Skip to content

Bump the gha-updates group across 1 directory with 10 updates#163

Merged
bckohan merged 1 commit intomainfrom
dependabot/github_actions/gha-updates-67db1f1ab2
May 1, 2026
Merged

Bump the gha-updates group across 1 directory with 10 updates#163
bckohan merged 1 commit intomainfrom
dependabot/github_actions/gha-updates-67db1f1ab2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 1, 2026

Bumps the gha-updates group with 10 updates in the / directory:

Package From To
astral-sh/setup-uv 7.3.1 8.1.0
extractions/setup-just 3.1.0 4.0.0
actions/upload-artifact 7.0.0 7.0.1
actions/download-artifact 8.0.0 8.0.1
pypa/gh-action-pypi-publish 1.13.0 1.14.0
sigstore/gh-action-sigstore-python 3.2.0 3.3.0
github/codeql-action 4.32.5 4.35.2
rhysd/action-setup-vim 1.6.0 1.6.1
codecov/codecov-action 5.5.2 6.0.0
actions-rust-lang/setup-rust-toolchain 1.15.3 1.16.0

Updates astral-sh/setup-uv from 7.3.1 to 8.1.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v8.1.0 🌈 New input no-project

Changes

This add the a new boolean input no-project. It only makes sense to use in combination with activate-environment: true and will append --no project to the uv venv call. This is for example useful if you have a pyproject.toml file with parts unparseable by uv

🚀 Enhancements

  • Add input no-project in combination with activate-environment @​eifinger (#856)

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

  • chore(deps): bump release-drafter/release-drafter from 7.1.1 to 7.2.0 @dependabot[bot] (#855)

v8.0.0 🌈 Immutable releases and secure tags

This is the first immutable release of setup-uv 🥳

All future releases are also immutable, if you want to know more about what this means checkout the docs.

This release also has two breaking changes

New format for manifest-file

The previously deprecated way of defining a custom version manifest to control which uv versions are available and where to download them from got removed. The functionality is still there but you have to use the new format.

No more major and minor tags

To increase security even more we will stop publishing minor tags. You won't be able to use @v8 or @v8.0 any longer. We do this because pinning to major releases opens up users to supply chain attacks like what happened to tj-actions.

[!TIP] Use the immutable tag as a version astral-sh/setup-uv@v8.0.0 Or even better the githash astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57

... (truncated)

Commits
  • 0880764 fix: grant contents:write to validate-release job (#860)
  • 717d6ab Add a release-gate step to the release workflow (#859)
  • 5a911eb Draft commitish releases (#858)
  • 080c31e Add action-types.yml to instructions (#857)
  • b3e97d2 Add input no-project in combination with activate-environment (#856)
  • 7dd591d chore(deps): bump release-drafter/release-drafter from 7.1.1 to 7.2.0 (#855)
  • 1541b77 chore: update known checksums for 0.11.7 (#853)
  • cdfb2ee Refactor version resolving (#852)
  • cb84d12 chore: update known checksums for 0.11.6 (#850)
  • 1912cc6 chore: update known checksums for 0.11.5 (#845)
  • Additional commits viewable in compare view

Updates extractions/setup-just from 3.1.0 to 4.0.0

Commits

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • See full diff in compare view

Updates actions/download-artifact from 8.0.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

Commits

Updates pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.0

✨ What's Changed

The main change in this release is that verbose and print-hash inputs are now on by default. This was contributed by @​whitequark💰 in #397.

📝 Docs

@​woodruffw💰 updated the mentions of PEP 740 to stop implying that it might be experimental (it hasn't been for quite a while!) in #388 and @​him2him2💰 brushed up some grammar in the README and SECURITY docs via #395.

🛠️ Internal Updates

@​woodruffw💰 bumped sigstore and pypi-attestations in the lock file (#391) and @​webknjaz💰 added infra for using type annotations in the project (#381).

💪 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.13.0...v1.14.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​facutuesca💰 and @​woodruffw💰 for helping maintain this project when I can't!

