chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 in the github-actions group - #75
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps the github-actions group with 1 update: [actions/setup-python](https://github.com/actions/setup-python). Updates `actions/setup-python` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
area/automation
github-actions
Bot
added
area/docs
CruxExperts
added a commit
that referenced
this pull request
Jul 23, 2026
## Summary - rolls the accepted Localsetup 4.3.0 source slices into the release branch - retains trusted-work-queue phase 1 snapshot and phase 2 immutable shared-folder deposit/list/claim transport - defers phase 3 fanout/materialization/result handling to a future concrete external harness boundary - updates all 12 `actions/setup-python` uses across nine workflows to immutable v7.0.0 commit `5fda3b95a4ea91299a34e894583c3862153e4b97`, superseding #75 once this release reaches `main` - includes sole final source commit `1afc80397f6cfc1b6eeed6624fe0caa8d6740b4e` and sole tool-owned final sync `6797b9d226d8d32cee5de30d0d30ceb9131a2d54` ## Review resolution - prior linked-worktree and generated-receipt findings remain fixed - phase-3 findings are resolved for 4.3.0 by removing that unreleased implementation and API/tests rather than weakening its security boundary - retained phase-1/2 hardening includes bounded descriptor reads, owner-only packet creation, identity-bound cleanup, atomic Linux/macOS no-replace publication, serialized deposit-finalization/claim transactions, lane-only receipts, and exclude-before-child-artifact ordering - latest exact-head fixes bind packet PRD hashing to one no-follow/nonblocking regular-file descriptor and bind snapshot archive hash plus tar-member validation to one descriptor with post-read identity/size checks - generated documentation omits deleted phase-3 files and binds the source tree to `1afc80397f6cfc1b6eeed6624fe0caa8d6740b4e` ## Validation - focused retained queue, routing, and client-state tests: 340 passed, 5 subtests passed - exact `version-sync --check` and clean no-fix `publish-preflight` - catalog, package-surface, deterministic generated-doc drift, Python architecture, and framework-audit gates - shell smoke: 9 passed - full clean-environment suite: 1631 passed, 2 skipped, 8 warnings, 5 subtests passed - final independent descriptor-security, integrated release, and provenance/artifact reviews found no material findings - verified 4.3.0 tarball, SHA-256 `bb8a00ee799fa725d5f6a9c3ebcb22e6bc64a5a2e210a8bd8856f9f4a549977b`, and CycloneDX SBOM at source commit `6797b9d226d8d32cee5de30d0d30ceb9131a2d54`, with 26 expected components and no discrepancies - fresh required GitHub checks and exact-head review must pass before merge ## Supply-chain evidence Fresh OSV, GitHub Advisory Database, NVD, and CISA KEV checks found no exact `actions/setup-python` v7.0.0 target advisory. deps.dev does not map this GitHub Action and remains a documented coverage limitation. Official immutable tag/release metadata binds v7.0.0 to the pinned commit; Localsetup uses no removed `pip-install` input and all consumers run on GitHub-hosted `ubuntu-latest` with Python 3.12.
Contributor
Author
|
Looks like actions/setup-python is updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/github_actions/github-actions-151ba0d261
branch
July 23, 2026 02:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 1 update: actions/setup-python.
Updates
actions/setup-pythonfrom 6.3.0 to 7.0.0Release notes
Sourced from actions/setup-python's releases.
Commits
5fda3b9Pin SHA commits and update docs with latest versions (#1338)4ab7e95Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-00f3a009Remove the pip-install input (#1336)f8cf429Migrate to ESM and upgrade dependencies (#1330)54baeeaValidate and retry manifest fetch to prevent silent failures (#1332)c709277Annotation code fix (#1335)6849080remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions