)]}'
{
  "log": [
    {
      "commit": "72e190685e234ff0add1d427cd4b7e1a3e4eaf1f",
      "tree": "a2d0fde6bad49163f22f1b0fd7f7eef4de14bd09",
      "parents": [
        "1f6750ce69d1c13f784584d20c9fafe0e220f52b"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sun Sep 20 19:36:36 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 20 19:36:36 2026"
      },
      "message": "🐛 fix(upgrade): format generated notices (#3272)"
    },
    {
      "commit": "1f6750ce69d1c13f784584d20c9fafe0e220f52b",
      "tree": "65d235b9c3c25afde8aa4af5fa4148f08bd4276f",
      "parents": [
        "7549b430a8424297f4c3ffd4c007bb28878e00f5"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Sun Sep 20 00:28:01 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Sun Sep 20 00:28:01 2026"
      },
      "message": "release 21.9.0"
    },
    {
      "commit": "7549b430a8424297f4c3ffd4c007bb28878e00f5",
      "tree": "27e9202ca4cb59bf1c6f91399890cdfa7ca4aae4",
      "parents": [
        "f4f69f8103eabf45e4af492b9853407573d40d6f"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sat Sep 19 17:49:48 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 17:49:48 2026"
      },
      "message": "✨ feat(build): make the embedded SBOM exhaustive (#3270)"
    },
    {
      "commit": "f4f69f8103eabf45e4af492b9853407573d40d6f",
      "tree": "d98615dcdfeb0ccb572173b873e7d714eebfe34d",
      "parents": [
        "ab0e25f350e937069ad1e497d1f587044e6c3666"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sat Sep 19 16:25:21 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 16:25:21 2026"
      },
      "message": "✨ feat(build): add SBOM timestamp and generator metadata (#3269)\n\nThe embedded SBOM\u0027s `metadata` block only carries the root `component`.\n`auditwheel` and Microsoft\u0027s `bocpy`, which hand-roll the same CycloneDX\nshape virtualenv does, both go further: `auditwheel` names itself in\n`metadata.tools`, and `bocpy` adds `metadata.timestamp` plus a nested\n`metadata.tools.components` entry for its own generator script. Neither\nputs build-environment details like the OS or Python version anywhere in\nthe SBOM. That\u0027s the SLSA build provenance attestation\u0027s job, and the\nrelease workflow already generates one; duplicating it here would blur\nthe line between what an SBOM describes (composition) and what an\nattestation describes (the build process), on top of risking the same\nreproducibility bug `serialNumber` had before #3268.\n\n`hatch_build.py` now derives `metadata.timestamp` from hatchling\u0027s own\n`get_reproducible_timestamp()`, the helper it already uses for the\nwheel\u0027s zip entry timestamps, so setting `SOURCE_DATE_EPOCH` for a\nreproducible build still produces a byte-identical SBOM. 🔁 I built the\nwheel twice with a fixed `SOURCE_DATE_EPOCH` and diffed the resulting\n`metadata.timestamp` and `serialNumber` values to confirm it.\n`metadata.tools.components` names `hatch_build.py` as the generator with\nno version number, since it has no version of its own and ships in\nlockstep with virtualenv. `tasks/validate_sbom.py` checks both fields\nthe same way it checks `serialNumber`."
    },
    {
      "commit": "ab0e25f350e937069ad1e497d1f587044e6c3666",
      "tree": "5c60854a62029acb4b70b9ad71d66513d26b5f3e",
      "parents": [
        "1d287967f309a9567e9b91490e903fadc973a0d1"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Sat Sep 19 15:54:42 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Sat Sep 19 15:54:42 2026"
      },
      "message": "release 21.8.1"
    },
    {
      "commit": "1d287967f309a9567e9b91490e903fadc973a0d1",
      "tree": "58cfa49bd837d12ca7e2b773cad31abca11da97f",
      "parents": [
        "a8b7f0a26fbed698a13f5fed8e2137506b3f9313"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sat Sep 19 15:53:41 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 15:53:41 2026"
      },
      "message": "🐛 fix(build): make the SBOM serial number deterministic and validate its structure in CI (#3268)\n\n`actions/attest`\u0027s own CycloneDX detector checks for `bomFormat`,\n`serialNumber`, and `specVersion` together before it treats a file as\nCycloneDX at all. 🔐 `serialNumber` is optional in the CycloneDX spec\nitself, but this action\u0027s format sniffer treats its absence as an\nunrecognized format rather than a valid document missing an optional\nfield, and refuses to attest it: `Error: Unsupported SBOM format. Must\nbe valid SPDX or CycloneDX JSON.`\n\nNothing in pull request CI catches this, since\n[`release.yaml`](https://github.com/pypa/virtualenv/blob/main/.github/workflows/release.yaml)\nonly runs on a tag push, so this code path only ever executed for real\ninside the [21.8.0\nrelease](https://github.com/pypa/virtualenv/actions/runs/35450914261),\nwhich failed at the attestation step as a result.\n\nA random `uuid4` satisfies that check but makes every build\u0027s SBOM\nnon-reproducible even from an identical source tree. Looking at how\ncomparable projects handle this: `auditwheel` and `maturin` both\nhand-roll the same CycloneDX document shape virtualenv does and ship the\nidentical missing-`serialNumber` gap in production today, while\nMicrosoft\u0027s `bocpy` is the one real precedent that gets this right,\nderiving a `uuid5` from stable build inputs so rebuilds are\nbyte-identical. `hatch_build.py` now does the same, seeded from the\npackage name, version, and the sorted bundled-wheel hashes. No CycloneDX\nlibrary was adopted for this: nothing surveyed uses one for this exact\ncase, since the object-model layer such libraries provide is built\naround resolving an installed dependency graph, and there is no such\ngraph here, only one root component and a flat list of bundled,\nundeclared wheels.\n\nThe more consequential gap is procedural rather than a missing field:\nthe wheel build and package checks already run on every pull request,\nbut nothing in that path inspected the SBOM\u0027s actual structure, so a\nfuture format change on the consumer side would fail silently again\nuntil the next real tag push. `tasks/validate_sbom.py` adds a small,\nstdlib-only check of the exact invariants `actions/attest`\u0027s format\nsniffer cares about, wired into the existing `tox -e readme` environment\nthat already builds and checks the wheel on every PR across Linux and\nWindows. I confirmed it both passes against a correct build and fails\nagainst a wheel with `serialNumber` stripped, reproducing the original\nbug exactly. 🧪"
    },
    {
      "commit": "a8b7f0a26fbed698a13f5fed8e2137506b3f9313",
      "tree": "176bb98b20237659a6f6765a77511e176f3692b7",
      "parents": [
        "da2aacc1f1d81310f37134473711112eba4334a1"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Sep 19 15:41:37 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 15:41:37 2026"
      },
      "message": "chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-actions group (#3267)\n\nBumps the github-actions group with 1 update:\n[astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).\n\nUpdates `astral-sh/setup-uv` from 10.0.1 to 10.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/releases\"\u003eastral-sh/setup-uv\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev10.1.0 🌈 New output \u003ccode\u003epython-runtime-id\u003c/code\u003eand respect\nNO_PROXY\u003c/h2\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cp\u003eThis release adds more bheind the scene security improvements and\nalso 2 small improvements.\u003c/p\u003e\n\u003ch3\u003eNO_PROXY\u003c/h3\u003e\n\u003cp\u003eThis action now respects \u003ccode\u003eno_proxy/NO_PROXY\u003c/code\u003e environment\nvariables which were previously ignored.\u003c/p\u003e\n\u003ch3\u003eNew output \u003ccode\u003epython-runtime-id\u003c/code\u003e\u003c/h3\u003e\n\u003cp\u003eThe new output \u003ccode\u003epython-runtime-id\u003c/code\u003e can be used to know\nwhich python version exactly was installed if you use\n\u003ccode\u003eactivate-environment\u003c/code\u003e. See \u003ca\nhref\u003d\"https://redirect.github.com/pyca/cryptography/pull/15572#discussion_r3913508686\"\u003epyca/cryptography#15572\u003c/a\u003e\nfor details on why this can be useful.\u003c/p\u003e\n\u003ch2\u003e🐛 Bug fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: respect no proxy directive \u003ca\nhref\u003d\"https://github.com/mj0nez\"\u003e\u003ccode\u003e@​mj0nez\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1037\"\u003e#1037\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse JSON + a typed wrapper instead of TS codegen \u003ca\nhref\u003d\"https://github.com/woodruffw\"\u003e\u003ccode\u003e@​woodruffw\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1025\"\u003e#1025\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🚀 Enhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eExpose a Python \u0026quot;identity\u0026quot; output \u003ca\nhref\u003d\"https://github.com/woodruffw\"\u003e\u003ccode\u003e@​woodruffw\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1036\"\u003e#1036\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eVerify downloads with astral-sh/versions checksums \u003ca\nhref\u003d\"https://github.com/zaniebot\"\u003e\u003ccode\u003e@​zaniebot\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1033\"\u003e#1033\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🧰 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore: update known checksums for 0.12.12 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1041\"\u003e#1041\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.10/0.12.11 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1038\"\u003e#1038\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.9 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1035\"\u003e#1035\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.7/0.12.8 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1031\"\u003e#1031\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.6 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1030\"\u003e#1030\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.12.5 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1020\"\u003e#1020\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse self-repo syntax for all in-repo actions/reusable workflows \u003ca\nhref\u003d\"https://github.com/woodruffw\"\u003e\u003ccode\u003e@​woodruffw\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1024\"\u003e#1024\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003ePin one-shot tools \u003ca\nhref\u003d\"https://github.com/woodruffw\"\u003e\u003ccode\u003e@​woodruffw\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1022\"\u003e#1022\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eci: remove obsolete direct push attempts \u003ca\nhref\u003d\"https://github.com/eifinger\"\u003e\u003ccode\u003e@​eifinger\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1019\"\u003e#1019\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📚 Documentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update version references to v10.0.1 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1018\"\u003e#1018\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⬆️ Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps-dev): roll up Dependabot updates \u003ca\nhref\u003d\"https://github.com/eifinger\"\u003e\u003ccode\u003e@​eifinger\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1043\"\u003e#1043\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eHarden npm install defaults \u003ca\nhref\u003d\"https://github.com/zaniebot\"\u003e\u003ccode\u003e@​zaniebot\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1026\"\u003e#1026\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd dependency cooldowns \u003ca\nhref\u003d\"https://github.com/woodruffw\"\u003e\u003ccode\u003e@​woodruffw\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1021\"\u003e#1021\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/bec219d24cd3e171d82865faccec33120bb574f4\"\u003e\u003ccode\u003ebec219d\u003c/code\u003e\u003c/a\u003e\nchore(deps-dev): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1043\"\u003e#1043\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/b90ec40d15bfa44c33c6700196eb6efcdddb4373\"\u003e\u003ccode\u003eb90ec40\u003c/code\u003e\u003c/a\u003e\nfix: respect no proxy directive (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1037\"\u003e#1037\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/421feb646df5262e7dd93bc54161edfa30372417\"\u003e\u003ccode\u003e421feb6\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.12.12 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1041\"\u003e#1041\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/f634bf473ad85bf3e23a613f52c5fa9f363874fc\"\u003e\u003ccode\u003ef634bf4\u003c/code\u003e\u003c/a\u003e\nExpose a Python \u0026quot;identity\u0026quot; output (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1036\"\u003e#1036\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/a6772c8f0a09dc9e3582c70a994b0c55af921803\"\u003e\u003ccode\u003ea6772c8\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.12.10/0.12.11 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1038\"\u003e#1038\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/e105c8fb1d7b13074b851babdaef4185243c6a07\"\u003e\u003ccode\u003ee105c8f\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.12.9 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1035\"\u003e#1035\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/cd13f9217092d43a771cf9ba7b09bdd3da8d7c4d\"\u003e\u003ccode\u003ecd13f92\u003c/code\u003e\u003c/a\u003e\nVerify downloads with astral-sh/versions checksums (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1033\"\u003e#1033\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/3aef7b92c52cec135792ea1e95f4c77683d39e61\"\u003e\u003ccode\u003e3aef7b9\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.12.7/0.12.8 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1031\"\u003e#1031\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/d08d816a1ea176d61a318eff45abd3dffef415b1\"\u003e\u003ccode\u003ed08d816\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.12.6 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1030\"\u003e#1030\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/19b4d1e990bec64818914c40230bde93a0de300b\"\u003e\u003ccode\u003e19b4d1e\u003c/code\u003e\u003c/a\u003e\nHarden npm install defaults (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1026\"\u003e#1026\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/compare/20cfd1bf945f4377ade1205e4dbc17946fc9a30d...bec219d24cd3e171d82865faccec33120bb574f4\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dastral-sh/setup-uv\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d10.0.1\u0026new-version\u003d10.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "da2aacc1f1d81310f37134473711112eba4334a1",
      "tree": "22f8136b9fbe4e991eb872658cd2ebf8c3f82bbc",
      "parents": [
        "3d3537eca58c4d3366deb3bbb3a24cdc6a1480e1"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Sat Sep 19 15:09:11 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Sat Sep 19 15:09:11 2026"
      },
      "message": "release 21.8.0"
    },
    {
      "commit": "3d3537eca58c4d3366deb3bbb3a24cdc6a1480e1",
      "tree": "e69d95dbec4a397d796fc0a67c87680879601488",
      "parents": [
        "777dc41cff5ef9b32fb71c9f7a1a844aecd07a70"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sat Sep 19 15:07:59 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 15:07:59 2026"
      },
      "message": "🔧 chore(deps): watch pip ecosystem with Dependabot (#3264)\n\nDependabot only watched the `github-actions` ecosystem, so the six\nruntime dependencies declared in `pyproject.toml` (`distlib`,\n`filelock`, `platformdirs`, `python-discovery`, `typing-extensions`) got\nno automated bump proposals at all. 🤖 Adding a `pip` ecosystem entry\ncloses that gap, using the same weekly Tuesday schedule and 7-day\ncooldown as the existing `github-actions` entry, and grouping the\nresulting PRs the same way so a bump doesn\u0027t fan out into five separate\nones.\n\nNo changelog fragment: this changes repository automation configuration,\nnot runtime, packaging, or user-visible behaviour."
    },
    {
      "commit": "777dc41cff5ef9b32fb71c9f7a1a844aecd07a70",
      "tree": "f5f9d861749b8096346a621fef01f8086946dc88",
      "parents": [
        "3e95492a67f7edde0c4717fcce93cb8ba3a0af43"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sat Sep 19 15:07:47 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 15:07:47 2026"
      },
      "message": "✨ feat(build): ship a CycloneDX SBOM in every wheel (#3265)\n\nDownstream consumers scanning for bundled software cannot see the pip\nand setuptools wheels virtualenv embeds under\n`src/virtualenv/seed/wheels/embed`. 📦 I tested syft, cyclonedx-py, and\nGitHub\u0027s own dependency-graph export against a real build of this\nproject: each one reads declared dependency metadata or an installed\nenvironment, and these wheels are neither. They are data files,\ninvisible to every tool tried, so anyone auditing what a virtualenv\ninstall actually contains has no way to find them today.\n\n[PEP 770](https://peps.python.org/pep-0770/) exists for exactly this\ncase. `hatch_build.py` adds a hatchling build hook that writes a\nCycloneDX 1.6 document into the wheel\u0027s `.dist-info/sboms/` directory,\ndeclaring each bundled wheel with its name, version, licence, and the\nSHA-256 already computed for integrity checking at install time. The\nhook reads `BUNDLE_SUPPORT` and `BUNDLE_SHA256` straight out of the\nexisting `embed/__init__.py` with `ast.literal_eval`, the same approach\n`tasks/upgrade_wheels.py` already uses to regenerate those tables, so a\nwheel bump keeps the SBOM current without a separate update step.\n\nNo scanner runs in CI. Every one I tested against this repository either\nfound nothing or a component list that omitted the four things actually\nworth declaring, so adding one here would add a dependency and an\nupgrade treadmill just to reproduce data `pyproject.toml` already\nstates. 🔍\n\n`hatchling\u003e\u003d1.28` is now required, since that is the release that added\n`sbom-files` support. The release workflow extracts the SBOM from the\nbuilt wheel and attests it against the sdist and wheel with\n`actions/attest`, whose required permissions (`id-token`,\n`attestations`, `artifact-metadata`) I checked against the action\u0027s own\ndocumentation rather than assume, and whose pinned SHA I resolved from\nits real tags rather than copy from a neighbouring step."
    },
    {
      "commit": "3e95492a67f7edde0c4717fcce93cb8ba3a0af43",
      "tree": "593983863a7064552e1181d09470b963c3721bf5",
      "parents": [
        "4c946c2555260b87d94b2f8ede45215e2f75e70b"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sat Sep 19 14:55:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 14:55:52 2026"
      },
      "message": "✨ feat(build): publish a third-party notices file (#3266)\n\nvirtualenv already satisfies its MIT obligations. 📄 Every embedded pip\nand setuptools wheel carries its own MIT notice inside its own\n`.dist-info/licenses/` directory, and virtualenv redistributes that\nwheel unmodified, notice included. What was missing was discoverability,\nnot compliance: nothing at the top level told a downstream auditor those\nnotices existed or where to find them without unzipping a bundled wheel\nto check.\n\n`tasks/upgrade_wheels.py` now writes `THIRD-PARTY-NOTICES.md` alongside\n`embed/__init__.py`, reading the same `BUNDLE_SHA256` table so a wheel\nbump keeps it current with no separate update step. Only the licence of\nthe wheel virtualenv itself redistributes gets reproduced; whatever that\nwheel in turn vendors already carries its own licence inside it, so\nduplicating those at the top level would only add churn on every bump\nfor no benefit. Identical licence text across bundled versions of the\nsame package collapses into one section listing every matching filename,\nwhich is why `pip-26.0.1` and `pip-26.2.1` share a section today.\n\n`LICENSE` itself stays untouched. [GitHub\u0027s own\nguidance](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository)\nwarns that a licence file complicated by appended text can stop its\ndetector from naming a licence at all, showing \"View license\" in the\nsidebar instead, which is exactly what happens on projects that append\nthird-party text to their own `LICENSE`. The notices live in a separate\nfile and are declared alongside `LICENSE` through [PEP\n639](https://peps.python.org/pep-0639/) `license-files` rather than\nfolded into it.\n\nA unit test asserts every currently bundled distribution has a section\nin the checked-in file, so a wheel bump that forgets to regenerate it\nfails loudly instead of silently drifting."
    },
    {
      "commit": "4c946c2555260b87d94b2f8ede45215e2f75e70b",
      "tree": "307b7b24492593dcd2427090b607e1a0639e7941",
      "parents": [
        "630ae100ca873e619ff7dad2174ea25dc3b9454e"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Sat Sep 19 06:57:47 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Sat Sep 19 06:57:47 2026"
      },
      "message": "release 21.7.16"
    },
    {
      "commit": "630ae100ca873e619ff7dad2174ea25dc3b9454e",
      "tree": "79ca21e6a048c9652bbd9896784b53b92a0d5873",
      "parents": [
        "496e8c903d695051f8a4e27de481e25c9c42d865"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sat Sep 19 06:56:37 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 06:56:37 2026"
      },
      "message": "🐛 fix(activation): escape csh prompt expansion characters (#3263)"
    },
    {
      "commit": "496e8c903d695051f8a4e27de481e25c9c42d865",
      "tree": "c573801038c2a940e0a515da3380b7f4e9d490f8",
      "parents": [
        "85606520d3f56bf6eaefd1233f177119dd8dbb00"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sat Sep 19 04:10:05 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 04:10:05 2026"
      },
      "message": "📝 docs(security): document both reporting lanes and scope (#3261)\n\n`SECURITY.md` sent every reporter to Tidelift and advertised a supported\nversions table naming `20.15.1`, while the project ships `21.7.x`. 🔐\nThis repository has since turned on private vulnerability reporting, and\nGitHub [tells reporters they may ignore\n`SECURITY.md`](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)\nwhenever that feature is on. Reports therefore already arrive through a\ndoor the policy never described.\n\nThe policy now documents both lanes. It puts the [advisory\nform](https://github.com/pypa/virtualenv/security/advisories/new) first\nand keeps Tidelift for anyone without a GitHub account or holding a\nsubscription, since Tidelift carries a contractual response time that a\nsingle maintainer cannot promise unaided. A latest-only statement\nreplaces the version table and removes the failure mode that let the old\none rot. The policy also names acknowledgement and assessment targets,\ncalls them targets rather than guarantees, and hands the reporter an\nescalation path when they slip, which beats implying cover that nobody\nprovides.\n\nThe scope section comes from the advisories this project has already\npublished, not from a template. It covers caller-supplied values such as\n`--prompt` or the destination path reaching generated activation scripts\nor `pyvenv.cfg` with their meaning changed, the integrity of downloaded\nseed wheels, and writes landing outside the directory virtualenv was\npointed at. For the out-of-scope half it borrows the reasoning\n[pip](https://github.com/pypa/pip/blob/main/SECURITY.md) and\n[curl](https://github.com/curl/curl/blob/master/docs/VULN-DISCLOSURE-POLICY.md)\napply to an attacker who already owns the machine or chooses the command\nline. It closes by asking for the report anyway when a reporter cannot\ntell which side their finding falls on. 📄\n\nTwo notes for review. This carries no changelog fragment, since it\nchanges repository governance rather than runtime, packaging or\nuser-visible behaviour. The `CWE` mention stays unlinked because\n`cwe.mitre.org` trips both `typos` and `codespell`, and teaching two\nspell checkers about MITRE belongs in its own change."
