NPA-6797: Dependabot upgrades

[ehallam]

Pull Request

🧾 Ticket Link

https://nhsd-jira.digital.nhs.uk/browse/NPA-6797

---

📄 Description/Summary of Changes

• Handles all the open dependabot upgrades

---

🧪 Developer Testing Carried Out

---

📋 PR Principles

• Keep PRs Small and Focused: Ensure the PR addresses a single task or feature to make it easier to review.
• Multiple PRs for one Ticket: When splitting work into multiple PRs, clearly describe what this PR addresses and outline the remaining work to complete the ticket.
• Ensure Tests Are Included: Add or update unit, integration, or end-to-end tests to cover the changes made.
• Follow Coding Standards: Ensure the code adheres to the team's coding guidelines and best practices.
• Resolve Comments Promptly: If you raise a comment, ensure you follow up and resolve it before approving the PR to maintain clarity and ensure comments are addressed.
• Foster Learning: PR reviews are an opportunity to share knowledge, provide constructive feedback, and encourage a collaborative environment.

🏷️ Naming Conventions Reminder

Please ensure the following naming conventions are followed:

• PR title follows the format: NPA-XXXX: <short-description>
• Branch name follows the convention: <type>/NPA-XXXX/<short-description>
• Commit messages follow the template: NPA-XXXX: <short-description>

[Copilot]

Pull request overview

Updates Python dependencies and GitHub Actions to address outstanding Dependabot alerts, keeping the service’s runtime/tooling current and security-scanned.

Changes:

• Bump Python deps: requests to 2.33.0, gunicorn to 25.3.0 (and refresh uv.lock accordingly).
• Upgrade CodeQL GitHub Action to v4.35.3.
• Upgrade astral-sh/setup-uv GitHub Action to v8.0.0 across composite actions.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
uv.lock	Regenerated lockfile reflecting upgraded requests/gunicorn.
pyproject.toml	Updates dependency group pins/ranges and uv overrides for requests.
.github/workflows/codeql-analysis.yml	Upgrades CodeQL action SHA/tag.
.github/actions/setup-python-dependencies/action.yaml	Upgrades setup-uv and continues using version-file for uv selection.
.github/actions/run-unit-tests/action.yaml	Upgrades setup-uv used by unit test composite action.
.github/actions/ruff-format/action.yaml	Upgrades setup-uv used by ruff format composite action.
.github/actions/ruff-checks/action.yaml	Upgrades setup-uv used by ruff checks composite action.
.github/actions/check-uv-lock/action.yaml	Upgrades setup-uv used by uv lock check composite action.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.