chore(deps): update github actions

[agntcy-automation]

This PR contains the following updates:

Package	Type	Update	Change	Pending
astral-sh/uv	uses-with	patch	0.12.3 → 0.12.5
github/codeql-action	action	patch	v4.37.6 → v4.37.7	v4.37.8
step-security/harden-runner	action	minor	v2.20.1 → v2.21.0

---

Release Notes

astral-sh/uv (astral-sh/uv)

v0.12.5

Compare Source

Released on 2026-08-14.

Python

• Add CPython 3.10.21, 3.11.16, and 3.12.14 (#​21138)
• Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (#​21134)

Enhancements

• Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (#​21130)

Preview features

• Allow --index and --default-index to select configured package indexes by name with the index-by-name preview feature (#​17455)
• Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (#​21131)
• Fall back to logical file sizes when using cache-physical-space on filesystems that do not support physical-space accounting (#​21133)

Bug fixes

• Resolve relative package index paths in PEP 723 scripts against the script directory (#​21097)

v0.12.4

Compare Source

Released on 2026-08-13.

Enhancements

• Prefer post-quantum key exchange and enable opt-in TLS diagnostics (#​21054)
• Accept whitespace before versions in noncompliant wildcard comparisons such as Requires-Python: >= 3.5.* (#​21012)
• Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content (#​20944)
• Omit source-span carets from diagnostics for empty PEP 508 requirements (#​21094)

Preview features

• Add uv check --no-install-project and respect UV_NO_INSTALL_PROJECT to install dependencies without building or installing the project (#​21085)
• Make the ty subprocess invoked by uv check honor uv's color and progress settings, including quiet mode (#​21086)

Performance

• Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges (#​20804)
• Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly (#​21041)

Bug fixes

• Use windowed pythonw.exe launchers for virtual environments created from managed Python minor-version links (#​19235)
• Allow uv lock to proceed when .venv is an unusable project environment (#​21068)
• Respect fork-strategy when ordering forks created from environments or existing lockfile resolution-markers (#​21000)
• Preserve consecutive wildcard Python minor-version exclusions such as !=3.11.*, !=3.12.* in uv.lock (#​21045)
• Preserve inline comments on the final item in dependency arrays when uv add updates it (#​21008)
• Recover from stale base-interpreter cache metadata when an existing virtual environment exposes a version mismatch (#​21073)
• Prevent interpreter cache reuse across different PYTHONEXECUTABLE and __PYVENV_LAUNCHER__ overrides (#​21075)
• Show standard styling, usage guidance, and line termination for invalid uv version --bump values (#​21076)

github/codeql-action (github/codeql-action)

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

step-security/harden-runner (step-security/harden-runner)

v2.21.0

Compare Source

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!