chore(deps): bump the actions group across 1 directory with 3 updates

[dependabot]

Bumps the actions group with 3 updates in the / directory: astral-sh/setup-uv, pypa/hatch and CodSpeedHQ/action.

Updates astral-sh/setup-uv from 9.0.0 to 10.0.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

• Disable automatic caching for sensitive events @​eifinger (#992)

🐛 Bug fixes

• Reject paths in .tool-versions @​eifinger (#1007)

🚀 Enhancements

• Read Python version from .tool-versions @​eifinger (#996)
• Add latest-known version selector @​eifinger (#993)

... (truncated)

Commits

• ae62891 chore(deps): roll up Dependabot updates (#1013)
• f9cdb47 Reject paths in .tool-versions (#1007)
• 4f6036f Require pull requests for Dependabot rollups (#1005)
• 8d6402c chore(deps): roll up Dependabot updates (#1004)
• 46f427b Read Python version from .tool-versions (#996)
• 8ed89c5 ci: pin Alpine container image (#995)
• 8473c7f chore(deps): roll up Dependabot updates (#994)
• 18d451d Add latest-known version selector (#993)
• f451684 Disable automatic caching for sensitive events (#992)
• b68407c chore: update known checksums for 0.12.3 (#991)
• Additional commits viewable in compare view

Updates pypa/hatch from 257e27e51a6a5616ed08a39a408a21c35c9931bc to f647ed70d49adb885f53a27d1c7f5bdaeacf2c60

Commits

• f647ed7 add --fail flag to curl to show HTTP errors (#2144)
• See full diff in compare view

Updates CodSpeedHQ/action from 5.0.2 to 5.0.3

Release notes

Sourced from CodSpeedHQ/action's releases.

v5.0.3

Bumps the CodSpeed runner to v5.0.2.

🐛 Bug Fixes

• Retry complete pinned binary downloads by @​art049 in #499
• Accept --exclude-allocations and --cycle-estimation without a value by @​not-matthias

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

• chore: bump runner version to 5.0.2 by @​github-actions[bot] in CodSpeedHQ/action#230

Full Changelog: CodSpeedHQ/action@v5.0.2...v5.0.3

Commits

• 4296e51 Release v5.0.3 🚀
• 271ae6a chore: bump runner version to 5.0.2 (#230)
• See full diff in compare view