From 19046657b0d730886449c45ef72fb1ac545c1b09 Mon Sep 17 00:00:00 2001 From: Daniel Lemire Date: Sat, 14 Nov 2026 10:22:34 -0500 Subject: [PATCH] Update pypa/gh-action-pypi-publish to v1.14.3 Versions up to 1.14.2 are affected by GHSA-5xjx-3w67-w9x9 (critical): revocation of a CA in the chain that Sigstore uses for Trusted Publishing and digital attestations. --- .github/workflows/wheels.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index 9cf5833..33c667c 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -93,7 +93,7 @@ jobs: merge-multiple: true - name: List dist contents run: ls -l dist - - uses: pypa/gh-action-pypi-publish@v1.13.0 + - uses: pypa/gh-action-pypi-publish@v1.14.3 with: user: __token__ password: ${{ secrets.PYPI_API_TOKEN }}