deps(actions): Bump the actions group across 1 directory with 3 updates

[dependabot]

Bumps the actions group with 3 updates in the / directory: astral-sh/setup-uv, anthropics/claude-code-action and dorny/paths-filter.

Updates astral-sh/setup-uv from 9.0.0 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

• docs: update version references to v10.0.0 @github-actions[bot] (#1014)

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

• 20cfd1b chore: update known checksums for 0.12.4 (#1017)
• d73a0ca Tolerate transient manifest timeouts (#1016)
• ae3b92d docs: update version references to v10.0.0 (#1014)
• ae62891 chore(deps): roll up Dependabot updates (#1013)
• f9cdb47 Reject paths in .tool-versions (#1007)
• 4f6036f Require pull requests for Dependabot rollups (#1005)
• 8d6402c chore(deps): roll up Dependabot updates (#1004)
• 46f427b Read Python version from .tool-versions (#996)
• 8ed89c5 ci: pin Alpine container image (#995)
• 8473c7f chore(deps): roll up Dependabot updates (#994)
• Additional commits viewable in compare view

Updates anthropics/claude-code-action from 1.0.183 to 1.0.193

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.193

Full Changelog: anthropics/claude-code-action@v1.0.192...v1.0.193

v1.0.192

What's Changed

• fix(mcp): paginate GitHub Actions results by @​abhinavkr26104 in anthropics/claude-code-action#1629
• fix(summary): keep every text block in structured tool results by @​Neal006 in anthropics/claude-code-action#1619
• fix(mcp): detect binary files by content instead of extension allowlist by @​henriquepe in anthropics/claude-code-action#1633

New Contributors

• @​abhinavkr26104 made their first contribution in anthropics/claude-code-action#1629
• @​Neal006 made their first contribution in anthropics/claude-code-action#1619
• @​henriquepe made their first contribution in anthropics/claude-code-action#1633

Full Changelog: anthropics/claude-code-action@v1.0.191...v1.0.192

v1.0.191

Full Changelog: anthropics/claude-code-action@v1.0.190...v1.0.191

v1.0.190

Full Changelog: anthropics/claude-code-action@v1...v1.0.190

v1.0.189

Full Changelog: anthropics/claude-code-action@v1...v1.0.189

v1.0.188

What's Changed

• Enforce max-turn limits from claude_args by @​ulofiai in anthropics/claude-code-action#1607
• fix: handle null files field from GraphQL on very large PRs by @​leepokai in anthropics/claude-code-action#1593
• fix: support labeled action for pull_request events in track_progress by @​takakisatojp in anthropics/claude-code-action#1586
• fix: match label_trigger case-insensitively by @​sahilempire in anthropics/claude-code-action#1576
• docs: fix broken Bedrock anchor in cloud-providers.md by @​shoemoney in anthropics/claude-code-action#1579
• docs: replace removed base-action inputs with claude_args and settings by @​fallintoplace in anthropics/claude-code-action#1550
• fix(cache): disable setup-bun cache to avoid 5-retry HTML-error burn by @​necofuryai in anthropics/claude-code-action#1580
• ci: pass base-action tool restrictions through claude_args by @​fallintoplace in anthropics/claude-code-action#1552
• fix(mcp): stop retrying deterministic reference update failures by @​fallintoplace in anthropics/claude-code-action#1551
• fix: expose conclusion as a root action output by @​fallintoplace in anthropics/claude-code-action#1549
• fix(branch): validate generated branch name under commit signing by @​rishavnaskar in anthropics/claude-code-action#1582
• fix(branch): collapse empty path segments in branch_name_template by @​NickNojiri in anthropics/claude-code-action#1539

New Contributors

• @​ulofiai made their first contribution in anthropics/claude-code-action#1607
• @​leepokai made their first contribution in anthropics/claude-code-action#1593
• @​takakisatojp made their first contribution in anthropics/claude-code-action#1586
• @​sahilempire made their first contribution in anthropics/claude-code-action#1576
• @​shoemoney made their first contribution in anthropics/claude-code-action#1579
• @​fallintoplace made their first contribution in anthropics/claude-code-action#1550
• @​necofuryai made their first contribution in anthropics/claude-code-action#1580
• @​rishavnaskar made their first contribution in anthropics/claude-code-action#1582

... (truncated)

Commits

• 9d7150b chore: bump Claude Code to 2.1.233 and Agent SDK to 0.3.233
• e63208c chore: bump Claude Code to 2.1.232 and Agent SDK to 0.3.232
• dc33e8a chore: bump Claude Code to 2.1.231 and Agent SDK to 0.3.231
• c58ad32 chore: bump Claude Code to 2.1.229 and Agent SDK to 0.3.229
• dfb8fc7 fix(mcp): detect binary files by content instead of extension allowlist (#1633)
• a2489ef fix(summary): keep every text block in structured tool results (#1619)
• 8b87458 fix: paginate GitHub Actions MCP responses (#1629)
• 239e3a7 chore: bump Claude Code to 2.1.228 and Agent SDK to 0.3.228
• 5ef2e55 chore: bump Claude Code to 2.1.227 and Agent SDK to 0.3.227
• 6b082c4 chore: bump Claude Code to 2.1.226 and Agent SDK to 0.3.226
• Additional commits viewable in compare view

Updates dorny/paths-filter from 4.0.2 to 4.0.3

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.3

What's Changed

• Update Outputs in readme to account for the 'every' predicate-quantifier by @​hintron in dorny/paths-filter#247
• fix: scope base-ignored warning to API path by @​saschabratton in dorny/paths-filter#319
• docs: add contents permission to PR example by @​134130 in dorny/paths-filter#248
• feat: add 'some-with-excludes' predicate quantifier by @​arxeiss in dorny/paths-filter#322
• Document safe handling of file list outputs in workflows by @​dorny in dorny/paths-filter#326

Security

• Escape multi-line filenames in list-files shell and csv output] by @​ken-matsui and @​tjswlsgg in https://github.com/advisories/GHSA-7hc6-8hq5-9q2m

New Contributors

• @​hintron made their first contribution in dorny/paths-filter#247
• @​134130 made their first contribution in dorny/paths-filter#248
• @​arxeiss made their first contribution in dorny/paths-filter#322

Full Changelog: dorny/paths-filter@v4...v4.0.3

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.3

• Document safe handling of file list outputs in workflows
• Escape multi-line filenames in list-files shell and csv output
• Add 'some-with-excludes' predicate quantifier
• Add contents permission to PR example
• Scope base-ignored warning to API path
• Update outputs in readme to account for the 'every' predicate-quantifier

v4.0.2

• Work around git dubious ownership errors in container jobs
• Use rev-parse instead of branch --show-current for older git compat
• Fix warning message

v4.0.1

• Support merge queue

v4.0.0

• Update action runtime to node24

v3.0.4

• Escape multi-line filenames in list-files shell and csv output

v3.0.3

• Add missing predicate-quantifier

v3.0.2

• Add config parameter for predicate quantifier

v3.0.1

• Compare base and ref when token is empty

v3.0.0

• Update to Node.js 20
• Update all dependencies

v2.11.1

• Update @​actions/core to v1.10.0 - Fixes warning about deprecated set-output
• Document need for pull-requests: read permission
• Updating to actions/checkout@v3

v2.11.0

• Set list-files input parameter as not required
• Update Node.js
• Fix incorrect handling of Unicode characters in exec()
• Use Octokit pagination
• Updates real world links

v2.10.2

... (truncated)

Commits

• ceb8a2b Update CHANGELOG.md for v4.0.3 and v3.0.4 (#327)
• ef09b88 Document safe handling of file list outputs in workflows (#326)
• 44adc5b Merge commit from fork
• 4711b7a feat: add 'some-with-excludes' predicate quantifier (#322)
• 93c889f fix: escape multi-line filenames in list-files shell and csv output
• b41dfa9 docs: add contents permission to PR example (#248)
• 9af6e5a fix: scope base-ignored warning to API path (#319)
• cae9006 docs: update outputs in readme to account for the 'every' predicate-quantifie...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions