diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 488450a..b0c47ec 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -29,16 +29,3 @@ updates: update-types: - 'minor' - 'patch' - ignore: - # Held across the fleet: the robosystems backend pins v8.3.2 and ignores - # majors because v9 flipped `prune-cache` to false and would grow its uv - # cache. This repo sits on v9.0.0 and stays there — it is pinned by SHA - # now, and neither v9's nor v10's breaking change actually bites here - # (no workflow triggers on release, pull_request_target or workflow_run, - # which is the only surface v10's cache guard touches). Downgrading to - # match the backend's exact pin would be churn for no security gain, so - # what is shared is the rule, not the version. Drop this entry when the - # backend takes a setup-uv major, and move in step with it. - - dependency-name: 'astral-sh/setup-uv' - update-types: - - 'version-update:semver-major' diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index fb4336b..29dc66a 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -37,7 +37,7 @@ jobs: python-version: "3.14" - name: Install uv - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 - name: Get current version id: current-version diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index ba13a5e..2aa5bf8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -26,7 +26,7 @@ jobs: python-version: ${{ matrix.python-version }} - name: Install uv - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 - name: Install dependencies run: |