chore(deps): Update github-actions (#237)

cloudquery-ci[bot] · web-flow · commit fe23a353926a · 2026-05-01T01:20:17.000Z
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/create-github-app-token](https://redirect.github.com/actions/create-github-app-token) ([changelog](https://redirect.github.com/actions/create-github-app-token/compare/f8d387b68d61c58ab83c6c016672934102569859..1b10c78c7865c340bc4f6099eb2f838309f1e8c3)) | action | digest | `f8d387b` → `1b10c78` | | | [astral-sh/uv](https://redirect.github.com/astral-sh/uv) | uses-with | patch | `0.11.2` → `0.11.7` | `0.11.8` | | [googleapis/release-please-action](https://redirect.github.com/googleapis/release-please-action) ([changelog](https://redirect.github.com/googleapis/release-please-action/compare/16a9c90856f42705d54a6fda1823352bdc62cf38..5c625bfb5d1ff62eadeeb3772007f7f66fdcf071)) | action | digest | `16a9c90` → `5c625bf` | | | [peter-evans/create-pull-request](https://redirect.github.com/peter-evans/create-pull-request) ([changelog](https://redirect.github.com/peter-evans/create-pull-request/compare/c0f553fe549906ede9cf27b5156039d195d2ece0..5f6978faf089d4d20b00c7766989d076bb2fc7f1)) | action | digest | `c0f553f` → `5f6978f` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | digest | `ed0c539` → `cef2210` | | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/218) for more information. --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.11.7`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0117) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.11.6...0.11.7) Released on 2026-04-15. ##### Python - Upgrade CPython build to [`2026041`](https://redirect.github.com/astral-sh/uv/commit/20260414) including an OpenSSL security upgrade ([#&#8203;19004](https://redirect.github.com/astral-sh/uv/pull/19004)) ##### Enhancements - Elevate configuration errors to `required-version` mismatches ([#&#8203;18977](https://redirect.github.com/astral-sh/uv/pull/18977)) - Further improve TLS certificate validation messages ([#&#8203;18933](https://redirect.github.com/astral-sh/uv/pull/18933)) - Improve `--exclude-newer` hints ([#&#8203;18952](https://redirect.github.com/astral-sh/uv/pull/18952)) ##### Preview features - Fix `--script` handling in `uv audit` ([#&#8203;18970](https://redirect.github.com/astral-sh/uv/pull/18970)) - Fix traversal of extras in `uv audit` ([#&#8203;18970](https://redirect.github.com/astral-sh/uv/pull/18970)) ##### Bug fixes - De-quote `workspace metadata` in linehaul data ([#&#8203;18966](https://redirect.github.com/astral-sh/uv/pull/18966)) - Avoid installing tool workspace member dependencies as editable ([#&#8203;18891](https://redirect.github.com/astral-sh/uv/pull/18891)) - Emit JSON report for `uv sync --check` failures ([#&#8203;18976](https://redirect.github.com/astral-sh/uv/pull/18976)) - Filter and warn on invalid TLS certificates ([#&#8203;18951](https://redirect.github.com/astral-sh/uv/pull/18951)) - Fix equality comparisons for version specifiers with `~=` operators ([#&#8203;18960](https://redirect.github.com/astral-sh/uv/pull/18960)) - Fix stale Python upgrade preview feature check in project environment construction ([#&#8203;18961](https://redirect.github.com/astral-sh/uv/pull/18961)) - Improve Windows path normalization ([#&#8203;18945](https://redirect.github.com/astral-sh/uv/pull/18945)) ### [`v0.11.6`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0116) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.11.5...0.11.6) Released on 2026-04-09. This release resolves a low severity security advisory in which wheels with malformed RECORD entries could delete arbitrary files on uninstall. See [GHSA-pjjw-68hj-v9mw](https://redirect.github.com/astral-sh/uv/security/advisories/GHSA-pjjw-68hj-v9mw) for details. ##### Bug fixes - Do not remove files outside the venv on uninstall ([#&#8203;18942](https://redirect.github.com/astral-sh/uv/pull/18942)) - Validate and heal wheel `RECORD` during installation ([#&#8203;18943](https://redirect.github.com/astral-sh/uv/pull/18943)) - Avoid `uv cache clean` errors due to Win32 path