chore(deps): bump the all group across 1 directory with 8 updates by dependabot[bot] · Pull Request #3097 · crytic/slither

dependabot · 2026-09-09T22:55:27Z

Bumps the all group with 8 updates in the / directory:

Package	From	To
astral-sh/setup-uv	`9.0.0`	`10.0.1`
cachix/install-nix-action	`31.11.0`	`31.11.1`
cachix/cachix-action	`5f2d7c5294214f71b873db4b969586b980625e71`	`38b082610b782e7e93e209c35fd730d399dee866`
docker/setup-qemu-action	`4.2.0`	`4.3.0`
docker/setup-buildx-action	`4.2.0`	`4.3.0`
actions/deploy-pages	`5.0.0`	`5.0.1`
DavidAnson/markdownlint-cli2-action	`24.1.0`	`24.2.0`
softprops/action-gh-release	`3.0.2`	`3.0.3`

Updates astral-sh/setup-uv from 9.0.0 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @arguile- for making this action more resilient.

🐛 Bug fixes

Tolerate transient manifest timeouts @arguile- (#1016)

🧰 Maintenance

chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

docs: update version references to v10.0.0 @github-actions[bot] (#1014)

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

pull_request_target

workflow_run

release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known
- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"
This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions
- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

20cfd1b chore: update known checksums for 0.12.4 (#1017)
d73a0ca Tolerate transient manifest timeouts (#1016)
ae3b92d docs: update version references to v10.0.0 (#1014)
ae62891 chore(deps): roll up Dependabot updates (#1013)
f9cdb47 Reject paths in .tool-versions (#1007)
4f6036f Require pull requests for Dependabot rollups (#1005)
8d6402c chore(deps): roll up Dependabot updates (#1004)
46f427b Read Python version from .tool-versions (#996)
8ed89c5 ci: pin Alpine container image (#995)
8473c7f chore(deps): roll up Dependabot updates (#994)
Additional commits viewable in compare view

Updates cachix/install-nix-action from 31.11.0 to 31.11.1

Release notes

Sourced from cachix/install-nix-action's releases.

v31.11.1

What's Changed

nix: 2.35.1 -> 2.35.2 by @github-actions[bot] in cachix/install-nix-action#281 Fixes a crash (Assertion '!awake.empty()' failed) that could abort builds.

Full Changelog: cachix/install-nix-action@v31.11.0...v31.11.1

Commits

13d8dd5 fix(ci): skip latest installer on x86_64-darwin
875018f Merge pull request #281 from cachix/create-pull-request/patch
6624a11 nix: 2.35.1 -> 2.35.2
See full diff in compare view

Updates cachix/cachix-action from 5f2d7c5294214f71b873db4b969586b980625e71 to 38b082610b782e7e93e209c35fd730d399dee866

Changelog

Sourced from cachix/cachix-action's changelog.

Release
Create and push a new tag:
git tag v17
git push origin v17
Wait for CI to pass.

Create a release for the new tag.
Move the major version tag to the latest release:
git tag -fa v17
git push origin v17 --force

Commits

38b0826 dev: cleanup tests and dev files
0fe030c dist
792dafc deps: bump dependencies
b690244 ci: improve Nix compatibility test coverage
f495f3f Merge pull request #217 from cachix/dependabot/github_actions/actions/checkout-7
9ee3c77 chore(deps): bump actions/checkout from 6 to 7
See full diff in compare view

Updates docker/setup-qemu-action from 4.2.0 to 4.3.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.3.0

Bump @docker/actions-toolkit from 0.92.0 to 0.96.0 in docker/setup-qemu-action#336

