chore(deps): bump the actions group across 1 directory with 5 updates by dependabot[bot] · Pull Request #4552 · zarr-developers/zarr-python

dependabot · 2026-10-22T04:27:10Z

Bumps the actions group with 5 updates in the / directory:

Package	From	To
astral-sh/setup-uv	`10.2.0`	`10.3.0`
CodSpeedHQ/action	`5.2.1`	`5.5.0`
actions/upload-artifact	`7.0.1`	`7.0.2`
actions/download-artifact	`8.0.1`	`8.0.2`
zizmorcore/zizmor-action	`0.6.4`	`0.7.1`

Updates astral-sh/setup-uv from 10.2.0 to 10.3.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.0 🌈 Add Python architecture selection

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

Use macOS 15 runners for tests @charliermarsh (#1081)

🚀 Enhancements

Add python-arch support @zanieb (#1079)

🧰 Maintenance

chore: update known checksums for 0.13.0 @github-actions[bot] (#1089)

chore: update known checksums for 0.12.24 @github-actions[bot] (#1084)

chore: update known checksums for 0.12.23 @github-actions[bot] (#1082)

chore: update known checksums for 0.12.22 @github-actions[bot] (#1080)

chore: update known checksums for 0.12.21 @github-actions[bot] (#1078)

chore: update known checksums for 0.12.20 @github-actions[bot] (#1076)

chore: update known checksums for 0.12.19 @github-actions[bot] (#1068)

chore: update known checksums for 0.12.18 @github-actions[bot] (#1065)

⬆️ Dependency updates

chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 @dependabot[bot] (#1077)

Commits

1c37ad0 chore: update known checksums for 0.13.0 (#1089)
b3c9b5f chore: update known checksums for 0.12.24 (#1084)
b06acff Add python-arch support (#1079)
c84232c chore: update known checksums for 0.12.23 (#1082)
51fdd26 Use macOS 15 runners for tests (#1081)
a96208b chore: update known checksums for 0.12.22 (#1080)
0e3884b chore: update known checksums for 0.12.21 (#1078)
bcf0580 chore: update known checksums for 0.12.20 (#1076)
b92a892 chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#1077)
227a0f6 chore: update known checksums for 0.12.19 (#1068)
Additional commits viewable in compare view

Updates CodSpeedHQ/action from 5.2.1 to 5.5.0

Release notes

Sourced from CodSpeedHQ/action's releases.

v5.5.0

Bumps the CodSpeed runner to v5.5.0.

This release adds support for Ubuntu 26.04, on both x86_64 and arm64. The officially supported distributions are now Ubuntu 22.04, 24.04 and 26.04, and Debian 12.

Profile uploads are also faster on GitHub-hosted runners, and archives larger than 5 GiB can now be uploaded.

Results from the Memory instrument are processed much faster and with less memory on large benchmarks.

This release also fixes a crash that could affect some pytest-codspeed benchmarks since v5.4.2.

🚀 Features

Split profile archive uploads into concurrent parts by @lvaroqui in #565

🐛 Bug Fixes

Only set PYTHONPERFSUPPORT for exec-harness benchmarks by @not-matthias in #584

⚡ Performance

Stream memtrack frames and decode them in parallel when finding module events by @not-matthias in #578

Use mimalloc as the runner's global allocator by @not-matthias in #581

⚙️ Internals

Support Ubuntu 26.04 by @lvaroqui in #574

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

ci: migrate to github default arm runners by @lvaroqui in CodSpeedHQ/action#250

chore: bump runner version to 5.5.0 by @github-actions[bot] in CodSpeedHQ/action#251

New Contributors

@lvaroqui made their first contribution in CodSpeedHQ/action#250

Full Changelog: CodSpeedHQ/action@v5.4.2...v5.5.0

v5.4.2

Bumps the CodSpeed runner to v5.4.2, including v5.4.1.

This release improves and adds support for memory flamegraphs in C++, Python and Node.js.

