build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2
What the developer wrote
Authored by dependabot[bot]
build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/fac544c07dec837d0ccb6301d7b5580bf5edae39...11f9893b081a58869d3b5fccaea48c9e9e46f990)
---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.3.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The action is referenced by a fixed commit hash (a 'pin'), which is a security best practice. There is no indication in the commit that this fixes a security problem; it is a normal dependency bump.
No security action required. Treat as routine maintenance. If desired, review the upstream setup-uv release notes for any security fixes, but the commit itself does not claim any.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit bumps astral-sh/setup-uv from commit fac544c07dec837d0ccb6301d7b5580bf5edae39 to 11f9893b081a58869d3b5fccaea48c9e9e46f990 in .github/workflows/cron-zizmor.yml and .github/workflows/zizmor.yml. Both workflows run the zizmor static analyzer. The action remains pinned to a specific SHA and the major version comment stays at # v5. No functional code, secrets handling, or workflow logic changes are present.
Changed components
.github/workflows/cron-zizmor.yml.github/workflows/zizmor.ymlInspect captured patch +2 / −2
### .github/workflows/cron-zizmor.yml
@@ -19,7 +19,7 @@ jobs:
persist-credentials: false
- name: Install the latest version of uv
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v5
+ uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v5
- name: Run zizmor 🌈
run: uvx zizmor --format sarif . > results.sarif
### .github/workflows/zizmor.yml
@@ -19,7 +19,7 @@ jobs:
persist-credentials: false
- name: Install the latest version of uv
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v5
+ uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v5
- name: Run zizmor 🌈
run: uvx zizmor@1.22.0 .Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.