build(deps): bump the actions-updates group across 1 directory with 3 updates

[dependabot]

Bumps the actions-updates group with 3 updates in the / directory: step-security/harden-runner, docker/setup-buildx-action and astral-sh/setup-uv.

Updates step-security/harden-runner from 2.20.1 to 2.21.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.21.1

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

v2.21.0

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

Commits

• e14015d Merge pull request #690 from step-security/rc-43
• 9001249 docs: update harden-runner version pin to v2.21.0 in getting started example
• a447fba docs: expand enterprise feature list and document custom VM and ubuntu-slim l...
• b0eaf8d docs: clarify community vs enterprise tiers and add maintained actions section
• 063e8e3 Merge pull request #687 from rohan-stepsecurity/rp/fix/bin-echo-fallback
• f46bdc1 chore: bump agent-ebpf to v1.9.1 and agent to v0.16.3
• 42e6daa fix: fall back to /bin/echo for non-usr-merged distros
• 05e3151 Merge pull request #684 from step-security/rc-42
• 0f37afa fix: ignore denied-endpoints on non-enterprise tier
• 93b58ee fix: resolve cache host read-first and never downgrade egress policy
• Additional commits viewable in compare view

Updates docker/setup-buildx-action from 4.2.0 to 4.3.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.3.0

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in docker/setup-buildx-action#595
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/setup-buildx-action#600
• Bump js-yaml from 5.2.0 to 5.3.0 in docker/setup-buildx-action#585
• Bump postcss from 8.5.10 to 8.5.25 in docker/setup-buildx-action#598
• Bump undici from 6.27.0 to 6.28.0 in docker/setup-buildx-action#601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

Commits

• 37fe631 Merge pull request #595 from docker/dependabot/npm_and_yarn/docker/actions-to...
• b5c4f91 [dependabot skip] chore: update generated content
• 3e93b63 build(deps): bump @​docker/actions-toolkit from 0.92.0 to 0.95.0
• e527031 Merge pull request #600 from docker/dependabot/npm_and_yarn/brace-expansion-1...
• c68814b [dependabot skip] chore: update generated content
• 3f891b0 build(deps): bump brace-expansion from 1.1.13 to 1.1.18
• 787db26 Merge pull request #585 from docker/dependabot/npm_and_yarn/js-yaml-5.2.1
• f779368 [dependabot skip] chore: update generated content
• 7d5e604 build(deps): bump js-yaml from 5.2.0 to 5.3.0
• 292c2fb Merge pull request #590 from docker/dependabot/github_actions/actions/setup-n...
• Additional commits viewable in compare view

Updates astral-sh/setup-uv from 10.0.1 to 10.1.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.1.0 🌈 New output python-runtime-idand respect NO_PROXY

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 for details on why this can be useful.

🐛 Bug fixes

• fix: respect no proxy directive @​mj0nez (#1037)
• Use JSON + a typed wrapper instead of TS codegen @​woodruffw (#1025)

🚀 Enhancements

• Expose a Python "identity" output @​woodruffw (#1036)
• Verify downloads with astral-sh/versions checksums @​zaniebot (#1033)

🧰 Maintenance

• chore: update known checksums for 0.12.12 @github-actions[bot] (#1041)
• chore: update known checksums for 0.12.10/0.12.11 @github-actions[bot] (#1038)
• chore: update known checksums for 0.12.9 @github-actions[bot] (#1035)
• chore: update known checksums for 0.12.7/0.12.8 @github-actions[bot] (#1031)
• chore: update known checksums for 0.12.6 @github-actions[bot] (#1030)
• chore: update known checksums for 0.12.5 @github-actions[bot] (#1020)
• Use self-repo syntax for all in-repo actions/reusable workflows @​woodruffw (#1024)
• Pin one-shot tools @​woodruffw (#1022)
• ci: remove obsolete direct push attempts @​eifinger (#1019)

📚 Documentation

• docs: update version references to v10.0.1 @github-actions[bot] (#1018)

⬆️ Dependency updates

• chore(deps-dev): roll up Dependabot updates @​eifinger (#1043)
• Harden npm install defaults @​zaniebot (#1026)
• Add dependency cooldowns @​woodruffw (#1021)

Commits

• bec219d chore(deps-dev): roll up Dependabot updates (#1043)
• b90ec40 fix: respect no proxy directive (#1037)
• 421feb6 chore: update known checksums for 0.12.12 (#1041)
• f634bf4 Expose a Python "identity" output (#1036)
• a6772c8 chore: update known checksums for 0.12.10/0.12.11 (#1038)
• e105c8f chore: update known checksums for 0.12.9 (#1035)
• cd13f92 Verify downloads with astral-sh/versions checksums (#1033)
• 3aef7b9 chore: update known checksums for 0.12.7/0.12.8 (#1031)
• d08d816 chore: update known checksums for 0.12.6 (#1030)
• 19b4d1e Harden npm install defaults (#1026)
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.