    },
    {
      "commit": "85606520d3f56bf6eaefd1233f177119dd8dbb00",
      "tree": "8a1be12ff55f4af3b1da44b502eb1bb5d11bbb0c",
      "parents": [
        "502d383b4e1af50fb66486b2666eac31ff5c4537"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sat Sep 19 04:09:53 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 19 04:09:53 2026"
      },
      "message": "📝 docs(security): add an incident response plan (#3262)\n\n`SECURITY.md` tells a reporter how to reach the project and what counts\nas a vulnerability. 🛡️ It says nothing about what happens after that,\nand nothing at all about the incidents that are not code bugs: a\ntampered artifact on PyPI or `bootstrap.pypa.io`, a tag nobody pushed, a\ncompromised publishing credential. Those are the cases where working out\nwhat to do while it is happening goes worst, and they are the likelier\nreal incident for a project with one maintainer.\n\nThis adds `.github/INCIDENT_RESPONSE.md` as the complement, so the\npolicy stays reporter-facing and the process lives next to it. It names\none responder and then says nothing depends on that staying true, since\nanyone holding release rights can run it. It states plainly that there\nis no rotation and no out-of-hours cover, which makes the targets in the\npolicy read as what one person can manage rather than as a service\nlevel, and it records the split that already exists in practice:\n[Tidelift](https://tidelift.com/security) handles intake, the first\nreply and release-timing coordination, while triage, the fix, the\nrelease and the announcement stay with the maintainer.\n\nSeverity is four judged levels with worked examples taken from\nadvisories already published against this project, and no CVSS vector.\nThat matches what has actually happened here, where three of five\nadvisories carry no vector at all, and it follows the reasoning\n[curl](https://curl.se/dev/vuln-disclosure.html), the ASF and OpenSSL\neach give for refusing numeric scores on a library, where the score\ndepends on how a caller invokes the code. Severity drives exactly one\ndecision: whether a fix is built in a private fork and released out of\nband, or goes through an ordinary pull request that does not advertise\nitself.\n\nThe containment step is the part with no equivalent anywhere in the\ncurrent docs, covering the PyPI yank, credential and `release`\nenvironment revocation, tag verification against known-good commits, and\nthe `bootstrap.pypa.io/virtualenv.pyz` rollback. The closing sections\nkeep repair items out of the closed advisory, where nobody reads them\nagain, so they survive as public issues once the release ships.\n\nTwo notes for review. No changelog fragment, on the same reasoning as\n#3261: repository governance rather than runtime, packaging or\nuser-visible behaviour. And the reciprocal link from `SECURITY.md` is\ndeliberately absent here to avoid conflicting with #3261, which rewrites\nthat file; it belongs in whichever of the two lands second. 🔗"
    },
    {
      "commit": "502d383b4e1af50fb66486b2666eac31ff5c4537",
      "tree": "822ae041e048d2558e60390585aaded9ab342a9b",
      "parents": [
        "fc2f35f51d563c495564f4709ec1a22f0c686352"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Sep 18 23:14:53 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Sep 18 23:14:53 2026"
      },
      "message": "release 21.7.15"
    },
    {
      "commit": "fc2f35f51d563c495564f4709ec1a22f0c686352",
      "tree": "0a317b1a3d3bb40db59f8d33c76c4218f005f89f",
      "parents": [
        "ee55cc271542fdbfd2d38151196ca18019282736"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Sep 18 23:13:33 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 23:13:33 2026"
      },
      "message": "🐛 fix(activation): make csh deactivate work without test (#3260)"
    },
    {
      "commit": "ee55cc271542fdbfd2d38151196ca18019282736",
      "tree": "8fab808403d53f4dcbd075d91823b5bb1c6288f9",
      "parents": [
        "9baea3c1212d8f8b083337afcb28005ecb27385d"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Sep 18 23:00:06 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 23:00:06 2026"
      },
      "message": "🐛 fix(activation): restore empty saved values on deactivate (#3259)"
    },
    {
      "commit": "9baea3c1212d8f8b083337afcb28005ecb27385d",
      "tree": "282a1c0b33133b156532f16160d6d9ecfd5f48ac",
      "parents": [
        "ab3dcff43d7ba8abc516e58c24f9bbb6e408d971"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Sep 18 05:22:57 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Sep 18 05:22:57 2026"
      },
      "message": "release 21.7.14"
    },
    {
      "commit": "ab3dcff43d7ba8abc516e58c24f9bbb6e408d971",
      "tree": "d7b3d5019c12cd7ee79fd36a74a1df455478673b",
      "parents": [
        "0c295ff1a5f298e8e11935e3588f59f7455c1f8f"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Sep 18 05:21:40 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 05:21:40 2026"
      },
      "message": "🐛 fix(activation): escape ! for csh history expansion (#3256)"
    },
    {
      "commit": "0c295ff1a5f298e8e11935e3588f59f7455c1f8f",
      "tree": "db64be689cd1b2a6bdc088e00088784fe2b6a8e5",
      "parents": [
        "4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Sep 18 04:34:13 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Sep 18 04:34:13 2026"
      },
      "message": "release 21.7.13"
    },
    {
      "commit": "4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6",
      "tree": "26d3de5c0a443b15bdb539043482a77abfaadb28",
      "parents": [
        "0525dcea21865059ffedc70054f6f982be723992"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Sep 18 04:10:09 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 04:10:09 2026"
      },
      "message": "🐛 fix(activation): stop path command injection in bash and fish (#3252)"
    },
    {
      "commit": "0525dcea21865059ffedc70054f6f982be723992",
      "tree": "a5d6545f6dd174de5fb5aecd932609ed40f39dee",
      "parents": [
        "aa8323a907834e9c16fb734613ce41a6d7e27260"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Sep 18 04:09:51 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 04:09:51 2026"
      },
      "message": "👷 ci: scope the nushell apt key to its own repo (#3253)"
    },
    {
      "commit": "aa8323a907834e9c16fb734613ce41a6d7e27260",
      "tree": "8fd435a17fb67dbf455e19f87bf8fac222f8ae80",
      "parents": [
        "a43547765e017f3a13f029e24c6e6f73882e15bc"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Sep 18 04:09:24 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 04:09:24 2026"
      },
      "message": "🔧 chore: drop misc as a changelog fragment type (#3255)"
    },
    {
      "commit": "a43547765e017f3a13f029e24c6e6f73882e15bc",
      "tree": "64d059da4a71a9872bed91286daa27cf1c1e1796",
      "parents": [
        "9666b42afc8d6103e765d77958d7bae782f5406e"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Sep 18 03:59:18 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 03:59:18 2026"
      },
      "message": "👷 ci: correct a stale checkout pin comment (#3254)"
    },
    {
      "commit": "9666b42afc8d6103e765d77958d7bae782f5406e",
      "tree": "0399d484baee69a4be8d7feb73628bc4088e4165",
      "parents": [
        "a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Sep 18 01:39:17 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Sep 18 01:39:17 2026"
      },
      "message": "release 21.7.12"
    },
    {
      "commit": "a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d",
      "tree": "087fc29c0d6a803b383cb41715187e6f3266112a",
      "parents": [
        "d721ff140ce4afdc2a9b76751e4584e25d9fbea6"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Sep 18 01:37:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 01:37:42 2026"
      },
      "message": "🐛 fix(seed): verify downloaded wheel digests (#3251)\n\nCo-authored-by: pre-commit-ci[bot] \u003c66853113+pre-commit-ci[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "d721ff140ce4afdc2a9b76751e4584e25d9fbea6",
      "tree": "7da19c4bbe60c057e3f2ba5eb62c80ed6e624a63",
      "parents": [
        "087a2ef8bd3aa15b562a3558b1068f603e50f77a"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Sep 18 01:37:29 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 01:37:29 2026"
      },
      "message": "🐛 fix(activation): escape batch quote() against injection (#3250)\n\nCo-authored-by: pre-commit-ci[bot] \u003c66853113+pre-commit-ci[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "087a2ef8bd3aa15b562a3558b1068f603e50f77a",
      "tree": "1b973b60d3fcc5fc22ae6a42978d9de15a944d59",
      "parents": [
        "73e352ae02bfa52ffc0e307b04f1b6a7168c4eb0"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Thu Sep 17 21:13:57 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 21:13:57 2026"
      },
      "message": "🔧 chore(changelog): drop dead CVE-2026-24049 fragment (#3249)"
    },
    {
      "commit": "73e352ae02bfa52ffc0e307b04f1b6a7168c4eb0",
      "tree": "b62c0f347f9993a968eb2fe2e577be8983315df1",
      "parents": [
        "68ee5a3f27ca44912af9bd73c4c87e41978a8c08"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Thu Sep 17 16:30:08 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Thu Sep 17 16:30:08 2026"
      },
      "message": "release 21.7.11"
    },
    {
      "commit": "68ee5a3f27ca44912af9bd73c4c87e41978a8c08",
      "tree": "692252b613059505a7989192a7edeb84ce2b3005",
      "parents": [
        "787d1c9a0843310200f37861e6b2744a7d1e5364"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Thu Sep 17 16:28:29 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 16:28:29 2026"
      },
      "message": "📝 docs(readme): add OpenSSF Best Practices badge (#3248)\n\nThe README carries an OpenSSF Scorecard badge but not the companion Best\nPractices one, so a reader has no signal about the self-certification\nwork behind the [bestpractices.dev\nproject](https://www.bestpractices.dev/projects/14689). The Scorecard\n`CII-Best-Practices` check reads that project directly, which makes it\npart of the same security-posture story the neighbouring badge already\ntells.\n\nThe badge image reflects the live tier, so it moves from `in progress`\nto `passing` on its own once the remaining criteria are answered. No\nworkflow or packaging change is involved."
    },
    {
      "commit": "787d1c9a0843310200f37861e6b2744a7d1e5364",
      "tree": "2a3e5f0ac379b81dc29db262ce641055e4ce7eca",
      "parents": [
        "a30f995461043acb6cacbf3a890951563ccf7140"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Thu Sep 17 16:28:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 16:28:22 2026"
      },
      "message": "🔧 chore(test): add opt-in Atheris fuzz harness (#3246)\n\nOpenSSF Scorecard\u0027s Fuzzing check scores 0 for this repo. Its detection\nonly checks for `import atheris` (or a ClusterFuzzLite/OSS-Fuzz setup)\nanywhere in the tree, so this adds a real target rather than a token\nimport that would move the number without doing anything.\n\n`NushellActivator.quote` and `PowerShellActivator.quote` are hand-rolled\nescaping schemes over arbitrary strings pulled from paths and prompts:\nNushell counts the longest run of `#` and wraps in one more than that,\nPowerShell doubles single quotes. Both take untrusted-shaped input, and\na broken escape is a correctness bug worth catching, not just a lint\ntarget. Each harness in `tasks/fuzz_*.py` recomputes the expected output\nfrom the escaping rule on its own and asserts equality against the real\nfunction, so it fails on any scheme violation, not only on a crash. I\nran both assertions against 200k+ randomized adversarial strings\n(embedded quotes, `#` runs, control characters, Unicode) against the\nreal functions before wiring them into Atheris.\n\nAtheris only ships prebuilt wheels for Linux + CPython 3.12-3.14 - it\ndoesn\u0027t build on this machine at all, since Apple Clang doesn\u0027t ship\nlibFuzzer. It lives in its own `fuzz` dependency group with a marker\nmatching that exact combination, so nothing else ever tries to install\nit or falls into a doomed source build. `tox -e fuzz` is opt-in and\noutside `env_list`, so no existing environment or CI job changes."
    },
    {
      "commit": "a30f995461043acb6cacbf3a890951563ccf7140",
      "tree": "7c8b959855e939deec3c0aaf787a0f4c63fbc47c",
      "parents": [
        "469dd28e659f7cd3e7d8cdb3f1245c125d32e817"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Thu Sep 17 16:06:12 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 16:06:12 2026"
      },
      "message": "🐛 fix(create): keep pyvenv.cfg values on a single line (#3247)"
    },
    {
      "commit": "469dd28e659f7cd3e7d8cdb3f1245c125d32e817",
      "tree": "855880a10c15b98f25d41c08df74b45f5937cfb1",
      "parents": [
        "a045a14c76dcb71d1811fe57aa6c5f4fad2357cd"
      ],
      "author": {
        "name": "darrenhuai",
        "email": "60621295+darrenhuai@users.noreply.github.com",
        "time": "Thu Sep 17 14:09:47 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 14:09:47 2026"
      },
      "message": "🐛 fix(activation): undo a live activation before activate.bat saves values (#3245)"
    },
    {
      "commit": "a045a14c76dcb71d1811fe57aa6c5f4fad2357cd",
      "tree": "ccad0c6c1df290acbb6281080b0e6cb9d233ccb4",
      "parents": [
        "7c1991e06295fcb4e01945afca20fd11755c0ed1"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Thu Sep 17 05:23:58 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 05:23:58 2026"
      },
      "message": "👷 ci: run macOS jobs on macos-26 (#3244)"
    },
    {
      "commit": "7c1991e06295fcb4e01945afca20fd11755c0ed1",
      "tree": "87c695ac0629d1e80cead6c110c7b05673657e4c",
      "parents": [
        "13ed8ccd9b13a89c9a48324e98b1363d78990089"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Thu Sep 17 05:23:42 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 05:23:42 2026"
      },
      "message": "🐛 fix(ci): mark real-shell activation tests as slow (#3243)"
    },
    {
      "commit": "13ed8ccd9b13a89c9a48324e98b1363d78990089",
      "tree": "8396c5af6017eb89fbe8c79c63ceb67df76de61b",
      "parents": [
        "e13bb213aa649baab1c0bf70374421bac0083853"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Thu Sep 17 03:52:58 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 03:52:58 2026"
      },
      "message": "🐛 fix(ci): parallelize graalpy tests, recover crashed workers (#3240)"
    },
    {
      "commit": "e13bb213aa649baab1c0bf70374421bac0083853",
      "tree": "d95783aac61683fca8186bf5a734db9e1b23a32a",
      "parents": [
        "18a239dd17efd33a596e203a836ec9463157ade6"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Wed Sep 16 23:00:57 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 23:00:57 2026"
      },
      "message": "👷 ci: harden Scorecard-scored checks in CI (#3241)"
    },
    {
      "commit": "18a239dd17efd33a596e203a836ec9463157ade6",
      "tree": "8b6090d2ed3fc54889e9ddb0ac13f456696995a8",