normalization ([#&#8203;18856](https://redirect.github.com/astral-sh/uv/pull/18856)) ### [`v0.11.5`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0115) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.11.4...0.11.5) Released on 2026-04-08. ##### Python - Add CPython 3.13.13, 3.14.4, and 3.15.0a8 ([#&#8203;18908](https://redirect.github.com/astral-sh/uv/pull/18908)) ##### Enhancements - Fix `build_system.requires` error message ([#&#8203;18911](https://redirect.github.com/astral-sh/uv/pull/18911)) - Remove trailing path separators in path normalization ([#&#8203;18915](https://redirect.github.com/astral-sh/uv/pull/18915)) - Improve error messages for unsupported or invalid TLS certificates ([#&#8203;18924](https://redirect.github.com/astral-sh/uv/pull/18924)) ##### Preview features - Add `exclude-newer` to `[[tool.uv.index]]` ([#&#8203;18839](https://redirect.github.com/astral-sh/uv/pull/18839)) - `uv audit`: add context/warnings for ignored vulnerabilities ([#&#8203;18905](https://redirect.github.com/astral-sh/uv/pull/18905)) ##### Bug fixes - Normalize persisted fork markers before lock equality checks ([#&#8203;18612](https://redirect.github.com/astral-sh/uv/pull/18612)) - Clear junction properly when uninstalling Python versions on Windows ([#&#8203;18815](https://redirect.github.com/astral-sh/uv/pull/18815)) - Report error cleanly instead of panicking on TLS certificate error ([#&#8203;18904](https://redirect.github.com/astral-sh/uv/pull/18904)) ##### Documentation - Remove the legacy `PIP_COMPATIBILITY.md` redirect file ([#&#8203;18928](https://redirect.github.com/astral-sh/uv/pull/18928)) - Fix `uv init example-bare --bare` examples ([#&#8203;18822](https://redirect.github.com/astral-sh/uv/pull/18822), [#&#8203;18925](https://redirect.github.com/astral-sh/uv/pull/18925)) ### [`v0.11.4`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0114) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.11.3...0.11.4) Released on 2026-04-07. ##### Enhancements - Add support for `--upgrade-group` ([#&#8203;18266](https://redirect.github.com/astral-sh/uv/pull/18266)) - Merge repeated archive URL hashes by version ID ([#&#8203;18841](https://redirect.github.com/astral-sh/uv/pull/18841)) - Require all direct URL hash algorithms to match ([#&#8203;18842](https://redirect.github.com/astral-sh/uv/pull/18842)) ##### Bug fixes - Avoid panics in environment finding via cycle detection ([#&#8203;18828](https://redirect.github.com/astral-sh/uv/pull/18828)) - Enforce direct URL hashes for `pyproject.toml` dependencies ([#&#8203;18786](https://redirect.github.com/astral-sh/uv/pull/18786)) - Error on `--locked` and `--frozen` when script lockfile is missing ([#&#8203;18832](https://redirect.github.com/astral-sh/uv/pull/18832)) - Fix `uv export` extra resolution for workspace member and conflicting extras ([#&#8203;18888](https://redirect.github.com/astral-sh/uv/pull/18888)) - Include conflicts defined in virtual workspace root ([#&#8203;18886](https://redirect.github.com/astral-sh/uv/pull/18886)) - Recompute relative `exclude-newer` values during `uv tree --outdated` ([#&#8203;18899](https://redirect.github.com/astral-sh/uv/pull/18899)) - Respect `--exclude-newer` in `uv tool list --outdated` ([#&#8203;18861](https://redirect.github.com/astral-sh/uv/pull/18861)) - Sort by comparator to break specifier ties ([#&#8203;18850](https://redirect.github.com/astral-sh/uv/pull/18850)) - Store relative timestamps in tool receipts ([#&#8203;18901](https://redirect.github.com/astral-sh/uv/pull/18901)) - Track newly-activated extras when determining conflicts ([#&#8203;18852](https://redirect.github.com/astral-sh/uv/pull/18852)) - Patch `Cargo.lock` in `uv-build` source distributions ([#&#8203;18831](https://redirect.github.com/astral-sh/uv/pull/18831)) ##### Documentation - Clarify that `--exclude-newer` compares artifact upload times ([#&#8203;18830](https://redirect.github.com/astral-sh/uv/pull/18830)) ### [`v0.11.3`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0113) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.11.2...0.11.3) Released