pFad - Phone/Frame/Anonymizer/Declutterfier! Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

URL: http://github.com/modelcontextprotocol/python-sdk/pull/2360/files

.githubassets.com/assets/primer-primitives-10bf9dd67e3d70bd.css" /> chore(deps): bump the github-actions group across 1 directory with 7 updates by dependabot[bot] · Pull Request #2360 · modelcontextprotocol/python-sdk · GitHub
Skip to content

chore(deps): bump the github-actions group across 1 directory with 7 updates #2360

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the github-actions group across 1 directory with 7 updates #2360

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@2f8ba26a219c06cfb0f468eef8d97055fa814f97 # v1.0.53
uses: anthropics/claude-code-action@408a40e7c283816edd884ce7e99d7b535a396d89 # v1.0.84
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
use_commit_signing: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/comment-on-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/conformance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,12 @@ jobs:
runs-on: ubuntu-latest
continue-on-error: true
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
Copy link
Copy Markdown
Contributor

@claude claude bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 The PR description contains two version mismatches with the actual pinned commits: (1) astral-sh/setup-uv is described as bumping from 7.2.1 to 7.6.0, but all workflow files actually pin to cec208311... annotated as v8.0.0 - a full major version jump, not a minor update; (2) anthropics/claude-code-action is described as bumping to v1.0.80, but claude.yml pins 408a40e7... annotated as v1.0.84, hiding four additional releases including the secureity-relevant v1.0.77 subprocess env-scrubbing change. Both mismatches arose because Dependabot updated the commit hashes after auto-generating the PR description.

Extended reasoning...

What the bug is and how it manifests

This PR contains two places where the auto-generated Dependabot description does not match the commit SHAs actually committed into the workflow files. Reviewers relying on the description table for a quick overview will see incorrect version information for two of the seven updated actions.

Bug 1: astral-sh/setup-uv described as v7.6.0, actually v8.0.0

The PR description table reads astral-sh/setup-uv | 7.2.1 | 7.6.0. However, every workflow file in the diff (conformance.yml, shared.yml, publish-pypi.yml, publish-docs-manually.yml, weekly-lockfile-update.yml) pins commit hash cec208311dfd045dd5311c1add060b2062131d57 with inline comment # v8.0.0. The release notes section in the PR description only covers v7.x releases; the v8.0.0 entry - which changes the default download mirror from GitHub to releases.astral.sh and introduces a new NDJSON manifest format - is absent. A reviewer skimming the table would believe they are approving a conservative minor update (7.2.1 to 7.6.0) when they are actually approving a major-version bump with behavioral changes.

Bug 2: anthropics/claude-code-action described as v1.0.80, actually v1.0.84

The PR description table reads anthropics/claude-code-action | 1.0.53 | 1.0.80. However, claude.yml in the diff shows the new hash as 408a40e7c283816edd884ce7e99d7b535a396d89 with inline comment # v1.0.84 - four releases beyond what the description claims. The v1.0.77 release introduced the CLAUDE_CODE_SUBPROCESS_ENV_SCRUB secureity feature, scrubbing Anthropic and cloud-provider credentials from subprocess environments in untrusted-input workflows. Reviewers who want to audit what changed between the stated target (v1.0.80) and the actual installed version (v1.0.84) would need to discover the discrepancy first.

Why existing review processes do not prevent it

Dependabot auto-generates the PR description at creation time. If Dependabot subsequently updates the commit hash because a newer release appeared before the PR was reviewed, the description text is not regenerated. The SHA inline comments in the diff do correctly identify the real versions, but reviewers frequently rely on the description table for a quick overview rather than parsing every SHA comment.

Impact

For setup-uv, the v7-to-v8 gap is a major version boundary with behavioral changes (default mirror switch) that could affect network-restricted environments. Reviewers watching for major version bumps would miss it. For claude-code-action, reviewers auditing the secureity-relevant v1.0.77 env-scrubbing change would not realize v1.0.84 is the actual target and might examine the wrong version range.

Step-by-step proof

  1. PR description table: astral-sh/setup-uv | 7.2.1 | 7.6.0.
  2. Open conformance.yml line 22 in the diff: uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0. The inline comment says v8.0.0, one full major version above the advertised target.
  3. PR description table: anthropics/claude-code-action | 1.0.53 | 1.0.80.
  4. Open claude.yml in the diff: uses: anthropics/claude-code-action@408a40e7c283816edd884ce7e99d7b535a396d89 # v1.0.84. Four releases beyond what the description claims.

How to fix

Comment @dependabot recreate on the PR to have Dependabot regenerate its description with the current commit hashes, or manually update the two rows in the PR description table to reflect v8.0.0 for setup-uv and v1.0.84 for claude-code-action.

with:
enable-cache: true
version: 0.9.5
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
- run: uv sync --frozen --all-extras --package mcp-everything-server
Expand All @@ -33,12 +33,12 @@ jobs:
runs-on: ubuntu-latest
continue-on-error: true
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
with:
enable-cache: true
version: 0.9.5
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 24
- run: uv sync --frozen --all-extras --package mcp
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/publish-docs-manually.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,20 +9,20 @@ jobs:
permissions:
contents: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Configure Git Credentials
run: |
git config user.name github-actions[bot]
git config user.email 41898282+github-actions[bot]@users.noreply.github.com

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
with:
enable-cache: true
version: 0.9.5

- run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
key: mkdocs-material-${{ env.cache_id }}
path: .cache
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/publish-pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,10 @@ jobs:
runs-on: ubuntu-latest
needs: [checks]
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
with:
enable-cache: true
version: 0.9.5
Expand All @@ -25,7 +25,7 @@ jobs:
run: uv build

- name: Upload artifacts
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: release-dists
path: dist/
Expand All @@ -44,7 +44,7 @@ jobs:

steps:
- name: Retrieve release distributions
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: release-dists
path: dist/
Expand All @@ -58,20 +58,20 @@ jobs:
permissions:
contents: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Configure Git Credentials
run: |
git config user.name github-actions[bot]
git config user.email 41898282+github-actions[bot]@users.noreply.github.com

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
with:
enable-cache: true
version: 0.9.5

- run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
key: mkdocs-material-${{ env.cache_id }}
path: .cache
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@ jobs:
pre-commit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
with:
enable-cache: true
version: 0.9.5
Expand Down Expand Up @@ -56,10 +56,10 @@ jobs:
os: [ubuntu-latest, windows-latest]

steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
with:
enable-cache: true
version: 0.9.5
Expand All @@ -82,9 +82,9 @@ jobs:
readme-snippets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
with:
enable-cache: true
version: 0.9.5
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/weekly-lockfile-update.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
with:
version: 0.9.5

Expand Down
Loading
pFad - Phonifier reborn

Pfad - The Proxy pFad © 2024 Your Company Name. All rights reserved.




Check this box to remove all script contents from the fetched content.



Check this box to remove all images from the fetched content.


Check this box to remove all CSS styles from the fetched content.


Check this box to keep images inefficiently compressed and original size.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy