Transient timeout fetching manifests have increased significantly
recently, especially with private runners.
```
Fetching manifest data from https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson ...
Error: The operation was aborted due to timeout
```
Retry transient manifest network failures up to three times with a
progressive backoff (not exponential), keeping the total wait bounded
while making setup resilient to short network blips.
Co-authored-by: Raymond <arguile-@users.noreply.github.com>
## Summary
Roll up the remaining dependency changes from Dependabot PRs #997, #998,
#999, #1000, #1001, #1002, and #1003:
- update `github/codeql-action` to 4.37.6
- update `zizmorcore/zizmor-action` to 0.6.2
- update `undici` to 8.10.0
- update `smol-toml` to 1.7.1
- update `@biomejs/biome` and its schema to 2.5.6
- regenerate the published bundles
PRs #905 and #907 were excluded because their requested Jest and pep440
versions are already present on `main`.
## Validation
- `npm run all`
- `actionlint .github/workflows/codeql-analysis.yml
.github/workflows/test.yml`
- `uvx zizmor .github/workflows/codeql-analysis.yml
.github/workflows/test.yml`
- `git diff --check`
Refs: pi-session 019ff0c9-8e00-72d3-99ad-d4383a4c57d4
## Summary
Roll up the remaining net changes from the open Dependabot updates:
- release-drafter/release-drafter 7.7.0 (#990)
- github/codeql-action 4.37.4 (#987, #988, #989)
- zizmorcore/zizmor-action 0.6.1 (#986)
- @actions/cache 6.2.0 (#975)
- @biomejs/biome 2.5.4 (#974)
- undici 8.7.0 (#973)
The Jest 30.4.2 (#905) and @renovatebot/pep440 5.0.0 (#907) updates are
already present on main and require no additional changes.
This also updates the Biome schema, applies the formatter changes from
Biome 2.5.4, and regenerates the published bundles.
## Testing
- `npm run all`
- `actionlint`
- `git diff --check`
Refs: pi-session 019ff01b-f917-73c1-950e-2966956f263c
## Summary
- add `latest-known` as an explicit version selector
- resolve it locally to the newest version in the bundled checksum table
- preserve existing default and `latest` behavior
- document custom-manifest checksum semantics and update published
bundles
## Testing
- `npm ci --ignore-scripts`
- `npm run all` (99 tests passed)
Closes#919
Refs: pi-session 019fed0e-6019-7504-911b-bd9955cbbd49
## Summary
Roll up the remaining dependency changes from Dependabot PRs:
- #966: update `actions/setup-node` from 6.4.0 to 7.0.0
- #965: update `js-yaml` from 4.1.1 to 5.2.1
- #964: update `@types/node` from 26.0.1 to 26.1.1
- #963: update `esbuild` from 0.28.0 to 0.28.1
PRs #907 and #905 require no net changes because `@renovatebot/pep440`
5.0.0 and Jest 30.4.2 are already on `main`.
## Validation
- `npm run all`
Refs: pi-session 019f854e-4714-73ad-8de2-e79900f41b4d
Rolls up the current open Dependabot npm updates:
- #848 esbuild from 0.27.5 to 0.28.0
- #847 undici from 8.0.0 to 8.3.0
- #846 ts-jest from 29.4.9 to 29.4.11
- #841 @biomejs/biome from 2.4.10 to 2.4.15, including the matching
biome.json schema URL update
Validation:
- npm run all
Rolls up the current open Dependabot npm updates:
- #848 esbuild from 0.27.4 to 0.27.5
- #847 undici from 7.24.2 to 8.0.0
- #846 ts-jest from 29.4.6 to 29.4.9
- #841 @biomejs/biome from 2.4.7 to 2.4.10, including the matching
biome.json schema URL update
- #834 smol-toml from 1.6.0 to 1.6.1
Validation:
- npm run all
## Summary
Adds a new `quiet` input (default: `false`) that suppresses `info`-level
log output when set to `true`. Only warnings and errors are shown.
Contributes to: #868