on 2026-04-01. ##### Enhancements - Add progress bar for hashing phase in uv publish ([#&#8203;18752](https://redirect.github.com/astral-sh/uv/pull/18752)) - Add support for ROCm 7.2 ([#&#8203;18730](https://redirect.github.com/astral-sh/uv/pull/18730)) - Emit abi3t tags for every abi3 version ([#&#8203;18777](https://redirect.github.com/astral-sh/uv/pull/18777)) - Expand `uv workspace metadata` with dependency information from the lock ([#&#8203;18356](https://redirect.github.com/astral-sh/uv/pull/18356)) - Implement support for PEP 803 ([#&#8203;18767](https://redirect.github.com/astral-sh/uv/pull/18767)) - Pretty-print platform in built wheel errors ([#&#8203;18738](https://redirect.github.com/astral-sh/uv/pull/18738)) - Publish installers to `/installers/uv/latest` on the mirror ([#&#8203;18725](https://redirect.github.com/astral-sh/uv/pull/18725)) - Show free-threaded Python in built-wheel errors ([#&#8203;18740](https://redirect.github.com/astral-sh/uv/pull/18740)) ##### Preview features - Add `--ignore` and `--ignore-until-fixed` to `uv audit` ([#&#8203;18737](https://redirect.github.com/astral-sh/uv/pull/18737)) ##### Bug fixes - Bump simple API cache ([#&#8203;18797](https://redirect.github.com/astral-sh/uv/pull/18797)) - Don't drop `blake2b` hashes ([#&#8203;18794](https://redirect.github.com/astral-sh/uv/pull/18794)) - Handle broken range request implementations ([#&#8203;18780](https://redirect.github.com/astral-sh/uv/pull/18780)) - Remove `powerpc64-unknown-linux-gnu` from release build targets ([#&#8203;18800](https://redirect.github.com/astral-sh/uv/pull/18800)) - Respect dependency metadata overrides in `uv pip check` ([#&#8203;18742](https://redirect.github.com/astral-sh/uv/pull/18742)) - Support debug CPython ABI tags in environment compatibility ([#&#8203;18739](https://redirect.github.com/astral-sh/uv/pull/18739)) ##### Documentation - Document `false` opt-out for `exclude-newer-package` ([#&#8203;18768](https://redirect.github.com/astral-sh/uv/pull/18768), [#&#8203;18803](https://redirect.github.com/astral-sh/uv/pull/18803)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate).
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -17,7 +17,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
         with:
-          version: "0.11.2"
+          version: "0.11.7"
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -20,12 +20,12 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
         with:
-          version: "0.11.2"
+          version: "0.11.7"
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.14"
       - name: Build package
         run: uv build
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
diff --git a/.github/workflows/regen.yml b/.github/workflows/regen.yml
@@ -11,7 +11,7 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
         with:
           app-id: ${{ secrets.CQ_APP_ID }}
           private-key: ${{ secrets.CQ_APP_PRIVATE_KEY }}
@@ -22,7 +22,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
         with:
-          version: "0.11.2"
+          version: "0.11.7"
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
@@ -34,7 +34,7 @@ jobs:
           make clone-proto
           make gen-proto
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           # required so the PR triggers workflow runs
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/release_pr.yml b/.github/workflows/release_pr.yml
@@ -13,13 +13,13 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
         with:
           app-id: ${{ secrets.CQ_APP_ID }}
           private-key: ${{ secrets.CQ_APP_PRIVATE_KEY }}
           permission-contents: write
           permission-pull-requests: write
-      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         id: release
         with:
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/unittest.yml b/.github/workflows/unittest.yml
@@ -19,7 +19,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
         with:
-          version: "0.11.2"
+          version: "0.11.7"
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
