chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
anthropics/claude-code-action	action	digest	9c5ddab → 9cdae7f
astral-sh/setup-uv	action	minor	v10.0.1 → v10.1.0
astral-sh/uv	uses-with	patch	0.12.10 → 0.12.13
chromaui/action	action	minor	v18.7.2 → v18.8.1

---

Release Notes

astral-sh/setup-uv (astral-sh/setup-uv)

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @​mj0nez (#​1037)
• Use JSON + a typed wrapper instead of TS codegen @​woodruffw (#​1025)

🚀 Enhancements

• Expose a Python "identity" output @​woodruffw (#​1036)
• Verify downloads with astral-sh/versions checksums @​zaniebot (#​1033)

🧰 Maintenance

• chore: update known checksums for 0.12.12 @​github-actions[bot] (#​1041)
• chore: update known checksums for 0.12.10/0.12.11 @​github-actions[bot] (#​1038)
• chore: update known checksums for 0.12.9 @​github-actions[bot] (#​1035)
• chore: update known checksums for 0.12.7/0.12.8 @​github-actions[bot] (#​1031)
• chore: update known checksums for 0.12.6 @​github-actions[bot] (#​1030)
• chore: update known checksums for 0.12.5 @​github-actions[bot] (#​1020)
• Use self-repo syntax for all in-repo actions/reusable workflows @​woodruffw (#​1024)
• Pin one-shot tools @​woodruffw (#​1022)
• ci: remove obsolete direct push attempts @​eifinger (#​1019)

📚 Documentation

• docs: update version references to v10.0.1 @​github-actions[bot] (#​1018)

⬆️ Dependency updates

• chore(deps-dev): roll up Dependabot updates @​eifinger (#​1043)
• Harden npm install defaults @​zaniebot (#​1026)
• Add dependency cooldowns @​woodruffw (#​1021)

astral-sh/uv (astral-sh/uv)

v0.12.13

Compare Source

Released on 2026-09-10.

Python

• Add GraalPy 3.13.0 (#​21431)

Enhancements

• Verify hashes when downloading PEP 658 metadata sidecars (#​21563)

Preview features

• Respect ty exclusions when uv check automatically selects members of a virtual workspace (#​21555)

Performance

• Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (#​21279)

Bug fixes

• Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (#​18713)
• Prefer core-metadata over legacy aliases in JSON index responses (#​21563)

v0.12.12

Compare Source

Released on 2026-09-09.

The executables in our macOS and Windows release archives and uv and uv_build wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

• Exclude distributions uploaded after the exclude-newer cutoff from lockfiles and generated requirement hashes (#​21539)

v0.12.11

Compare Source

Released on 2026-09-08.

Preview features

• Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#​20146)
• Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#​21462)

Performance

• Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#​21478)
• Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#​21468)
• Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#​21500)
• Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#​21499)
• Avoid transitive dependency checks and unnecessary resolution when uv pip install --no-deps finds the requested packages already installed (#​21523)

Bug fixes

• Verify source archives against hashes recorded in uv.lock before reading their metadata or running their build backends (#​21223)
• Verify supplied hashes for registry requirements pinned with === under both --verify-hashes and --require-hashes (#​21543)
• Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided (#​21544)
• Support PowerShell virtual environment activation from UNC paths, including WSL paths (#​19159)
• Trim surrounding whitespace from entries in .python-version and .python-versions files (#​21529)
• Suppress VIRTUAL_ENV mismatch warnings for uv add --no-sync, uv remove --no-sync, and uv add --frozen (#​21496)
• Warn and continue when uv python list cannot query an interpreter (#​21498)

Documentation

• Restore TOML syntax highlighting for exclude-newer examples (#​21534)

chromaui/action (chromaui/action)

v18.8.1

Compare Source

🐛 Bug Fix

• Ignore ENAMETOOLONG errors #​1485 (@​codykaup)
• Strip webpack escape characters in file paths #​1484 (@​codykaup)

Authors: 1

• Cody Kaup (@​codykaup)

---

v18.8.0

Compare Source

🚀 Enhancement

• Set component owners if present #​1478 (@​justin-thurman)

Authors: 1

• Justin Thurman (@​justin-thurman)

---

v18.7.4

Compare Source

🐛 Bug Fix

• Filter .storybook/*.md and .storybook/*.txt changes from TurboSnap v2 #​1482 (@​codykaup)

Authors: 1

• Cody Kaup (@​codykaup)

---

v18.7.3

Compare Source

🐛 Bug Fix

• Remove TurboSnap v2 Sentry fingerprinting #​1480 (@​codykaup)
• Expand E2E verbiage #​1474 (@​codykaup)
• fix: build failures not to reference Storybook when in Vitest run #​1473 (@​AriPerkkio)
• fix: descriptive TurboSnap errors in Vitest runs #​1468 (@​AriPerkkio @​codykaup)

Authors: 2

• Ari Perkkiö (@​AriPerkkio)
• Cody Kaup (@​codykaup)

---

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Only on Monday (* * * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	a71dec4
Status:	✅  Deploy successful!
Preview URL:	https://571d993e.mouseterm.pages.dev
Branch Preview URL:	https://renovate-github-actions.mouseterm.pages.dev

View logs

[dormouse-bot]

Feedback on a draft — not a merge verdict. Mark ready when you want the full review.

All three SHA pins resolve correctly: chromaui/action@259eda5 is v18.8.1, astral-sh/setup-uv@bec219d is v10.1.0, and anthropics/claude-code-action@9cdae7f is the current v1.

The setup-uv and uv bumps in tend-mention.yaml and tend-notifications.yaml won't survive. Both files are generated — their header reads Do not edit this file directly — it will be overwritten on regeneration — and astral-sh/setup-uv@v10.0.1 / version: "0.12.10" were emitted by tend's generator in d2eda84 (0.1.24 → 0.2.0) and re-emitted unchanged through the 0.2.5 and 0.2.6 regenerations. The next chore: update tend workflows commit rewrites both files from the generator and drops these two lines; Renovate then re-opens the same bump the following Monday, indefinitely. docs/specs/security-ci.rationale.md already records the mechanism for the tend action itself: "a hand-edited SHA is overwritten by the next nightly regen, so pinning locally is not durable."

The durable fix is in .github/renovate.json, not here — a packageRules entry scoping the github-actions manager out of the generated files, alongside the existing "tend manages its own action version" rule:

{
  "description": "tend's workflows are generated; a Renovate bump inside them is reverted by the next `uvx tend@latest init` regen. Upstream owns these pins",
  "matchManagers": ["github-actions"],
  "matchFileNames": [".github/workflows/tend-*.yaml"],
  "enabled": false
}

That belongs in its own PR. The three remaining bumps here — chromatic.yml, security-audit.yaml, workflow-audit.yaml — are all hand-maintained files and stick fine.