build(deps): bump astral-sh/setup-uv from 7.1.2 to 8.1.0
What the developer wrote
Authored by dependabot[bot]
build(deps): bump astral-sh/setup-uv from 7.1.2 to 8.1.0
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 7.1.2 to 8.1.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41...08807647e7069bb48b6ef5acd8ec9567f424441b)
---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: 8.1.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new version is a major release of the setup-uv action, but the commit itself only updates the pinned commit hash and keeps the same major-version comment. There is no indication in the commit that this fixes a security vulnerability or introduces malicious behavior.
No immediate action is required. If you want to be cautious, review the astral-sh/setup-uv v8.1.0 release notes and changelog for any breaking or security-related changes before merging, and verify the pinned commit hash matches the v8.1.0 tag.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates the astral-sh/setup-uv GitHub Action from commit 85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 (v7.1.2) to 08807647e7069bb48b6ef5acd8ec9567f424441b (v8.1.0) in .github/workflows/cron-zizmor.yml and .github/workflows/zizmor.yml. Both workflows use the action only to install uv so that zizmor (a static analyzer for GitHub Actions security issues) can run. The workflows already set persist-credentials: false on the checkout step. The change is a dependency bump with no code logic modifications.
Changed components
.github/workflows/cron-zizmor.yml.github/workflows/zizmor.ymlInspect captured patch +2 / −2
diff --git a/.github/workflows/cron-zizmor.yml b/.github/workflows/cron-zizmor.yml
index 6b6940d2..b46ed6f9 100644
--- a/.github/workflows/cron-zizmor.yml
+++ b/.github/workflows/cron-zizmor.yml
@@ -19,7 +19,7 @@ jobs:
persist-credentials: false
- name: Install the latest version of uv
- uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v5
+ uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v5
- name: Run zizmor 🌈
run: uvx zizmor --format sarif . > results.sarif
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 507b3111..4e5ce83f 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -19,7 +19,7 @@ jobs:
persist-credentials: false
- name: Install the latest version of uv
- uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v5
+ uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v5
- name: Run zizmor 🌈
run: uvx zizmor@1.22.0 .
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.