[renovate]

This PR contains the following updates:

Package	Type	Update	Change
astral-sh/setup-uv		patch	v10.3.0 → v10.3.3
astral-sh/setup-uv	action	patch	v10.3.0 → v10.3.3
getsentry/craft	action	minor	3.9.0 → 3.11.1
getsentry/craft	workflow	minor	3.9.0 → 3.11.1
java-jdk	uses-with	major	21 → 25

---

Release Notes

astral-sh/setup-uv

v10.3.3: 🌈 Use Astral mirror for version manifests with GitHub fallback

Compare Source

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable.
(Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @​eifinger (#​1119)
• fix: allow whitespace in uv requirement specifiers @​soujasK (#​1112)
• fix: resolve ~= specifiers with PEP 440 semantics @​soujasK (#​1111)
• fix: only report a saved cache when saving succeeded @​soujasK (#​1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @​github-actions[bot] (#​1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @​eifinger (#​1113)
• docs: update version references to v10.3.2 @​github-actions[bot] (#​1104)

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes

🧰 Maintenance

• chore: update known checksums for 0.13.5 @​github-actions[bot] (#​1103)

📚 Documentation

• docs: update version references to v10.3.1 @​github-actions[bot] (#​1102)

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

• fix: preserve cache error class names in save-cache bundle @​dannyward630 (#​1093)

🧰 Maintenance

• chore: update known checksums for 0.13.4 @​github-actions[bot] (#​1099)
• chore: update known checksums for 0.13.2/0.13.3 @​github-actions[bot] (#​1098)
• chore: update known checksums for 0.13.1 @​github-actions[bot] (#​1094)
• Verify npm dependency signatures before builds @​zaniebot (#​1027)

📚 Documentation

• docs: cache-dependency-glob matches relative to the working directory @​flange-ipb (#​1092)
• docs: update version references to v10.3.0 @​github-actions[bot] (#​1090)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#​1101)

getsentry/craft

v3.11.1

Compare Source

Floating GitHub tags now resolve to valid stable releases across preparation, versioning, and changelog operations.

Bug Fixes 🐛

GitHub version lookups select valid stable releases for floating tags across prepare, versioning, and changelog operations.

• (github) Skip prereleases and ignore floating tags in version lookup by @​BYK with @​sentry-junior in #​969

v3.11.0

Compare Source

Larger changelogs gain bounded AI summarization, while publishing surfaces merge failures, handles narrow version conflicts, and waits for npm availability.

New Features ✨

Configurable AI summary budgets and clearer timeout diagnostics accommodate larger changelogs without changing request limits.

Changelog

AI summary timing is now configurable through aiSummary.timeout. The default total budget remains 120 seconds; integer values from 30 to 1800 are accepted. Set aiSummary.timeout to 0 to remove the total budget, while the 30-second per-request limit and 64-request cap still apply. Warnings now distinguish request-timeout from total-budget deadline failures.

• Allow disabling the AI summary total timeout by @​sentry-junior in #​968
• Make the AI summary timeout configurable by @​BYK with @​sentry-junior in #​967

Bug Fixes 🐛

Publishing exposes merge failures, safely retries completed targets, resolves limited version conflicts, and waits for npm availability.

Publish

Publishing now fails when merging the release branch back fails, instead of reporting success after targets ship. The retained publish state allows retries to skip completed targets. Version-bump-only conflicts can be resolved automatically when every conflicted file matches the supported version-token pattern; other conflicts continue to the existing conflict handling.

• Fail the publish when the release branch merge fails by @​BYK with @​sentry-junior in #​965
• Resolve merge conflicts caused only by the version bump by @​BYK with @​sentry-junior in #​964

Other

• (targets) Wait for npm before publishing to the MCP Registry by @​BYK with @​sentry-junior in #​963

v3.10.0

Compare Source

Deployments now wait for builds and expose failures, while release tooling supports Craft 3 and prevents accidental pre-1.0 major version jumps.

New Features ✨

GitHub Pages deployments now wait for builds and report failures with deployment details.

• (gh-pages) Wait for the Pages build and retry when it fails by @​BYK with @​sentry-junior in #​961

Bug Fixes 🐛

The reusable release workflow now uses the Craft v3 action, enabling Craft 3 configuration and current release-blocker handling. For versions below 1.0.0, craft prepare auto and craft prepare pre convert commit-selected major bumps to minor versions. Use craft prepare major or an explicit exact version to release 1.0.0. JSON changelog output and PR previews still show the raw major bump type.

• (release) Use craft v3 action in reusable release workflow by @​BYK with @​sentry-junior in #​959
• (version) Keep auto and pre below 1.0.0 on breaking changes by @​sentry-junior in #​962

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Java 25 breaks Spark 3 tests

High Severity

Bumping java-version to 25 will fail the Spark 3.5.9 integration tests. pyspark 3.5.9 only supports Java 8, 11, and 17, and Spark 3.x still calls System.setSecurityManager, which JDK 24+ rejects. Those jobs create a SparkContext at fixture setup and will crash on startup. Spark 4.2.0 is unaffected, but 3.5.9 has no JAVA_HOME override.

 

^{Reviewed by Cursor Bugbot for commit db98fbd. Configure here.}

[github-actions]

Coverage Results 📊

✅ 137212 passed | ❌ 9 failed | ⏭️ 7456 skipped | Total: 144677 | Pass Rate: 94.84% | Execution Time: 449m 54s

📊 Comparison with Base Branch

Metric	Change
Total Tests	—
Passed Tests	📉 -9
Failed Tests	📈 +9
Skipped Tests	—

✨ Test counts unchanged from base.

✅ Patch coverage is 100.00% (no changed executable lines found; target 80%).
Project statement coverage is 90.32%.

---

Generated by Coverage Action

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 91dd107. Configure here.}

[cursor]

Craft preview secret interface mismatch

Medium Severity

The changelog-preview caller still passes a named GITHUB_TOKEN secret into Craft’s reusable workflow after the v2 to v3 pin. Current Craft v3 workflow_call no longer declares that secret and expects secrets: inherit or no secrets map, so GitHub can reject the workflow as invalid on every pull request.

 

^{Reviewed by Cursor Bugbot for commit 91dd107. Configure here.}