chore(deps): bump github/codeql-action/init from 4.38.1 to 4.38.2

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.38.1 to 4.38.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
docs: use JSDoc for compatible release specifier comment (#1113 )
2026-11-05 01:35:32 +00:00 · 2026-10-26 10:56:39 +00:00 · 2026-10-26 08:49:11 +01:00 · 2026-10-26 08:37:03 +01:00 · 2026-10-25 19:39:29 +01:00 · 2026-10-25 19:38:39 +01:00
11 changed files with 229 additions and 97 deletions
@@ -47,7 +47,7 @@ jobs:

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          languages: ${{ matrix.language }}
          source-root: src
@@ -0,0 +1,87 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  afterAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+import { CacheLocalSource, type SetupInputs } from "../../src/utils/inputs";
+import { createSetupInputs } from "../helpers/setup-inputs";
+
+const mockSaveCache = jest.fn<() => Promise<number>>();
+const mockInfo = jest.fn();
+const mockLoadInputs = jest.fn<() => SetupInputs>(() =>
+  createSetupInputs({ enableCache: false }),
+);
+const state: Record<string, string> = {};
+
+jest.unstable_mockModule("@actions/cache", () => ({
+  saveCache: mockSaveCache,
+}));
+
+jest.unstable_mockModule("@actions/core", () => ({
+  getState: jest.fn((name: string) => state[name] ?? ""),
+  setFailed: jest.fn(),
+}));
+
+jest.unstable_mockModule("../../src/utils/inputs", () => ({
+  loadInputs: mockLoadInputs,
+}));
+
+jest.unstable_mockModule("../../src/utils/logging", () => ({
+  info: mockInfo,
+  warning: jest.fn(),
+}));
+
+jest.spyOn(process, "exit").mockImplementation((() => undefined) as never);
+
+const { run } = await import("../../src/save-cache");
+
+const cacheDir = mkdtempSync(join(tmpdir(), "setup-uv-save-cache-"));
+const cacheKey = "setup-uv-2-x86_64-unknown-linux-gnu-ubuntu-24.04-3.12-hash";
+
+function infoMessages(): string[] {
+  return mockInfo.mock.calls.map(([msg]) => msg as string);
+}
+
+beforeEach(() => {
+  delete process.env.UV_CACHE_DIR;
+  state["cache-key"] = cacheKey;
+  state["cache-matched-key"] = "";
+  mockLoadInputs.mockReturnValue(
+    createSetupInputs({
+      cacheLocalPath: { path: cacheDir, source: CacheLocalSource.Input },
+    }),
+  );
+});
+
+afterAll(() => {
+  rmSync(cacheDir, { force: true, recursive: true });
+});
+
+describe("saveCache", () => {
+  it("reports the saved key when the cache is saved", async () => {
+    mockSaveCache.mockResolvedValue(42);
+
+    await run();
+
+    expect(mockSaveCache).toHaveBeenCalledWith([cacheDir], cacheKey);
+    expect(infoMessages()).toContain(`uv cache saved with key: ${cacheKey}`);
+  });
+
+  it("does not report the cache as saved when saving fails", async () => {
+    // @actions/cache logs the failure itself and returns -1
+    mockSaveCache.mockResolvedValue(-1);
+
+    await run();
+
+    expect(mockSaveCache).toHaveBeenCalledWith([cacheDir], cacheKey);
+    expect(infoMessages()).not.toContain(
+      `uv cache saved with key: ${cacheKey}`,
+    );
+  });
+});
@@ -146,6 +146,28 @@ describe("download-version", () => {
      expect(mockGetAllVersions).not.toHaveBeenCalled();
    });

+    it("resolves ~= with PEP 440 compatible release semantics", async () => {
+      mockGetFirstMatchingVersion.mockImplementation(
+        (predicate: (version: string) => boolean) =>
+          ["1.0.0", "0.10.2", "0.9.26"].find(predicate),
+      );
+
+      const version = await resolveVersion("~=0.9", undefined);
+
+      expect(version).toBe("0.10.2");
+    });
+
+    it("resolves ~= with PEP 440 compatible release semantics from manifest-file", async () => {
+      mockGetAllVersions.mockResolvedValue(["1.0.0", "0.10.2", "0.9.26"]);
+
+      const version = await resolveVersion(
+        "~=0.9",
+        "https://example.com/custom.ndjson",
+      );
+
+      expect(version).toBe("0.10.2");
+    });
+
    it("treats == exact pins as explicit versions", async () => {
      const version = await resolveVersion("==0.9.26", undefined);

@@ -35,3 +35,14 @@ test("strips PEP 508 markers from requirements dependencies", () => {

  expect(parsedVersion).toBe("==0.11.20");
 });
+
+test.each([
+  ["uv >= 0.5.0", ">=0.5.0"],
+  ["uv == 0.11.20", "==0.11.20"],
+  ["uv>=0.5.0, <0.6.0", ">=0.5.0,<0.6.0"],
+  ["uv >= 0.5.0 , < 0.6.0", ">=0.5.0,<0.6.0"],
+  ["uv==0.11.20 --hash=sha256:abc", "==0.11.20"],
+  ["uv==0.11.20  # pinned for CI", "==0.11.20"],
+])("allows whitespace in the uv specifier %s", (dependency, expected) => {
+  expect(getUvVersionFromRequirementsText(dependency)).toBe(expected);
+});
@@ -66671,8 +66671,10 @@ async function saveCacheToKey(cacheKey, cachePath, stateKey, cacheName) {
    return;
  }
  info2(`Including ${cacheName} path: ${cachePath}`);
-  await saveCache2([cachePath], cacheKey);
-  info2(`${cacheName} saved with key: ${cacheKey}`);
+  const cacheId = await saveCache2([cachePath], cacheKey);
+  if (cacheId !== -1) {
+    info2(`${cacheName} saved with key: ${cacheKey}`);
+  }
 }
 __name(saveCacheToKey, "saveCacheToKey");
 run();
@@ -101579,7 +101579,7 @@ function getUvVersionFromAllDependencies(allDependencies) {
 }
 function getUvVersionFromDependency(dependency) {
  const dependencyWithoutMarker = dependency.split(";", 1)[0]?.trim();
-  return dependencyWithoutMarker?.match(/^uv([=<>~!]+\S*)/)?.[1].trim();
+  return dependencyWithoutMarker?.match(/^uv\s*((?:[=<>~!]+\s*[^\s,]+\s*,?\s*)+)/)?.[1].replace(/\s/g, "");
 }

 // src/version/tool-versions-file.ts
@@ -101937,7 +101937,7 @@ async function resolveVersion(versionInput, manifestUrl, resolutionStrategy = "h
  throw new Error(`No version found for ${versionInput}`);
 }
 async function findHighestSatisfyingVersion(versionSpecifier) {
-  const semverRange = semver5.validRange(versionSpecifier);
+  const semverRange = isCompatibleReleaseSpecifier(versionSpecifier) ? null : semver5.validRange(versionSpecifier);
  if (semverRange !== null) {
    const semverMatch = await getFirstMatchingVersion(
      (version3) => semver5.satisfies(version3, semverRange)
@@ -101959,8 +101959,11 @@ async function findHighestSatisfyingVersion(versionSpecifier) {
  }
  return pep440Match;
 }
+function isCompatibleReleaseSpecifier(versionSpecifier) {
+  return versionSpecifier.includes("~=");
+}
 function maxSatisfying2(versions, version3) {
-  const maxSemver = evaluateVersions(versions, version3);
