build(deps): bump the actions group across 1 directory with 3 updates by dependabot[bot] · Pull Request #4607 · dimensionalOS/dimos

dependabot · 2026-10-16T05:37:04Z

Bumps the actions group with 3 updates in the / directory: astral-sh/setup-uv, actions/cache and pypa/cibuildwheel.

Updates astral-sh/setup-uv from 10.0.1 to 10.3.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.0 🌈 Add Python architecture selection

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

Use macOS 15 runners for tests @charliermarsh (#1081)

🚀 Enhancements

Add python-arch support @zanieb (#1079)

🧰 Maintenance

chore: update known checksums for 0.13.0 @github-actions[bot] (#1089)

chore: update known checksums for 0.12.24 @github-actions[bot] (#1084)

chore: update known checksums for 0.12.23 @github-actions[bot] (#1082)

chore: update known checksums for 0.12.22 @github-actions[bot] (#1080)

chore: update known checksums for 0.12.21 @github-actions[bot] (#1078)

chore: update known checksums for 0.12.20 @github-actions[bot] (#1076)

chore: update known checksums for 0.12.19 @github-actions[bot] (#1068)

chore: update known checksums for 0.12.18 @github-actions[bot] (#1065)

⬆️ Dependency updates

chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 @dependabot[bot] (#1077)

v10.2.0 🌈 Disable automatic cache saves for merge queues

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

Disable automatic cache saves for merge queues @eifinger (#1056)

🧰 Maintenance

chore: update known checksums for 0.12.17 @github-actions[bot] (#1058)

chore: update known checksums for 0.12.16 @github-actions[bot] (#1057)

chore: update known checksums for 0.12.15 @github-actions[bot] (#1054)

chore: update known checksums for 0.12.14 @github-actions[bot] (#1053)

chore: update known checksums for 0.12.13 @github-actions[bot] (#1045)

📚 Documentation

docs: update version references to v10.1.0 @github-actions[bot] (#1044)

⬆️ Dependency updates

... (truncated)

Commits

1c37ad0 chore: update known checksums for 0.13.0 (#1089)
b3c9b5f chore: update known checksums for 0.12.24 (#1084)
b06acff Add python-arch support (#1079)
c84232c chore: update known checksums for 0.12.23 (#1082)
51fdd26 Use macOS 15 runners for tests (#1081)
a96208b chore: update known checksums for 0.12.22 (#1080)
0e3884b chore: update known checksums for 0.12.21 (#1078)
bcf0580 chore: update known checksums for 0.12.20 (#1076)
b92a892 chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#1077)
227a0f6 chore: update known checksums for 0.12.19 (#1068)
Additional commits viewable in compare view

Updates actions/cache from 4 to 6

Release notes

Sourced from actions/cache's releases.

v6.0.0

What's Changed

Update packages, migrate to ESM by @Samirat in actions/cache#1760

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Bump @actions/cache to v5.1.0 - handle read-only cache access by @jasongin in actions/cache#1775

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token

Switch redundant "Cache save failed" warning to debug log in save-only

6.0.0

Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2

Migrated to ESM module system

Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

... (truncated)

Commits

55cc834 Merge pull request #1768 from jasongin/readonly-cache
d8cd72f Bump @actions/cache to v6.1.0 - handle cache write error due to RO token
2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
e9b91fd Prettier fixes
e4884b8 Rebuild dist
10baf01 Fixed licenses
e39b386 Fix test mock return order
b692820 PR feedback
6074912 Rebuild dist bundles as ESM to match type:module
5a912e8 Fix lint and jest issues
Additional commits viewable in compare view

Updates pypa/cibuildwheel from 4.2.1 to 4.3.2

Release notes

Sourced from pypa/cibuildwheel's releases.

v4.3.2

🔐 Updates our dependency pins to certifi==2026.10.19, following the eMudhra Intermediate CA Compromise. Linux builds may still be vulnerable through manylinux images - a patch release will soon follow if so.

v4.3.1

🛠 Updates CPython 3.15 to the final 3.15.0 release (#3009)

v4.3.0

✨ Extends option inheritance to every configuration layer, so global and platform-specific settings can append or prepend to existing values, including cibuildwheel's defaults. Environment variables can also extend earlier settings using CIBW_INHERIT. (#2928)

✨ Adds PyPy 3.12 support and updates PyPy 3.11 to v8.0.0, available with the pypy enable flag (#2998)

✨ Adds GraalPy 3.13 (v25.3) support on Linux, Windows, and macOS arm64, available with the graalpy enable flag (#2982)

✨ Adds log-fold-mode to override CI log folding, including CIBW_LOG_FOLD_MODE=disabled to keep build steps expanded (#2972)

✨ Adds a python-path input to the GitHub Action to choose the Python interpreter used to run cibuildwheel, and falls back to system python3 on runner architectures unsupported by setup-python, such as native riscv64 (#2990)

🐛 Fixes Windows command execution when paths or arguments contain shell metacharacters, including dependency specifiers containing < or > (#2978)

