build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1

[dependabot]

Bumps astral-sh/setup-uv from 9.0.0 to 10.0.1.

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

• docs: update version references to v10.0.0 @github-actions[bot] (#1014)

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

• 20cfd1b chore: update known checksums for 0.12.4 (#1017)
• d73a0ca Tolerate transient manifest timeouts (#1016)
• ae3b92d docs: update version references to v10.0.0 (#1014)
• ae62891 chore(deps): roll up Dependabot updates (#1013)
• f9cdb47 Reject paths in .tool-versions (#1007)
• 4f6036f Require pull requests for Dependabot rollups (#1005)
• 8d6402c chore(deps): roll up Dependabot updates (#1004)
• 46f427b Read Python version from .tool-versions (#996)
• 8ed89c5 ci: pin Alpine container image (#995)
• 8473c7f chore(deps): roll up Dependabot updates (#994)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[seonghobae]

Blocking exact head a476dbe7733742aae15553ec1f5aed321ed1a2fb: this dependency bump updates the pinned astral-sh/setup-uv SHA in .github/workflows/release-acceptance.yml to 20cfd1bf945f4377ade1205e4dbc17946fc9a30d, but the repository's executable workflow contract still requires the prior v9 SHA in tests/test_release_acceptance_workflow.py. CI run 32282136470 reproduces this deterministically on Python 3.10: test_release_acceptance_workflow_is_exact_head_least_privilege fails on the stale exact-SHA assertion (1331 passed, 1 failed), and the CI workflow is therefore non-passing. This is branch-introduced rather than the unrelated main coverage-only blocker affecting other current dependency PRs. Please update the corresponding exact-pin regression contract together with the workflow bump (without weakening the full-SHA pin requirement), then rerun all exact-head gates.

[seonghobae]

Fresh supersession verification: this Dependabot PR’s unique relative delta is limited to the setup-uv 10.0.1 exact SHA 20cfd1bf945f4377ade1205e4dbc17946fc9a30d in .github/workflows/ci.yml and .github/workflows/release-acceptance.yml. Draft successor #325 at exact 0378fdeb4b3312b9d4df4e0a7e9f35fa2ca3b6a6 preserves both of those exact pins, adds the missing matching executable release-acceptance regression, and removes the later-invalid docs paths-ignore behavior while remaining stacked on current #233. The original #259 exact head is independently known non-passing because its contract still asserted the v9 pin. No unique production delta, test, fixture, contract, or failure evidence remains only on #259. Closing this PR is therefore verified successor convergence, not close-to-zero queue handling; #325 remains Draft/non-passing until its own exact-head gates and dependency stack complete.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.