build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0
What the developer wrote
Authored by dependabot[bot]
build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9)
---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 9.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the workflow still uses it only to install and run the zizmor security scanner. There is no indication in the commit of any security bug, malicious change, or vulnerability being fixed or introduced.
No security action required. Treat as normal dependency maintenance. If desired, review the upstream astral-sh/setup-uv v9.0.0 release notes for any breaking changes that could affect the workflow, but the commit itself does not indicate a security issue.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit bumps astral-sh/setup-uv from commit SHA 11f9893b081a58869d3b5fccaea48c9e9e46f990 to c771a70e6277c0a99b617c7a806ffedaca235ff9 (tagged v5 -> v9.0.0) in .github/workflows/cron-zizmor.yml and .github/workflows/zizmor.yml. Both workflows already set persist-credentials: false on the checkout step and use the action solely to install uv and run zizmor. The diff is a two-line SHA change with no functional workflow logic changes.
Changed components
.github/workflows/cron-zizmor.yml.github/workflows/zizmor.ymlInspect captured patch +2 / −2
### .github/workflows/cron-zizmor.yml
@@ -19,7 +19,7 @@ jobs:
persist-credentials: false
- name: Install the latest version of uv
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v5
+ uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v5
- name: Run zizmor 🌈
run: uvx zizmor --format sarif . > results.sarif
### .github/workflows/zizmor.yml
@@ -19,7 +19,7 @@ jobs:
persist-credentials: false
- name: Install the latest version of uv
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v5
+ uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v5
- name: Run zizmor 🌈
run: uvx zizmor@1.22.0 .Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.