Bump actions/setup-python from 6 to 6.2.0

[dependabot]

Bumps actions/setup-python from 6 to 6.2.0.

Release notes

Sourced from actions/setup-python's releases.

v6.2.0

What's Changed

Dependency Upgrades

• Upgrade dependencies to Node 24 compatible versions by @​salmanmkc in actions/setup-python#1259
• Upgrade urllib3 from 2.5.0 to 2.6.3 in /__tests__/data by @​dependabot in actions/setup-python#1253 and actions/setup-python#1264

Full Changelog: actions/setup-python@v6...v6.2.0

v6.1.0

What's Changed

Enhancements:

• Add support for pip-install input by @​gowridurgad in actions/setup-python#1201
• Add graalpy early-access and windows builds by @​timfel in actions/setup-python#880

Dependency and Documentation updates:

• Enhanced wording and updated example usage for allow-prereleases by @​yarikoptic in actions/setup-python#979
• Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by @​dependabot in actions/setup-python#1139
• Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by @​dependabot in actions/setup-python#1094
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by @​dependabot in actions/setup-python#1199
• Upgrade requests from 2.32.2 to 2.32.4 by @​dependabot in actions/setup-python#1130
• Upgrade prettier from 3.5.3 to 3.6.2 by @​dependabot in actions/setup-python#1234
• Upgrade @​types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by @​dependabot in actions/setup-python#1235

New Contributors

• @​yarikoptic made their first contribution in actions/setup-python#979

Full Changelog: actions/setup-python@v6...v6.1.0

Commits

• 03bb615 Bump idna from 2.9 to 3.7 in /tests/data (#843)
• 36da51d Add version parsing from Pipfile (#1067)
• 3c6f142 update documentation (#1156)
• 88ffd4d Include python version in PyPy python-version output (#1110)
• 532b046 Add Architecture-Specific PATH Management for Python with --user Flag on Wind...
• 1264885 Enhance cache-dependency-path handling to support files outside the workspace...
• e9c40fb Add support for pip-version (#1129)
• 5fa0ee6 Bump @​actions/tool-cache from 2.0.1 to 2.0.2 (#1095)
• 5db1cf9 Enhance reading from .python-version (#787)
• a26af69 Bump ts-jest from 29.1.2 to 29.3.2 (#1081)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

Code Review

This PR updates actions/setup-python from the floating @v6 tag to the pinned @v6.2.0 version across 10 GitHub Actions workflow files.

---

Code Quality

✅ Style guide — YAML formatting is consistent and correct across all changed files.

✅ No commented-out code — No commented code present.

✅ Meaningful variable names — N/A for this change type.

✅ DRY principle — The repetition across workflow files is expected; each workflow is an independent CI job. No concern here.

✅ Defects / bugs — No logic errors. The version bump is applied consistently across all 10 files with no missed instances.

---

Testing

✅ N/A — This is a CI configuration change only; no application logic is affected.

---

Documentation

⚠️ CHANGELOG.md — Dependency bumps of this nature typically warrant a CHANGELOG entry. Check whether this project maintains a changelog and if so, whether it was updated.

✅ README / API docs — No updates needed for this change.

---

Security

✅ No hardcoded credentials — None present.

✅ No license files — No .lic files or AQAAAD-prefixed content.

⚠️ Action pinning — Pinning to @v6.2.0 is a meaningful improvement over the floating @v6 tag, but for stronger supply chain security the GitHub security hardening guide recommends pinning to a full commit SHA (e.g., actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065). This is a low-severity observation — @v6.2.0 is substantially better than @v6, but not fully immutable.

---

Summary

Area	Status
Code Quality	✅ Pass
Testing	✅ N/A
Documentation	⚠️ Verify CHANGELOG
Security	⚠️ Consider SHA pinning

The change is correct and well-scoped. The main actionable item is verifying the CHANGELOG was updated; the SHA pinning note is a hardening suggestion, not a blocker.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

[github-actions]

🤖 Claude Code Review

PR Code Review

This PR updates actions/setup-python from @v6 to @v6.2.0 across 10 GitHub Actions workflow files.

---

Code Quality

✅ Code style — YAML workflow files are clean and consistent.

✅ No commented-out code — None present.

✅ Meaningful variable names — N/A for this change type.

✅ DRY principle — The same version string appears in 10 files. GitHub Actions doesn't offer a native way to centralize action versions, so this repetition is expected and acceptable.

✅ Defects — No bugs, logic errors, or security vulnerabilities. Pinning to v6.2.0 over v6 is a security improvement — it prevents silent updates if the v6 tag is force-pushed. Note: the gold standard is pinning to a commit SHA (e.g., uses: actions/setup-python@a26af69...), but version tags are the common convention here.

✅ CLAUDE.md — No issues; the project CLAUDE.md is appropriately general.

---

Testing

✅ N/A — CI configuration change; no new code logic to test.

---

Documentation

✅ README — No update needed.

✅ Inline comments — N/A.

❓ CHANGELOG.md — Not updated. Dependency bumps are typically logged. Verify whether this project's convention requires a CHANGELOG entry for CI tooling updates.

---

Security

✅ No hardcoded credentials.

✅ No .lic files or AQAAAD-prefixed content.

✅ Version pinning — Moving from a floating major tag (@v6) to a pinned minor version (@v6.2.0) reduces supply-chain risk. Acceptable; SHA pinning would be stronger but is not required by the existing project convention.

---

Summary

Approve with minor note. The change is correct, consistent across all 10 workflow files, and is a security improvement over floating @v6. The only open question is whether a CHANGELOG entry is expected for CI dependency bumps — check the project's existing CHANGELOG convention to decide.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter