chore(actions)(deps): bump astral-sh/setup-uv from 8.2.0 to 10.0.0

[dependabot]

Bumps astral-sh/setup-uv from 8.2.0 to 10.0.0.

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

• Disable automatic caching for sensitive events @​eifinger (#992)

🐛 Bug fixes

• Reject paths in .tool-versions @​eifinger (#1007)

🚀 Enhancements

• Read Python version from .tool-versions @​eifinger (#996)
• Add latest-known version selector @​eifinger (#993)

... (truncated)

Commits

• ae62891 chore(deps): roll up Dependabot updates (#1013)
• f9cdb47 Reject paths in .tool-versions (#1007)
• 4f6036f Require pull requests for Dependabot rollups (#1005)
• 8d6402c chore(deps): roll up Dependabot updates (#1004)
• 46f427b Read Python version from .tool-versions (#996)
• 8ed89c5 ci: pin Alpine container image (#995)
• 8473c7f chore(deps): roll up Dependabot updates (#994)
• 18d451d Add latest-known version selector (#993)
• f451684 Disable automatic caching for sensitive events (#992)
• b68407c chore: update known checksums for 0.12.3 (#991)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 4089668 — chore(actions)(deps): bump astral-sh/setup-uv from 8.2.0 to}

❌ Job failures

JS & TS checks / apps/desktop / check:lint · View job

Job JS & TS checks / apps/desktop / check:lint failed.

---

Python tests / Run tests slice 9/12 · View job

Job Python tests / Run tests slice 9/12 failed.

---

⚠️ Action required

CI-sensitive file review · View job

This PR changes CI-sensitive files (eslint config, workflow YAMLs, or composite actions). These influence what the js-autofix job executes and pushes to main.

Sensitive files changed:

• .github/workflows/docker.yml
• .github/workflows/e2e-desktop.yml
• .github/workflows/lint.yml
• .github/workflows/tests-os.yml
• .github/workflows/tests.yml
• .github/workflows/uv-lockfile-check.yml

How to fix:

Add the ci-reviewed label after verifying:

• no new eslint rules with custom fix functions that write outside linted paths,
• no workflow changes that widen permissions or remove guards,
• no composite action changes that alter what gets executed.

---

⚠️ Warnings

CI timings · View report · View job

Wall time 17m21s vs 8m30s (+104.1%). 15 job(s) slower, 22 faster, 2 unchanged.

• Python tests / Run tests slice 4/12: -75.0s
• Python tests / Run tests slice 3/12: -60.0s
• Python tests / Run tests slice 2/12: -50.0s
• Python tests / Run tests slice 1/12: -48.0s
• Python tests / Run tests slice 11/12: -43.0s

---

OSV vulnerability scan · View job

4 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in website/package-lock.json
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

[bbasketballer75]

🤖 hermes automated review

• 6 files changed, 9 additions, 9 deletions
• ⚠️ tests not run (no test command detected)

No heuristic issues detected.

---

Review generated by hermes pr-reviewer. Trust but verify.

[bbasketballer75]

🤖 hermes automated review

• 6 files changed, 9 additions, 9 deletions
• ⚠️ tests not run (no test command detected)

No heuristic issues detected.

---

Review generated by hermes pr-reviewer. Trust but verify.