uv#1101))

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Los_Angeles)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzUuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjE3NS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Reviewed-on: https://git.foxden.network/FoxDen/core/pulls/233
luketainton pushed a commit to luketainton/luke_rsu that referenced this pull request Oct 22, 2026
renovate[bot] @luketainton
chore(deps): update astral-sh/setup-uv action to v10.3.2 (#60)
073bbd8 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | action | patch | `v10.3.0` → `v10.3.2` |

---

### Release Notes

<details>
<summary>astral-sh/setup-uv</summary>

### [`v10.3.2`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5

[Compare Source](astral-sh/setup-uv@v10.3.1...v10.3.2)

#### Changes

#### 🧰 Maintenance

- chore: update known checksums for 0.13.5 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1103](astral-sh/setup-uv#1103))

#### 📚 Documentation

- docs: update version references to v10.3.1 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1102](astral-sh/setup-uv#1102))

### [`v10.3.1`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle

[Compare Source](astral-sh/setup-uv@v10.3.0...v10.3.1)

#### Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

`##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.`

#### 🐛 Bug fixes

- fix: preserve cache error class names in save-cache bundle [@&#8203;dannyward630](https://github.com/dannyward630) ([#&#8203;1093](astral-sh/setup-uv#1093))

#### 🧰 Maintenance

- chore: update known checksums for 0.13.4 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1099](astral-sh/setup-uv#1099))
- chore: update known checksums for 0.13.2/0.13.3 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1098](astral-sh/setup-uv#1098))
- chore: update known checksums for 0.13.1 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1094](astral-sh/setup-uv#1094))
- Verify npm dependency signatures before builds [@&#8203;zaniebot](https://github.com/zaniebot) ([#&#8203;1027](astral-sh/setup-uv#1027))

#### 📚 Documentation

- docs: cache-dependency-glob matches relative to the working directory [@&#8203;flange-ipb](https://github.com/flange-ipb) ([#&#8203;1092](astral-sh/setup-uv#1092))
- docs: update version references to v10.3.0 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1090](astral-sh/setup-uv#1090))

#### ⬆️ Dependency updates

- chore(deps): roll up Dependabot updates [@&#8203;eifinger](https://github.com/eifinger) ([#&#8203;1101](astral-sh/setup-uv#1101))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjAuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==-->

Reviewed-on: https://git.tainton.uk/repos/rsu/pulls/60
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
luketainton pushed a commit to luketainton/repos_labmcp that referenced this pull request Oct 24, 2026
renovate[bot] @luketainton
chore(deps): update astral-sh/setup-uv action to v10.3.2 (#80)
48974b7 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | action | patch | `v10.3.0` → `v10.3.2` |

---

### Release Notes

<details>
<summary>astral-sh/setup-uv</summary>

### [`v10.3.2`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5

[Compare Source](astral-sh/setup-uv@v10.3.1...v10.3.2)

#### Changes

#### 🧰 Maintenance

- chore: update known checksums for 0.13.5 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1103](astral-sh/setup-uv#1103))

#### 📚 Documentation

- docs: update version references to v10.3.1 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1102](astral-sh/setup-uv#1102))

### [`v10.3.1`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle

[Compare Source](astral-sh/setup-uv@v10.3.0...v10.3.1)

#### Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

`##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.`

#### 🐛 Bug fixes

- fix: preserve cache error class names in save-cache bundle [@&#8203;dannyward630](https://github.com/dannyward630) ([#&#8203;1093](astral-sh/setup-uv#1093))

#### 🧰 Maintenance

- chore: update known checksums for 0.13.4 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1099](astral-sh/setup-uv#1099))
- chore: update known checksums for 0.13.2/0.13.3 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1098](astral-sh/setup-uv#1098))
- chore: update known checksums for 0.13.1 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1094](astral-sh/setup-uv#1094))
- Verify npm dependency signatures before builds [@&#8203;zaniebot](https://github.com/zaniebot) ([#&#8203;1027](astral-sh/setup-uv#1027))

#### 📚 Documentation

- docs: cache-dependency-glob matches relative to the working directory [@&#8203;flange-ipb](https://github.com/flange-ipb) ([#&#8203;1092](astral-sh/setup-uv#1092))
- docs: update version references to v10.3.0 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1090](astral-sh/setup-uv#1090))

#### ⬆️ Dependency updates

- chore(deps): roll up Dependabot updates [@&#8203;eifinger](https://github.com/eifinger) ([#&#8203;1101](astral-sh/setup-uv#1101))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjAuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==-->

