Post #1177370
2026-04-13 20:38 UTC
Do you use astral-sh/setup-uv@v7 in #GitHubActions?
And it's not hash-pinned?
And you use #Dependabot or #Renovate?
The setup-uv project has switched to only Vx.y.z tags, no more Vx or Vx.y.
But Dependabot and Renovate won't upgrade from Vx to Vx.y.z, so you'll need to manually update to setup-uv@v8.0.0 to keep up with future updates.
"To increase security even more we will stop publishing minor tags. You won't be able to use v8 or v8.0 any longer."
https://github.com/astral-sh/setup-uv/issues/830
#Python #uv
Replies (1)
-
@nedbat@hachyderm.io 2026-04-13 20:56
@hugovk I've always disliked that `v6` was a tag, but that it moved. I'm glad to see Astral break with tradition in the name of making people consider their security.