chore(deps): bump the github-actions group with 4 updates

[dependabot]

Bumps the github-actions group with 4 updates: astral-sh/setup-uv, github/codeql-action/init, github/codeql-action/analyze and PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml.

Updates astral-sh/setup-uv from 9.0.0 to 10.0.1

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

• Tolerate transient manifest timeouts @​arguile- (#1016)

🧰 Maintenance

• chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

• docs: update version references to v10.0.0 @github-actions[bot] (#1014)

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

• pull_request_target
• workflow_run
• release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"
</tr></table> 

... (truncated)

Commits

• 20cfd1b chore: update known checksums for 0.12.4 (#1017)
• d73a0ca Tolerate transient manifest timeouts (#1016)
• ae3b92d docs: update version references to v10.0.0 (#1014)
• ae62891 chore(deps): roll up Dependabot updates (#1013)
• f9cdb47 Reject paths in .tool-versions (#1007)
• 4f6036f Require pull requests for Dependabot rollups (#1005)
• 8d6402c chore(deps): roll up Dependabot updates (#1004)
• 46f427b Read Python version from .tool-versions (#996)
• 8ed89c5 ci: pin Alpine container image (#995)
• 8473c7f chore(deps): roll up Dependabot updates (#994)
• Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.6 to 4.37.7

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

... (truncated)

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.6 to 4.37.7

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

... (truncated)

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Updates PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml from eea2a62aa490b1bfa2e2b3488fc0042b89cfa5ed to 30b84840a6cdca267aa2a7a296ff20e8da7b51ad

Changelog

Sourced from PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml's changelog.

posthog-sdk-test-harness

1.0.0 — 2026-08-14

Major changes

• 4a7e606 Require SDK adapters to normalize event timestamps to canonical UTC before capture. — Thanks @​marandaneto!

0.11.0 — 2026-08-13

Minor changes

• c8c78d3 Add capture_ai test suite for the dedicated AI capture endpoint — Thanks @​carlos-marchal-ph for your first contribution 🎉!

0.10.0 — 2026-07-02

Minor changes

• 1b7b345 Add /flags retry contract tests for transient 502 and 504 responses — Thanks @​marandaneto!

0.9.1 — 2026-07-02

Patch changes

• 2216d8c Relax the /flags distinct_id contract. — Thanks @​marandaneto!

0.9.0 — 2026-06-30

Minor changes

• 829b49b Add SDK compliance workflow options for suite selection, SDK type, and blocking failures — Thanks @​marandaneto!

0.8.0 — 2026-06-04

Minor changes

• baad3c3 Switch the release flow to Sampo with a gated Release GitHub environment. Docker image publishes now require explicit human approval via Slack before they go out, addressing the supply-chain concern that any merge to main could push a new image consumed by every PostHog SDK. Contributors now write sampo add changesets instead of editing pyproject.toml and CHANGELOG.md by hand. — Thanks @​ioannisj!

0.7.0 - 2026-05-29

Changed

• Removed error_response_has_structured_body and error_response_has_correct_tag tests from response_format_validation -- these tested mock fidelity, not SDK behavior
• Clarified in test_actions.yaml that assert_v1_error_response_format, assert_v1_error_tag, and assert_v1_per_event_result are infrastructure for integration tests, not used in the base SDK compliance suite
• assert_events_in_batch_count now accepts a request_index param (default -1, the most recent request) so partial-batch retry tests can inspect the retried batch instead of the original. Fixes retries_only_retry_events_from_partial, which previously asserted against the original 3-event batch rather than the 1-event retry

Added

• unknown_result_treated_as_terminal test: SDK does not retry events with unrecognized per-event result strings (forward compatibility)
• respects_retry_after_on_retryable_error test: SDK honors Retry-After header on 503 error responses

... (truncated)

Commits

• 30b8484 chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the githu...
• 16a62da chore(deps-dev): update setuptools requirement (#48)
• 6d19abb chore: Release v1.0.0 [skip ci]
• 4a7e606 fix: require UTC timestamps in SDK contracts (#47)
• 8d9cadf chore: Release v0.11.0 [skip ci]
• c8c78d3 feat: capture_ai suite (#46)
• 78074c3 chore: group Dependabot updates (#45)
• e9ecc8c chore(deps): bump actions/cache from 5.0.5 to 6.1.0 (#42)
• 0c1e9bc chore(deps): bump actions/github-script from 7.1.0 to 9.0.0 (#41)
• 1e9c058 chore(deps): bump docker/login-action from 3.7.0 to 4.6.0 (#43)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

posthog-python Compliance Report

Date: 2026-08-24 10:19:52 UTC
Duration: 256387ms

✅ All Tests Passed!

111/111 tests passed

---

Capture_V1 Tests

✅ 94/94 tests passed

View Details

Test	Status	Duration
Endpoint And Method.Targets V1 Endpoint	✅	516ms
Endpoint And Method.Does Not Use Legacy Endpoints	✅	511ms
Required Headers.Has Authorization Bearer Header	✅	511ms
Required Headers.Has Content Type Json	✅	510ms
Required Headers.Has Posthog Sdk Info Format	✅	511ms
Required Headers.Has Posthog Attempt Header	✅	510ms
Required Headers.Has Posthog Request Id	✅	510ms
Required Headers.Has Posthog Request Timestamp	✅	510ms
Required Headers.Has User Agent	✅	510ms
Body Format.Body Has Created At And Batch	✅	511ms
Body Format.No Api Key In Body	✅	510ms
Body Format.No Sent At In Body	✅	510ms
Event Format.Event Has Required Root Fields	✅	511ms
Event Format.Event Uuid Is Valid	✅	510ms
Event Format.Event Timestamp Is Rfc3339	✅	510ms
Event Format.Distinct Id Is String	✅	511ms
Event Format.Distinct Id At Root Not Properties	✅	510ms
Event Format.Custom Properties Preserved	✅	510ms
Event Format.Set Properties Preserved	✅	509ms
Event Format.Set Once Properties Preserved	✅	511ms
Event Format.Groups Properties Preserved	✅	510ms
Event Format.Sdk Generates Uuid If Not Provided	✅	510ms
Event Format.Event Has Required Root Fields Batch	✅	513ms
Event Format.Event Uuid Is Valid Batch	✅	514ms
Event Format.Event Timestamp Is Rfc3339 Batch	✅	513ms
Event Format.Distinct Id Is String Batch	✅	514ms
Event Format.Distinct Id At Root Not Properties Batch	✅	514ms
Event Format.Custom Properties Preserved Batch	✅	514ms
Event Format.Set Properties Preserved Batch	✅	513ms
Event Format.Set Once Properties Preserved Batch	✅	513ms
Event Format.Groups Properties Preserved Batch	✅	514ms
Event Format.Sdk Generates Uuid If Not Provided Batch	✅	513ms
Batch Behavior.Multiple Events In Single Batch	✅	518ms
Batch Behavior.Batch Envelope Smoke	✅	515ms
Batch Behavior.Flush With No Events Sends Nothing	✅	506ms
Batch Behavior.Flush At Triggers Batch	✅	1011ms
Batch Behavior.Created At Reflects Batch Creation Time	✅	511ms
Deduplication.Generates Unique Uuids	✅	517ms
Deduplication.Different Events Same Content Different Uuids	✅	512ms
Deduplication.Preserves Uuid On Retry	✅	6519ms
Deduplication.Preserves Timestamp On Retry	✅	6515ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	6523ms
Deduplication.No Duplicate Events In Batch	✅	518ms
Header Behavior On Retry.Attempt Header Starts At One	✅	510ms
Header Behavior On Retry.Attempt Header Increments On Retry	✅	13527ms
Header Behavior On Retry.Request Id Preserved On Retry	✅	6515ms
Header Behavior On Retry.Different Requests Have Different Request Ids	✅	3020ms
Header Behavior On Retry.Request Timestamp Changes On Retry	✅	6514ms
Response Format Validation.Success Response Has Uuid Keyed Results	✅	511ms
Response Format Validation.Success Response Has Ok For Each Event	✅	514ms
Response Format Validation.Success No Retry After When All Ok	✅	512ms
Response Format Validation.Success Retry After Present When Retry Events	✅	1516ms
Response Format Validation.Success No Retry After When Drop Only	✅	512ms
Response Format Validation.Response Echoes Request Id	✅	511ms
Retry Behavior.Retries On 408	✅	6519ms
Retry Behavior.Retries On 500	✅	6520ms
Retry Behavior.Retries On 503	✅	8518ms
Retry Behavior.Retries On 504	✅	6519ms
Retry Behavior.Retryable Errors Have Retry After	✅	3516ms
Retry Behavior.Respects Retry After On Retryable Error	✅	11524ms
Retry Behavior.Does Not Retry On 400	✅	2514ms
Retry Behavior.Does Not Retry On 401	✅	2513ms
Retry Behavior.Does Not Retry On 402	✅	2512ms
Retry Behavior.Does Not Retry On 413	✅	2512ms
Retry Behavior.Does Not Retry On 415	✅	2514ms
Retry Behavior.Non Retryable Errors Have No Retry After	✅	2513ms
Retry Behavior.Implements Backoff	✅	22536ms
Retry Behavior.Max Retries Respected	✅	22530ms
Partial Batch Handling.Handles 200 Full Success	✅	2512ms
Partial Batch Handling.Handles 200 With All Ok	✅	3517ms
Partial Batch Handling.Does Not Retry Dropped Events	✅	3515ms
Partial Batch Handling.Does Not Retry Limited Events	✅	3515ms
Partial Batch Handling.Prunes Ok Events On Partial Retry	✅	6521ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry	✅	6522ms
Partial Batch Handling.Retries Only Retry Events From Partial	✅	6523ms
Partial Batch Handling.Partial Retry Preserves Uuids	✅	6522ms
Partial Batch Handling.Partial Retry Attempt Header Increments	✅	6516ms
Partial Batch Handling.Partial Retry Request Id Preserved	✅	6519ms
Partial Batch Handling.Respects Retry After On Partial	✅	8521ms
Partial Batch Handling.Unknown Result Treated As Terminal	✅	3517ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry	✅	3517ms
Compression.Sends Gzip Content Encoding	✅	510ms
Compression.No Content Encoding When Disabled	✅	510ms
Compression.Compressed Body Is Decompressible	✅	510ms
Error Handling.Does Not Retry On Unknown 4Xx	✅	2512ms
Event Options.Cookieless Mode Override	✅	511ms
Event Options.Disable Skew Correction Override	✅	510ms
Event Options.Process Person Profile Override	✅	510ms
Event Options.Product Tour Id Override	✅	510ms
Event Options.Unset Options Omitted	✅	510ms
Event Options.Options Override In Batch	✅	513ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties	✅	510ms
Geoip And Historical Migration.Historical Migration Set In Body	✅	510ms
Geoip And Historical Migration.Historical Migration Absent By Default	✅	509ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	10ms
Request Payload.Flags Request Uses V2 Query Param	✅	10ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	9ms
Request Payload.Flags Request Omits Authorization Header	✅	9ms
Request Payload.Token In Flags Body Matches Init	✅	9ms
Request Payload.Groups Round Trip	✅	9ms
Request Payload.Groups Default To Empty Object	✅	9ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	9ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	9ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	9ms
Request Lifecycle.No Flags Request On Init Alone	✅	3ms
Request Lifecycle.No Flags Request On Normal Capture	✅	510ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	13ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	9ms
Retry Behavior.Retries Flags On 502	✅	313ms
Retry Behavior.Retries Flags On 504	✅	314ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	511ms