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-qemu-action#316

Bump brace-expansion from 1.1.15 to 1.1.18 in docker/setup-qemu-action#332

Bump js-yaml from 4.2.0 to 4.3.1 in docker/setup-qemu-action#334

Bump postcss from 8.5.10 to 8.5.25 in docker/setup-qemu-action#331

Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-qemu-action#317

Bump undici from 6.27.0 to 6.28.0 in docker/setup-qemu-action#333

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

Commits

1f40c72 Merge pull request #336 from docker/dependabot/npm_and_yarn/docker/actions-to...
932216e [dependabot skip] chore: update generated content
a39e895 build(deps): bump @docker/actions-toolkit from 0.92.0 to 0.96.0
a98ae9f Merge pull request #333 from docker/dependabot/npm_and_yarn/undici-6.28.0
8ebc9d1 [dependabot skip] chore: update generated content
c41e3fc build(deps): bump undici from 6.27.0 to 6.28.0
5fc60df Merge pull request #332 from docker/dependabot/npm_and_yarn/brace-expansion-1...
a26e892 Merge pull request #328 from docker/dependabot/github_actions/actions/checkou...
aa6d042 Merge pull request #324 from docker/dependabot/github_actions/actions/setup-n...
d381ce5 Merge pull request #317 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 4.2.0 to 4.3.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.3.0

Bump @docker/actions-toolkit from 0.92.0 to 0.95.0 in docker/setup-buildx-action#595

Bump brace-expansion from 1.1.13 to 1.1.18 in docker/setup-buildx-action#600

Bump js-yaml from 5.2.0 to 5.3.0 in docker/setup-buildx-action#585

Bump postcss from 8.5.10 to 8.5.25 in docker/setup-buildx-action#598

Bump undici from 6.27.0 to 6.28.0 in docker/setup-buildx-action#601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

Commits

37fe631 Merge pull request #595 from docker/dependabot/npm_and_yarn/docker/actions-to...
b5c4f91 [dependabot skip] chore: update generated content
3e93b63 build(deps): bump @docker/actions-toolkit from 0.92.0 to 0.95.0
e527031 Merge pull request #600 from docker/dependabot/npm_and_yarn/brace-expansion-1...
c68814b [dependabot skip] chore: update generated content
3f891b0 build(deps): bump brace-expansion from 1.1.13 to 1.1.18
787db26 Merge pull request #585 from docker/dependabot/npm_and_yarn/js-yaml-5.2.1
f779368 [dependabot skip] chore: update generated content
7d5e604 build(deps): bump js-yaml from 5.2.0 to 5.3.0
292c2fb Merge pull request #590 from docker/dependabot/github_actions/actions/setup-n...
Additional commits viewable in compare view

Updates actions/deploy-pages from 5.0.0 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

Add backoff and jitter to deployment polling @yoannchaudet (#444)

Improve deployment request test coverage @adwitiyagoyal (#440)

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits

368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
7e97763 Validate deployment polling intervals
0143e11 Add backoff and jitter to deployment polling
5e98f10 Merge pull request #440 from actions/user/adwitiya
8b0625a Improve deployment request test coverage
See full diff in compare view

Updates DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0

Commits

21c1be1 Update to version 24.2.0.
cb5282d Freshen generated package-lock.json file, freshen generated index.js file.
d36517c Add eslint-package-json/all to lint script, address new issues.
57b7f61 Refactor eslint.config.mjs to use defineConfig, change eslint-plugin-n from "...
fe75d07 Address new lint error from previous commit, freshen generated index.js file.
cea0e19 Bump eslint-plugin-unicorn from 71.1.0 to 72.0.0
5137af3 Freshen generated index.js file.
ab8971b Bump markdownlint-cli2 from 0.23.1 to 0.23.2
92a0fc4 Bump actions/setup-node from 6 to 7
03ca1e4 Bump eslint from 10.6.0 to 10.7.0
Additional commits viewable in compare view

Updates softprops/action-gh-release from 3.0.2 to 3.0.3

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

fix: safely classify GitHub API errors by @chenrui333 in softprops/action-gh-release#822

Other Changes 🔄

dependency updates

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

fix: safely classify GitHub API errors by @chenrui333 in softprops/action-gh-release#822

Other Changes 🔄

dependency updates

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

feat: improve release error reporting and test coverage by @chenrui333 in softprops/action-gh-release#813

Bug fixes 🐛

fix: publish existing draft releases as prereleases by @godfengliang in softprops/action-gh-release#801

fix: upload small checksum assets reliably by @chenrui333 in softprops/action-gh-release#815

fix: replace existing release assets on Gitea by @chenrui333 in softprops/action-gh-release#816

fix: clarify release creation 404 errors by @chenrui333 in softprops/action-gh-release#817

Other Changes 🔄

chore(deps): upgrade TypeScript to 7 by @chenrui333 in softprops/action-gh-release#812

chore(deps): remove unused TypeScript tooling by @chenrui333 in softprops/action-gh-release#814

dependency, Node 24 pin, and CI maintenance merged since 3.0.1

3.0.1

maintenance release with updated dependencies

... (truncated)

Commits

efb3536 release 3.0.3 (#840)
6441963 chore(deps): bump the npm group with 2 updates (#839)
e5ee6bc chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (#837)
d1e6617 chore(deps): bump undici from 6.27.0 to 6.28.0 (#831)
6403751 chore(deps): bump the npm group with 2 updates (#835)
7c7184b chore(deps): bump postcss from 8.5.19 to 8.5.25 (#833)
0f3f0d2 chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#832)
77fb938 chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (#830)
5a6f517 chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#828)
a3c91c9 chore(deps): bump the github-actions group with 2 updates (#825)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the all group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `9.0.0` | `10.0.1` | | [cachix/install-nix-action](https://github.com/cachix/install-nix-action) | `31.11.0` | `31.11.1` | | [cachix/cachix-action](https://github.com/cachix/cachix-action) | `5f2d7c5294214f71b873db4b969586b980625e71` | `38b082610b782e7e93e209c35fd730d399dee866` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.2.0` | `4.3.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.3.0` | | [actions/deploy-pages](https://github.com/actions/deploy-pages) | `5.0.0` | `5.0.1` | | [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) | `24.1.0` | `24.2.0` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.2` | `3.0.3` | Updates `astral-sh/setup-uv` from 9.0.0 to 10.0.1 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@c771a70...20cfd1b) Updates `cachix/install-nix-action` from 31.11.0 to 31.11.1 - [Release notes](https://github.com/cachix/install-nix-action/releases) - [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md) - [Commits](cachix/install-nix-action@630ae54...13d8dd5) Updates `cachix/cachix-action` from 5f2d7c5294214f71b873db4b969586b980625e71 to 38b082610b782e7e93e209c35fd730d399dee866 - [Release notes](https://github.com/cachix/cachix-action/releases) - [Changelog](https://github.com/cachix/cachix-action/blob/master/RELEASE.md) - [Commits](cachix/cachix-action@5f2d7c5...38b0826) Updates `docker/setup-qemu-action` from 4.2.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@96fe6ef...1f40c72) Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@bb05f3f...37fe631) Updates `actions/deploy-pages` from 5.0.0 to 5.0.1 - [Release notes](https://github.com/actions/deploy-pages/releases) - [Commits](actions/deploy-pages@cd2ce8f...368f825) Updates `DavidAnson/markdownlint-cli2-action` from 24.1.0 to 24.2.0 - [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases) - [Commits](DavidAnson/markdownlint-cli2-action@6bf21b0...21c1be1) Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@3d0d988...efb3536) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all - dependency-name: cachix/install-nix-action dependency-version: 31.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: cachix/cachix-action dependency-version: 38b082610b782e7e93e209c35fd730d399dee866 dependency-type: direct:production dependency-group: all - dependency-name: docker/setup-qemu-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: docker/setup-buildx-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: actions/deploy-pages dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: DavidAnson/markdownlint-cli2-action dependency-version: 24.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: softprops/action-gh-release dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 9, 2026

dependabot Bot requested a review from elopez as a code owner September 9, 2026 22:55

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 9, 2026

Navigation Menu

chore(deps): bump the all group across 1 directory with 8 updates - #3097

chore(deps): bump the all group across 1 directory with 8 updates#3097
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/master/all-f498f57276

dependabot Bot commented on behalf of github Sep 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Extra security by default

version: latest-known

Read python version from .tool-versions

v31.11.1

What's Changed

Release

v4.3.0

v4.3.0

v5.0.1

Changelog

v3.0.3

What's Changed

Bug fixes 🐛

Other Changes 🔄

3.0.3

What's Changed

Bug fixes 🐛

Other Changes 🔄

3.0.2

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

3.0.1

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 9, 2026 •

edited

Loading

`version: latest-known`

Read python version from `.tool-versions`