+  const maxSemver = isCompatibleReleaseSpecifier(version3) ? "" : evaluateVersions(versions, version3);
  if (maxSemver !== "") {
    debug(`Found a version that satisfies the semver range: ${maxSemver}`);
    return maxSemver;
@@ -101975,7 +101978,7 @@ function maxSatisfying2(versions, version3) {
  return void 0;
 }
 function minSatisfying3(versions, version3) {
-  const minSemver = semver5.minSatisfying(versions, version3);
+  const minSemver = isCompatibleReleaseSpecifier(version3) ? null : semver5.minSatisfying(versions, version3);
  if (minSemver !== null) {
    debug(`Found a version that satisfies the semver range: ${minSemver}`);
    return minSemver;
@@ -20,7 +20,7 @@
        "undici": "^8.10.0"
      },
      "devDependencies": {
-        "@biomejs/biome": "^2.5.14",
+        "@biomejs/biome": "^2.5.11",
        "@types/js-yaml": "^4.0.9",
        "@types/node": "^26.4.0",
        "@types/semver": "^7.8.0",
@@ -912,9 +912,9 @@
      "license": "MIT"
    },
    "node_modules/@biomejs/biome": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.14.tgz",
-      "integrity": "sha512-0FabLIjd4M/dm8VFI86RMaLLdgepzbdfiAL2R8cr7V81OYYrP1w7Z73KfAwPK5h9SrEBXTzNG2y+mBwPo9xRnw==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.11.tgz",
+      "integrity": "sha512-Tj0dnkLPdW0ASjHfj2D/ZkkvPU2wrFmnE1jWTD2xzV1ycapV1DutbYXk4NDnR3rYTi1ZCbNFD4G2gRMEY65WaA==",
      "dev": true,
      "license": "MIT OR Apache-2.0",
      "bin": {
@@ -928,20 +928,20 @@
        "url": "https://opencollective.com/biome"
      },
      "optionalDependencies": {
-        "@biomejs/cli-darwin-arm64": "2.5.14",
-        "@biomejs/cli-darwin-x64": "2.5.14",
-        "@biomejs/cli-linux-arm64": "2.5.14",
-        "@biomejs/cli-linux-arm64-musl": "2.5.14",
-        "@biomejs/cli-linux-x64": "2.5.14",
-        "@biomejs/cli-linux-x64-musl": "2.5.14",
-        "@biomejs/cli-win32-arm64": "2.5.14",
-        "@biomejs/cli-win32-x64": "2.5.14"
+        "@biomejs/cli-darwin-arm64": "2.5.11",
+        "@biomejs/cli-darwin-x64": "2.5.11",
+        "@biomejs/cli-linux-arm64": "2.5.11",
+        "@biomejs/cli-linux-arm64-musl": "2.5.11",
+        "@biomejs/cli-linux-x64": "2.5.11",
+        "@biomejs/cli-linux-x64-musl": "2.5.11",
+        "@biomejs/cli-win32-arm64": "2.5.11",
+        "@biomejs/cli-win32-x64": "2.5.11"
      }
    },
    "node_modules/@biomejs/cli-darwin-arm64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.14.tgz",
-      "integrity": "sha512-UnzaXO65L4tsZimFITFP2M121GyhDcWFrT3pL5ZJ5U4XcS/0L5VHYytVohdCf/gnDUFHgl2I9xnt5bV/J1kxHQ==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.11.tgz",
+      "integrity": "sha512-6SGZxoKbXvUjMn1t6A98HqWISPnGNbYs0R/Rt2JarmXBSev+lva4QxUMWEBX9lX1Wo1XTJ78uk5xVDtG58SRZg==",
      "cpu": [
        "arm64"
      ],
@@ -956,9 +956,9 @@
      }
    },
    "node_modules/@biomejs/cli-darwin-x64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.14.tgz",
-      "integrity": "sha512-kiy8qA16K93J7uvFfWi4LgjqDpnRKyePAna6A0Y4jxyUga35SYpIZ2cNWlhy0lsfgqRenCpfymnJWEZ6mgpRgA==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.11.tgz",
+      "integrity": "sha512-nYkXY7tLBEgnGbYapDKAyKzgt44ZEyG+AKalvTXtCWKYgepI9dw327q+cVgedxm+Udi1ZzHKUyZrIusHi/KQbw==",