Fixes flamegraphs for Python in simulation mode in the exec CLI.

🚀 Features

... (truncated)

Commits

821a40c Release v5.5.0 🚀
a0d1b90 chore: bump runner version to 5.5.0 (#251)
67e2f8c ci: migrate to github default arm runners (#250)
f842b9a Release v5.4.2 🚀
d71714c chore: bump runner version to 5.4.2 (#246)
c4fd08a Release v5.4.0 🚀
759ae97 feat: add disable-memory-capture-stack and disable-memory-track-physical inputs
fe42bc0 chore: bump runner version to 5.4.0 (#244)
c205870 feat: add a run-id output (#243)
48820ec chore: bump runner version to 5.3.1 (#240)
Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
c2acded chore: prepare v7.0.2 release
4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
8cbe1be Bump @actions/artifact to 6.3.1
See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

Update the readme by @danwkennedy in actions/download-artifact#473

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.

Update @actions/artifact to 6.3.1 by @tunc-d in actions/download-artifact#492

Prepare download-artifact v8.0.2 by @tunc-d in actions/download-artifact#493

New Contributors

@tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
e455989 Prepare download-artifact v8.0.2
a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
29bb7ce Update @actions/artifact to 6.3.1
484a0b5 Update the readme (#473)
See full diff in compare view

Updates zizmorcore/zizmor-action from 0.6.4 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

Sync zizmor versions by @github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

The typosquat-uses audit now supports pre-commit config inputs (#2437)

The self-hosted-runner audit is now significantly more precise (#2350)

Many thanks to @ubiratansoares for proposing and implementing this enhancement!

The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

zizmor is now aware of the image_version workflow trigger (#2397)

The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

The cache-poisoning audit is now aware of pnpm/setup (#2409)

The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

Many thanks to @ubiratansoares for proposing and implementing this enhancement!

The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

85b2b9f Sync zizmor versions (#178)
38c745a README: bump pins (#177)
f9597c8 Sync zizmor versions (#175)
2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
27d989b chore(deps): bump the github-actions group with 2 updates (#173)
a91218c Bootstrap zizmor without Docker (#169)
ee3f1bf chore(deps): bump the github-actions group with 2 updates (#170)
8eacaa5 README: bump pins (#167)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` | | [CodSpeedHQ/action](https://github.com/codspeedhq/action) | `5.2.1` | `5.5.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.4` | `0.7.1` | Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@c18668a...1c37ad0) Updates `CodSpeedHQ/action` from 5.2.1 to 5.5.0 - [Release notes](https://github.com/codspeedhq/action/releases) - [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md) - [Commits](CodSpeedHQ/action@373d686...821a40c) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@043fb46...cf430e0) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@3e5f45b...9000827) Updates `zizmorcore/zizmor-action` from 0.6.4 to 0.7.1 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@cc914d7...85b2b9f) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: CodSpeedHQ/action dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 22, 2026

d-v-b approved these changes Oct 22, 2026

View reviewed changes

d-v-b merged commit 957a5f6 into main Oct 22, 2026
61 of 62 checks passed

d-v-b deleted the dependabot/github_actions/actions-c5d3add6c3 branch October 22, 2026 09:14

Navigation Menu

Repository navigation

chore(deps): bump the actions group across 1 directory with 5 updates - #4552

chore(deps): bump the actions group across 1 directory with 5 updates#4552
d-v-b merged 1 commit into
mainfrom
dependabot/github_actions/actions-c5d3add6c3

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 22, 2026

v10.3.0 🌈 Add Python architecture selection

Changes

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

v5.5.0

🚀 Features

🐛 Bug Fixes

⚡ Performance

⚙️ Internals

What's Changed

New Contributors

v5.4.2

🚀 Features

v7.0.2

What's Changed

New Contributors

v8.0.2

What's Changed

New Contributors

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

action changes

What's Changed

v0.7.0

zizmor notes

Enhancements 🌱🔗

Bug Fixes 🐛🔗

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant