[dependabot]

Bumps the all-dependencies group with 2 updates: astral-sh/setup-uv and MishaKav/pytest-coverage-comment.

Updates astral-sh/setup-uv from 10.3.2 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @​eifinger (#1119)
• fix: allow whitespace in uv requirement specifiers @​soujasK (#1112)
• fix: resolve ~= specifiers with PEP 440 semantics @​soujasK (#1111)
• fix: only report a saved cache when saving succeeded @​soujasK (#1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @github-actions[bot] (#1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @​eifinger (#1113)
• docs: update version references to v10.3.2 @github-actions[bot] (#1104)

Commits

• 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
• 0192b69 chore: update known checksums for 0.13.6 (#1117)
• 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
• 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
• 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
• 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
• 56618ca docs: update version references to v10.3.2 (#1104)
• See full diff in compare view

Updates MishaKav/pytest-coverage-comment from 1.12.5 to 1.13.0

Release notes

Sourced from MishaKav/pytest-coverage-comment's releases.

v1.13.0

What's Changed

• new annotate-missing-lines option: adds GitHub annotations on lines added in the pull request or push that aren't covered by tests (missing lines and partial branches), shown right below the code in the "Files changed" tab. Works with txt, xml and json coverage on pull_request, pull_request_target and push events. Combine it with hide-comment: true to get annotations without a PR comment, fixes #321
• new annotation-type option to set the annotation level: notice, warning (default) or error
• coverage-path-prefix is now stripped only from the start of a changed file's path (previously the first match anywhere in the path was removed)

Full Changelog: MishaKav/pytest-coverage-comment@v1.12.5...v1.13.0

Changelog

Sourced from MishaKav/pytest-coverage-comment's changelog.

Changelog of the Pytest Coverage Comment

Pytest Coverage Comment 1.13.0

Release Date: 2026-10-26

Changes

• new annotate-missing-lines option: adds GitHub annotations on lines added in the pull request or push that aren't covered by tests (missing lines and partial branches), shown right below the code in the "Files changed" tab. Works with txt, xml and json coverage on pull_request, pull_request_target and push events. Combine it with hide-comment: true to get annotations without a PR comment, fixes #321
• new annotation-type option to set the annotation level: notice, warning (default) or error
• coverage-path-prefix is now stripped only from the start of a changed file's path (previously the first match anywhere in the path was removed)

Pytest Coverage Comment 1.12.5

Release Date: 2026-10-24

Changes

• escape report values in the coverage table and keep them out of markdown parsing, so a crafted coverage report can't inject HTML, markdown, links or a fake badge into the comment
• url-encode file paths in coverage table links, don't link paths with .., support windows \ paths, and strip the workspace prefix from missing-line links
• fix a crash when a coverage report has a top-level folder named like an Object member (e.g. constructor)

Pytest Coverage Comment 1.12.4

Release Date: 2026-10-24

Changes

• bump dev dependencies: vitest 5.0.5, @vitest/coverage-v8 5.0.5, @types/node 26.6.5, eslint 10.13.0, typescript-eslint 8.72.0, prettier 3.9.10, vite 8.3.5
• bump undici from 6.29.0 to 6.29.1 (fixes two high severity vulnerabilities)

Pytest Coverage Comment 1.12.3

Release Date: 2026-10-03

Changes

• bump dev dependencies: vitest 5.0.3, @vitest/coverage-v8 5.0.3, @types/node 26.6.4, eslint 10.12.0, typescript-eslint 8.71.0, prettier 3.9.9 (#309)
• bump undici from 6.28.0 to 6.29.0 (#309)
• bump brace-expansion from 5.0.8 to 5.0.12 (fixes four security vulnerabilities) (#309)

Pytest Coverage Comment 1.12.2

Release Date: 2026-09-01

Changes

• bump dev dependencies: @types/node 26.4.0, @vercel/ncc 0.45.0, @vitest/coverage-v8 4.1.11, vitest 4.1.11, eslint 10.9.1, typescript-eslint 8.68.0 (#302)

Pytest Coverage Comment 1.12.1

... (truncated)

Commits

• 9516bf7 feat: add annotate-missing-lines option (v1.13.0) (2/2) (#323)
• 344cdca feat: build annotations for uncovered added lines (1/2) (#322)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report •

File	Stmts	Miss	Branch	BrPart	Cover	Missing
TOTAL	103727	2287	5900	900	97%

report-only-changed-files is enabled. No changed files were found in the coverage report :)

Tests	Skipped	Failures	Errors	Time
2798	0 💤	0 ❌	0 🔥	5m 44s ⏱️