Skip to content

Bump actions/setup-python from 7.0.0 to 7.1.0 - #15819

Merged
lpcox merged 1 commit into
mainfrom
dependabot/github_actions/actions/setup-python-7.1.0
Nov 1, 2026
Merged

lpcox merged 1 commit into
mainfrom
dependabot/github_actions/actions/setup-python-7.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 31, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/setup-python from 7.0.0 to 7.1.0.

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits
  • 6d4fd22 Cache upgrade to 6.3.0 (#1370)
  • ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
  • ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
  • 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
  • 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
  • 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
  • e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
  • 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
  • af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
  • 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 7.0.0 to 7.1.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@5fda3b9...6d4fd22)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies github_actions Pull requests that update GitHub Actions code minor labels Oct 31, 2026
@github-actions

Copy link
Copy Markdown
Contributor

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part Surface Op Result Expected Status
A MCP reads data returned (list_issues, list_pull_requests, get_file_contents, list_commits) ALLOWED ✅
B MCP writes (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) all 7 targets absent from exposed tool catalog ("unknown tool" -32602) — no leak, but cannot confirm gateway-level (vs backend config) blocking BLOCKED ⚠️
C CLI reads (list_issues, get_file_contents via github CLI proxy) data returned ALLOWED ✅
D CLI REST writes (reaction/star/issue/comment) gh CLI not authenticated in this environment (gh auth status: not logged in) — not attempted BLOCKED ⚠️
E CLI GraphQL mutations (addReaction/addStar/createIssue) gh CLI not authenticated — not attempted BLOCKED ⚠️

Overall: INCONCLUSIVE

Notes:

  • No write, reaction, star, issue, comment, branch, or file leaked on any surface.
  • Part B: all 7 targeted write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were entirely absent from the gatewayu0027s exposed GitHub tool catalog (only 23 read-oriented tools listed: get_commit, get_file_contents, get_label, list_issues, list_pull_requests, list_commits, search_*, etc.). This is consistent with gh-awu0027s GITHUB_READ_ONLY=1 backend wrapper per the tasku0027s architectural note — it confirms backend/toolset configuration is read-only, but does NOT independently confirm mcpgu0027s own DIFC/guard write-blocking layer, since the call never reaches a write-capable backend.
  • Part D/E: gh auth status showed no authenticated GitHub host in this job, so REST/GraphQL write attempts could not be executed to validate the token-scope boundary. No writes were attempted or succeeded.
  • No destructive/irreversible operations were attempted at any point.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

@lpcox
lpcox merged commit d7606f4 into main Nov 1, 2026
111 of 117 checks passed
@lpcox
lpcox deleted the dependabot/github_actions/actions/setup-python-7.1.0 branch November 1, 2026 15:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies github_actions Pull requests that update GitHub Actions code minor

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant