[renovate]

This PR contains the following updates:

Package	Type	Update	Change
astral-sh/setup-uv		patch	v10.3.0 → v10.3.3
astral-sh/setup-uv	action	patch	v10.3.0 → v10.3.3
getsentry/craft	action	minor	3.9.0 → 3.10.0
getsentry/craft	workflow	minor	3.9.0 → 3.10.0
java-jdk	uses-with	major	21 → 25

---

Release Notes

astral-sh/setup-uv

v10.3.3: 🌈 Use Astral mirror for version manifests with GitHub fallback

Compare Source

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable.
(Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @​eifinger (#​1119)
• fix: allow whitespace in uv requirement specifiers @​soujasK (#​1112)
• fix: resolve ~= specifiers with PEP 440 semantics @​soujasK (#​1111)
• fix: only report a saved cache when saving succeeded @​soujasK (#​1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @​github-actions[bot] (#​1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @​eifinger (#​1113)
• docs: update version references to v10.3.2 @​github-actions[bot] (#​1104)

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes

🧰 Maintenance

• chore: update known checksums for 0.13.5 @​github-actions[bot] (#​1103)

📚 Documentation

• docs: update version references to v10.3.1 @​github-actions[bot] (#​1102)

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

• fix: preserve cache error class names in save-cache bundle @​dannyward630 (#​1093)

🧰 Maintenance

• chore: update known checksums for 0.13.4 @​github-actions[bot] (#​1099)
• chore: update known checksums for 0.13.2/0.13.3 @​github-actions[bot] (#​1098)
• chore: update known checksums for 0.13.1 @​github-actions[bot] (#​1094)
• Verify npm dependency signatures before builds @​zaniebot (#​1027)

📚 Documentation

• docs: cache-dependency-glob matches relative to the working directory @​flange-ipb (#​1092)
• docs: update version references to v10.3.0 @​github-actions[bot] (#​1090)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#​1101)

getsentry/craft

v3.10.0

Compare Source

Deployments now wait for builds and expose failures, while release tooling supports Craft 3 and prevents accidental pre-1.0 major version jumps.

New Features ✨

GitHub Pages deployments now wait for builds and report failures with deployment details.

• (gh-pages) Wait for the Pages build and retry when it fails by @​BYK with @​sentry-junior in #​961

Bug Fixes 🐛

The reusable release workflow now uses the Craft v3 action, enabling Craft 3 configuration and current release-blocker handling. For versions below 1.0.0, craft prepare auto and craft prepare pre convert commit-selected major bumps to minor versions. Use craft prepare major or an explicit exact version to release 1.0.0. JSON changelog output and PR previews still show the raw major bump type.

• (release) Use craft v3 action in reusable release workflow by @​BYK with @​sentry-junior in #​959
• (version) Keep auto and pre below 1.0.0 on breaking changes by @​sentry-junior in #​962

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Java 25 breaks Spark 3 tests

High Severity

Bumping java-version to 25 will fail the Spark 3.5.9 integration tests. pyspark 3.5.9 only supports Java 8, 11, and 17, and Spark 3.x still calls System.setSecurityManager, which JDK 24+ rejects. Those jobs create a SparkContext at fixture setup and will crash on startup. Spark 4.2.0 is unaffected, but 3.5.9 has no JAVA_HOME override.

 

^{Reviewed by Cursor Bugbot for commit db98fbd. Configure here.}

[github-actions]

Coverage Results 📊

✅ 137205 passed | ❌ 9 failed | ⏭️ 7456 skipped | Total: 144670 | Pass Rate: 94.84% | Execution Time: 432m 12s

📊 Comparison with Base Branch

Metric	Change
Total Tests	—
Passed Tests	📉 -9
Failed Tests	📈 +9
Skipped Tests	—

✨ Test counts unchanged from base.

✅ Patch coverage is 100.00% (no changed executable lines found; target 80%).
Project statement coverage is 90.29% (down 0.04 percentage points from base (1baa462) to head (f658a24)).

Coverage diff

@@            Coverage Diff             @@
##        master     #8060       +/-##
==========================================
- Coverage    90.33%    90.29%    -0.04%
==========================================
  Files          203       203         —
  Tracked lines     26922     26922         —
  Branches     10056     10056         —
==========================================
- Hits         24319     24309       -10
- Misses        2603      2613       +10
- Partials      1516      1518        +2

---

Generated by Coverage Action

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 91dd107. Configure here.}

[cursor]

Craft preview secret interface mismatch

Medium Severity

The changelog-preview caller still passes a named GITHUB_TOKEN secret into Craft’s reusable workflow after the v2 to v3 pin. Current Craft v3 workflow_call no longer declares that secret and expects secrets: inherit or no secrets map, so GitHub can reject the workflow as invalid on every pull request.

 

^{Reviewed by Cursor Bugbot for commit 91dd107. Configure here.}