🛠 Improves readability of logged commands whose arguments contain quotes (#2993)

🛠 Updates Pyodide to 0.27.8, 0.29.5, and 314.0.7, and updates its build tooling, including auditwheel-emscripten 0.3.0 (#2996)

🛠 Updates dependencies and container pins, including CPython 3.15.0rc3 (#2986, #3003)

📚 Corrects references to --archs in CLI help, error messages, and documentation (#2992)

Changelog

Sourced from pypa/cibuildwheel's changelog.

v4.3.2

20 October 2026

🔐 Updates our dependency pins to certifi==2026.10.19, following the eMudhra Intermediate CA Compromise. Linux builds may still be vulnerable through manylinux images - a patch release will soon follow if so.

v4.3.1

10 October 2026

🛠 Updates CPython 3.15 to the final 3.15.0 release (#3009)

v4.3.0

5 October 2026

✨ Extends option inheritance to every configuration layer, so global and platform-specific settings can append or prepend to existing values, including cibuildwheel's defaults. Environment variables can also extend earlier settings using CIBW_INHERIT. (#2928)

✨ Adds PyPy 3.12 support and updates PyPy 3.11 to v8.0.0, available with the pypy enable flag (#2998)

✨ Adds GraalPy 3.13 (v25.3) support on Linux, Windows, and macOS arm64, available with the graalpy enable flag (#2982)

✨ Adds log-fold-mode to override CI log folding, including CIBW_LOG_FOLD_MODE=disabled to keep build steps expanded (#2972)

✨ Adds a python-path input to the GitHub Action to choose the Python interpreter used to run cibuildwheel, and falls back to system python3 on runner architectures unsupported by setup-python, such as native riscv64 (#2990)

🐛 Fixes Windows command execution when paths or arguments contain shell metacharacters, including dependency specifiers containing < or > (#2978)

🛠 Improves readability of logged commands whose arguments contain quotes (#2993)

🛠 Updates Pyodide to 0.27.8, 0.29.5, and 314.0.7, and updates its build tooling, including auditwheel-emscripten 0.3.0 (#2996)

🛠 Updates dependencies and container pins, including CPython 3.15.0rc3 (#2986, #3003)

📚 Corrects references to --archs in CLI help, error messages, and documentation (#2992)

Commits

f111813 Bump version: v4.3.2
d5d8026 Bump certifi to 2026.10.19 (#3015)
b3395e2 Bump version: v4.3.1
5dbcbbb [Bot] Update dependencies (#3009)
2ea220c chore: update flake8-lazy to v0.10.1 (#3007)
e0d0953 [pre-commit.ci] pre-commit autoupdate (#3006)
1362429 [Bot] Update dependencies (#3005)
adba99c Bump version: v4.3.0
8a0d481 Add the ability to set 'inherit' at all levels of the options cascade (#2928)
8bc038b chore(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the actions gro...
Additional commits viewable in compare view

github-actions

go2 replay realtime (arm64)

Details

Benchmark suite	Current: `cd93188`	Previous: `2db1858`	Ratio
`peak memory`	`1735.605` MB	`1686.867` MB	`1.03`
`peak threads`	`372` threads	`370` threads	`1.01`
`network (transport)`	`2736.323` MB	`2725.723` MB	`1.00`
`disk write`	`1.711` MB	`1.504` MB	`1.14`
`instructions`	`137.569` G	`136.165` G	`1.01`

This comment was automatically generated by workflow using github-action-benchmark.

greptile-apps · 2026-10-16T05:47:29Z

Confidence Score: 5/5

[High impact] No merge-blocking issue was identified in the dependency updates.

Summary

Updates three GitHub Actions dependencies across six workflows:

Dimos workflows set up uv with the newer action.
CI jobs restore and save Rust build caches with actions/cache 6.
Wheel checks and releases build packages with cibuildwheel 4.3.0.

No actionable issues were found. Workflow inputs, permissions, and build targets remain unchanged.

Paired execution checks passed for the old and new setup-uv and cache action bundles using workflow-derived inputs on Linux x64 with simulated runner and cache services. All six workflows passed workflow validation with the existing custom runner labels declared. Both cibuildwheel versions selected identical wheel targets for the smoke job and all three release configurations, and configuration resolution succeeded for every selected target. Container-image digests changed, while the selected image families remained unchanged.

Full GitHub workflows, successful cache transfers, Docker wheel builds, and native macOS/ARM64 execution were not run. No merge-blocking issue was identified within the checked scope.

_{Reviews (1) · Last reviewed commit: "chore(deps): bump the actions group acro..." · Reviewed by Greptile}

codecov · 2026-10-16T05:48:12Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

@@           Coverage Diff           @@
##             main    #4607   +/-   ##
=======================================
  Coverage        ?   82.73%           
=======================================
  Files           ?     1711           
  Lines           ?   161263           
  Branches        ?    13424           
=======================================
  Hits            ?   133415           
  Misses          ?    24359           
  Partials        ?     3489

Components	Coverage Δ
Tests	`96.73% <ø> (?)`

Flag	Coverage Δ
OS-macos-latest	`76.58% <ø> (?)`
OS-ubuntu-24.04-arm	`76.42% <ø> (?)`
OS-ubuntu-latest	`76.77% <ø> (?)`
Py-3.10	`76.77% <ø> (?)`
Py-3.12	`76.75% <ø> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Bumps the actions group with 3 updates in the / directory: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [actions/cache](https://github.com/actions/cache) and [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel). Updates `astral-sh/setup-uv` from 10.0.1 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v10.0.1...v10.3.0) Updates `actions/cache` from 4 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v6) Updates `pypa/cibuildwheel` from 4.2.1 to 4.3.2 - [Release notes](https://github.com/pypa/cibuildwheel/releases) - [Changelog](https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md) - [Commits](pypa/cibuildwheel@v4.2.1...v4.3.2) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: pypa/cibuildwheel dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-28T05:37:48Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot requested review from Dreamsorcerer and leshy as code owners October 16, 2026 05:37

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 16, 2026

dependabot Bot requested review from mustafab0, paul-nechifor and spomichter as code owners October 16, 2026 05:37

dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Oct 16, 2026

github-actions Bot added backport:skip Skip creating a backport to any release branches first-time-contributor PR opened by an author who had not previously committed to this repository labels Oct 16, 2026

dependabot Bot temporarily deployed to cachix October 16, 2026 05:37 Inactive

github-actions Bot reviewed Oct 16, 2026

View reviewed changes

dependabot Bot changed the title ~~chore(deps): bump the actions group across 1 directory with 3 updates~~ build(deps): bump the actions group across 1 directory with 3 updates Oct 19, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions-61b5708d97 branch from 76a44ee to cfaad6e Compare October 19, 2026 05:38

dependabot Bot requested review from TomCC7 and aclauer as code owners October 19, 2026 05:38

dependabot Bot temporarily deployed to cachix October 19, 2026 05:38 Inactive

github-actions Bot added the ready-to-merge Required CI checks have passed on this PR label Oct 19, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions-61b5708d97 branch from cfaad6e to 00fa76a Compare October 20, 2026 05:37

github-actions Bot removed the ready-to-merge Required CI checks have passed on this PR label Oct 20, 2026

dependabot Bot temporarily deployed to cachix October 20, 2026 05:37 Inactive

github-actions Bot added the ready-to-merge Required CI checks have passed on this PR label Oct 20, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions-61b5708d97 branch from 00fa76a to a30ca70 Compare October 21, 2026 05:37

github-actions Bot removed the ready-to-merge Required CI checks have passed on this PR label Oct 21, 2026

dependabot Bot temporarily deployed to cachix October 21, 2026 05:37 Inactive

dependabot Bot force-pushed the dependabot/github_actions/actions-61b5708d97 branch from a30ca70 to e6fb958 Compare October 22, 2026 05:37

dependabot Bot temporarily deployed to cachix October 22, 2026 05:38 Inactive

dependabot Bot force-pushed the dependabot/github_actions/actions-61b5708d97 branch from e6fb958 to 63ea1f0 Compare October 23, 2026 05:37

dependabot Bot temporarily deployed to cachix October 23, 2026 05:37 Inactive

dependabot Bot force-pushed the dependabot/github_actions/actions-61b5708d97 branch 2 times, most recently from 42796d4 to 82f73b1 Compare October 26, 2026 05:59

dependabot Bot force-pushed the dependabot/github_actions/actions-61b5708d97 branch from 82f73b1 to cd93188 Compare October 27, 2026 05:37

dependabot Bot temporarily deployed to cachix October 27, 2026 05:37 Inactive

dependabot Bot closed this Oct 28, 2026

dependabot Bot deleted the dependabot/github_actions/actions-61b5708d97 branch October 28, 2026 05:37

Navigation Menu

Repository navigation

build(deps): bump the actions group across 1 directory with 3 updates - #4607

build(deps): bump the actions group across 1 directory with 3 updates#4607
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-61b5708d97

dependabot Bot commented on behalf of github Oct 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment •

edited

Loading

Uh oh!

greptile-apps Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v10.3.0 🌈 Add Python architecture selection

Changes

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

v10.2.0 🌈 Disable automatic cache saves for merge queues

Changes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v6.0.0

What's Changed

v5.1.0

What's Changed

v5.0.5

What's Changed

v5.0.4

What's Changed

New Contributors

v5.0.3

What's Changed

v.5.0.2

v5.0.2

What's Changed

Releases

How to prepare a release

Changelog

6.1.0

6.0.0

5.0.4

5.0.3

5.0.2

v4.3.2

v4.3.1

v4.3.0

v4.3.2

v4.3.1

v4.3.0

Uh oh!

github-actions Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

go2 replay realtime (arm64)

Uh oh!

greptile-apps Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

codecov Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 16, 2026 •

edited

Loading

github-actions Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 16, 2026 •

edited

Loading

codecov Bot commented Oct 16, 2026 •

edited

Loading