ci: bump the actions group across 1 directory with 3 updates

[dependabot]

Bumps the actions group with 3 updates in the / directory: astral-sh/setup-uv, amannn/action-semantic-pull-request and googleapis/release-please-action.

Updates astral-sh/setup-uv from 9.0.0 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

• docs: update version references to v10.0.0 @github-actions[bot] (#1014)

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

• 20cfd1b chore: update known checksums for 0.12.4 (#1017)
• d73a0ca Tolerate transient manifest timeouts (#1016)
• ae3b92d docs: update version references to v10.0.0 (#1014)
• ae62891 chore(deps): roll up Dependabot updates (#1013)
• f9cdb47 Reject paths in .tool-versions (#1007)
• 4f6036f Require pull requests for Dependabot rollups (#1005)
• 8d6402c chore(deps): roll up Dependabot updates (#1004)
• 46f427b Read Python version from .tool-versions (#996)
• 8ed89c5 ci: pin Alpine container image (#995)
• 8473c7f chore(deps): roll up Dependabot updates (#994)
• Additional commits viewable in compare view

Updates amannn/action-semantic-pull-request from 5.5.3 to 6.1.1

Release notes

Sourced from amannn/action-semantic-pull-request's releases.

v6.1.1

6.1.1 (2025-08-22)

Bug Fixes

• Parse headerPatternCorrespondence properly (#295) (800da4c)

v6.1.0

6.1.0 (2025-08-19)

Features

• Support providing regexps for types (#292) (a30288b)

Bug Fixes

• Remove trailing whitespace from "unknown release type" error message (#291) (afa4edb)

v6.0.1

6.0.1 (2025-08-13)

Bug Fixes

• Actually execute action (#289) (58e4ab4)

v6.0.0

6.0.0 (2025-08-13)

⚠ BREAKING CHANGES

• Upgrade action to use Node.js 24 and ESM (#287)

Features

• Upgrade action to use Node.js 24 and ESM (#287) (bc0c9a7)

Changelog

Sourced from amannn/action-semantic-pull-request's changelog.

Changelog

6.1.1 (2025-08-22)

Bug Fixes

• Parse headerPatternCorrespondence properly (#295) (800da4c)

6.1.0 (2025-08-19)

Features

• Support providing regexps for types (#292) (a30288b)

Bug Fixes

• Remove trailing whitespace from "unknown release type" error message (#291) (afa4edb)

6.0.1 (2025-08-13)

Bug Fixes

• Actually execute action (#289) (58e4ab4)

6.0.0 (2025-08-13)

⚠ BREAKING CHANGES

• Upgrade action to use Node.js 24 and ESM (#287)

Features

• Upgrade action to use Node.js 24 and ESM (#287) (bc0c9a7)

5.5.3 (2024-06-28)

Bug Fixes

• Bump braces dependency (#269. by @​EelcoLos) (2d952a1)

5.5.2 (2024-04-24)

Bug Fixes

• Bump tar from 6.1.11 to 6.2.1 (#262 by @​EelcoLos) (9a90d5a)

5.5.1 (2024-04-24)

... (truncated)

Commits

• 48f2562 chore: Release 6.1.1 [skip ci]
• 800da4c fix: Parse headerPatternCorrespondence properly (#295)
• 677b895 test: Fix broken test
• 24e6f01 ci: Fix permissions for tagger
• 7f33ba7 chore: Release 6.1.0 [skip ci]
• afa4edb fix: Remove trailing whitespace from "unknown release type" error message (#291)
• a30288b feat: Support providing regexps for types (#292)
• a46a7c8 build: Move Vitest to devDependencies (#290)
• fdd4d3d chore: Release 6.0.1 [skip ci]
• 58e4ab4 fix: Actually execute action (#289)
• Additional commits viewable in compare view

Updates googleapis/release-please-action from 4.4.1 to 5.0.0

Release notes

Sourced from googleapis/release-please-action's releases.

v5.0.0

5.0.0 (2026-04-22)

⚠ BREAKING CHANGES

• upgrade to node24 (#1188)

Features

• upgrade to node24 (#1188) (46dfc01)

Bug Fixes

• bump release-please from 17.3.0 to 17.6.0 (#1199) (f533c26)

Changelog

Sourced from googleapis/release-please-action's changelog.

Changelog

5.0.0 (2026-04-22)

⚠ BREAKING CHANGES

• upgrade to node24 (#1188)

Features

• upgrade to node24 (#1188) (46dfc01)

Bug Fixes

• bump release-please from 17.3.0 to 17.6.0 (#1199) (f533c26)

4.4.1 (2026-02-20)

Bug Fixes

• bump release-please from 17.1.3 to 17.3.0 (#1183) (ef9c274)

4.4.0 (2025-10-09)

Features

• add ability to select versioning-strategy and release-as (#1121) (ee0f5ba)

Bug Fixes

• changelog-host parameter ignored when using manifest configuration (#1151) (535c413)
• bump mocha from 11.7.1 to 11.7.2 in the npm_and_yarn group across 1 directory (#1149) (3612a99)
• bump release-please from 17.1.2 to 17.1.3 (#1158) (66fbfe9)

4.3.0 (2025-08-20)

Features

• deps: update release-please to 17.1.2 (f07192c)

4.2.0 (2025-03-07)

Features

... (truncated)

Commits

• 45996ed chore(main): release 5.0.0 (#1200)
• a8121b9 chore: build dist (#1201)
• f533c26 fix: bump release-please from 17.3.0 to 17.6.0 (#1199)
• 46dfc01 feat!: upgrade to node24 (#1188)
• See full diff in compare view

[deliro]

@dependabot rebase