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

Commits
  • cef2210 Merge pull request #397 from whitequark/patch-1
  • b4595e2 Enable verbose and print-hash by default.
  • e2bab26 Merge pull request #395 from him2him2/docs/fix-typos-and-grammar
  • 7495c38 docs: fix typos and grammar in README and SECURITY
  • 03f86fe Merge pull request #388 from woodruffw-forks/ww/rm-experimental
  • 4c78f1c Merge branch 'unstable/v1' into ww/rm-experimental
  • b5a6e8b deps: bump sigstore and pypi-attestations
  • a48a03e remove another experimental mention
  • 8087a88 action: remove a lingering mention of PEP 740 being experimental
  • 3317ede 🧪 Integrate actionlint via pre-commit framework
  • Additional commits viewable in compare view

Updates sigstore/gh-action-sigstore-python from 3.2.0 to 3.3.0

Release notes

Sourced from sigstore/gh-action-sigstore-python's releases.

v3.3.0

What's Changed

  • Dependency updates. Most importantly used sigstore-python is now version 4.2.0

Full Changelog: sigstore/gh-action-sigstore-python@v3.2.0...v3.3.0

Commits
  • 04cffa1 build(deps): bump requests from 2.32.5 to 2.33.0 in /requirements (#342)
  • 69171e8 build(deps): bump charset-normalizer in the python-dependencies group (#340)
  • 40198d7 build(deps): bump github/codeql-action in the actions group (#338)
  • ca55bb0 build(deps): bump the python-dependencies group with 2 updates (#339)
  • 2736143 build(deps): bump the actions group with 3 updates (#335)
  • 9afbb88 build(deps): bump pyasn1 from 0.6.2 to 0.6.3 in /requirements (#337)
  • eb907b0 build(deps): bump pyopenssl from 25.3.0 to 26.0.0 in /requirements (#334)
  • 84eaebf build(deps): bump astral-sh/setup-uv in the actions group (#331)
  • 57c12be build(deps): bump charset-normalizer in the python-dependencies group (#332)
  • 57918d7 build(deps): bump pyjwt from 2.11.0 to 2.12.0 in /requirements (#333)
  • Additional commits viewable in compare view

Updates github/codeql-action from 4.32.5 to 4.35.2

Release notes

Sourced from github/codeql-action's releases.

v4.35.2

  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
  • Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
  • Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
  • Update default CodeQL bundle version to 2.25.2. #3823

v4.35.1

v4.35.0

v4.34.1

  • Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

v4.34.0

  • Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
  • We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
  • Update default CodeQL bundle version to 2.25.0. #3585

v4.33.0

  • Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

    To opt out of this change:

    • Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

  • Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557

  • The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559

  • Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563

  • Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564

  • A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

v4.32.6

  • Update default CodeQL bundle version to 2.24.3. #3548
Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
  • Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
  • Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
  • Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
  • Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
  • Update default CodeQL bundle version to 2.25.2. #3823

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

4.34.1 - 20 Mar 2026

  • Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

4.34.0 - 20 Mar 2026

  • Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
  • We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
  • Update default CodeQL bundle version to 2.25.0. #3585

4.33.0 - 16 Mar 2026

  • Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

    To opt out of this change:

    • Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

  • Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557

  • The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559

  • Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563

  • Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564

... (truncated)

Commits
  • 95e58e9 Merge pull request #3824 from github/update-v4.35.2-d2e135a73
  • 6f31bfe Update changelog for v4.35.2
  • d2e135a Merge pull request #3823 from github/update-bundle/codeql-bundle-v2.25.2
  • 60abb65 Add changelog note
  • 5a0a562 Update default bundle to codeql-bundle-v2.25.2
  • 6521697 Merge pull request #3820 from github/dependabot/github_actions/dot-github/wor...
  • 3c45af2 Merge pull request #3821 from github/dependabot/npm_and_yarn/npm-minor-345b93...
  • f1c3393 Rebuild
  • 1024fc4 Rebuild
  • 9dd4cfe Bump the npm-minor group across 1 directory with 6 updates
  • Additional commits viewable in compare view

Updates rhysd/action-setup-vim from 1.6.0 to 1.6.1

Release notes

Sourced from rhysd/action-setup-vim's releases.

v1.6.1

This is a small patch update for security fixes.

  • Update major versions of @actions/* packages including some security fixes in HTTP client.
  • Update glob and js-yaml indirect dependencies for security fixes.
  • Update the major version of proxy-from-env that disables the support for the legacy npm_config_-prefixed environment variables.
Changelog

Sourced from rhysd/action-setup-vim's changelog.

v1.6.1 - 2026-03-18

This is a small patch update for security fixes.

  • Update major versions of @actions/* packages including some security fixes in HTTP client.
  • Update js-yaml indirect dependency for security fix.
  • Update glob indirect dependency for security fix.
  • Update the major version of proxy-from-env that disables the support for the legacy npm_config_-prefixed environment variables.

[Changes][v1.6.1]

v1.6.0 - 2025-11-09

  • Add new vim-dir output which stores the $VIM directory absolute path of the installation. See :help $VIM for more details about the directory. This output is useful to locate where the Vim/Neovim is installed by the following steps. Here is an example of setting the installation-specific vimrc configuration: 
    - uses: rhysd/action-setup-vim@v1
  id: vim
- name: Setup vimrc specific to the Vim installation
  run: |
    cp vimrc_for_ci.vim '${{ vim.vim-dir }}/vimrc'
  • Fix the Vim installation directory structure on Windows. It did not conform the standard directory layout which Vim assumes (though it worked fine for compatibility reasons). Previously the runtime directory was wrongly squashed. The paths before/after this release when installing stable version are:
    • Previous wrong path: ~/vim-stable/vim.exe
    • New correct path: ~/vim-stable/vim91/vim.exe
  • Clean up temporary directories created by this action after installation completes. Temporary directories containing downloaded assets were not removed previously but they could cause troubles when installing multiple Vim/Neovim instances.
  • Report logs via core.info() instead of directly calling console.log().

[Changes][v1.6.0]

v1.5.1 - 2025-11-02

  • Fix installing stable Vim on macos-15-intel runner. It was broken again after v1.4.5 release due to the change in the upstream runner. (#52)
  • Update @actions/io to v2.0.0 for better Node.js v24 support.

[Changes][v1.5.1]

v1.5.0 - 2025-10-26

  • Support arm64 native binaries on windows-11-arm runner.
    • When an arm64 binary is missing in the release due to some reasons (e.g. build error), it falls back to x86_64 binary so that your workflow can continue. In this case the x86_64 binary is executed via x86 emulation.
    • Neovim only supports arm64 binaries on nightly builds for now.
  • Migrate the action runtime from node20 to node24. This change only affects users running this action on self-hosted runners.
  • Fix the validation for installed executables was not sufficient on Windows.

... (truncated)

Commits
  • febef33 Release v1.6.1 at 96eb633a04e4bf2eea5ecc4cc6727cef90c1f21d
  • See full diff in compare view

Updates codecov/codecov-action from 5.5.2 to 6.0.0

Release notes

Sourced from codecov/codecov-action's releases.

v6.0.0

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

v5.5.4

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

v5.5.3

What's Changed

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

Updates actions-rust-lang/setup-rust-toolchain from 1.15.3 to 1.16.0

Release notes

Sourced from actions-rust-lang/setup-rust-toolchain's releases.

v1.16.0

What's Changed

New Contributors

Full Changelog: actions-rust-lang/setup-rust-toolchain@v1.15.4...v1.16.0

v1.15.4

What's Changed

New Contributors

Full Changelog: actions-rust-lang/setup-rust-toolchain@v1.15.3...v1.15.4

Changelog

Sourced from actions-rust-lang/setup-rust-toolchain's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[1.16.0] - 2026-04-13

  • Add new parameter cache-save-if that is propagated to Swatinem/rust-cache as save-if (#90 by @​ChanTsune)

[1.15.4] - 2026-03-15

  • Bump Swatinem/rust-cache from 2.8.2 to 2.9.1 (#87 by @​hyperfinitism) This gets rid of the warnings about Node.js 20.

[1.15.3] - 2026-03-01

  • Bump Swatinem/rust-cache from 2.8.1 to 2.8.2

[1.15.2] - 2025-10-04

  • Fix: Run the version detection steps in the selected rust-src-dir directory. This should enable the version selection even without a default toolchain installed. Fixes #74.