      "cpu": [
        "x64"
      ],
@@ -973,16 +973,13 @@
      }
    },
    "node_modules/@biomejs/cli-linux-arm64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.14.tgz",
-      "integrity": "sha512-vO/9BaU1n30CiFNLx49gMTMtbCAAqlo/EqFoG0BU3deQInTbJrmXSmTQ9e3FoDZIKQnvSLDVNL4lx1ci7y1T1Q==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.11.tgz",
+      "integrity": "sha512-3PVLSTD9RR73rvVPt5G3T1gc+ycggWEGfTD7RvzzbtcDPD27NxgxBbAFfpm7DXJKW6VLHWE1lLMGvFt2Qxjcow==",
      "cpu": [
        "arm64"
      ],
      "dev": true,
-      "libc": [
-        "glibc"
-      ],
      "license": "MIT OR Apache-2.0",
      "optional": true,
      "os": [
@@ -993,16 +990,13 @@
      }
    },
    "node_modules/@biomejs/cli-linux-arm64-musl": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.14.tgz",
-      "integrity": "sha512-SJ9PrZkBnnH9dHJDnxk34vKs0GB2dbsioaft6/hPhWJ7AHpwYH83Isnhj0FSRpFkGgpVfJ1lds23ApB2czUDLQ==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.11.tgz",
+      "integrity": "sha512-qhyZUMyCbWYFV2bAwRNVvfMVZ+hv7WYl6mossGrxC+uiQQXhvsuWWU8zz6jYX0mChZd9MgQZbm4vozTmG/5iGw==",
      "cpu": [
        "arm64"
      ],
      "dev": true,
-      "libc": [
-        "musl"
-      ],
      "license": "MIT OR Apache-2.0",
      "optional": true,
      "os": [
@@ -1013,16 +1007,13 @@
      }
    },
    "node_modules/@biomejs/cli-linux-x64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.14.tgz",
-      "integrity": "sha512-VHZRa7CCQBUWKxNwUvHJeuW03WFRgN5NWO//SDGOitc9QIeNyfA42V9zlKm+x82xFSG9Bzi5fi+hbhm9anO8yA==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.11.tgz",
+      "integrity": "sha512-JOytptlsgM33B2MMFUg8iBrb4IKpbD5JnJrSeYiaFEeAj4vuXx0iQSQZ4qK7sqyMtfjZxxPdNdMZZVL4y/mFyA==",
      "cpu": [
        "x64"
      ],
      "dev": true,
-      "libc": [
-        "glibc"
-      ],
      "license": "MIT OR Apache-2.0",
      "optional": true,
      "os": [
@@ -1033,16 +1024,13 @@
      }
    },
    "node_modules/@biomejs/cli-linux-x64-musl": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.14.tgz",
-      "integrity": "sha512-2kI5PrMgW5dcEZYrstLPmUmCwkUwZY39rP4BN93Vxbwcs2O57LDQOktUZZYPvvspN5i0mhGr3TJtF5sU26NUWg==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.11.tgz",
+      "integrity": "sha512-oRRlrchG5EfrEL/EmtT1qUjSNHk3/5LGeZhQqADBBAJF1b1ET6964xEKe7aGlGARzDfza8H/seEsFJl7S6Ql9w==",
      "cpu": [
        "x64"
      ],
      "dev": true,
-      "libc": [
-        "musl"
-      ],
      "license": "MIT OR Apache-2.0",
      "optional": true,
      "os": [
@@ -1053,9 +1041,9 @@
      }
    },
    "node_modules/@biomejs/cli-win32-arm64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.14.tgz",
-      "integrity": "sha512-pHgAFffmZtaYoxavEsWEYNvcA7NwOIjLyqw2HXyLbt16xYryX0L4fMV2u0G9ag6LNYPIoqWaWqzUcnc6rLGGXg==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.11.tgz",
+      "integrity": "sha512-e49E6K9hzH/ohJNx8Y26mY8HaV4I4ZViIeoqhKsmoXLKHhQnMeBAVqCgsGf2Wa3lXlS7RkporDXMHHWkzvZzFw==",
      "cpu": [
        "arm64"
      ],
@@ -1070,9 +1058,9 @@
      }
    },
    "node_modules/@biomejs/cli-win32-x64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.14.tgz",
-      "integrity": "sha512-oJWmBhoHsnhUKIke+0gXDX0mltJrWHA1UyHsrTlXwX0TL64ilVZAo+TYZm97baecV0esBdpzy3k96q+09JaZUQ==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.11.tgz",
+      "integrity": "sha512-QSQr/KjOgXA7OzXJUWS+oguKyAZ3Q0l/lnlDGbu397eKo83atuWUjBPJrsqbKNF6CARGw8XXJLGzpHC8Ryhd4Q==",
      "cpu": [
        "x64"
      ],
@@ -6666,74 +6654,74 @@
      "dev": true
    },
    "@biomejs/biome": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.14.tgz",
-      "integrity": "sha512-0FabLIjd4M/dm8VFI86RMaLLdgepzbdfiAL2R8cr7V81OYYrP1w7Z73KfAwPK5h9SrEBXTzNG2y+mBwPo9xRnw==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.11.tgz",
+      "integrity": "sha512-Tj0dnkLPdW0ASjHfj2D/ZkkvPU2wrFmnE1jWTD2xzV1ycapV1DutbYXk4NDnR3rYTi1ZCbNFD4G2gRMEY65WaA==",
      "dev": true,
      "requires": {
-        "@biomejs/cli-darwin-arm64": "2.5.14",
-        "@biomejs/cli-darwin-x64": "2.5.14",
-        "@biomejs/cli-linux-arm64": "2.5.14",
-        "@biomejs/cli-linux-arm64-musl": "2.5.14",
-        "@biomejs/cli-linux-x64": "2.5.14",
-        "@biomejs/cli-linux-x64-musl": "2.5.14",
-        "@biomejs/cli-win32-arm64": "2.5.14",
-        "@biomejs/cli-win32-x64": "2.5.14"
+        "@biomejs/cli-darwin-arm64": "2.5.11",
+        "@biomejs/cli-darwin-x64": "2.5.11",
+        "@biomejs/cli-linux-arm64": "2.5.11",
+        "@biomejs/cli-linux-arm64-musl": "2.5.11",
+        "@biomejs/cli-linux-x64": "2.5.11",
+        "@biomejs/cli-linux-x64-musl": "2.5.11",
+        "@biomejs/cli-win32-arm64": "2.5.11",
+        "@biomejs/cli-win32-x64": "2.5.11"
      }
    },
    "@biomejs/cli-darwin-arm64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.14.tgz",
-      "integrity": "sha512-UnzaXO65L4tsZimFITFP2M121GyhDcWFrT3pL5ZJ5U4XcS/0L5VHYytVohdCf/gnDUFHgl2I9xnt5bV/J1kxHQ==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.11.tgz",
+      "integrity": "sha512-6SGZxoKbXvUjMn1t6A98HqWISPnGNbYs0R/Rt2JarmXBSev+lva4QxUMWEBX9lX1Wo1XTJ78uk5xVDtG58SRZg==",
      "dev": true,
      "optional": true
    },
    "@biomejs/cli-darwin-x64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.14.tgz",
-      "integrity": "sha512-kiy8qA16K93J7uvFfWi4LgjqDpnRKyePAna6A0Y4jxyUga35SYpIZ2cNWlhy0lsfgqRenCpfymnJWEZ6mgpRgA==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.11.tgz",
+      "integrity": "sha512-nYkXY7tLBEgnGbYapDKAyKzgt44ZEyG+AKalvTXtCWKYgepI9dw327q+cVgedxm+Udi1ZzHKUyZrIusHi/KQbw==",
      "dev": true,
      "optional": true
    },
    "@biomejs/cli-linux-arm64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.14.tgz",
-      "integrity": "sha512-vO/9BaU1n30CiFNLx49gMTMtbCAAqlo/EqFoG0BU3deQInTbJrmXSmTQ9e3FoDZIKQnvSLDVNL4lx1ci7y1T1Q==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.11.tgz",
+      "integrity": "sha512-3PVLSTD9RR73rvVPt5G3T1gc+ycggWEGfTD7RvzzbtcDPD27NxgxBbAFfpm7DXJKW6VLHWE1lLMGvFt2Qxjcow==",
      "dev": true,
      "optional": true
    },
    "@biomejs/cli-linux-arm64-musl": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.14.tgz",
-      "integrity": "sha512-SJ9PrZkBnnH9dHJDnxk34vKs0GB2dbsioaft6/hPhWJ7AHpwYH83Isnhj0FSRpFkGgpVfJ1lds23ApB2czUDLQ==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.11.tgz",
+      "integrity": "sha512-qhyZUMyCbWYFV2bAwRNVvfMVZ+hv7WYl6mossGrxC+uiQQXhvsuWWU8zz6jYX0mChZd9MgQZbm4vozTmG/5iGw==",
      "dev": true,
      "optional": true
    },
    "@biomejs/cli-linux-x64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.14.tgz",
-      "integrity": "sha512-VHZRa7CCQBUWKxNwUvHJeuW03WFRgN5NWO//SDGOitc9QIeNyfA42V9zlKm+x82xFSG9Bzi5fi+hbhm9anO8yA==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.11.tgz",
+      "integrity": "sha512-JOytptlsgM33B2MMFUg8iBrb4IKpbD5JnJrSeYiaFEeAj4vuXx0iQSQZ4qK7sqyMtfjZxxPdNdMZZVL4y/mFyA==",
      "dev": true,
      "optional": true
    },
    "@biomejs/cli-linux-x64-musl": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.14.tgz",
-      "integrity": "sha512-2kI5PrMgW5dcEZYrstLPmUmCwkUwZY39rP4BN93Vxbwcs2O57LDQOktUZZYPvvspN5i0mhGr3TJtF5sU26NUWg==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.11.tgz",
+      "integrity": "sha512-oRRlrchG5EfrEL/EmtT1qUjSNHk3/5LGeZhQqADBBAJF1b1ET6964xEKe7aGlGARzDfza8H/seEsFJl7S6Ql9w==",
      "dev": true,
      "optional": true
    },
    "@biomejs/cli-win32-arm64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.14.tgz",
-      "integrity": "sha512-pHgAFffmZtaYoxavEsWEYNvcA7NwOIjLyqw2HXyLbt16xYryX0L4fMV2u0G9ag6LNYPIoqWaWqzUcnc6rLGGXg==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.11.tgz",
+      "integrity": "sha512-e49E6K9hzH/ohJNx8Y26mY8HaV4I4ZViIeoqhKsmoXLKHhQnMeBAVqCgsGf2Wa3lXlS7RkporDXMHHWkzvZzFw==",
      "dev": true,
      "optional": true
    },
    "@biomejs/cli-win32-x64": {
-      "version": "2.5.14",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.14.tgz",
-      "integrity": "sha512-oJWmBhoHsnhUKIke+0gXDX0mltJrWHA1UyHsrTlXwX0TL64ilVZAo+TYZm97baecV0esBdpzy3k96q+09JaZUQ==",
+      "version": "2.5.11",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.11.tgz",
+      "integrity": "sha512-QSQr/KjOgXA7OzXJUWS+oguKyAZ3Q0l/lnlDGbu397eKo83atuWUjBPJrsqbKNF6CARGw8XXJLGzpHC8Ryhd4Q==",
      "dev": true,
      "optional": true
    },
@@ -49,7 +49,7 @@
    "undici": "^8.10.0"
  },
  "devDependencies": {
-    "@biomejs/biome": "^2.5.14",
+    "@biomejs/biome": "^2.5.11",
    "@types/js-yaml": "^4.0.9",
    "@types/node": "^26.4.0",
    "@types/semver": "^7.8.0",
@@ -159,8 +159,10 @@ async function saveCacheToKey(
  }

  log.info(`Including ${cacheName} path: ${cachePath}`);
-  await cache.saveCache([cachePath], cacheKey);
-  log.info(`${cacheName} saved with key: ${cacheKey}`);
+  const cacheId = await cache.saveCache([cachePath], cacheKey);
+  if (cacheId !== -1) {
+    log.info(`${cacheName} saved with key: ${cacheKey}`);
+  }
 }

 run();
@@ -69,5 +69,7 @@ function getUvVersionFromAllDependencies(

 function getUvVersionFromDependency(dependency: string): string | undefined {
  const dependencyWithoutMarker = dependency.split(";", 1)[0]?.trim();
-  return dependencyWithoutMarker?.match(/^uv([=<>~!]+\S*)/)?.[1].trim();
+  return dependencyWithoutMarker
+    ?.match(/^uv\s*((?:[=<>~!]+\s*[^\s,]+\s*,?\s*)+)/)?.[1]
+    .replace(/\s/g, "");
 }
@@ -169,7 +169,9 @@ async function findHighestSatisfyingVersion(
 ): Promise<string | undefined> {
  // This fast path assumes uv releases are semver-monotonic: newer manifest
  // entries always have higher versions, with no lower-version backports.
-  const semverRange = semver.validRange(versionSpecifier);
+  const semverRange = isCompatibleReleaseSpecifier(versionSpecifier)
+    ? null
+    : semver.validRange(versionSpecifier);
  if (semverRange !== null) {
    const semverMatch = await getFirstMatchingVersion((version) =>
      semver.satisfies(version, semverRange),
@@ -193,11 +195,22 @@ async function findHighestSatisfyingVersion(
  return pep440Match;
 }

+/**
+ * `~=` is the PEP 440 compatible release operator. semver accepts it as a
+ * tilde range with a narrower upper bound (`~=0.5` as `<0.6.0` instead of
+ * `<1.0`), so it must only be evaluated as PEP 440.
+ */
+function isCompatibleReleaseSpecifier(versionSpecifier: string): boolean {
+  return versionSpecifier.includes("~=");
+}
+
 function maxSatisfying(
  versions: string[],
  version: string,
 ): string | undefined {
-  const maxSemver = tc.evaluateVersions(versions, version);
+  const maxSemver = isCompatibleReleaseSpecifier(version)
+    ? ""
+    : tc.evaluateVersions(versions, version);
  if (maxSemver !== "") {
    core.debug(`Found a version that satisfies the semver range: ${maxSemver}`);
    return maxSemver;
@@ -218,7 +231,9 @@ function minSatisfying(
  versions: string[],
  version: string,
 ): string | undefined {
-  const minSemver = semver.minSatisfying(versions, version);
+  const minSemver = isCompatibleReleaseSpecifier(version)
+    ? null
+    : semver.minSatisfying(versions, version);
  if (minSemver !== null) {
    core.debug(`Found a version that satisfies the semver range: ${minSemver}`);
    return minSemver;
Author	SHA1	Message	Date
dependabot[bot]andGitHub	8274394096	chore(deps): bump github/codeql-action/init from 4.38.1 to 4.38.2 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.38.1 to 4.38.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-26 10:56:39 +00:00
Kevin Stillhammer GitHub Amp	2f29784424	docs: use JSDoc for compatible release specifier comment (#1113 ) Amp-Thread-ID: https://ampcode.com/threads/T-01a17443-b5b9-703c-8877-780650eae403 Co-authored-by: Amp <amp@ampcode.com>	2026-10-26 08:49:11 +01:00
soujasK GitHub Claude Opus 5.5	9c7332190c	fix: allow whitespace in uv requirement specifiers (#1112 ) ## Summary When the uv version is read from dependencies (`requirements.txt`, or `project.dependencies` / `optional-dependencies` / `dependency-groups` in `pyproject.toml` via `version-file`), the specifier was matched with `/^uv([=<>~!]+\S*)/`. PEP 508 allows whitespace around operators and after commas, and those valid forms were misread: \| dependency \| before \| after \| \|---\|---\|---\| \| `uv >= 0.5.0` \| not found, latest uv installed \| `>=0.5.0` \| \| `uv == 0.11.20` \| not found, latest uv installed \| `==0.11.20` \| \| `uv>=0.5.0, <0.6.0` \| `>=0.5.0,`, fails with `No version found for >=0.5.0,` \| `>=0.5.0,<0.6.0` \| The regex now allows whitespace around operators and between comma-separated clauses, and strips it from the result. Inputs that worked before give the same result, including inline `--hash=` options, trailing ` # comments`, the `\` continuation lines from `uv pip compile --generate-hashes`, and names that only start with `uv` (`uvicorn`, `uv-build`). ## Test plan - Added cases for spaced operators, spaced clauses, inline `--hash` and trailing comments. The four whitespace cases failed before the change. - `npm run all` on Ubuntu (WSL) with Node 24.19.0: build, Biome (no fixes), packaging, and 165 tests across 15 suites pass. The rebuilt `dist/setup/index.cjs` only differs in the changed line. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-26 08:37:03 +01:00
