Bump the github-actions group across 1 directory with 3 updates by dependabot[bot] · Pull Request #903 · TGSAI/mdio-python

dependabot · 2026-11-01T14:03:03Z

Bumps the github-actions group with 3 updates in the / directory: pypa/gh-action-pypi-publish, release-drafter/release-drafter and actions/setup-python.

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
331eccb Upgrade certifi and sigstore
f68fee4 💰 Sync the FUNDING config
c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
9090099 🧪 Make smoke test deps hash-pinned in CI
34e40c2 📌 Bump pip-tools managed transitive deptrees
e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
dd8c5f4 🔧 Make pip-tools config available in container
See full diff in compare view

Updates release-drafter/release-drafter from 7.7.0 to 7.10.0

Release notes

Sourced from release-drafter/release-drafter's releases.

v7.10.0

What's Changed

New

feat(check-pr): validate base and proposed configuration (#1809) @jetersen

feat(replacers): select PR body sections by heading (#1808) @jetersen

feat: scope replacers to change titles (#1805) @jetersen

feat: scope replacers to pull request bodies (#1804) @jetersen

feat: add change-body-escapes (#1797) @jetersen

Dependency Updates

chore(deps): update dependency knip to 6.39.0 (#1830) @renovate[bot]

chore(deps): update dependency @biomejs/biome to 2.5.15 (#1829) @renovate[bot]

chore(deps): update vitest to 5.0.3 (#1827) @renovate[bot]

chore(deps): lock file maintenance (#1826) @renovate[bot]

fix(deps): update dependency @octokit/plugin-paginate-rest to 16.0.0 (#1813) @renovate[bot]

chore(deps): update dependency @graphql-codegen/typescript-operations to 6.1.9 (#1818) @renovate[bot]

chore(deps): update dependency testcontainers to 12.2.0 (#1812) @renovate[bot]

chore(deps): update graphql-codegen (#1810) @renovate[bot]

fix(deps): update dependency undici to 6.29.0 (#1796) @renovate[bot]

chore(deps): update dependency @types/node to 24.19.0 (#1798) @renovate[bot]

chore(deps): update vitest to 5.0.2 (#1795) @renovate[bot]

Maintenance

fix: authorize publication at the original release commit (#1793) @jetersen

fix: handle missing release tags during discovery (#1792) @jetersen

fix: publish merged release PRs from main pushes (#1791) @jetersen

test: run GitLab conformance against GitLab CE 19.4.1 (#1825) @jetersen

test: use the GitLab image that caches Mustermann's encoded characters (#1824) @jetersen

ci: speed up forge conformance with a preseeded GitLab image (#1819) @jetersen

ci: run workflows on Ubuntu 26.04 and cache node_modules (#1823) @jetersen

test: expand coverage and reduce test runtime (#1794) @jetersen

ci: report actionlint findings on its workflow job (#1817) @jetersen

build: simplify tooling validation and coverage reporting (#1816) @jetersen

build: simplify workspace dependency checks (#1815) @jetersen

refactor: use runtime fetch in the public facade (#1800) @jetersen

test: allow dependency version updates in package consumer contract (#1799) @jetersen

Documentation

docs: simplify agent guidance and require the PR template (#1807) @jetersen

docs: summarize deployment options and add npm branding (#1802) @jetersen

... (truncated)

Commits

978bb0b chore: release v7.10.0 (#1828)
7875ba4 chore(deps): update dependency knip to 6.39.0 (#1830)
cab3fb0 chore(deps): update dependency @biomejs/biome to 2.5.15 (#1829)
eea1614 chore(deps): update vitest to 5.0.3 (#1827)
c91bcd7 chore(deps): lock file maintenance (#1826)
9fece4e test: run GitLab conformance against GitLab CE 19.4.1 (#1825)
f8732bf test: use the GitLab image that caches Mustermann's encoded characters (#1824)
20ee3a7 feat(check-pr): validate base and proposed configuration (#1809)
4248c85 fix(deps): update dependency @octokit/plugin-paginate-rest to 16.0.0 (#1813)
988dde1 feat(replacers): select PR body sections by heading (#1808)
Additional commits viewable in compare view

Updates actions/setup-python from 6 to 7

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Migrate to ESM and upgrade dependencies by @priyagupta108 in actions/setup-python#1330

Pin SHA commits and update docs with latest versions by @HarithaVattikuti in actions/setup-python#1338

Remove the pip-install input by @gowridurgad in actions/setup-python#1336

Bug Fix

Fix to Classify stderr warning messages as warnings instead of errors in annotations by @lmvysakh in actions/setup-python#1335

Validate and retry manifest fetch to prevent silent failures by @priyagupta108 in actions/setup-python#1332

Dependency Upgrade

Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @dependabot in actions/setup-python#1328

Remove EOL Python versions and Bumps numpy text fixture by @priya-kinthali in actions/setup-python#1333

Upgrade @actions/cache to 6.2.0 by @philip-gai in actions/setup-python#1337

New Contributors

@lmvysakh made their first contribution in actions/setup-python#1335

@philip-gai made their first contribution in actions/setup-python#1337

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Add RHEL support and include Linux distro in cache keys by @priyagupta108 in actions/setup-python#1323

Fix pip cache error handling on Windows by @priyagupta108 in actions/setup-python#1040

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-python#1281

Upgrade actions dependencies by @gowridurgad with @Copilot in actions/setup-python#1303

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-python#1324

Upgrade dependency versions and test workflow configuration by @HarithaVattikuti in actions/setup-python#1322

Documentation

Update advanced-usage.md by @Dunky-Z in actions/setup-python#811

New Contributors

@gowridurgad with @Copilot made their first contribution in actions/setup-python#1303

@jasongin made their first contribution in actions/setup-python#1324

@Dunky-Z made their first contribution in actions/setup-python#811

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

Upgrade dependencies to Node 24 compatible versions by @salmanmkc in actions/setup-python#1259

... (truncated)

Commits

6d4fd22 Cache upgrade to 6.3.0 (#1370)
ec52d0a Bump @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
e1be392 Bump @types/semver from 7.7.1 to 7.8.0 (#1359)
06da627 Bump @vercel/ncc from 0.44.0 to 0.45.0 (#1357)
af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
7aeabeb Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
release-drafter/release-drafter	[>= 5.21.a, < 5.22]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 3 updates in the / directory: [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish), [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) and [actions/setup-python](https://github.com/actions/setup-python). Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@v1.14.2...v1.14.3) Updates `release-drafter/release-drafter` from 7.7.0 to 7.10.0 - [Release notes](https://github.com/release-drafter/release-drafter/releases) - [Commits](release-drafter/release-drafter@v7.7.0...v7.10.0) Updates `actions/setup-python` from 6 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6...v7) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: release-drafter/release-drafter dependency-version: 7.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Nov 1, 2026

Navigation Menu

Repository navigation

Bump the github-actions group across 1 directory with 3 updates - #903

Bump the github-actions group across 1 directory with 3 updates#903
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-b7c964a207

dependabot Bot commented on behalf of github Nov 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 1, 2026

v1.14.3

🛠️ Security Tightening

v7.10.0

What's Changed

New

Dependency Updates

Maintenance

Documentation

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

v6.2.0

What's Changed

Dependency Upgrades

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants