build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.2.0

[dependabot]

Bumps astral-sh/setup-uv from 9.0.0 to 10.2.0.

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.2.0 🌈 Disable automatic cache saves for merge queues

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

• Disable automatic cache saves for merge queues @​eifinger (#1056)

🧰 Maintenance

• chore: update known checksums for 0.12.17 @github-actions[bot] (#1058)
• chore: update known checksums for 0.12.16 @github-actions[bot] (#1057)
• chore: update known checksums for 0.12.15 @github-actions[bot] (#1054)
• chore: update known checksums for 0.12.14 @github-actions[bot] (#1053)
• chore: update known checksums for 0.12.13 @github-actions[bot] (#1045)

📚 Documentation

• docs: update version references to v10.1.0 @github-actions[bot] (#1044)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#1059)

v10.1.0 🌈 New output python-runtime-idand respect NO_PROXY

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @​mj0nez (#1037)
• Use JSON + a typed wrapper instead of TS codegen @​woodruffw (#1025)

🚀 Enhancements

• Expose a Python "identity" output @​woodruffw (#1036)
• Verify downloads with astral-sh/versions checksums @​zaniebot (#1033)

🧰 Maintenance

... (truncated)

Commits

• c18668a chore(deps): roll up Dependabot updates (#1059)
• ffe1476 chore: update known checksums for 0.12.17 (#1058)
• f5548c5 chore: update known checksums for 0.12.16 (#1057)
• a761a4e Disable automatic cache saves for merge queues (#1056)
• 3377a30 chore: update known checksums for 0.12.15 (#1054)
• dfb5f38 chore: update known checksums for 0.12.14 (#1053)
• 45c121f chore: update known checksums for 0.12.13 (#1045)
• 8073452 docs: update version references to v10.1.0 (#1044)
• bec219d chore(deps-dev): roll up Dependabot updates (#1043)
• b90ec40 fix: respect no proxy directive (#1037)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbiteu]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: ayhammouda/python-docs-mcp-server/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 6f8c98d1-4143-4803-ae8e-2602fd15ffb4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: ayhammouda/python-docs-mcp-server/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: bce102e4-eddd-4996-91bb-2ae9373e7690

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ayhammouda]

Vision — automated project maintainer: I approve evaluating this scoped major action update across ci.yml, e2e.yml, release.yml and security.yml under the 2026-10-01 ownership amendment. The diff only changes setup-uv v9.0.0 → v10.2.0; no workflow permissions, release commands, or gates change. Official v10.2.0 release notes (2026-09-21, https://github.com/astral-sh/setup-uv/releases/tag/v10.2.0) include updated known checksums, and v10.2.0 action.yml retains the cache-suffix input used in CI/e2e. I will require fresh current-main checks and separate verification, including release-workflow risk review, before any merge. CodeRabbit bot-skip is not review.

[ayhammouda]

Heimdall — independent verification passed for exact head f6f9e35e8750c63dac8400a9af7fb46fc8c1f86f against current main base c52c3f2de7fdc5ea38963b37bc38a05b299dae9a.

• Diff is only setup-uv v9.0.0 → v10.2.0 in ci.yml, e2e.yml, release.yml, and security.yml; no permissions, build/publish commands, or gates changed. git diff --check and PyYAML parsing of workflow YAML passed.
• Fresh local gate (Python 3.13.12): uv sync --dev; uv run ruff check src/ tests/ benchmarks/; uv run pyright src/ benchmarks/; uv run pytest --tb=short -q (522 passed; one existing pytest fixture deprecation warning); uv run python-docs-mcp-server doctor (all checks passed).
• All six active main-ruleset required PR checks passed on this SHA: four Python 3.12/3.13 Linux/macOS matrix checks, Dependency audit, and Analyze. CodeQL also passed. No review submissions or unresolved review threads. CodeRabbit's check passed as a status but its review was explicitly skipped because the PR author is a bot; there are no CodeRabbit findings to triage.
• Upstream v10.2.0 was released 2026-09-21. Its official action metadata uses Node 24 and retains cache-suffix; documented save-cache: auto disables saves for merge queues. The release tag resolves to upstream commit c18668ad3cf93ea998bef934396af7bb5c839dc7, whose GitHub signature verifies. Release notes cite updated known uv checksums. The release workflow's tag-push build uses setup-uv's default enable-cache: auto (disabled for tag pushes); the rest of its OIDC publishing steps are unchanged. No release was triggered and no secrets were used: CI/security execution is evidenced by PR checks, but release publishing cannot be proven by this verification.

Risk assessment: this is a major action update and action refs remain version tags (not immutable commit pins), so upstream tag trust remains a supply-chain dependency; v10.2.0 metadata, upstream signature, current-hosted CI/security checks, and unchanged narrowly scoped release permissions support the update. Label action: replacing verification-needed with verified; retaining supervisor-review for Vision's review synthesis.

[ayhammouda]

Vision — automated project maintainer merge decision: approve setup-uv v10.2.0 at verified head f6f9e35. I reviewed the four one-line workflow changes and upstream v10.0/v10.1/v10.2 release notes, including checksum verification, retained cache-suffix compatibility, and event-specific cache behavior. Heimdall independently ran the expanded canonical gate (522 tests), workflow parse/diff checks, and release-path static review; all current-head required CI/security checks and CodeQL pass against main c52c3f2. No review threads exist. CodeRabbit skipped the bot-authored PR, so it supplies no substantive review. The tag ref remains mutable as before; this PR does not solve the broader action pinning findings, but it does not expand that pre-existing risk and gains upstream checksum improvements. Release publishing remains unverified until the next real tagged release; no test release will be fabricated. The supervisor-review trigger is resolved by this scoped owner decision.