[dependabot]

Bumps the actions-deps group with 5 updates:

Package	From	To
actions/checkout	7.0.0	7.0.1
astral-sh/setup-uv	8.3.2	10.3.2
pypa/gh-action-pypi-publish	1.14.0	1.14.3
codecov/codecov-action	7.0.0	7.1.1
re-actors/alls-green	1.2.2	1.3.0

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates astral-sh/setup-uv from 8.3.2 to 10.3.2

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

• chore: update known checksums for 0.13.5 @github-actions[bot] (#1103)

📚 Documentation

• docs: update version references to v10.3.1 @github-actions[bot] (#1102)

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

• fix: preserve cache error class names in save-cache bundle @​dannyward630 (#1093)

🧰 Maintenance

• chore: update known checksums for 0.13.4 @github-actions[bot] (#1099)
• chore: update known checksums for 0.13.2/0.13.3 @github-actions[bot] (#1098)
• chore: update known checksums for 0.13.1 @github-actions[bot] (#1094)
• Verify npm dependency signatures before builds @​zaniebot (#1027)

📚 Documentation

• docs: cache-dependency-glob matches relative to the working directory @​flange-ipb (#1092)
• docs: update version references to v10.3.0 @github-actions[bot] (#1090)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#1101)

v10.3.0 🌈 Add Python architecture selection

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

• Use macOS 15 runners for tests @​charliermarsh (#1081)

🚀 Enhancements

• Add python-arch support @​zanieb (#1079)

... (truncated)

Commits

• 07a047e chore: update known checksums for 0.13.5 (#1103)
• e1b8536 docs: update version references to v10.3.1 (#1102)
• 18d369b chore(deps): roll up Dependabot updates (#1101)
• 4ad2329 chore: update known checksums for 0.13.4 (#1099)
• 4bc6759 chore: update known checksums for 0.13.2/0.13.3 (#1098)
• c97f06e fix: preserve cache error class names in save-cache bundle (#1093)
• 8ca4be0 chore: update known checksums for 0.13.1 (#1094)
• b627d85 docs: cache-dependency-glob matches relative to the working directory (#1092)
• f8c8897 Verify npm dependency signatures before builds (#1027)
• f64d32b docs: update version references to v10.3.0 (#1090)
• Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

... (truncated)

Commits

• 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
• 331eccb Upgrade certifi and sigstore
• f68fee4 💰 Sync the FUNDING config
• c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
• 9090099 🧪 Make smoke test deps hash-pinned in CI
• 34e40c2 📌 Bump pip-tools managed transitive deptrees
• e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
• dd8c5f4 🔧 Make pip-tools config available in container
• dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
• 8b2f234 Bump pypi-attestations and sigstore
• Additional commits viewable in compare view

Updates codecov/codecov-action from 7.0.0 to 7.1.1

Release notes

Sourced from codecov/codecov-action's releases.

v7.1.1

What's Changed

• chore(release): 7.1.1 by @​thomasrockhu-codecov in codecov/codecov-action#1973

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

What's Changed

• chore(release): 7.1.0 by @​thomasrockhu-codecov in codecov/codecov-action#1971

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

Commits

• 303a32d chore(release): 7.1.1 (#1973)
• 0b35c9e chore(release): 7.1.0 (#1971)
• See full diff in compare view

Updates re-actors/alls-green from 1.2.2 to 1.3.0

Release notes

Sourced from re-actors/alls-green's releases.

v1.3.0

🛡️ What's Unmessed

[!caution]

There was a small command injection risk in prior versions. I consider it very low because of the specifics of the action use case. But still, do upgrade, okay?

@​illera88💰 fixed this template injection bug in #37 by passing inputs via env vars.

See GHSA-gj76-h2ch-5m76 for more detail that was first reported by @​Corbynx010💰 while I was at EuroPython.

✨ What's Improved

I did a bunch of internal refactoring including hints of what @​max-sixty💰 reported in #23. And took a small patch of @​krokofant💰 in. This involved a bunch of preparatory infra work with testing infra.

One notable improvement is that now thanks to @​tomasr8💰's and @​hugovk💰's UX suggestions in #31, the gate status output is colored in the console and should be easier to scan in the log output per line. They entries now have leading ✓/❌ acceptance marks and the actual incoming job outcomes are labeled with 🟢/🔴/⬜/⚫.

🐛 What's Fixed

The job-statuses summary could print "Some of the allowed to be skipped jobs did not succeed" based on the wrong condition — it's now tied to allowed-skips as intended, not allowed-failures.

💪 New Contributors

• @​Corbynx010💰 lurked in GHSA-gj76-h2ch-5m76 before everyone else 😉
• @​illera88 made their first contribution in #37 and GHSA-gj76-h2ch-5m76
• @​krokofant and @​max-sixty first contributed in #23
• @​tomasr8 and @​hugovk in #31

🪞 Full Diff: re-actors/alls-green@v1.2.2...v1.3.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• b5b5b37 Merge pull request #38 from re-actors/pre-commit-ci-update-config
• bd6edd6 [pre-commit.ci] pre-commit autoupdate
• 3967c81 💅 Make the output easier to scan
• e68df08 💅 Style job statuses title with a 🔮
• 62d37b2 🧪 Unxfail 'success-of-some-allowed-to-skip-or-fail'
• 7b5df6d 💅 Add a Codecov badge to README
• 2410c4c 🐛 Correct reporting failed skipped jobs
• 6457593 💅 Add a GH Sponsors badge
• a617895 💅 Add a pre-commit.ci badge
• 8de05dc 🧪 Force ctrace core in coveragepy
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.69%. Comparing base (924204d) to head (4585d56).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #104   +/-   ##
=======================================
  Coverage   76.69%   76.69%           
=======================================
  Files          15       15           
  Lines         618      618           
=======================================
  Hits          474      474           
  Misses        144      144           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.