build(deps): bump the github-actions group across 1 directory with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates in the / directory: actions/setup-python, astral-sh/setup-uv and actions/labeler.

Updates actions/setup-python from 6 to 7

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-python#1330
• Pin SHA commits and update docs with latest versions by @​HarithaVattikuti in actions/setup-python#1338
• Remove the pip-install input by @​gowridurgad in actions/setup-python#1336

Bug Fix

• Fix to Classify stderr warning messages as warnings instead of errors in annotations by @​lmvysakh in actions/setup-python#1335
• Validate and retry manifest fetch to prevent silent failures by @​priyagupta108 in actions/setup-python#1332

Dependency Upgrade

• Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @​dependabot in actions/setup-python#1328
• Remove EOL Python versions and Bumps numpy text fixture by @​priya-kinthali in actions/setup-python#1333
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-python#1337

New Contributors

• @​lmvysakh made their first contribution in actions/setup-python#1335
• @​philip-gai made their first contribution in actions/setup-python#1337

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

• Add RHEL support and include Linux distro in cache keys by @​priyagupta108 in actions/setup-python#1323
• Fix pip cache error handling on Windows by @​priyagupta108 in actions/setup-python#1040

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-python#1281
• Upgrade actions dependencies by @​gowridurgad with @​Copilot in actions/setup-python#1303
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-python#1324
• Upgrade dependency versions and test workflow configuration by @​HarithaVattikuti in actions/setup-python#1322

Documentation

• Update advanced-usage.md by @​Dunky-Z in actions/setup-python#811

New Contributors

• @​gowridurgad with @​Copilot made their first contribution in actions/setup-python#1303
• @​jasongin made their first contribution in actions/setup-python#1324
• @​Dunky-Z made their first contribution in actions/setup-python#811

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

• Upgrade dependencies to Node 24 compatible versions by @​salmanmkc in actions/setup-python#1259

... (truncated)

Commits

• 5fda3b9 Pin SHA commits and update docs with latest versions (#1338)
• 4ab7e95 Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-0
• 0f3a009 Remove the pip-install input (#1336)
• f8cf429 Migrate to ESM and upgrade dependencies (#1330)
• 54baeea Validate and retry manifest fetch to prevent silent failures (#1332)
• c709277 Annotation code fix (#1335)
• 6849080 remove EOL Python versions and Bumps numpy text fixture (#1333)
• 0903b46 Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)
• See full diff in compare view

Updates astral-sh/setup-uv from 8.3.2 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

• docs: update version references to v10.0.0 @github-actions[bot] (#1014)

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

• 20cfd1b chore: update known checksums for 0.12.4 (#1017)
• d73a0ca Tolerate transient manifest timeouts (#1016)
• ae3b92d docs: update version references to v10.0.0 (#1014)
• ae62891 chore(deps): roll up Dependabot updates (#1013)
• f9cdb47 Reject paths in .tool-versions (#1007)
• 4f6036f Require pull requests for Dependabot rollups (#1005)
• 8d6402c chore(deps): roll up Dependabot updates (#1004)
• 46f427b Read Python version from .tool-versions (#996)
• 8ed89c5 ci: pin Alpine container image (#995)
• 8473c7f chore(deps): roll up Dependabot updates (#994)
• Additional commits viewable in compare view

Updates actions/labeler from 6 to 7

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

• Migrate to ESM and update dependencies by @​chiranjib-swain in actions/labeler#949

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

• Improve PR number validation and warning messages in input handling by @​chiranjib-swain in actions/labeler#939

Dependency Updates

• Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by @​dependabot in actions/labeler#943
• Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 by @​dependabot in actions/labeler#942

Full Changelog: actions/labeler@v6.1.0...v6.2.0

v6.1.0

Enhancements

• Add changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by @​bluca in actions/labeler#923

Bug Fixes

• Improve Labeler Action documentation and permission error handling by @​chiranjib-swain in actions/labeler#897
• Preserve manually added labels during workflow runs and refine label synchronization logic by @​chiranjib-swain in actions/labeler#917

Dependency Updates

• Upgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by @​dependabot in actions/labeler#877
• Upgrade minimatch from 10.0.1 to 10.2.3 by @​dependabot in actions/labeler#926
• Upgrade dependencies (@​actions/core, @​actions/github, js-yaml, minimatch, @​typescript-eslint) by @​Copilot in actions/labeler#934

New Contributors

• @​chiranjib-swain made their first contribution in actions/labeler#897
• @​bluca made their first contribution in actions/labeler#923
• @​Copilot made their first contribution in actions/labeler#934

Full Changelog: actions/labeler@v6...v6.1.0

v6.0.1

What's Changed

• Upgrade publish-action from 0.2.2 to 0.4.0 by @​aparnajyothi-y in actions/labeler#901

New Contributors

• @​aparnajyothi-y made their first contribution in actions/labeler#901

Full Changelog: actions/labeler@v6.0.0...v6.0.1

Commits

• bf12e9b feat: migrate to ESM and update dependencies (#949)
• See full diff in compare view