chore(deps): bump astral-sh/setup-uv from 5.4.2 to 8.1.0 - #9663
Merged
isaacbmiller merged 1 commit intoApr 29, 2026
Conversation
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 5.4.2 to 8.1.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@d4b2f3b...0880764) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
deleted the
dependabot/github_actions/astral-sh/setup-uv-8.1.0
branch
April 29, 2026 15:42
isaacbmiller
added a commit
that referenced
this pull request
May 5, 2026
* Update versions * ci(release): drop unused contents:write on TestPyPI job; add twine check --strict (#9648) The build-and-publish-test-pypi job never performs any git writes, so the contents: write permission is unnecessary and widens the blast radius of a compromised step in the OIDC-holding job. This removes it. The prod PyPI job keeps contents: write because it still pushes the 'Update versions' commit; that separation is addressed in a follow-up PR. Adds twine check --strict dist/* immediately after each python -m build (TestPyPI dspy-ai-test-isaac build, PyPI dspy build, PyPI dspy-ai build) so malformed distributions fail the workflow before any upload attempt. Also fixes the dspy-ai alias package's broken readme reference: the .github/.internal_dspyai/pyproject.toml pointed at a README.md that doesn't exist in that directory, so long_description was silently dropped. Replaces the reference with an inline one-line description clarifying that dspy-ai is a compatibility alias and users should install dspy. Without this, twine check --strict fails on the dspy-ai build. Refs PyPI security-model guidance: https://docs.pypi.org/trusted-publishers/security-model/ ("Limit the scope of your publishing job"). Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> * chore: refresh uv.lock to match pyproject 3.2.0 (#9650) The 3.2.0 release updated pyproject.toml and dspy/__metadata__.py but left uv.lock at 3.1.3. Running uv lock regenerates it cleanly; only the dspy package entry in the lockfile changes (no transitive dependency updates). Repro: uv lock # reports: Updated dspy v3.1.3 -> v3.2.0 * fix(lm): forward headers to _get_stream_completion_fn in alitellm_completion (#9669) Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> * chore(deps): bump pytest-asyncio from 1.0.0 to 1.3.0 (#9665) Bumps [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) from 1.0.0 to 1.3.0. - [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases) - [Commits](pytest-dev/pytest-asyncio@v1.0.0...v1.3.0) --- updated-dependencies: - dependency-name: pytest-asyncio dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump ruff from 0.12.0 to 0.15.10 (#9664) Bumps [ruff](https://github.com/astral-sh/ruff) from 0.12.0 to 0.15.10. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.12.0...0.15.10) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.15.10 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): update mkdocs-llmstxt requirement in /docs (#9661) Updates the requirements on [mkdocs-llmstxt](https://github.com/pawamoy/mkdocs-llmstxt) to permit the latest version. - [Release notes](https://github.com/pawamoy/mkdocs-llmstxt/releases) - [Changelog](https://github.com/pawamoy/mkdocs-llmstxt/blob/main/CHANGELOG.md) - [Commits](pawamoy/mkdocs-llmstxt@0.3.0...0.5.0) --- updated-dependencies: - dependency-name: mkdocs-llmstxt dependency-version: 0.5.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): remove litellm upper bound (#9687) * ci(release): give TestPyPI its own GitHub environment (#9649) Splits the TestPyPI publishing job off the shared 'pypi' environment into a dedicated 'testpypi' environment, matching the PyPA publishing guide's recommendation to use distinct environments for TestPyPI and production PyPI. This lets us keep required-reviewer protection on the 'pypi' environment (already configured) without it also gating the TestPyPI pre-flight, and scopes OIDC claims per-environment. Operator requirement: the Trusted Publisher registration on test.pypi.org for this repo/workflow must be updated to set the environment field to 'testpypi' before this PR is merged, otherwise the TestPyPI publish step will fail with an audience/environment mismatch. Refs: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ (separate 'testpypi' and 'pypi' environments). * docs(deployment): convert GitHub-flavored [!NOTE] alert to MkDocs admonition (#9690) The MLflow note in the deployment tutorial used GitHub-flavored alert syntax (> [!NOTE]), which isn't supported by MkDocs Material. The block was rendering as a plain blockquote with literal '[!NOTE]' text instead of a styled admonition. Switched to the !!! note syntax used elsewhere in the docs. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> * docs(observability): quote admonition titles so they render correctly (#9691) The MLflow tutorial admonition (`!!! info Learn more about MLflow`) and the callbacks admonition (`!!! info Handling Inputs and Outputs in Callbacks`) were missing quotes around the title text. Without quotes, the title tokens are parsed as additional CSS classes and the rendered admonition title falls back to the type name ("Info") instead of the intended descriptive title. Quoting the titles restores them. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> * chore(deps): bump mkdocstrings from 1.0.3 to 1.0.4 in /docs (#9668) Bumps [mkdocstrings](https://github.com/mkdocstrings/mkdocstrings) from 1.0.3 to 1.0.4. - [Release notes](https://github.com/mkdocstrings/mkdocstrings/releases) - [Changelog](https://github.com/mkdocstrings/mkdocstrings/blob/main/CHANGELOG.md) - [Commits](mkdocstrings/mkdocstrings@1.0.3...1.0.4) --- updated-dependencies: - dependency-name: mkdocstrings dependency-version: 1.0.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/cache from 4.3.0 to 5.0.5 (#9662) Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.5. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...27d5ce7) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump astral-sh/setup-uv from 5.4.2 to 8.1.0 (#9663) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 5.4.2 to 8.1.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@d4b2f3b...0880764) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump mistune from 3.0.2 to 3.2.0 in /docs (#9666) Bumps [mistune](https://github.com/lepture/mistune) from 3.0.2 to 3.2.0. - [Release notes](https://github.com/lepture/mistune/releases) - [Changelog](https://github.com/lepture/mistune/blob/main/docs/changes.rst) - [Commits](lepture/mistune@v3.0.2...v3.2.0) --- updated-dependencies: - dependency-name: mistune dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs: fix duplicate-word typos ("are are", "with with") (#9695) Fixes two cases of accidentally-duplicated stop words that were missed by PR #9641: - `dspy/teleprompt/bootstrap_finetune.py`: "are are structurally equivalent" -> "are structurally equivalent" - `docs/docs/deep-dive/data-handling/loading-custom-data.md`: "work with with" -> "work with" Both are pure prose-quality fixes — no functional or API change. * chore(deps): bump pre-commit from 4.5.1 to 4.6.0 (#9699) Bumps [pre-commit](https://github.com/pre-commit/pre-commit) from 4.5.1 to 4.6.0. - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md) - [Commits](pre-commit/pre-commit@v4.5.1...v4.6.0) --- updated-dependencies: - dependency-name: pre-commit dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump datamodel-code-generator from 0.31.1 to 0.56.1 (#9701) Bumps [datamodel-code-generator](https://github.com/koxudaxi/datamodel-code-generator) from 0.31.1 to 0.56.1. - [Release notes](https://github.com/koxudaxi/datamodel-code-generator/releases) - [Changelog](https://github.com/koxudaxi/datamodel-code-generator/blob/main/CHANGELOG.md) - [Commits](koxudaxi/datamodel-code-generator@0.31.1...0.56.1) --- updated-dependencies: - dependency-name: datamodel-code-generator dependency-version: 0.56.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump optuna from 4.4.0 to 4.8.0 (#9697) Bumps [optuna](https://github.com/optuna/optuna) from 4.4.0 to 4.8.0. - [Release notes](https://github.com/optuna/optuna/releases) - [Commits](optuna/optuna@v4.4.0...v4.8.0) --- updated-dependencies: - dependency-name: optuna dependency-version: 4.8.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump urllib3 from 1.26.6 to 2.6.3 (#9698) Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.6 to 2.6.3. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@1.26.6...2.6.3) --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.6.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump mkdocs-jupyter from 0.26.1 to 0.26.3 in /docs (#9700) Bumps [mkdocs-jupyter](https://github.com/danielfrg/mkdocs-jupyter) from 0.26.1 to 0.26.3. - [Changelog](https://github.com/danielfrg/mkdocs-jupyter/blob/main/CHANGELOG.md) - [Commits](https://github.com/danielfrg/mkdocs-jupyter/commits) --- updated-dependencies: - dependency-name: mkdocs-jupyter dependency-version: 0.26.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(docs): move Deployment to technical tabs; promote Use Cases under Community (#9709) * Update production use cases for DSPy Removed 'Replit' from the list of companies using DSPy in production. Signed-off-by: Omar Khattab <okhat@users.noreply.github.com> * chore(ci): remove unused setup-node step from docs-push workflow (#9702) The docs build was migrated from a Node-based static site generator to MkDocs in #1657 (Oct 2024), which switched the build commands to 'pip install -r requirements.txt && mkdocs build'. The 'Set up Node.js' step was left behind even though nothing in the build invokes node or npm: docs/requirements.txt is pure Python (mkdocs, mkdocs-material, mkdocs-jupyter, mkdocs-redirects, mkdocstrings, mkdocs-llmstxt). Verified locally by rebuilding the docs with node/npm stripped from PATH; build succeeded normally. Removes the dead step (and an unnecessary external action pin) so future dependabot churn on actions/setup-node no longer touches this workflow. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> * fix(clients): honor caching=False per-call in dspy.Embedder (#9708) `Embedder._preprocess` used `caching or self.caching`, silently ignoring caching=False when the instance default was True. Switched to an explicit None-sentinel check. * ci(release): open main version bump PR after publishing (#9716) Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Omar Khattab <okhat@users.noreply.github.com> Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gopal Bagaswar <67310594+GopalGB@users.noreply.github.com> Co-authored-by: Omar Khattab <okhat@users.noreply.github.com> Co-authored-by: Sitananda Prasad <spjosyula2005@outlook.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps astral-sh/setup-uv from 5.4.2 to 8.1.0.
Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
0880764fix: grant contents:write to validate-release job (#860)717d6abAdd a release-gate step to the release workflow (#859)5a911ebDraft commitish releases (#858)080c31eAdd action-types.yml to instructions (#857)b3e97d2Add input no-project in combination with activate-environment (#856)7dd591dchore(deps): bump release-drafter/release-drafter from 7.1.1 to 7.2.0 (#855)1541b77chore: update known checksums for 0.11.7 (#853)cdfb2eeRefactor version resolving (#852)cb84d12chore: update known checksums for 0.11.6 (#850)1912cc6chore: update known checksums for 0.11.5 (#845)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)