      "parents": [
        "0c2fcafdc6449d5998f28429b1ecc714e2e4a465"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Wed Sep 16 23:00:48 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 23:00:48 2026"
      },
      "message": "👷 ci(release): attest and sign release provenance (#3242)"
    },
    {
      "commit": "0c2fcafdc6449d5998f28429b1ecc714e2e4a465",
      "tree": "262db842bc47ccb62cfbf9a3b1fd9c49529d9271",
      "parents": [
        "903d05dc7b19798db8e59d4aa51ea1ae5b0102d9"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Wed Sep 16 22:16:39 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 22:16:39 2026"
      },
      "message": "Document AI-assisted contributions and licensing policy (#3239)"
    },
    {
      "commit": "903d05dc7b19798db8e59d4aa51ea1ae5b0102d9",
      "tree": "a9ef1b207ab5674189eb30a13b31ad5449bb5866",
      "parents": [
        "7af37246dfa15b42e9415ceca1315f4383eb5401"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Wed Sep 16 22:16:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 22:16:22 2026"
      },
      "message": "Add OpenSSF Scorecard workflow (#3238)"
    },
    {
      "commit": "7af37246dfa15b42e9415ceca1315f4383eb5401",
      "tree": "36cd6b68939adba7d61cf1df537e9e32434f0554",
      "parents": [
        "f90e92781597d99620beb39ebf03c4bb6694f3b8"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Tue Sep 15 23:34:49 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Tue Sep 15 23:34:49 2026"
      },
      "message": "release 21.7.10"
    },
    {
      "commit": "f90e92781597d99620beb39ebf03c4bb6694f3b8",
      "tree": "e54d60b974d04ce8f36fd1181522792afa01b975",
      "parents": [
        "b5bd5207564ff04ddeb6227a498ea388bf9f5070"
      ],
      "author": {
        "name": "darrenhuai",
        "email": "60621295+darrenhuai@users.noreply.github.com",
        "time": "Tue Sep 15 23:33:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 23:33:34 2026"
      },
      "message": "🐛 fix(activation): restore PKG_CONFIG_PATH that was not set before (#3233)\n\nCo-authored-by: Bernat Gabor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "b5bd5207564ff04ddeb6227a498ea388bf9f5070",
      "tree": "e19365d47b112886ed2145d673b0a4a8e19d2be1",
      "parents": [
        "973298af31219c36ce1681fe33627c9e3731bf9c"
      ],
      "author": {
        "name": "Zhaoqi Xu",
        "email": "lzy00419@outlook.com",
        "time": "Tue Sep 15 22:56:32 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 22:56:32 2026"
      },
      "message": "🐛 fix(create): skip blank and comment lines in pyvenv.cfg (#3232)\n\nCo-authored-by: Bernat Gabor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "973298af31219c36ce1681fe33627c9e3731bf9c",
      "tree": "6a07c30024d0135737935296c50f7b4b9615011f",
      "parents": [
        "a438d8aaa1143d99a08a548cfa2b94e140225c31"
      ],
      "author": {
        "name": "darrenhuai",
        "email": "60621295+darrenhuai@users.noreply.github.com",
        "time": "Tue Sep 15 22:56:02 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 22:56:02 2026"
      },
      "message": "🐛 fix(activation): keep and restore the user\u0027s TCL_LIBRARY and TK_LIBRARY (#3234)\n\nCo-authored-by: Bernat Gabor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "a438d8aaa1143d99a08a548cfa2b94e140225c31",
      "tree": "d9e23d3afa29fdff36fa074853500b6fb2f7cb43",
      "parents": [
        "ca4025d81d5a6372020b720439a1c37a8a51f066"
      ],
      "author": {
        "name": "Vladimir Roshchin",
        "email": "51440383+even-even@users.noreply.github.com",
        "time": "Tue Sep 15 22:32:59 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 22:32:59 2026"
      },
      "message": "🔧 chore: check spelling with typos in pre-commit (#3235)\n\nCo-authored-by: vyuroshchin \u003c\u003e\nCo-authored-by: Bernat Gabor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "ca4025d81d5a6372020b720439a1c37a8a51f066",
      "tree": "8437b08d066a4e5665c48d321cf3b060af755b8d",
      "parents": [
        "abd3829378b6c14369962b43907f92049bb962e8"
      ],
      "author": {
        "name": "pre-commit-ci[bot]",
        "email": "66853113+pre-commit-ci[bot]@users.noreply.github.com",
        "time": "Mon Sep 14 19:32:47 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 14 19:32:47 2026"
      },
      "message": "[pre-commit.ci] pre-commit autoupdate (#3236)\n\n\u003c!--pre-commit.ci start--\u003e\nupdates:\n- [github.com/tox-dev/pyproject-fmt: v2.29.3 →\nv2.29.4](https://github.com/tox-dev/pyproject-fmt/compare/v2.29.3...v2.29.4)\n- [github.com/astral-sh/ruff-pre-commit: v0.16.6 →\nv0.16.7](https://github.com/astral-sh/ruff-pre-commit/compare/v0.16.6...v0.16.7)\n- [github.com/zizmorcore/zizmor-pre-commit: v1.30.0 →\nv1.30.1](https://github.com/zizmorcore/zizmor-pre-commit/compare/v1.30.0...v1.30.1)\n\u003c!--pre-commit.ci end--\u003e\n\nCo-authored-by: pre-commit-ci[bot] \u003c66853113+pre-commit-ci[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "abd3829378b6c14369962b43907f92049bb962e8",
      "tree": "3411d1ec345b4cf52f48f93388b6b41be73ce328",
      "parents": [
        "66fadcbfeac2977a12d4d671b81a32f0a3458cb4"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Wed Sep 09 01:01:38 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Wed Sep 09 01:01:38 2026"
      },
      "message": "release 21.7.9"
    },
    {
      "commit": "66fadcbfeac2977a12d4d671b81a32f0a3458cb4",
      "tree": "b48acddeb193ce0b06027d51d41a94cb00548461",
      "parents": [
        "4b31a6316a872a5c0713c88ace1ceb1782d6b5b4"
      ],
      "author": {
        "name": "darrenhuai",
        "email": "60621295+darrenhuai@users.noreply.github.com",
        "time": "Wed Sep 09 01:00:23 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 01:00:23 2026"
      },
      "message": "🐛 fix(util): replace a stale symlink instead of writing through it (#3229)\n\nCo-authored-by: Bernat Gabor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "4b31a6316a872a5c0713c88ace1ceb1782d6b5b4",
      "tree": "6c6f661309d89f1fa6d6a1e292887c3a0c273558",
      "parents": [
        "f9010b32c2116388a89080f4d07879772e28c820"
      ],
      "author": {
        "name": "darrenhuai",
        "email": "60621295+darrenhuai@users.noreply.github.com",
        "time": "Wed Sep 09 00:42:20 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 00:42:20 2026"
      },
      "message": "🐛 fix(config): ignore a config file that fails to parse instead of crashing (#3230)\n\nCo-authored-by: Bernat Gabor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "f9010b32c2116388a89080f4d07879772e28c820",
      "tree": "a411ed4edd33c03e7739a2e3fe22c481478d4afa",
      "parents": [
        "2ef85af47fcae15625ca7ad6f77452d5c78fadb2"
      ],
      "author": {
        "name": "pre-commit-ci[bot]",
        "email": "66853113+pre-commit-ci[bot]@users.noreply.github.com",
        "time": "Tue Sep 08 03:30:47 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 08 03:30:47 2026"
      },
      "message": "[pre-commit.ci] pre-commit autoupdate (#3231)\n\n\u003c!--pre-commit.ci start--\u003e\nupdates:\n- [github.com/tox-dev/tox-toml-fmt: v1.10.0 →\nv1.10.3](https://github.com/tox-dev/tox-toml-fmt/compare/v1.10.0...v1.10.3)\n- [github.com/tox-dev/pyproject-fmt: v2.29.0 →\nv2.29.3](https://github.com/tox-dev/pyproject-fmt/compare/v2.29.0...v2.29.3)\n- [github.com/astral-sh/ruff-pre-commit: v0.16.5 →\nv0.16.6](https://github.com/astral-sh/ruff-pre-commit/compare/v0.16.5...v0.16.6)\n\u003c!--pre-commit.ci end--\u003e\n\nCo-authored-by: pre-commit-ci[bot] \u003c66853113+pre-commit-ci[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "2ef85af47fcae15625ca7ad6f77452d5c78fadb2",
      "tree": "3eb5d8f59b56d4b2e3c509ae71a13f6ef86e73a4",
      "parents": [
        "e8e8615269d665cc5e780803e54846bb0beffb6d"
      ],
      "author": {
        "name": "Vladimir Roshchin",
        "email": "51440383+even-even@users.noreply.github.com",
        "time": "Tue Sep 01 16:17:50 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 16:17:50 2026"
      },
      "message": "fix(test): EncodingWarning: \u0027encoding\u0027 argument not specified (#3228)\n\nCo-authored-by: vyuroshchin \u003c\u003e"
    },
    {
      "commit": "e8e8615269d665cc5e780803e54846bb0beffb6d",
      "tree": "709f197e6635d0f08482f81bb3d822d526252066",
      "parents": [
        "f4e186e4a5349690eb00a941022559973ed86958"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Tue Sep 01 13:34:52 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Tue Sep 01 13:34:52 2026"
      },
      "message": "release 21.7.8"
    },
    {
      "commit": "f4e186e4a5349690eb00a941022559973ed86958",
      "tree": "7157e00c03e419a49dc4cd9240f72ef53776ae80",
      "parents": [
        "adfa9e463315c4f8f67845eb3de2d4857ddac78a"
      ],
      "author": {
        "name": "darrenhuai",
        "email": "60621295+darrenhuai@users.noreply.github.com",
        "time": "Tue Sep 01 05:14:38 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 05:14:38 2026"
      },
      "message": "🐛 fix(create): report a missing source that both modes need (#3227)"
    },
    {
      "commit": "adfa9e463315c4f8f67845eb3de2d4857ddac78a",
      "tree": "f5f2ba18d979ba8688ef84250c28464eb4525433",
      "parents": [
        "b65d93df5e727effffdd61a4e8be9f1a7f64b369"
      ],
      "author": {
        "name": "pre-commit-ci[bot]",
        "email": "66853113+pre-commit-ci[bot]@users.noreply.github.com",
        "time": "Tue Sep 01 04:37:40 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 04:37:40 2026"
      },
      "message": "[pre-commit.ci] pre-commit autoupdate (#3226)"
    },
    {
      "commit": "b65d93df5e727effffdd61a4e8be9f1a7f64b369",
      "tree": "78bd2e3f3b1ec800164e0beb4546b854cef13677",
      "parents": [
        "72776f2e7922aa0c442324b8b89b44d82d8e4445"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Aug 28 18:58:23 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Aug 28 18:58:23 2026"
      },
      "message": "release 21.7.7"
    },
    {
      "commit": "72776f2e7922aa0c442324b8b89b44d82d8e4445",
      "tree": "05c8861741bd5bc1233f1c3f12ad1e2b168dc202",
      "parents": [
        "8fab8d6ac125afcd0c41b806064daf0521faaecd"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Aug 28 18:57:08 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 18:57:08 2026"
      },
      "message": "🎨 refactor(create): read the system exe without narrowing (#3224)\n\nCo-authored-by: pre-commit-ci[bot] \u003c66853113+pre-commit-ci[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "8fab8d6ac125afcd0c41b806064daf0521faaecd",
      "tree": "17e58bc725ee146a474b38bd8e727a38cc506626",
      "parents": [
        "267f4cda46d450138750448bef10cb7758834772"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Aug 28 18:56:52 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 18:56:52 2026"
      },
      "message": "📄 docs: document the interpreter names in an environment (#3225)\n\nCo-authored-by: pre-commit-ci[bot] \u003c66853113+pre-commit-ci[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "267f4cda46d450138750448bef10cb7758834772",
      "tree": "fb63b396fc784ddb16c4fa690f995cd1eca97da9",
      "parents": [
        "28c4cd14d60887567c72df6eb2254e0deba11ea0"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Aug 28 16:16:29 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Aug 28 16:16:29 2026"
      },
      "message": "release 21.7.6"
    },
    {
      "commit": "28c4cd14d60887567c72df6eb2254e0deba11ea0",
      "tree": "95e0d49de4f5afdcfbdad7c135e1a2d9f34678ef",
      "parents": [
        "2a645aece0241e6dc02bf3d67acd88aa0770b601"
      ],
      "author": {
        "name": "darrenhuai",
        "email": "60621295+darrenhuai@users.noreply.github.com",
        "time": "Fri Aug 28 16:15:23 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 16:15:23 2026"
      },
      "message": "🐛 fix(create): name Windows venv exes after the interpreter (#3223)\n\nCo-authored-by: Bernat Gabor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "2a645aece0241e6dc02bf3d67acd88aa0770b601",
      "tree": "4f91217d5b0b3077bf792dcff42fc3d6e016deef",
      "parents": [
        "a48bf4bdce585ab2df7e3eef056b84591429976e"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Tue Aug 25 05:37:53 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Tue Aug 25 05:37:53 2026"
      },
      "message": "release 21.7.5"
    },
    {
      "commit": "a48bf4bdce585ab2df7e3eef056b84591429976e",
      "tree": "7b791e821eb56279781c8d2c5bd970b59d2dccbc",
      "parents": [
        "31b50810666aac5075a68472d7f9376148dac8d9"
      ],
      "author": {
        "name": "darrenhuai",
        "email": "60621295+darrenhuai@users.noreply.github.com",
        "time": "Tue Aug 25 04:29:58 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 04:29:58 2026"
      },
      "message": "🐛 fix(util): make safe_delete\u0027s error handler actually run (#3222)\n\n### Thanks for contributing, make sure you address all the checklists\n(for details on how see [development\ndocumentation](https://virtualenv.pypa.io/en/latest/development.html#development))\n\n- [x] ran the linter to address style issues (`tox -e fix`)\n- [x] wrote descriptive pull request text\n- [x] ensured there are test(s) validating the fix\n- [x] added news fragment in `docs/changelog` folder\n- [ ] updated/extended the documentation\n\n---\n\n`safe_delete` hands `shutil.rmtree` a chmod-and-retry handler and sets\n`ignore_errors\u003dTrue` at the same time:\n\n```python\ndef onerror(func, path, exc_info):\n    if not os.access(path, os.W_OK):\n        os.chmod(path, S_IWUSR)\n        func(path)\n    else:\n        raise\n\nshutil.rmtree(str(dest), ignore_errors\u003dTrue, onexc\u003donerror)\n```\n\n`rmtree` overwrites whatever handler it is given when `ignore_errors` is\nset — `onexc \u003d _onexc \u003d lambda *args: None` — so this handler has never\nrun. Every deletion failure was swallowed and `safe_delete` returned as\nif it had worked.\n\nThat matters on Windows, where the read-only attribute blocks\n`os.unlink`, and virtualenv marks every file in a wheel image read-only\nitself via `set_tree`. So:\n\n- `--reset-app-data` kept the image trees it reported removing\n- recreating an env with `--clear` could leave read-only files from the\nold one behind\n- replacing a seed package could leave a mix of old and new files\n\nI found this by asking what the `# ty: ignore[call-non-callable]` on the\n`func(path)` line was hiding. The suppression was there because `func`\nis annotated `object`, and `func` is annotated `object` because nothing\never called it. Before the fix, on Windows, `rmtree` left the tree in\nplace and the handler was invoked zero times.\n\nDropping `ignore_errors` lets the handler do what it was written to do:\nclear the read-only bit, retry, and surface anything it genuinely cannot\ndelete instead of pretending the delete succeeded. Typing `func`\nproperly removes the `ty` suppression — `ty check src/virtualenv` still\npasses without it.\n\nOne caller needed a guard. `AppDataDiskFolder.reset` is the only one\nthat calls `safe_delete` without an `exists()` check first, so a missing\ndirectory used to be absorbed by `ignore_errors`. `onerror` now returns\nearly on `FileNotFoundError` to keep that a no-op.\n\nThree tests: a read-only tree is actually removed, a missing path stays\na no-op, and an undeletable entry now raises instead of being swallowed.\nThe first and third fail on `main`. The third is Windows-only, since it\nneeds an open file handle to block deletion; the first passes on POSIX\neither way, because there deleting a file depends on the parent\ndirectory\u0027s permissions rather than the file\u0027s own.\n\n`tests/unit` is green locally on Windows / 3.13 (296 passed, 31\nskipped), along with ruff and `ty`.\n\n---------\n\nCo-authored-by: Bernat Gabor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "31b50810666aac5075a68472d7f9376148dac8d9",
      "tree": "f3cfc255152351271a99f5d6ab5dd1c12452d0a8",
      "parents": [
        "5640eef0a51cbea4518ab7d8a302069866a743c9"
      ],
      "author": {
        "name": "darrenhuai",
        "email": "60621295+darrenhuai@users.noreply.github.com",
        "time": "Tue Aug 25 03:57:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 03:57:22 2026"
      },
      "message": "🐛 fix(create): check every execute bit in ExePathRef.can_run (#3217)\n\nCo-authored-by: Bernat Gabor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "5640eef0a51cbea4518ab7d8a302069866a743c9",
      "tree": "b23308d666a70c248970c634cc9c6569be522a2a",
      "parents": [
        "1ebcab6131bf2f777805e3682b755bf1c81b4f60"
      ],
      "author": {
        "name": "pre-commit-ci[bot]",
        "email": "66853113+pre-commit-ci[bot]@users.noreply.github.com",
        "time": "Tue Aug 25 03:57:10 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 03:57:10 2026"
      },
      "message": "[pre-commit.ci] pre-commit autoupdate (#3221)"
    },
    {
      "commit": "1ebcab6131bf2f777805e3682b755bf1c81b4f60",
      "tree": "6ec1570c420eeb7687af344ebb3160246a352da2",
      "parents": [
        "eb241a03b1b94d4263512c8346fdbaa14f2ba7c3"
      ],
      "author": {
        "name": "Vladimir",
        "email": "51440383+even-even@users.noreply.github.com",
        "time": "Sun Aug 23 19:19:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 19:19:34 2026"
      },
      "message": "docs: actualize python support version (#3220)\n\nHello\nIn PR actualize max support pythonVersion 3.14 -\u003e 3.15 (like\nhttps://github.com/pypa/virtualenv/blob/main/pyproject.toml#L37)\n\nCo-authored-by: vyuroshchin \u003c\u003e"
    },
    {
      "commit": "eb241a03b1b94d4263512c8346fdbaa14f2ba7c3",
      "tree": "4d189bb68ea5b07442f53fe73ad3fa60e07a3adb",
      "parents": [
        "9534eda10bd9a74317ae50e8fdb1327ffc87a8a2"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sun Aug 23 18:35:14 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 18:35:14 2026"
      },
      "message": "🔧 chore: batch dependency updates weekly on Tuesday (#3219)\n\nDependabot opened a separate pull request for every bump here, which\nturned routine maintenance into a stream of near-identical reviews. 🔁\n\n`.github/dependabot.yaml` now runs weekly on Tuesday with a catch-all\n`groups` entry per ecosystem, so one pull request carries the week\u0027s\nbumps. The other projects I maintain are moving to the same schedule."
    },
    {
      "commit": "9534eda10bd9a74317ae50e8fdb1327ffc87a8a2",
      "tree": "cc8c5b6c8307f6fe0653d03fed12fae68f603be8",
      "parents": [
        "c8c4285104995d63859991f115534828add66457"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Aug 21 01:08:28 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 01:08:28 2026"
      },
      "message": "chore(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#3218)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from\n10.0.0 to 10.0.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/releases\"\u003eastral-sh/setup-uv\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev10.0.1 🌈 Tolerate transient manifest timeouts\u003c/h2\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cp\u003eThank you \u003ca\nhref\u003d\"https://github.com/arguile\"\u003e\u003ccode\u003e@​arguile\u003c/code\u003e\u003c/a\u003e- for making\nthis action more resilient.\u003c/p\u003e\n\u003ch2\u003e🐛 Bug fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eTolerate transient manifest timeouts \u003ca\nhref\u003d\"https://github.com/arguile\"\u003e\u003ccode\u003e@​arguile\u003c/code\u003e\u003c/a\u003e- (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1016\"\u003e#1016\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🧰 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore: update known checksums for 0.12.4 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1017\"\u003e#1017\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📚 Documentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update version references to v10.0.0 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1014\"\u003e#1014\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/20cfd1bf945f4377ade1205e4dbc17946fc9a30d\"\u003e\u003ccode\u003e20cfd1b\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.12.4 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1017\"\u003e#1017\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/d73a0cab66a532d7afa440d9df4a67ea9fe65a30\"\u003e\u003ccode\u003ed73a0ca\u003c/code\u003e\u003c/a\u003e\nTolerate transient manifest timeouts (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1016\"\u003e#1016\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/ae3b92d1bdb308a10adfe7b8f408e5cc8c30f3f6\"\u003e\u003ccode\u003eae3b92d\u003c/code\u003e\u003c/a\u003e\ndocs: update version references to v10.0.0 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1014\"\u003e#1014\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/compare/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d...20cfd1bf945f4377ade1205e4dbc17946fc9a30d\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dastral-sh/setup-uv\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d10.0.0\u0026new-version\u003d10.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "c8c4285104995d63859991f115534828add66457",
      "tree": "2e0df0139e6a4908c69b592079fbab47448b594a",
      "parents": [
        "ea806dbc80cbaa493c2de8569767c81b816e9a24"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Aug 19 13:54:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 13:54:15 2026"
      },
      "message": "chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#3215)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from\n9.0.0 to 10.0.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/releases\"\u003eastral-sh/setup-uv\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev10.0.0 🌈 Disable automatic caching for sensitive events and new QOL\nfeatures\u003c/h2\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cp\u003eAnother breaking release, directly after v9.0.0 but we think the\nadded security justifies that.\u003c/p\u003e\n\u003ch3\u003eExtra security by default\u003c/h3\u003e\n\u003cp\u003eIf you use the default \u003ccode\u003eenable-cache: auto\u003c/code\u003e this will now\n\u003cstrong\u003eDISABLE THE CACHE\u003c/strong\u003e to protect against cache poisoning\nfor the following events:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003epull_request_target\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eworkflow_run\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003erelease\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eYou can read the full reasoning in \u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/984\"\u003eastral-sh/setup-uv#984\u003c/a\u003e\u003c/p\u003e\n\u003ch3\u003e\u003ccode\u003eversion: latest-known\u003c/code\u003e\u003c/h3\u003e\n\u003cpre lang\u003d\"yaml\"\u003e\u003ccode\u003e- name: Install the latest version of uv known to\nsetup-uv\n  uses: astral-sh/setup-uv@v10.0.0\n  with:\n    version: \u0026quot;latest-known\u0026quot;\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThis will now install the latest version with a checksum that is\nknown by this action. The \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts\"\u003eknown\n\u003ccode\u003euv\u003c/code\u003e checksums\u003c/a\u003e are automatically updated but will take a\nrelease of this action to take effect. You won\u0027t be always using the\nlatest \u0026amp; greatest but you will have an extra level of security.\u003c/p\u003e\n\u003ch3\u003eRead python version from \u003ccode\u003e.tool-versions\u003c/code\u003e\u003c/h3\u003e\n\u003cpre lang\u003d\"yaml\"\u003e\u003ccode\u003e- name: Install uv based on the version defined\nin .tool-versions and also set python\n  uses: astral-sh/setup-uv@v10.0.0\n  with:\n    version-file: \u0026quot;pyproject.toml\u0026quot;\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eWill now also set the python version if it is defined in\n\u003ccode\u003e.tool-versions\u003c/code\u003e. You can read the details \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/blob/main/docs/advanced-version-configuration.md#install-a-version-defined-in-a-requirements-or-config-file\"\u003ein\nthe docs\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e🚨 Breaking changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDisable automatic caching for sensitive events \u003ca\nhref\u003d\"https://github.com/eifinger\"\u003e\u003ccode\u003e@​eifinger\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/992\"\u003e#992\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🐛 Bug fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject paths in .tool-versions \u003ca\nhref\u003d\"https://github.com/eifinger\"\u003e\u003ccode\u003e@​eifinger\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1007\"\u003e#1007\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🚀 Enhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRead Python version from .tool-versions \u003ca\nhref\u003d\"https://github.com/eifinger\"\u003e\u003ccode\u003e@​eifinger\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/996\"\u003e#996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd latest-known version selector \u003ca\nhref\u003d\"https://github.com/eifinger\"\u003e\u003ccode\u003e@​eifinger\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/993\"\u003e#993\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d\"\u003e\u003ccode\u003eae62891\u003c/code\u003e\u003c/a\u003e\nchore(deps): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1013\"\u003e#1013\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/f9cdb47d487aee2be8925d1e57290177ad9e1ac2\"\u003e\u003ccode\u003ef9cdb47\u003c/code\u003e\u003c/a\u003e\nReject paths in .tool-versions (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1007\"\u003e#1007\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/4f6036f71cec78afb113b323f220c9185d983c12\"\u003e\u003ccode\u003e4f6036f\u003c/code\u003e\u003c/a\u003e\nRequire pull requests for Dependabot rollups (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1005\"\u003e#1005\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/8d6402c9b71205b2d8d0b82de531d8fed8430182\"\u003e\u003ccode\u003e8d6402c\u003c/code\u003e\u003c/a\u003e\nchore(deps): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1004\"\u003e#1004\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/46f427bd47c794e99536b75ffaa9f27602425027\"\u003e\u003ccode\u003e46f427b\u003c/code\u003e\u003c/a\u003e\nRead Python version from .tool-versions (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/996\"\u003e#996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/8ed89c51143f65ea13eaba62db51dbb8ea52d0a3\"\u003e\u003ccode\u003e8ed89c5\u003c/code\u003e\u003c/a\u003e\nci: pin Alpine container image (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/995\"\u003e#995\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/8473c7fea42cdfd540f4b01317a17ac5f54126ae\"\u003e\u003ccode\u003e8473c7f\u003c/code\u003e\u003c/a\u003e\nchore(deps): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/994\"\u003e#994\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/18d451d679e1650bc59f25f17116168d04f30748\"\u003e\u003ccode\u003e18d451d\u003c/code\u003e\u003c/a\u003e\nAdd latest-known version selector (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/993\"\u003e#993\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/f45168497b927d08c229345a5ab9ad5c85418d0b\"\u003e\u003ccode\u003ef451684\u003c/code\u003e\u003c/a\u003e\nDisable automatic caching for sensitive events (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/992\"\u003e#992\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/b68407c192114b6e47cc45b98289832c3df00d5e\"\u003e\u003ccode\u003eb68407c\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.12.3 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/991\"\u003e#991\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/compare/c771a70e6277c0a99b617c7a806ffedaca235ff9...ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dastral-sh/setup-uv\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d9.0.0\u0026new-version\u003d10.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "ea806dbc80cbaa493c2de8569767c81b816e9a24",
      "tree": "5132206378505b5030dbb9947ff00c455f7bd462",
      "parents": [
        "a21130f1a430f30aa72bf97bdb424c79c7b3a379"
      ],
      "author": {
        "name": "pre-commit-ci[bot]",
        "email": "66853113+pre-commit-ci[bot]@users.noreply.github.com",
        "time": "Mon Aug 17 19:42:11 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 19:42:11 2026"
      },
      "message": "[pre-commit.ci] pre-commit autoupdate (#3214)"
    },
    {
      "commit": "a21130f1a430f30aa72bf97bdb424c79c7b3a379",
      "tree": "3ae8d7fe6160d0719d64c49cba1ddecf26248bf7",
      "parents": [
        "00b80f5437a14318342b28a4ad749703145da393"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Sat Aug 15 07:18:22 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 15 07:18:22 2026"
      },
      "message": "Push renamed changelog to PR branch in upgrade workflow (#3213)\n\nThe \"Rename changelog with PR number\" step in `upgrade.yaml` checks out\nthe local `auto/upgrade-embedded-deps` branch that create-pull-request\nleft behind (no upstream configured) and then runs a bare `git push`,\nwhich fails with `fatal: The current branch auto/upgrade-embedded-deps\nhas no upstream branch`\n(https://github.com/pypa/virtualenv/actions/runs/31094988576,\nhttps://github.com/pypa/virtualenv/actions/runs/31307714056); the runs\nsince then are green only because no upgrade was pending. The step now\nchecks out `FETCH_HEAD` from the fetch it already does, so it works on\nwhat is actually on the remote for both the created and updated paths,\nand pushes explicitly with `git push origin\nHEAD:auto/upgrade-embedded-deps`."
    },
    {
      "commit": "00b80f5437a14318342b28a4ad749703145da393",
      "tree": "038ecf306fbea689f7f760ed80242e8c647841fc",
      "parents": [
        "38a2a31844eed86019cb1e94b5b9c2c5e811c74b"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Wed Aug 12 20:51:45 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 12 20:51:45 2026"
      },
      "message": "📄 docs: publish llms.txt from the docs build (#3210)"
    },
    {
      "commit": "38a2a31844eed86019cb1e94b5b9c2c5e811c74b",
      "tree": "185cd28353f9e176f00e7f66dcff452b4a403225",
      "parents": [
        "60ed5e984ff62e1e5f39809ba5bc658da0c6d8b9"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Wed Aug 12 17:31:35 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 12 17:31:35 2026"
      },
      "message": "🐛 fix(types): adapt to python-discovery 1.5.2 annotations (#3211)\n\nThe type environment fails on every PR since python-discovery 1.5.2\nreached PyPI today, for example in [this\njob](https://github.com/pypa/virtualenv/actions/runs/31618753498/job/94187986986).\nThe release added class-level annotations to `PythonInfo`, widening\n`prefix` to `str | None` and the `sysconfig_vars` values to `str | int |\nNone`, and ty rejects two call sites that assumed the narrower types.\n\nThe annotations match what the collector produces: `prefix` comes from\n`getattr(sys, \"prefix\", None)` and `sysconfig_vars` values from\n`sysconfig.get_config_var`, which returns strings, ints, or None.\n`Py_ENABLE_SHARED` for instance is an int. `Describe._calc_config_vars`\nreturns the vars unchanged when `prefix` is None, since no value can\npoint inside a prefix that does not exist.\n`CPython3Posix._shared_libpython` narrows `INSTSONAME` and `LIBDIR` to\nnon-empty strings before joining them into a path; an int in either slot\ncannot name a shared library, so it bails out the same way it did for\nmissing values.\n\nOn a regular CPython host `prefix` is a string and both vars are\nstrings, so runtime behavior stays the same. `tox r -e type` and `tox r\n-e fix` pass against 1.5.2. So do the describe and cpython3 unit tests.\n\n---------\n\nCo-authored-by: pre-commit-ci[bot] \u003c66853113+pre-commit-ci[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "60ed5e984ff62e1e5f39809ba5bc658da0c6d8b9",
      "tree": "65e25914e32a6155834e2d0f0600796350397a8e",
      "parents": [
        "6d9300904051ad30a917bbf351eb5344dd6ad06b"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Mon Aug 10 22:53:10 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Mon Aug 10 22:53:10 2026"
      },
      "message": "release 21.7.4"
    },
    {
      "commit": "6d9300904051ad30a917bbf351eb5344dd6ad06b",
      "tree": "723ac1a3b73652abe2445d92d2b7b289abc80d10",
      "parents": [
        "8b4f9f934899a28b9bbfde419fe9cc49f04e4153"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Mon Aug 10 22:52:00 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 10 22:52:00 2026"
      },
      "message": "Upgrade embedded pip/setuptools/wheel (#3208)\n\nCo-authored-by: gaborbernat \u003c690238+gaborbernat@users.noreply.github.com\u003e"
    },
    {
      "commit": "8b4f9f934899a28b9bbfde419fe9cc49f04e4153",
      "tree": "a35334edbfc72cc954ea9c25eb44ba346b05c6d3",
      "parents": [
        "2c52ec0a2b7c222078a1eb92941ffb93a37f67f8"
      ],
      "author": {
        "name": "pre-commit-ci[bot]",
        "email": "66853113+pre-commit-ci[bot]@users.noreply.github.com",
        "time": "Mon Aug 10 19:35:03 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 10 19:35:03 2026"
      },
      "message": "[pre-commit.ci] pre-commit autoupdate (#3209)\n\n\u003c!--pre-commit.ci start--\u003e\nupdates:\n- [github.com/python-jsonschema/check-jsonschema: 0.37.4 →\n0.38.0](https://github.com/python-jsonschema/check-jsonschema/compare/0.37.4...0.38.0)\n- [github.com/tox-dev/pyproject-fmt: v2.26.0 →\nv2.27.0](https://github.com/tox-dev/pyproject-fmt/compare/v2.26.0...v2.27.0)\n- [github.com/astral-sh/ruff-pre-commit: v0.16.1 →\nv0.16.2](https://github.com/astral-sh/ruff-pre-commit/compare/v0.16.1...v0.16.2)\n\u003c!--pre-commit.ci end--\u003e\n\nCo-authored-by: pre-commit-ci[bot] \u003c66853113+pre-commit-ci[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "2c52ec0a2b7c222078a1eb92941ffb93a37f67f8",
      "tree": "465f767194a6b9be34206535dc5a8a34955fe0f6",
      "parents": [
        "8873d5eb711c89389b96c3a90f699bd600b51439"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Sat Aug 08 14:42:03 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Sat Aug 08 14:42:03 2026"
      },
      "message": "release 21.7.3"
    },
    {
      "commit": "8873d5eb711c89389b96c3a90f699bd600b51439",
      "tree": "f62299b7f68bc861ec08f36a4fb119e5c6a03fff",
      "parents": [
        "d32f44cd7ce0407e47486a7c216b37a00566e111"
      ],
      "author": {
        "name": "darrenhuai",
        "email": "60621295+darrenhuai@users.noreply.github.com",
        "time": "Sat Aug 08 14:40:44 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 08 14:40:44 2026"
      },
      "message": "🐛 fix(config): return a real list from ListType.split_values (#3207)\n\n`ListType.split_values` declares `-\u003e list[str]`, but the string branch\nended with `values \u003d filter(None, [...])` and returned that, so callers\ngot a one-shot iterator whose second pass came up empty and whose\n`len()` raised. 🐛 List input went through `list(value)`, so which type\nyou got back depended on which branch ran. The `ty:\nignore[invalid-return-type]` on the return statement was masking the\nmismatch. Since the only caller, `ListType.convert`, iterates the result\nonce, no user hits this today; it is a contract violation and a trap for\nthe next caller.\n\nBuilding the list in the string branch fixes that half. The `bytes` case\nwas messier. Both `splitlines` and `strip` accept `bytes`, so\n`split_values(b\"a\\nb\")` returned `[b\u0027a\u0027, b\u0027b\u0027]`, but input with no\nnewline fell through to `value.split(\",\")` and raised `TypeError` on the\n`str` separator, which the second `ty: ignore[invalid-argument-type]`\nwas hiding. Decoding `bytes` on entry repairs the comma path, leaves the\nnewline path working, and lets the result match the `list[str]`\nannotation, where before `self.as_type(i)` downstream would turn `b\"a\"`\ninto `\"b\u0027a\u0027\"`. Both ignore comments are gone and `ty check` still\npasses, the clearest evidence they were covering nothing but these two\nproblems.\n\nThe signature stays `str | bytes | list[str]`, so nothing public\nnarrows. Callers passing `bytes` now get `str` elements back instead of\n`bytes`.\n\n---------\n\nCo-authored-by: Bernat Gabor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "d32f44cd7ce0407e47486a7c216b37a00566e111",
      "tree": "59b572548e955419a0f0171a107ff0f18617f9d7",
      "parents": [
        "eb997d3262a8655d27f78d77562a361e8410076f"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Aug 07 22:54:54 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Aug 07 22:54:54 2026"
      },
      "message": "release 21.7.2"
    },
    {
      "commit": "eb997d3262a8655d27f78d77562a361e8410076f",
      "tree": "c16b0bac39b192b7f0390015ede3ab6920fa8c57",
      "parents": [
        "9952a89b1d1ee338e67421d887d7badf6adfbe53"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Fri Aug 07 22:53:35 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 22:53:35 2026"
      },
      "message": "Upgrade embedded pip/setuptools/wheel (#3206)\n\nCo-authored-by: gaborbernat \u003c690238+gaborbernat@users.noreply.github.com\u003e"
    },
    {
      "commit": "9952a89b1d1ee338e67421d887d7badf6adfbe53",
      "tree": "12017c506a395f5dccbfc6a6665fa9c7ac74d921",
      "parents": [
        "a3d3bb84af95336080c2a4c5699d704a39ba4d86"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Aug 05 00:25:40 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 05 00:25:40 2026"
      },
      "message": "chore(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#3203)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "a3d3bb84af95336080c2a4c5699d704a39ba4d86",
      "tree": "ff22cb0e65587efc544f4caea8e66b453916f9f2",
      "parents": [
        "e46c8e94d63b4214da3c24e1bc4febcfbfee7395"
      ],
      "author": {
        "name": "pre-commit-ci[bot]",
        "email": "66853113+pre-commit-ci[bot]@users.noreply.github.com",
        "time": "Mon Aug 03 19:22:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 19:22:15 2026"
      },
      "message": "[pre-commit.ci] pre-commit autoupdate (#3202)\n\n\u003c!--pre-commit.ci start--\u003e\nupdates:\n- [github.com/astral-sh/ruff-pre-commit: v0.16.0 →\nv0.16.1](https://github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1)\n- [github.com/zizmorcore/zizmor-pre-commit: v1.28.0 →\nv1.29.0](https://github.com/zizmorcore/zizmor-pre-commit/compare/v1.28.0...v1.29.0)\n\u003c!--pre-commit.ci end--\u003e\n\nCo-authored-by: pre-commit-ci[bot] \u003c66853113+pre-commit-ci[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "e46c8e94d63b4214da3c24e1bc4febcfbfee7395",
      "tree": "64ad66a7d31a085fcf47e42da1dc6650f34b95ec",
      "parents": [
        "b66560a65d38d2ea7fe29829685b86a8d55146b5"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Thu Jul 30 15:39:16 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Thu Jul 30 15:39:16 2026"
      },
      "message": "release 21.7.1"
    },
    {
      "commit": "b66560a65d38d2ea7fe29829685b86a8d55146b5",
      "tree": "c22c14fff82d0b6bd7252955b03b9b3a18d9b88a",
      "parents": [
        "bf5f5206ec83e7536068e6f9525f8c8a9cda69ab"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Thu Jul 30 15:37:53 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 30 15:37:53 2026"
      },
      "message": "Upgrade embedded pip/setuptools/wheel (#3201)\n\nAutomated upgrade of embedded pip, setuptools, and wheel dependencies.\n\nThis PR was created automatically by the [upgrade\nworkflow](https://github.com/pypa/virtualenv/actions/workflows/upgrade.yaml).\n\nCo-authored-by: gaborbernat \u003c690238+gaborbernat@users.noreply.github.com\u003e"
    },
    {
      "commit": "bf5f5206ec83e7536068e6f9525f8c8a9cda69ab",
      "tree": "a639d8139c69c9b27584e85c829a7b50f77dfd38",
      "parents": [
        "8507c7b0a0210eaa67c5c81d4d081d7c49fa679f"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Wed Jul 29 15:54:15 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 29 15:54:15 2026"
      },
      "message": "📝 docs(branding): clarify official logo vs favicon (#3200)\n\nThe `docs/_static` folder ships two logo files, `virtualenv.png` and\n`virtualenv.svg`, and a contributor in\n[#3199](https://github.com/pypa/virtualenv/issues/3199) read them as two\nformats of one asset and asked which is canonical. They are separate\ndesigns. The PNG is the detailed logo (snakes around a terminal with the\nwordmark). The SVG is a stripped-down mark used only for the favicon,\nwhere the detailed logo would be illegible at 16×16.\n\nA new \"Logo and branding\" section in the development guide states that\nthe PNG is the official logo and the SVG is a favicon-only mark. The\n`html_favicon` line in `docs/conf.py` now carries a comment pointing at\nthat note, so a later cleanup does not \"correct\" the mismatch. No assets\nchange."
    },
    {
      "commit": "8507c7b0a0210eaa67c5c81d4d081d7c49fa679f",
      "tree": "c85698b9059fb7b55b746ef4ee996141f0d305af",
      "parents": [
        "694406aeafe8a16011e6c04bb7728d1cd531df12"
      ],
      "author": {
        "name": "pre-commit-ci[bot]",
        "email": "66853113+pre-commit-ci[bot]@users.noreply.github.com",
        "time": "Wed Jul 29 15:21:12 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 29 15:21:12 2026"
      },
      "message": "[pre-commit.ci] pre-commit autoupdate (#3197)"
    },
    {
      "commit": "694406aeafe8a16011e6c04bb7728d1cd531df12",
      "tree": "c0755efbdbf41c496123403ec30c5c80bf1d7884",
      "parents": [
        "b486255413664ba1e7e264a7807e361feda5367b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 29 15:03:34 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 29 15:03:34 2026"
      },
      "message": "chore(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#3198)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from\n8.3.2 to 9.0.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/releases\"\u003eastral-sh/setup-uv\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev9.0.0 🌈 Change \u003ccode\u003eprune-cache\u003c/code\u003e default to\n\u003ccode\u003efalse\u003c/code\u003e\u003c/h2\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cp\u003eThis release disables the default cache cache pruning to ease the\nload on the PyPi infrastructure.\nSince users might experience more GitHub Actions cache usage which might\nresult in higher costs this is marked as a breaking change. To read more\non why we did this (now) you can read the detailed analysis and\nreasoning in \u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/967\"\u003e#967\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eBesides this big breaking change we also have a small bugfix while\nbuilding caches for linux distributions that behave a big different than\nthe \u0026quot;big ones\u0026quot; and a speed up in version resolution by only\nreading the version manifest until a matching version is found saving\nruntime and network bandwith.\u003c/p\u003e\n\u003ch2\u003e🚨 Breaking changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eChange \u003ccode\u003eprune-cache\u003c/code\u003e default to \u003ccode\u003efalse\u003c/code\u003e \u003ca\nhref\u003d\"https://github.com/charliermarsh\"\u003e\u003ccode\u003e@​charliermarsh\u003c/code\u003e\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/967\"\u003e#967\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🐛 Bug fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: fall back to distribution ID when os-release has no version\nfield \u003ca href\u003d\"https://github.com/cxzhong\"\u003e\u003ccode\u003e@​cxzhong\u003c/code\u003e\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/961\"\u003e#961\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🚀 Enhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSpeed up version client by partial response reads \u003ca\nhref\u003d\"https://github.com/eifinger\"\u003e\u003ccode\u003e@​eifinger\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/807\"\u003e#807\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🧰 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore: update known checksums for 0.11.30 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/968\"\u003e#968\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: update known checksums for 0.11.29 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/960\"\u003e#960\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📚 Documentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update version references to v8.3.2 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/949\"\u003e#949\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⬆️ Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): roll up Dependabot updates \u003ca\nhref\u003d\"https://github.com/eifinger\"\u003e\u003ccode\u003e@​eifinger\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/970\"\u003e#970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore(deps): roll up Dependabot updates \u003ca\nhref\u003d\"https://github.com/eifinger\"\u003e\u003ccode\u003e@​eifinger\u003c/code\u003e\u003c/a\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/962\"\u003e#962\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/c771a70e6277c0a99b617c7a806ffedaca235ff9\"\u003e\u003ccode\u003ec771a70\u003c/code\u003e\u003c/a\u003e\nchore(deps): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/970\"\u003e#970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/2f537ca87c1ffa233ca2a1b84815388e3e42d845\"\u003e\u003ccode\u003e2f537ca\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.11.30 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/968\"\u003e#968\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/2269552d547df6f50e57442326930d30d943afe3\"\u003e\u003ccode\u003e2269552\u003c/code\u003e\u003c/a\u003e\nSpeed up version client by partial response reads (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/807\"\u003e#807\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/47a7f4fb2e900d6c33a5b5f231fa21dbfaeba52f\"\u003e\u003ccode\u003e47a7f4f\u003c/code\u003e\u003c/a\u003e\nChange \u003ccode\u003eprune-cache\u003c/code\u003e default to \u003ccode\u003efalse\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/967\"\u003e#967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/71966eff34a27b0a62ed4b9f6f6e383e071b1bb5\"\u003e\u003ccode\u003e71966ef\u003c/code\u003e\u003c/a\u003e\nchore(deps): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/962\"\u003e#962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/f12b1f0a84bd6dc2331b36b2bbdbb1d1e617dbcc\"\u003e\u003ccode\u003ef12b1f0\u003c/code\u003e\u003c/a\u003e\nfix: fall back to distribution ID when os-release has no version field\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/961\"\u003e#961\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/ecd24dd710f2fb0dca1693a67af11fc4a5c5ec84\"\u003e\u003ccode\u003eecd24dd\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.11.29 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/960\"\u003e#960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/6a191366842ac1502ba6c07e9b5acd5c2d9d8db3\"\u003e\u003ccode\u003e6a19136\u003c/code\u003e\u003c/a\u003e\ndocs: update version references to v8.3.2 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/949\"\u003e#949\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dastral-sh/setup-uv\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d8.3.2\u0026new-version\u003d9.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "b486255413664ba1e7e264a7807e361feda5367b",
      "tree": "d34cebe5a654cd2bc37015c0fe36b625a41f1742",
      "parents": [
        "ac2ad97d67d2ecd6ceaaffde99586d98b7cfc8ea"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 27 06:31:38 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 27 06:31:38 2026"
      },
      "message": "chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#3196)\n\nBumps\n[pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish)\nfrom 1.14.0 to 1.14.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/gh-action-pypi-publish/releases\"\u003epypa/gh-action-pypi-publish\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.14.1\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e🛠️ Internal Dependencies\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://github.com/adisivaprasad\"\u003e\u003ccode\u003e@​adisivaprasad\u003c/code\u003e\u003c/a\u003e\u003ca\nhref\u003d\"https://github.com/sponsors/adisivaprasad\"\u003e💰\u003c/a\u003e helped get rid of\nthe GitHub Actions runner warning about the old Node 20 runtime being\nused by updating \u003ccode\u003eactions/setup-python\u003c/code\u003e from v5.6.0 to v6.2.0\nin \u003ca\nhref\u003d\"https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408\"\u003e#408\u003c/a\u003e.\u003c/p\u003e\n\u003ch2\u003e💪 New Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/adisivaprasad\"\u003e\u003ccode\u003e@​adisivaprasad\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408\"\u003e#408\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/jylenhof\"\u003e\u003ccode\u003e@​jylenhof\u003c/code\u003e\u003c/a\u003e\u003ca\nhref\u003d\"https://github.com/sponsors/jylenhof\"\u003e💰\u003c/a\u003e followed up and\nreminded us to actually cut this release in \u003ca\nhref\u003d\"https://redirect.github.com/pypa/gh-action-pypi-publish/issues/413\"\u003e#413\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e🪞 Full Diff\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.0...v1.14.1\"\u003ehttps://github.com/pypa/gh-action-pypi-publish/compare/v1.14.0...v1.14.1\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e🧔‍♂️ Release Manager:\u003c/strong\u003e \u003ca\nhref\u003d\"https://github.com/sponsors/webknjaz\"\u003e\u003ccode\u003e@​webknjaz\u003c/code\u003e\u003c/a\u003e\n\u003ca href\u003d\"https://stand-with-ukraine.pp.ua\"\u003e🇺🇦\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e🙏 Special Thanks\u003c/strong\u003e to \u003ca\nhref\u003d\"https://github.com/jylenhof\"\u003e\u003ccode\u003e@​jylenhof\u003c/code\u003e\u003c/a\u003e\u003ca\nhref\u003d\"https://github.com/sponsors/jylenhof\"\u003e💰\u003c/a\u003e for reminding me to\nwork on this release!\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e💬 Discuss\u003c/strong\u003e \u003ca\nhref\u003d\"https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrd7jpnxc22d\"\u003eon\nBluesky 🦋\u003c/a\u003e, \u003ca\nhref\u003d\"https://mastodon.social/@webknjaz/116970132515797444\"\u003eon Mastodon\n🐘\u003c/a\u003e and \u003ca\nhref\u003d\"https://github.com/pypa/gh-action-pypi-publish/discussions/414\"\u003eon\nGitHub\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ca href\u003d\"https://github.com/sponsors/webknjaz\"\u003e\u003cimg\nsrc\u003d\"https://img.shields.io/badge/%40webknjaz-transparent?logo\u003dgithubsponsors\u0026amp;logoColor\u003d%23EA4AAA\u0026amp;label\u003dSponsor\u0026amp;color\u003d2a313c\"\nalt\u003d\"GH Sponsors badge\" /\u003e\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/gh-action-pypi-publish/commit/ba38be9e461d3875417946c167d0b5f3d385a247\"\u003e\u003ccode\u003eba38be9\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408\"\u003e#408\u003c/a\u003e\nfrom adisivaprasad/bump-setup-python-v6\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/gh-action-pypi-publish/commit/a6c5088d60d08ef54b70075735d25df696e5ccaa\"\u003e\u003ccode\u003ea6c5088\u003c/code\u003e\u003c/a\u003e\nBump actions/setup-python from v5.6.0 to v6.2.0\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/pypa/gh-action-pypi-publish/compare/cef221092ed1bacb1cc03d23a2d87d1d172e277b...ba38be9e461d3875417946c167d0b5f3d385a247\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dpypa/gh-action-pypi-publish\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d1.14.0\u0026new-version\u003d1.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "ac2ad97d67d2ecd6ceaaffde99586d98b7cfc8ea",
      "tree": "d14d883f0625d7343e22b54a553d4ca962689bf5",
      "parents": [
        "df94b342b732f96859595104bebbcfa74a88616b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 27 06:31:32 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 27 06:31:32 2026"
      },
      "message": "chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (#3195)\n\nBumps [actions/setup-python](https://github.com/actions/setup-python)\nfrom 6.3.0 to 7.0.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/setup-python/releases\"\u003eactions/setup-python\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1330\"\u003eactions/setup-python#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin SHA commits and update docs with latest versions by \u003ca\nhref\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1338\"\u003eactions/setup-python#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the pip-install input by \u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1336\"\u003eactions/setup-python#1336\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix to Classify stderr warning messages as warnings instead of\nerrors in annotations by \u003ca\nhref\u003d\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eValidate and retry manifest fetch to prevent silent failures by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1332\"\u003eactions/setup-python#1332\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Upgrade\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump certifi from 2020.6.20 to 2024.7.4 in\n/\u003cstrong\u003etests\u003c/strong\u003e/data by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1328\"\u003eactions/setup-python#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove EOL Python versions and Bumps numpy text fixture by \u003ca\nhref\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1333\"\u003eactions/setup-python#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca\nhref\u003d\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/setup-python/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97\"\u003e\u003ccode\u003e5fda3b9\u003c/code\u003e\u003c/a\u003e\nPin SHA commits and update docs with latest versions (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1338\"\u003e#1338\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e\"\u003e\u003ccode\u003e4ab7e95\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1337\"\u003e#1337\u003c/a\u003e\nfrom actions/philip-gai/bump-actions-cache-6-2-0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c\"\u003e\u003ccode\u003e0f3a009\u003c/code\u003e\u003c/a\u003e\nRemove the pip-install input (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1336\"\u003e#1336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932\"\u003e\u003ccode\u003ef8cf429\u003c/code\u003e\u003c/a\u003e\nMigrate to ESM and upgrade dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1330\"\u003e#1330\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5\"\u003e\u003ccode\u003e54baeea\u003c/code\u003e\u003c/a\u003e\nValidate and retry manifest fetch to prevent silent failures (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1332\"\u003e#1332\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5\"\u003e\u003ccode\u003ec709277\u003c/code\u003e\u003c/a\u003e\nAnnotation code fix (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1335\"\u003e#1335\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a\"\u003e\u003ccode\u003e6849080\u003c/code\u003e\u003c/a\u003e\nremove EOL Python versions and Bumps numpy text fixture (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1333\"\u003e#1333\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e\"\u003e\u003ccode\u003e0903b46\u003c/code\u003e\u003c/a\u003e\nBump certifi from 2020.6.20 to 2024.7.4 in /\u003cstrong\u003etests\u003c/strong\u003e/data\n(\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1328\"\u003e#1328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-python\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d6.3.0\u0026new-version\u003d7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "df94b342b732f96859595104bebbcfa74a88616b",
      "tree": "9b7c9f7105c4249246329bfd7ddb5e0db9867c8e",
      "parents": [
        "e6eb5b02190608ba5bbae8639e98792e41d88179"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 24 05:43:49 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 24 05:43:49 2026"
      },
      "message": "chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#3194)\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0\nto 7.0.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/checkout/releases\"\u003eactions/checkout\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eskip running unsafe pr check if input is default by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etrim only ascii whitespace for branch by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eescape values passed to --unset by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/v7...v7.0.1\"\u003ehttps://github.com/actions/checkout/compare/v7...v7.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip running unsafe pr check if input is default by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTrim only ascii whitespace for branch by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape values passed to --unset by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run\nby \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements\nby \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca\nhref\u003d\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca\nhref\u003d\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca\nhref\u003d\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca\nhref\u003d\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca\nhref\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca\nhref\u003d\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment\nvariables by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca\nhref\u003d\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003e\u003ccode\u003e3d3c42e\u003c/code\u003e\u003c/a\u003e\nprep v7.0.1 release (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2531\"\u003e#2531\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07\"\u003e\u003ccode\u003e2880268\u003c/code\u003e\u003c/a\u003e\nescape values passed to --unset (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2530\"\u003e#2530\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1\"\u003e\u003ccode\u003e12cd223\u003c/code\u003e\u003c/a\u003e\ntrim only ascii whitespace for branch (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2521\"\u003e#2521\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541\"\u003e\u003ccode\u003e62661c4\u003c/code\u003e\u003c/a\u003e\nskip running unsafe pr check if input is default (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2518\"\u003e#2518\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f\"\u003e\u003ccode\u003ee8d4307\u003c/code\u003e\u003c/a\u003e\nBump the minor-actions-dependencies group with 2 updates (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2499\"\u003e#2499\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87\"\u003e\u003ccode\u003e631c942\u003c/code\u003e\u003c/a\u003e\neslint 9 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2474\"\u003e#2474\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e\"\u003e\u003ccode\u003e4f1f4ae\u003c/code\u003e\u003c/a\u003e\nBump actions/upload-artifact from 4 to 7 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2476\"\u003e#2476\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92\"\u003e\u003ccode\u003eba09753\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 6 to 7 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2488\"\u003e#2488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22\"\u003e\u003ccode\u003eb9e0990\u003c/code\u003e\u003c/a\u003e\nBump docker/login-action from 3.3.0 to 4.2.0 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2479\"\u003e#2479\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2\"\u003e\u003ccode\u003ee8cb398\u003c/code\u003e\u003c/a\u003e\nBump docker/build-push-action from 6.5.0 to 7.2.0 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2478\"\u003e#2478\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/checkout\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d7.0.0\u0026new-version\u003d7.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "e6eb5b02190608ba5bbae8639e98792e41d88179",
      "tree": "2900c1d56953b13121476569143a9667cc48bcc7",
      "parents": [
        "6d7bf90c34939a2fe6379be00d34e3b887988bb6"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Tue Jul 21 13:10:42 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Tue Jul 21 13:10:42 2026"
      },
      "message": "release 21.7.0"
    },
    {
      "commit": "6d7bf90c34939a2fe6379be00d34e3b887988bb6",
      "tree": "35b62c5dc26b3951e14e663c98dac19d12b39775",
      "parents": [
        "482c7f91d10b75b0f51e78aaf371a5dd05361f1a"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Tue Jul 21 13:10:17 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Tue Jul 21 13:10:17 2026"
      },
      "message": "Add changelog fragment for Python 3.15 support\n"
    },
    {
      "commit": "482c7f91d10b75b0f51e78aaf371a5dd05361f1a",
      "tree": "841f76cb3fe5d0993c7eb48ab07bfc815eb3a26a",
      "parents": [
        "a190228c76349ed8cf26db43aa4789a1f084cbb7"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Tue Jul 21 06:07:35 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 06:07:35 2026"
      },
      "message": "👷 ci: test against Python 3.15 beta (#3192)"
    },
    {
      "commit": "a190228c76349ed8cf26db43aa4789a1f084cbb7",
      "tree": "72220c78a9ce8fe110df13c75cbb844be33075c7",
      "parents": [
        "b54bc80c0f055fbc64cda453545486d589af0347"
      ],
      "author": {
        "name": "pre-commit-ci[bot]",
        "email": "66853113+pre-commit-ci[bot]@users.noreply.github.com",
        "time": "Tue Jul 21 05:42:06 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 05:42:06 2026"
      },
      "message": "[pre-commit.ci] pre-commit autoupdate (#3191)\n\nCo-authored-by: Bernát Gábor \u003cgaborjbernat@gmail.com\u003e"
    },
    {
      "commit": "b54bc80c0f055fbc64cda453545486d589af0347",
      "tree": "0d0446465e2bdad868a62998ccb69908a5691974",
      "parents": [
        "c5dff1d4defbd2f16ff0ead54de0354b2398fead"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Thu Jul 16 01:00:33 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 01:00:33 2026"
      },
      "message": "Replace prettier with mdformat and yamlfmt (#3190)\n\nCommitted via https://github.com/asottile/all-repos"
    },
    {
      "commit": "c5dff1d4defbd2f16ff0ead54de0354b2398fead",
      "tree": "0ed71dee4482515d2c5e3c340c95aa3fb75e28a9",
      "parents": [
        "cab4a0af798849839dfeaa814257e1c8e84ef01e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 15 07:30:51 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 15 07:30:51 2026"
      },
      "message": "chore(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 (#3189)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from\n8.3.1 to 8.3.2.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/11f9893b081a58869d3b5fccaea48c9e9e46f990\"\u003e\u003ccode\u003e11f9893\u003c/code\u003e\u003c/a\u003e\nchore: roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/948\"\u003e#948\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/f79855603231e1609d02bec6956bd0e05cbc46b5\"\u003e\u003ccode\u003ef798556\u003c/code\u003e\u003c/a\u003e\ndocs: update version references to v8.3.1 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/946\"\u003e#946\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/e80544d808267c93733c3fd1e2c8c65e0c8707d6\"\u003e\u003ccode\u003ee80544d\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.11.28 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/947\"\u003e#947\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/compare/f98e06938123ccabd21905ea5d0069192241f9f1...11f9893b081a58869d3b5fccaea48c9e9e46f990\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dastral-sh/setup-uv\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d8.3.1\u0026new-version\u003d8.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "cab4a0af798849839dfeaa814257e1c8e84ef01e",
      "tree": "88190d65e8b5d78efcc9496baf1c914751d6a2ae",
      "parents": [
        "c53b5b198abbc5ff7de38eb823bf15c9f618a9a3"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Jul 14 00:38:31 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 14 00:38:31 2026"
      },
      "message": "chore(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 (#3188)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from\n8.3.0 to 8.3.1.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/f98e06938123ccabd21905ea5d0069192241f9f1\"\u003e\u003ccode\u003ef98e069\u003c/code\u003e\u003c/a\u003e\nChange update-docs PR labels from \u0027update-docs\u0027 to \u0027documentation\u0027 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/945\"\u003e#945\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/cd462639a967553a16241af35461402a96978d48\"\u003e\u003ccode\u003ecd46263\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.11.27 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/944\"\u003e#944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/11245c7e122cd1c2297e8115d1e43fe1570f6270\"\u003e\u003ccode\u003e11245c7\u003c/code\u003e\u003c/a\u003e\ndocs: update version references to v8.3.0 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/939\"\u003e#939\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/compare/d31148d669074a8d0a63714ba94f3201e7020bc3...f98e06938123ccabd21905ea5d0069192241f9f1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dastral-sh/setup-uv\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d8.3.0\u0026new-version\u003d8.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "c53b5b198abbc5ff7de38eb823bf15c9f618a9a3",
      "tree": "b0e40777c09b6bf21a0da96fe6e7e9ef848dace3",
      "parents": [
        "20b70f30e8f712c099905454b100d68cc677ef53"
      ],
      "author": {
        "name": "pre-commit-ci[bot]",
        "email": "66853113+pre-commit-ci[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 20:47:49 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 20:47:49 2026"
      },
      "message": "[pre-commit.ci] pre-commit autoupdate (#3187)"
    },
    {
      "commit": "20b70f30e8f712c099905454b100d68cc677ef53",
      "tree": "d0731ebebca09770be6cd5b5599db85e8bda8182",
      "parents": [
        "544ca3d8b08188e8329570c88b362956496aaeec"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 04:10:06 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 04:10:06 2026"
      },
      "message": "chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 (#3186)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from\n8.2.0 to 8.3.0.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/d31148d669074a8d0a63714ba94f3201e7020bc3\"\u003e\u003ccode\u003ed31148d\u003c/code\u003e\u003c/a\u003e\nStrip environment markers from detected uv dependency pins (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/938\"\u003e#938\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/17c398959b4611a88929fabb5c563a8e43a0ff60\"\u003e\u003ccode\u003e17c3989\u003c/code\u003e\u003c/a\u003e\nFix cache keys for Python version ranges (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/937\"\u003e#937\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/3cc3c11fdf511cab39136b7c946d973d4ad0df20\"\u003e\u003ccode\u003e3cc3c11\u003c/code\u003e\u003c/a\u003e\nchore(deps): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/936\"\u003e#936\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/9225f843d7a9f80a757cf25ef48901fda69ba4bc\"\u003e\u003ccode\u003e9225f84\u003c/code\u003e\u003c/a\u003e\nchore(deps): bump release-drafter/release-drafter from 7.3.1 to 7.4.0\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/924\"\u003e#924\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/fc16fa3bbf37d2816834f76a1fe25d33564eaa34\"\u003e\u003ccode\u003efc16fa3\u003c/code\u003e\u003c/a\u003e\nchore(deps): bump actions/checkout from 6.0.2 to 7.0.0 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/a1a7345c8ef5d6d3b18c6f1c247244c19f1d878c\"\u003e\u003ccode\u003ea1a7345\u003c/code\u003e\u003c/a\u003e\nci: call docs update workflow from release (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/933\"\u003e#933\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/a5e9cbfd5f946647f478460490fa497b0a732e63\"\u003e\u003ccode\u003ea5e9cbf\u003c/code\u003e\u003c/a\u003e\ndocs: update version references to v8.2.0 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/932\"\u003e#932\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/c5680ec91f7b9b91406fab4ded5d45245abf7b67\"\u003e\u003ccode\u003ec5680ec\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.11.26 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/930\"\u003e#930\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/c86fe4ef1f4a79845e6d465628d733650f6c41d8\"\u003e\u003ccode\u003ec86fe4e\u003c/code\u003e\u003c/a\u003e\nAdd a threat model for setup-uv (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/923\"\u003e#923\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/224c887d488ab24d8a1b49f10416d6ad6b6ca71d\"\u003e\u003ccode\u003e224c887\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.11.25 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/929\"\u003e#929\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/compare/fac544c07dec837d0ccb6301d7b5580bf5edae39...d31148d669074a8d0a63714ba94f3201e7020bc3\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dastral-sh/setup-uv\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d8.2.0\u0026new-version\u003d8.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "544ca3d8b08188e8329570c88b362956496aaeec",
      "tree": "ea697b1db52c990b0c2286f296488087212e88df",
      "parents": [
        "3abee98f928981c19240f506401e92a15960e20c"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Jul 10 19:32:42 2026"
      },
      "committer": {
        "name": "Bernát Gábor",
        "email": "690238+gaborbernat@users.noreply.github.com",
        "time": "Fri Jul 10 19:32:42 2026"
      },
      "message": "release 21.6.1"
    },
    {
      "commit": "3abee98f928981c19240f506401e92a15960e20c",
      "tree": "3858e334e7d2696bc8e36cece3a2d7466e24a73f",
      "parents": [
        "57c8dc69a9080c3cd5741355aa756ce5a3b8ab15"
      ],
      "author": {
        "name": "Bernát Gábor",
        "email": "gaborjbernat@gmail.com",
        "time": "Fri Jul 10 19:31:35 2026"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 10 19:31:35 2026"
      },
      "message": "🐛 fix(fish): harden prompt against shadowed builtins (#3185)"
    }
  ],
  "next": "57c8dc69a9080c3cd5741355aa756ce5a3b8ab15"
}