build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0
What the developer wrote
Authored by dependabot[bot]
build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/08807647e7069bb48b6ef5acd8ec9567f424441b...fac544c07dec837d0ccb6301d7b5580bf5edae39)
---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new commit hash corresponds to the legitimate 8.2.0 release of astral-sh/setup-uv. There is no indication of malicious code or a security vulnerability in this change.
No security action required. Optionally, update the '# v5' comment to '# v8.2.0' to keep the version annotation accurate, and verify the new SHA against the upstream astral-sh/setup-uv release if not already done by Dependabot.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit bumps the pinned SHA of astral-sh/setup-uv from 08807647e7069bb48b6ef5acd8ec9567f424441b (v8.1.0) to fac544c07dec837d0ccb6301d7b5580bf5edae39 (v8.2.0) in .github/workflows/cron-zizmor.yml and .github/workflows/zizmor.yml. Both files still reference the action via a major-version comment ‘# v5’, which is now stale/incorrect because the pinned SHAs are for v8.x. The change only affects the CI environment used to run the zizmor static analyzer; it does not modify the rust-bitcoin library code, its dependencies, or its release artifacts.
Changed components
.github/workflows/cron-zizmor.yml.github/workflows/zizmor.ymlInspect captured patch +2 / −2
diff --git a/.github/workflows/cron-zizmor.yml b/.github/workflows/cron-zizmor.yml
index c0a0072a..7c8ae0d1 100644
--- a/.github/workflows/cron-zizmor.yml
+++ b/.github/workflows/cron-zizmor.yml
@@ -19,7 +19,7 @@ jobs:
persist-credentials: false
- name: Install the latest version of uv
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v5
+ uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v5
- name: Run zizmor 🌈
run: uvx zizmor --format sarif . > results.sarif
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 2555217f..739f5ae8 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -19,7 +19,7 @@ jobs:
persist-credentials: false
- name: Install the latest version of uv
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v5
+ uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v5
- name: Run zizmor 🌈
run: uvx zizmor@1.22.0 .
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.