soujasK GitHub Claude Opus 5.5	80fbe0140c	fix: resolve ~= specifiers with PEP 440 semantics (#1111 ) ## Summary `~=` is the PEP 440 compatible release operator, but the resolver tries `semver.validRange()` first, and semver accepts `~=` as a tilde range: \| specifier \| semver \| PEP 440 \| \|---\|---\|---\| \| `~=0.9` \| `>=0.9.0 <0.10.0` \| `>=0.9, ==0.*` \| So with the default `highest` strategy, `version: "~=0.9"` (or `required-version = "~=0.9"` picked up through `version-file`) installs the highest 0.9.x instead of the highest 0.x. The same happens with `manifest-file`, where `tc.evaluateVersions` is semver-based. This skips the semver evaluation for specifiers containing `~=`, so they are only evaluated with `@renovatebot/pep440`. No semver range legitimately uses `~=`. Notes: - Only a bare two-segment `~=X.Y` resolved incorrectly. `~=X.Y.Z` gives the same result in both, and compound specifiers like `~=0.9, !=0.9.3` were already rejected by semver and fell through to PEP 440. - `minSatisfying` gets the same check for consistency. The lower bound is the same under both interpretations, so `lowest` didn't produce wrong results before. - A single-segment `~=1` is invalid PEP 440. semver used to resolve it to 1.x; it now fails with `No version found for ~=1`, same as other invalid specifiers. ## Test plan - Added tests for `~=0.9` with the default manifest and with `manifest-file`. Both returned `0.9.26` instead of `0.10.2` before the change. - `npm run all` on Ubuntu (WSL) with Node 24.19.0: build, Biome (no fixes), packaging, and 161 tests across 15 suites pass. The rebuilt `dist/setup/index.cjs` only differs in the changed lines. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-25 19:39:29 +01:00
soujasK GitHub Claude Opus 5.5	36b7b57007	fix: only report a saved cache when saving succeeded (#1110 ) ## Summary The post step logs `uv cache saved with key: ...` (and `Python cache saved with key: ...`) even when the save failed. The log in #769 shows it right after `Warning: Failed to save: ...`: ``` Warning: Failed to save: "C:\Program failed with error: The process 'C:\Program Files\Git\usr\bin\tar.exe' failed with exit code 2 uv cache saved with key: setup-uv-2-x86_64-pc-windows-msvc-windows-11-3.12.12-pruned-... ``` `@actions/cache`'s `saveCache` doesn't throw for these failures. It logs them and returns `-1`, and `saveCacheToKey` ignored the return value. This now checks for `-1` before logging, which is the same check the `actions/cache` save step uses (`if (cacheId != -1) core.info("Cache saved with key: ...")`). `@actions/cache` already logs the reason, so nothing else is logged on failure, and the exit code stays the same. This only changes the log line. It doesn't address the underlying tar/gzip failure in #769. One limitation: with the legacy (v1) cache service, an upload that fails after the cache was reserved still returns the reserved id, so that one case is still reported as saved. That's on the `@actions/cache` side and affects `actions/cache` the same way. Related to #769 ## Test plan - Added `__tests__/cache/save-cache.test.ts`. The `-1` case fails before the change and passes after it. - `npm run all` on Ubuntu (WSL) with Node 24.19.0 / npm 11.17.0: build, Biome (no fixes), packaging, and all 161 tests across 16 suites pass. The regenerated `dist/save-cache/index.cjs` only differs in the changed lines. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-25 19:38:39 +01:00