[1.15.1] - 2025-09-23

  • Update Swatinem/rust-cache to v2.8.1

[1.15.0] - 2025-09-14

  • Add support for non-root source directory. Accept source code and rust-toolchain.toml file in subdirectories of the repository. Adds a new parameter rust-src-dir that controls the lookup for toolchain files and sets a default value for the cache-workspace input. (#69 by @​Kubaryt)

[1.14.1] - 2025-08-28

[1.14.0] - 2025-08-23

  • Add new parameters cache-all-crates and cache-workspace-crates that are propagated to Swatinem/rust-cache as cache-all-crates and cache-workspace-crates

[1.13.0] - 2025-06-16

  • Add new parameter cache-provider that is propagated to Swatinem/rust-cache as cache-provider (#65 by @​mindrunner)

... (truncated)

Commits
  • 2b1f5e9 Update CHANGELOG for version 1.16.0
  • 9030f3d Merge pull request #90 from ChanTsune/feat/cache-save-if
  • 186b99e feat: add cache-save-if input to propagate save-if to Swatinem/rust-cache
  • d197c15 Merge pull request #88 from ryuapp/chore/update-chekcout-v6-on-readme
  • fa057b4 Update actions/checkout to v6 on README
  • 150fca8 Update CHANGELOG for version 1.15.4
  • aa63f57 Merge pull request #87 from hyperfinitism/deps/bump-rust-cache
  • 229ed07 deps: Bump Swatinem/rust-cache from 2.8.2 to 2.9.1
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all...

Description has been truncated

@dependabot
Bump the gha-updates group across 1 directory with 10 updates
41c561e 
Bumps the gha-updates group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `7.3.1` | `8.1.0` |
| [extractions/setup-just](https://github.com/extractions/setup-just) | `3.1.0` | `4.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.0` | `8.0.1` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.0` |
| [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python) | `3.2.0` | `3.3.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.32.5` | `4.35.2` |
| [rhysd/action-setup-vim](https://github.com/rhysd/action-setup-vim) | `1.6.0` | `1.6.1` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.2` | `6.0.0` |
| [actions-rust-lang/setup-rust-toolchain](https://github.com/actions-rust-lang/setup-rust-toolchain) | `1.15.3` | `1.16.0` |



Updates `astral-sh/setup-uv` from 7.3.1 to 8.1.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@5a095e7...0880764)

Updates `extractions/setup-just` from 3.1.0 to 4.0.0
- [Release notes](https://github.com/extractions/setup-just/releases)
- [Commits](extractions/setup-just@f8a3cce...53165ef)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `actions/download-artifact` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@70fc10c...3e5f45b)

Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.0
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@ed0c539...cef2210)

Updates `sigstore/gh-action-sigstore-python` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/sigstore/gh-action-sigstore-python/releases)
- [Changelog](https://github.com/sigstore/gh-action-sigstore-python/blob/main/CHANGELOG.md)
- [Commits](sigstore/gh-action-sigstore-python@a5caf34...04cffa1)

Updates `github/codeql-action` from 4.32.5 to 4.35.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c793b71...95e58e9)

Updates `rhysd/action-setup-vim` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/rhysd/action-setup-vim/releases)
- [Changelog](https://github.com/rhysd/action-setup-vim/blob/master/CHANGELOG.md)
- [Commits](rhysd/action-setup-vim@19e3dd3...febef33)

Updates `codecov/codecov-action` from 5.5.2 to 6.0.0
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@671740a...57e3a13)

Updates `actions-rust-lang/setup-rust-toolchain` from 1.15.3 to 1.16.0
- [Release notes](https://github.com/actions-rust-lang/setup-rust-toolchain/releases)
- [Changelog](https://github.com/actions-rust-lang/setup-rust-toolchain/blob/main/CHANGELOG.md)
- [Commits](actions-rust-lang/setup-rust-toolchain@a0b538f...2b1f5e9)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-updates
- dependency-name: extractions/setup-just
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-updates
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-updates
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-updates
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha-updates
- dependency-name: sigstore/gh-action-sigstore-python
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha-updates
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha-updates
- dependency-name: rhysd/action-setup-vim
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-updates
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-updates
- dependency-name: actions-rust-lang/setup-rust-toolchain
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 1, 2026
@dependabot dependabot Bot requested a review from bckohan as a code owner May 1, 2026 05:27
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 1, 2026
@bckohan bckohan merged commit f5c928c into main May 1, 2026
24 checks passed
@dependabot dependabot Bot deleted the dependabot/github_actions/gha-updates-67db1f1ab2 branch May 1, 2026 16:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bckohan bckohan bckohan approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bckohan