Reviewed-on: https://git.tainton.uk/repos/labmcp/pulls/80
Reviewed-by: Luke Tainton <luke@tainton.uk>
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
fbidu added a commit to fbidu/cookie-py that referenced this pull request Oct 26, 2026
@fbidu
chore(template): update dependency astral-sh/setup-uv to v10.3.2 (#125)
4008efb 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) |  | patch | `v10.3.0` → `v10.3.2` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | action | patch | `v10.3.0` → `v10.3.2` |

---

### Release Notes

<details>
<summary>astral-sh/setup-uv</summary>

### [`v10.3.2`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5

[Compare Source](astral-sh/setup-uv@v10.3.1...v10.3.2)

##### Changes

##### 🧰 Maintenance

- chore: update known checksums for 0.13.5 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1103](astral-sh/setup-uv#1103))

##### 📚 Documentation

- docs: update version references to v10.3.1 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1102](astral-sh/setup-uv#1102))

### [`v10.3.1`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle

[Compare Source](astral-sh/setup-uv@v10.3.0...v10.3.1)

##### Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

`##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.`

##### 🐛 Bug fixes

- fix: preserve cache error class names in save-cache bundle [@&#8203;dannyward630](https://github.com/dannyward630) ([#&#8203;1093](astral-sh/setup-uv#1093))

##### 🧰 Maintenance

- chore: update known checksums for 0.13.4 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1099](astral-sh/setup-uv#1099))
- chore: update known checksums for 0.13.2/0.13.3 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1098](astral-sh/setup-uv#1098))
- chore: update known checksums for 0.13.1 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1094](astral-sh/setup-uv#1094))
- Verify npm dependency signatures before builds [@&#8203;zaniebot](https://github.com/zaniebot) ([#&#8203;1027](astral-sh/setup-uv#1027))

##### 📚 Documentation

- docs: cache-dependency-glob matches relative to the working directory [@&#8203;flange-ipb](https://github.com/flange-ipb) ([#&#8203;1092](astral-sh/setup-uv#1092))
- docs: update version references to v10.3.0 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1090](astral-sh/setup-uv#1090))

##### ⬆️ Dependency updates

- chore(deps): roll up Dependabot updates [@&#8203;eifinger](https://github.com/eifinger) ([#&#8203;1101](astral-sh/setup-uv#1101))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJ0ZW1wbGF0ZSJdfQ==-->

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) |  | patch | `v10.3.0` → `v10.3.2` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | action | patch | `v10.3.0` → `v10.3.2` |

---

### Release Notes

<details>
<summary>astral-sh/setup-uv</summary>

### [`v10.3.2`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5

[Compare Source](astral-sh/setup-uv@v10.3.1...v10.3.2)

##### Changes

##### 🧰 Maintenance

- chore: update known checksums for 0.13.5 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1103](astral-sh/setup-uv#1103))

##### 📚 Documentation

- docs: update version references to v10.3.1 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1102](astral-sh/setup-uv#1102))

### [`v10.3.1`](https://github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle

[Compare Source](astral-sh/setup-uv@v10.3.0...v10.3.1)

##### Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

`##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.`

##### 🐛 Bug fixes

- fix: preserve cache error class names in save-cache bundle [@&#8203;dannyward630](https://github.com/dannyward630) ([#&#8203;1093](astral-sh/setup-uv#1093))

##### 🧰 Maintenance

- chore: update known checksums for 0.13.4 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1099](astral-sh/setup-uv#1099))
- chore: update known checksums for 0.13.2/0.13.3 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1098](astral-sh/setup-uv#1098))
- chore: update known checksums for 0.13.1 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1094](astral-sh/setup-uv#1094))
- Verify npm dependency signatures before builds [@&#8203;zaniebot](https://github.com/zaniebot) ([#&#8203;1027](astral-sh/setup-uv#1027))

##### 📚 Documentation

- docs: cache-dependency-glob matches relative to the working directory [@&#8203;flange-ipb](https://github.com/flange-ipb) ([#&#8203;1092](astral-sh/setup-uv#1092))
- docs: update version references to v10.3.0 @&#8203;[github-actions\[bot\]](https://github.com/apps/github-actions) ([#&#8203;1090](astral-sh/setup-uv#1090))

##### ⬆️ Dependency updates

- chore(deps): roll up Dependabot updates [@&#8203;eifinger](https://github.com/eifinger) ([#&#8203;1101](astral-sh/setup-uv#1101))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJ0ZW1wbGF0ZSJdfQ==-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eifinger eifinger eifinger approved these changes

Assignees

No one assigned

Labels

ci Pull requests that change the CI workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@zaniebot @eifinger