[dependabot]

Bumps the dependencies group with 5 updates:

Package	From	To
astral-sh/setup-uv	10.3.2	10.3.3
github/codeql-action	4.39.1	4.39.2
jdx/mise-action	5.2.4	5.2.6
gradle/actions	6.4.0	6.4.1
actions-rust-lang/setup-rust-toolchain	2.0.0	2.0.1

Updates astral-sh/setup-uv from 10.3.2 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @​eifinger (#1119)
• fix: allow whitespace in uv requirement specifiers @​soujasK (#1112)
• fix: resolve ~= specifiers with PEP 440 semantics @​soujasK (#1111)
• fix: only report a saved cache when saving succeeded @​soujasK (#1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @github-actions[bot] (#1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @​eifinger (#1113)
• docs: update version references to v10.3.2 @github-actions[bot] (#1104)

Commits

• 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
• 0192b69 chore: update known checksums for 0.13.6 (#1117)
• 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
• 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
• 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
• 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
• 56618ca docs: update version references to v10.3.2 (#1104)
• See full diff in compare view

Updates github/codeql-action from 4.39.1 to 4.39.2

Release notes

Sourced from github/codeql-action's releases.

v4.39.2

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Changelog

Sourced from github/codeql-action's changelog.

4.39.2 - 03 Nov 2026

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

Commits

• 1fc58d0 Merge pull request #4286 from github/update-v4.39.2-c05042115
• d998481 Update changelog for v4.39.2
• c050421 Merge pull request #4284 from github/update-bundle/codeql-bundle-v2.27.4
• 750fe8f Merge branch 'main' into update-bundle/codeql-bundle-v2.27.4
• adfcd5f Add changelog note
• 2ef3b62 Update default bundle to codeql-bundle-v2.27.4
• b35c6c6 Merge pull request #4251 from github/mbg/refactor-util/errors
• ac9f257 Merge remote-tracking branch 'origin/main' into mbg/refactor-util/errors
• 52cf185 Merge pull request #4278 from github/mbg/macos27/xcode-detection
• 95dd6bf Fix new test not providing typical input
• Additional commits viewable in compare view

Updates jdx/mise-action from 5.2.4 to 5.2.6

Release notes

Sourced from jdx/mise-action's releases.

v5.2.6: Fix step hanging after a failed cache restore

The action now exits as soon as its work is done. Before this release, a cache restore that failed during the download could leave the step running for up to ten minutes after setup had finished.

Fixed

• A failed cache restore no longer leaves the step hanging. If the mise cache download failed partway through, for example with getaddrinfo EAI_AGAIN, the action logged a warning, installed the tools and saved the cache, then stopped producing output. The step stayed in progress until the job was cancelled or a timer inside @actions/cacheactions/toolkit#2470Error objects now mark the step as failed with their message. Before, they caused an unhandled rejection. (#718 by @​jdx and @​kjanat, fixes #717)

Full Changelog: jdx/mise-action@v5.2.5...v5.2.6

v5.2.5: Bundled packslip verifier updated to 1.11.0; README examples use v5

This release updates the packslip library that the action uses to verify downloaded mise releases, and updates the README examples to use the current major versions.

Changed

• packslip updated from 1.8.0 to 1.11.0. The action uses packslip to check a downloaded mise binary against the signed packslip.sigstore.json that ships with mise releases from 2026.9.3 onward. The new version runs extra checks on the signed statement: the identity it declares must match the certificate that signed it, and the certificate must belong to the github.com/jdx/mise repository. GitHub and GitLab repository names now match regardless of letter case. The action still asks for the same identity, issuer and tag as before, and there are no new inputs. (#715)
• The README examples now use jdx/mise-action@v5 and actions/checkout@v7. (#710 by @​deining)

Full Changelog: jdx/mise-action@v5.2.4...v5.2.5

Changelog

Sourced from jdx/mise-action's changelog.

5.2.6 - 2026-11-02

🐛 Bug Fixes

• exit after run and post so a failed cache restore can't hang the step (#718) by @​jdx in #718

---

5.2.5 - 2026-10-31

🔍 Other Changes

• bump versions (#710) by @​deining in #710

---

Commits

• f5be966 chore: release v5.2.6 (#719)
• 2187bd8 chore(deps): lock file maintenance (#720)
• 8008c3f fix: exit after run and post so a failed cache restore can't hang the step (#...
• 6612f0e chore: release v5.2.5 (#711)
• 432c79b chore(deps): update mise tools to latest (#714)
• 7533c93 fix(deps): update dependency packslip to v1.11.0 (#715)
• c0e0291 chore(deps): update dependency @​types/node to v26 (#716)
• 8a331fe chore(deps): update github actions (#713)
• 16bad93 README.md: bump versions (#710)
• See full diff in compare view

Updates gradle/actions from 6.4.0 to 6.4.1

Release notes

Sourced from gradle/actions's releases.

v6.4.1

Security fix

This release fixes a security vulnerability in the dependency-submission action: GHSA-chpw-2mqm-95cc. All users should upgrade.

What's Changed

• Combined dependency updates by @​bigdaz in gradle/actions#1105
• Update to latest Dependency Graph plugin by @​bigdaz in gradle/actions#1106

Full Changelog: gradle/actions@v6.4.0...v6.4.1

Commits

• 8da46b5 [bot] Update dist directory
• dcf6f72 Merge commit from fork
• bf74269 Update to latest Dependency Graph plugin (#1106)
• 65a6ba9 [bot] Update dist directory
• 35eba4f Combined dependency updates (#1105)
• 1cff18a Update known wrapper checksums (#1075)
• 399f0d3 Update known wrapper checksums
• ecf8cf2 Bump references to Develocity Gradle plugin from 4.5.1 to 4.6.0 (#1080)
• d740e82 Bump references to Develocity Gradle plugin from 4.5.1 to 4.6.0
• f9f39a9 Bump references to Develocity Gradle plugin from 4.5.0 to 4.5.1 (#1072)
• Additional commits viewable in compare view

Updates actions-rust-lang/setup-rust-toolchain from 2.0.0 to 2.0.1

Release notes

Sourced from actions-rust-lang/setup-rust-toolchain's releases.

v2.0.1

What's Changed

• Bump Swatinem/rust-cache from 2.9.2 to 2.9.3 by @​dependabot[bot] in actions-rust-lang/setup-rust-toolchain#109

Full Changelog: actions-rust-lang/setup-rust-toolchain@v2.0.0...v2.0.1

Changelog

Sourced from actions-rust-lang/setup-rust-toolchain's changelog.

[2.0.1] - 2026-11-02

• Update Swatinem/rust-cache to 2.9.3

Commits

• a188e68 Update CHANGELOG for 2.0.1
• b328d6b Merge pull request #109 from actions-rust-lang/dependabot/github_actions/Swat...
• 238616c Bump Swatinem/rust-cache from 2.9.2 to 2.9.3
• c8ff772 Update Readme
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions