mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-10-02 22:06:00 +01:00
dependabot[bot]
03ec7d1c06
Bumps the gh-actions group with 2 updates in the / directory: [docker/build-push-action](https://github.com/docker/build-push-action) and [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `docker/build-push-action` from 7.0.0 to 7.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/build-push-action/releases">docker/build-push-action's releases</a>.</em></p> <blockquote> <h2>v7.1.0</h2> <ul> <li>Git context <a href="https://docs.docker.com/build/concepts/context/#url-queries">query format</a> support by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/build-push-action/pull/1505">docker/build-push-action#1505</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.79.0 to 0.87.0 by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/build-push-action/pull/1505">docker/build-push-action#1505</a></li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a href="https://redirect.github.com/docker/build-push-action/pull/1500">docker/build-push-action#1500</a></li> <li>Bump fast-xml-parser from 5.4.2 to 5.5.7 in <a href="https://redirect.github.com/docker/build-push-action/pull/1489">docker/build-push-action#1489</a></li> <li>Bump flatted from 3.3.3 to 3.4.2 in <a href="https://redirect.github.com/docker/build-push-action/pull/1491">docker/build-push-action#1491</a></li> <li>Bump glob from 10.3.12 to 10.5.0 in <a href="https://redirect.github.com/docker/build-push-action/pull/1490">docker/build-push-action#1490</a></li> <li>Bump handlebars from 4.7.8 to 4.7.9 in <a href="https://redirect.github.com/docker/build-push-action/pull/1497">docker/build-push-action#1497</a></li> <li>Bump lodash from 4.17.23 to 4.18.1 in <a href="https://redirect.github.com/docker/build-push-action/pull/1510">docker/build-push-action#1510</a></li> <li>Bump picomatch from 4.0.3 to 4.0.4 in <a href="https://redirect.github.com/docker/build-push-action/pull/1496">docker/build-push-action#1496</a></li> <li>Bump undici from 6.23.0 to 6.24.1 in <a href="https://redirect.github.com/docker/build-push-action/pull/1486">docker/build-push-action#1486</a></li> <li>Bump vite from 7.3.1 to 7.3.2 in <a href="https://redirect.github.com/docker/build-push-action/pull/1509">docker/build-push-action#1509</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0">https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/build-push-action/commit/bcafcacb16a39f128d818304e6c9c0c18556b85f"><code>bcafcac</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1509">#1509</a> from docker/dependabot/npm_and_yarn/vite-7.3.2</li> <li><a href="https://github.com/docker/build-push-action/commit/18e62f1158d9c45a4a84a58a6828d21f8ed3644b"><code>18e62f1</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1510">#1510</a> from docker/dependabot/npm_and_yarn/lodash-4.18.1</li> <li><a href="https://github.com/docker/build-push-action/commit/46580d2c9d43b0888270cb6fa90956e483de56fc"><code>46580d2</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/build-push-action/commit/3f80b252ca2331f6ec3e890f4346b5506ee1dc81"><code>3f80b25</code></a> chore(deps): Bump lodash from 4.17.23 to 4.18.1</li> <li><a href="https://github.com/docker/build-push-action/commit/efeec9557c40a646afe433e39a1e94ca689103f0"><code>efeec95</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1505">#1505</a> from crazy-max/refactor-git-context</li> <li><a href="https://github.com/docker/build-push-action/commit/ddf04b08eb12882258ed936fea4a2806754ff349"><code>ddf04b0</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1511">#1511</a> from docker/dependabot/github_actions/crazy-max-dot-...</li> <li><a href="https://github.com/docker/build-push-action/commit/db08d97a08e4a0d15f85d1c4e64dfd5f88cbe1a9"><code>db08d97</code></a> chore(deps): Bump the crazy-max-dot-github group with 2 updates</li> <li><a href="https://github.com/docker/build-push-action/commit/ef1fb9688fc3626d0fd5e462f502cbbdc6456feb"><code>ef1fb96</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1508">#1508</a> from docker/dependabot/github_actions/docker/login-a...</li> <li><a href="https://github.com/docker/build-push-action/commit/2d8f2a1a378a5c302dcd7b2b4326cefa24180bb1"><code>2d8f2a1</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/build-push-action/commit/919ac7bd7d1aa8cb13fe4de76545abea8d8b5ed2"><code>919ac7b</code></a> fix test since secrets are not written to temp path anymore</li> <li>Additional commits viewable in <a href="https://github.com/docker/build-push-action/compare/d08e5c354a6adb9ed34480a06d141179aa583294...bcafcacb16a39f128d818304e6c9c0c18556b85f">compare view</a></li> </ul> </details> <br /> Updates `astral-sh/setup-uv` from 7.3.1 to 8.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v8.0.0 🌈 Immutable releases and secure tags</h2> <h1>This is the first immutable release of <code>setup-uv</code> 🥳</h1> <p>All future releases are also immutable, if you want to know more about what this means checkout <a href="https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases">the docs</a>.</p> <p>This release also has two breaking changes</p> <h2>New format for <code>manifest-file</code></h2> <p>The previously deprecated way of defining a custom version manifest to control which <code>uv</code> versions are available and where to download them from got removed. The functionality is still there but you have to use the <a href="https://github.com/astral-sh/setup-uv/blob/main/docs/customization.md#format">new format</a>.</p> <h2>No more major and minor tags</h2> <p>To increase <strong>security</strong> even more we will <strong>stop publishing minor tags</strong>. You won't be able to use <code>@v8</code> or <code>@v8.0</code> any longer. We do this because pinning to major releases opens up users to supply chain attacks like what happened to <a href="https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/">tj-actions</a>.</p> <blockquote> <p>[!TIP] Use the immutable tag as a version <code>astral-sh/setup-uv@v8.0.0</code> Or even better the githash <code>astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57</code></p> </blockquote> <h2>🚨 Breaking changes</h2> <ul> <li>Remove update-major-minor-tags workflow <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/826">#826</a>)</li> <li>Remove deprecrated custom manifest <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/813">#813</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>Shortcircuit latest version from manifest <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/828">#828</a>)</li> <li>Simplify inputs.ts <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/827">#827</a>)</li> <li>Bump release-drafter to v7.1.1 <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/825">#825</a>)</li> <li>Refactor inputs <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/823">#823</a>)</li> <li>Replace inline compile args with tsconfig <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/824">#824</a>)</li> <li>chore: update known checksums for 0.11.2 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/821">#821</a>)</li> <li>chore: update known checksums for 0.11.1 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/817">#817</a>)</li> <li>chore: update known checksums for 0.11.0 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/815">#815</a>)</li> <li>Fix latest-version workflow check <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/812">#812</a>)</li> <li>chore: update known checksums for 0.10.11/0.10.12 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/811">#811</a>)</li> </ul> <h2>v7.6.0 🌈 Fetch uv from Astral's mirror by default</h2> <h2>Changes</h2> <p>We now default to download uv from <code>releases.astral.sh</code>. This means by default we don't hit the GitHub API at all and shouldn't see any rate limits and timeouts any more.</p> <h2>🚀 Enhancements</h2> <ul> <li>Fetch uv from Astral's mirror by default <a href="https://github.com/zsol"><code>@zsol</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/809">#809</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>Switch to ESM for source and test, use CommonJS for dist <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/806">#806</a>)</li> <li>chore: update known checksums for 0.10.10 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/804">#804</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/cec208311dfd045dd5311c1add060b2062131d57"><code>cec2083</code></a> Shortcircuit latest version from manifest (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/828">#828</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/4dd8ab45206a76f8c1dfe399fa88df10a7264f27"><code>4dd8ab4</code></a> Simplify inputs.ts (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/827">#827</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/7fdbe7cf0c8ef50cfd0878eed7b5180abc6b53c7"><code>7fdbe7c</code></a> Remove update-major-minor-tags workflow (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/826">#826</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/485abd05e5c74a247f0a309e333d2433ab9a353a"><code>485abd0</code></a> Bump release-drafter to v7.1.1 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/825">#825</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f82eb19c06057c455674b2602e0139fd906f1428"><code>f82eb19</code></a> Refactor inputs (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/823">#823</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/868d1f74d9d862d7b40219546bfe35299c6dd452"><code>868d1f7</code></a> Replace inline compile args with tsconfig (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/824">#824</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/447e6d02b15d65b3247cce2d6019f11957285d11"><code>447e6d0</code></a> chore: update known checksums for 0.11.2 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/821">#821</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/5c62c5926145985eec91f09e2e0a75f40daed929"><code>5c62c59</code></a> chore: update known checksums for 0.11.1 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/817">#817</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/e1a7373adb857afd2a70b971e8ebdacc64ed27d0"><code>e1a7373</code></a> chore: update known checksums for 0.11.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/815">#815</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/89709315bb3bd4bf0f4b1db4b710e99009087ab5"><code>8970931</code></a> Remove deprecrated custom manifest (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/813">#813</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/5a095e7a2014a4212f075830d4f7277575a9d098...cec208311dfd045dd5311c1add060b2062131d57">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>