[renovate]

This PR contains the following updates:

Package	Type	Update	Change
astral-sh/setup-uv	action	patch	v10.3.2 → v10.3.3

---

Release Notes

astral-sh/setup-uv

v10.3.3: 🌈 Use Astral mirror for version manifests with GitHub fallback

Compare Source

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable.
(Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @​eifinger (#​1119)
• fix: allow whitespace in uv requirement specifiers @​soujasK (#​1112)
• fix: resolve ~= specifiers with PEP 440 semantics @​soujasK (#​1111)
• fix: only report a saved cache when saving succeeded @​soujasK (#​1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @​github-actions[bot] (#​1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @​eifinger (#​1113)
• docs: update version references to v10.3.2 @​github-actions[bot] (#​1104)

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARJAVA-7289

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Updating the pinned setup-uv action in two workflows changes CI tool installation and manifest retrieval, which could affect dependency setup or builds.

Bumps the astral-sh/setup-uv GitHub Action from v10.3.2 to v10.3.3, which fetches version manifests from the Astral mirror with GitHub fallback. No issues found.

Verification Rules 2/3 met PRs 1 inspected

Rules 1 failed 2 passed

❌ Approved GitHub Actions runners (approved_runners) - build.yml:484 and several other workflows use retired sonar-xs-public (e.g. releasability.yaml, cleanup-cache.yml); migrate to an approved label such as sonar-xs or github-ubuntu-latest-s per the runners policy (https://xtranet-sonarsource.atlassian.net/wiki/spaces/Platform/pages/3694231566/GitHub+Actions+Runners+-+GitHub); this PR's changed lines don't touch runners.
✅ Internal artifact registries (artifactory_registries)
✅ Repository license compliance (license_compliance)

Functional validation No results

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 92: Update astral-sh/setup-uv action to v10 Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[vdiez]

Auto-approved: Renovate dependency update.