dependabot[bot]
b4c3f6d47c
ci(deps): bump actions/setup-python from 6 to 7
...
Bumps [actions/setup-python](https://github.com/actions/setup-python ) from 6 to 7.
- [Release notes](https://github.com/actions/setup-python/releases )
- [Commits](https://github.com/actions/setup-python/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/setup-python
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-08-01 05:07:44 +00:00
dependabot[bot]
5a2c70c163
ci(deps): bump actions/checkout from 4 to 7 ( #15 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4 to 7.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4...v7 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-01 11:08:06 +09:00
dependabot[bot]
a2232026a2
ci(deps): bump astral-sh/setup-uv from 5 to 7 ( #14 )
...
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv ) from 5 to 7.
- [Release notes](https://github.com/astral-sh/setup-uv/releases )
- [Commits](https://github.com/astral-sh/setup-uv/compare/v5...v7 )
---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-01 11:07:17 +09:00
dependabot[bot]
aae1beabae
ci(deps): bump actions/setup-python from 5 to 6 ( #13 )
...
Bumps [actions/setup-python](https://github.com/actions/setup-python ) from 5 to 6.
- [Release notes](https://github.com/actions/setup-python/releases )
- [Commits](https://github.com/actions/setup-python/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/setup-python
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-01 10:40:38 +09:00
Katsuhide Tsuruta
d391f29820
ci: add monthly pip-audit scan and Dependabot config ( #12 )
...
Add a low-frequency (monthly + manual) security workflow that resolves
dependencies with uv and audits them against the OSV / PyPI Advisory DB
via pip-audit, failing the job when a vulnerability is found.
Also add Dependabot (pip + github-actions, monthly) to auto-open PRs
that bump dependencies to fixed versions. PRs are review/merge by hand
(no auto-merge) since there is no test-gating CI yet.
Closes #11
2026-07-01 10:29:15 +09:00
dependabot[bot]