chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 #409
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -22,7 +22,7 @@ jobs: | |
| id-token: write | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/deploy.yml | sed -n '1,100p'
printf '%s\n' '--- setup-uv action reference ---'
if command -v curl >/dev/null 2>&1; then
curl -fsSL --max-time 15 \
https://raw.githubusercontent.com/astral-sh/setup-uv/20cfd1bf945f4377ade1205e4dbc17946fc9a30d/action.yml
else
echo 'curl unavailable'
fiRepository: requests-cache/aiohttp-client-cache Length of output: 6614 🏁 Script executed: #!/bin/bash
set -eu
base='https://raw.githubusercontent.com/astral-sh/setup-uv/20cfd1bf945f4377ade1205e4dbc17946fc9a30d'
for file in dist/setup/index.cjs dist/save-cache/index.cjs; do
printf '\n--- %s ---\n' "$file"
curl -fsSL --max-time 20 "$base/$file" |
grep -oE '.{0,180}(UV_CACHE_DIR|cache-local-path|restore-cache|save-cache|actions/cache|restoreCache|saveCache|cacheKey|cache key).{0,300}' |
head -80 || true
done
printf '\n--- repository cache documentation ---\n'
for file in README.md docs/cache.md; do
printf '\n--- %s ---\n' "$file"
curl -fsSL --max-time 20 "$base/$file" 2>/dev/null |
grep -inE -A5 -B5 'cache|uvx|tool' | head -100 || true
doneRepository: requests-cache/aiohttp-client-cache Length of output: 17274 🏁 Script executed: #!/bin/bash
set -eu
sha='20cfd1bf945f4377ade1205e4dbc17946fc9a30d'
curl -fsSL --max-time 20 \
"https://api.github.com/repos/astral-sh/setup-uv/git/trees/$sha?recursive=1" |
jq -r '.tree[] | select(.path|test("(^|/)(cache|setup|save)[^/]*(\\.ts|\\.js)?$|src/")) | .path' |
head -120Repository: requests-cache/aiohttp-client-cache Length of output: 1513 🏁 Script executed: #!/bin/bash
set -eu
base='https://raw.githubusercontent.com/astral-sh/setup-uv/20cfd1bf945f4377ade1205e4dbc17946fc9a30d'
for file in src/cache/restore-cache.ts src/save-cache.ts src/setup-uv.ts src/utils/inputs.ts src/utils/constants.ts; do
printf '\n--- %s ---\n' "$file"
curl -fsSL --max-time 20 "$base/$file" | nl -ba | sed -n '1,260p'
doneRepository: requests-cache/aiohttp-client-cache Length of output: 774 🏁 Script executed: #!/bin/bash
set -eu
base='https://raw.githubusercontent.com/astral-sh/setup-uv/20cfd1bf945f4377ade1205e4dbc17946fc9a30d'
for file in src/cache/restore-cache.ts src/save-cache.ts src/setup-uv.ts src/utils/inputs.ts src/utils/constants.ts; do
printf '\n--- %s ---\n' "$file"
curl -fsSL --max-time 20 "$base/$file" | sed -n '1,280p'
doneRepository: requests-cache/aiohttp-client-cache Length of output: 27286 🌐 Web query:
💡 Result: In uv, uvx is an alias for uv tool run, and both commands function identically [1][2]. When you run a tool using uvx, it creates an ephemeral, isolated virtual environment to execute that tool [3][4]. Temporary Virtual Environments and Cache: - The temporary virtual environment created by uvx is stored within the uv cache directory [3][1]. - This environment is treated as disposable; it is cached primarily to reduce the performance overhead of repeated invocations [3][1]. - If you run uv cache clean or uv cache prune, these temporary environments are deleted [3][1][5]. They will be automatically recreated the next time the tool is invoked [3][1]. Cache Directory Configuration (UV_CACHE_DIR): - The cache directory is the central location where uv stores disposable data, including temporary tool environments [6][7]. - You can determine the current cache path by running the command uv cache dir [6][8]. - The location of the cache directory is determined by the following priority (highest to lowest) [9][10]: 1. A temporary directory if --no-cache is requested (though uv still uses a temporary cache for the single invocation) [9][10]. 2. A path explicitly defined via the --cache-dir command-line argument, the UV_CACHE_DIR environment variable, or the tool.uv.cache-dir setting [9][8][10]. 3. The system-appropriate default: - Unix: $XDG_CACHE_HOME/uv or $HOME/.cache/uv [9][6]. - Windows: %LOCALAPPDATA%\uv\cache [9][6]. For optimal performance, it is recommended that the cache directory be located on the same filesystem as your virtual environments to allow for efficient file linking instead of copying [9][6][7]. If you experience issues with cached environments, you can clear them using uv cache clean [5]. Citations:
Disable caching in the publishing job. For 🧰 Tools🪛 zizmor (1.29.0)[error] 25-25: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default (cache-poisoning) 🤖 Prompt for AI AgentsSources: MCP tools, Linters/SAST tools |
||
|
|
||
| - name: Set pre-release version | ||
| if: ${{ !startsWith(github.ref, 'refs/tags/v') }} | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: requests-cache/aiohttp-client-cache
Length of output: 7906
🏁 Script executed:
Repository: requests-cache/aiohttp-client-cache
Length of output: 2942
Use the automatic cache policy.
Because this workflow runs on tag pushes,
enable-cache: trueenables caching for those events. Set it toenable-cache: autososetup-uvv10 excludes tag pushes from cache restore and save operations.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 1-84: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[warning] 16-69: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[error] 37-37: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): this step
(cache-poisoning)
🤖 Prompt for AI Agents
Sources: MCP tools, Linters/SAST tools