Update CI configuration dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
alibaba/open-code-review	action	patch	v1.12.3 → v1.12.9	v1.12.11 (+1)
astral-sh/setup-uv	action	minor	v10.1.0 → v10.2.0
github/codeql-action	action	patch	v4.38.0 → v4.38.2

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

alibaba/open-code-review (alibaba/open-code-review)

v1.12.9

Compare Source

🐛 Bug Fixes

• fix(session): preserve findings across file renames (#​1529)
• fix(config): preserve unknown JSON fields during config updates (#​1508)
• fix(review): keep git stderr out of --commit background (#​1467)
• fix(ci): pin workflow action references to full commit SHAs (#​856)
• fix(viewer): wrap long session metadata on mobile (#​1458)

📖 Documentation

• docs(agents): add guideline to comment sparingly and explain why (#​1534)

Other Changes

• security: validate credential commands and expand .gitattributes binary markers (#​1291)
• Fix/gitlab multiline comments and suggestions (#​1000)
• test: stabilize token boundary fixtures (#​1015)
• test(diff): guard quoted-path parsing through a real git subprocess (#​1516)

Full Changelog: alibaba/open-code-review@v1.12.8...v1.12.9

v1.12.8

Compare Source

🚀 Features

• feat(rules): add F# review support (#​1448)

🐛 Bug Fixes

• fix(config): exclude dependency and build-output directories by default (#​1499)
• fix(viewer): keep vertical mouse-wheel working over scroll regions (#​1515)
• fix(action): honor an explicit llm_protocol instead of forcing openai or anthropic (#​1192)
• fix(diff): parse git's quoted pathnames instead of dropping the file (#​1498)
• fix(scan): keep NUL-delimited pathnames from git ls-files intact (#​1497)
• fix(viewer): shorten the session id cell on the session list (#​1488)
• fix(viewer): responsive, accessibility and contrast polish across the four screens (#​1426)
• fix(tool): keep non-ASCII paths literal in code_search results (#​1425)

📖 Documentation

• docs(assurance): correct API key storage claims (#​1449)
• docs(extensions): new translations for vscode ext (#​1381)
• docs(review): synchronize exclude & secret patterns (#​1491)

Other Changes

• perf(viewer): paginate large review result lists (#​1460)

Full Changelog: alibaba/open-code-review@v1.12.7...v1.12.8

v1.12.7

Compare Source

🚀 Features

• feat(viewer): export a session to a self-contained HTML file (#​1167) (#​1174)

🐛 Bug Fixes

• fix(allowlist): exclude pytest-style test_*.py from review (#​1439)

Other Changes

• chore: drop the last TEMPORARY english-only exemption (#​1445)
• chore(idea): translate the Chinese comments in services/ (#​1436)
• chore(idea): translate tests and narrow language exemptions (#​1429)
• chore(vscode): translate comments and test names to English (#​1427)
• chore(idea): translate provider and host string comments (#​1428)
• chore: translations (#​1437)

Full Changelog: alibaba/open-code-review@v1.12.6...v1.12.7

v1.12.6

Compare Source

🚀 Features

• feat(viewer): restyle the review comments section (#​1387)
• feat(viewer): restyle session detail header and meta bar (#​1384)
• feat(viewer): restyle the sessions list page (#​1377)
• feat(viewer): restyle the repositories page (#​1382)

🐛 Bug Fixes

• fix(test): add TestMain to isolate session writes from real HOME (#​1416)
• fix(npm): hide the updater's console window on Windows (#​1406)
• fix(viewer): make --surface white to match the mockup backgrounds (#​1404)

🔧 Refactoring

• refactor(viewer): dedupe shared viewer chrome (pager + back-link) (#​1400)

Other Changes

• chore(idea): rename the Marketplace listing and set version 0.1.0 (#​1438)
• chore: clear non-code blockers ahead of the english-only cleanup (#​1417)
• Feat/idea plugin (#​1031)
• chore: extend license and english-only gates to kt, py and css (#​1407)

Full Changelog: alibaba/open-code-review@v1.12.5...v1.12.6

v1.12.5

Compare Source

🚀 Features

• feat(viewer): restyle session detail sections (#​1358)
• feat(action): opt-in resolution of the bot's own outdated review threads (#​567) (#​944)
• feat(viewer): integrate a shared SVG icon set (#​1367)
• feat(viewer): align design-token values to the mockup palette (#​1365)
• feat(plugin): add kimi code plugin (#​1355)
• feat(pages): standardize web crawler policy (#​939)
• feat(viewer): restyle the session compare page (#​1328) (#​1331)
• feat(viewer): restyle Coverage and Token Usage cards (#​1346)
• feat(viewer): add shared design foundation (#​1338)
• feat(viewer): align suggested change indentation with existing code gutter (#​1313) (#​1315)

🐛 Bug Fixes

• fix(agent): enforce --max-tokens-budget inside a running group (#​1248)
• fix: dedupe overlapping incremental review comments (#​1359)
• fix(install): add download timeout to asset fetch in install.sh (#​1292)
• fix(tool): enforce the global code search result limit (#​1306)
• fix(session): tolerate truncated resume tail (#​1312)
• fix(diff): strip trailing CR from CRLF diff text (#​1302)

📖 Documentation

• docs(skill): skip ocr install pre-check on the common path (#​1356)
• docs(telemetry): document existing LLM and tool spans (#​1348)

Other Changes

• chore(pages): remove MacPorts install channel (#​1334)

Full Changelog: alibaba/open-code-review@v1.12.4...v1.12.5

v1.12.4

Compare Source

🚀 Features

• feat(action): add optional pr_number input and workflow_run fallback (#​1156)

🐛 Bug Fixes

• fix(diff): flag untracked binary files as binary in workspace mode (#​1288)

Other Changes

• perf(diff): skip oversized untracked files before reading (#​1310)
• test(action): satisfy resolved_head contract in workflow_run pr_number test (#​1309)
• test(diff): cover gitignore-drop interleaved with provider-exclude (#​1300)

Full Changelog: alibaba/open-code-review@v1.12.3...v1.12.4

astral-sh/setup-uv (astral-sh/setup-uv)

v10.2.0

Compare Source

github/codeql-action (github/codeql-action)

v4.38.2

Compare Source

• Update default CodeQL bundle version to 2.27.1. #​4160

v4.38.1

Compare Source

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • On day 3 and 22 of the month (* * 3,22 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.