Skip to content

MAINT: Bump the actions group across 1 directory with 10 updates#66

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/dot-github/workflows/actions-7186ccaf7e
Open

MAINT: Bump the actions group across 1 directory with 10 updates#66
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/dot-github/workflows/actions-7186ccaf7e

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 3, 2025

Bumps the actions group with 10 updates in the /.github/workflows directory:

Package From To
actions/checkout 4 5
scientific-python/action-towncrier-changelog 1 2
actions/setup-python 5 6
actions/labeler 5.0.0 6.0.1
actions/github-script 7.0.1 8.0.0
actions/first-interaction 1.3.0 3.1.0
pypa/gh-action-pypi-publish 1.12.4 1.13.0
pypa/cibuildwheel 2.23.1 3.2.1
actions/upload-artifact 4.6.2 5.0.0
conda-incubator/setup-miniconda 3.1.1 3.2.0

Updates actions/checkout from 4 to 5

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

What's Changed

Full Changelog: actions/checkout@v4.2.1...v4.2.2

v4.2.1

What's Changed

New Contributors

Full Changelog: actions/checkout@v4.2.0...v4.2.1

... (truncated)

Commits

Updates scientific-python/action-towncrier-changelog from 1 to 2

Release notes

Sourced from scientific-python/action-towncrier-changelog's releases.

v2.0.0 Release Notes

Also see CHANGES.rst.

What's Changed

Full Changelog: scientific-python/action-towncrier-changelog@v1.0.0...v2.0.0

Commits

Updates actions/setup-python from 5 to 6

Release notes

Sourced from actions/setup-python's releases.

v6.0.0

What's Changed

Breaking Changes

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Bug fixes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-python@v5...v6.0.0

v5.6.0

What's Changed

Full Changelog: actions/setup-python@v5...v5.6.0

v5.5.0

What's Changed

Enhancements:

Bug fixes:

... (truncated)

Commits
  • e797f83 Upgrade to node 24 (#1164)
  • 3d1e2d2 Revert "Enhance cache-dependency-path handling to support files outside the w...
  • 65b0712 Clarify pythonLocation behavior for PyPy and GraalPy in environment variables...
  • 5b668cf Bump actions/checkout from 4 to 5 (#1181)
  • f62a0e2 Change missing cache directory error to warning (#1182)
  • 9322b3c Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIn...
  • fbeb884 Bump form-data to fix critical vulnerabilities #182 & #183 (#1163)
  • 03bb615 Bump idna from 2.9 to 3.7 in /tests/data (#843)
  • 36da51d Add version parsing from Pipfile (#1067)
  • 3c6f142 update documentation (#1156)
  • Additional commits viewable in compare view

Updates actions/labeler from 5.0.0 to 6.0.1

Release notes

Sourced from actions/labeler's releases.

v6.0.1

What's Changed

New Contributors

Full Changelog: actions/labeler@v6.0.0...v6.0.1

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

Documentation changes

... (truncated)

Commits

Updates actions/github-script from 7.0.1 to 8.0.0

Release notes

Sourced from actions/github-script's releases.

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

New Contributors

Full Changelog: actions/github-script@v7...v7.1.0

Commits
  • ed59741 Merge pull request #653 from actions/sneha-krip/readme-for-v8
  • 2dc352e Bold minimum Actions Runner version in README
  • 01e118c Update README for Node 24 runtime requirements
  • 8b222ac Apply suggestion from @​salmanmkc
  • adc0eea README for updating actions/github-script from v7 to v8
  • 20fe497 Merge pull request #637 from actions/node24
  • e7b7f22 update licenses
  • 2c81ba0 Update Node.js version support to 24.x
  • f28e40c Merge pull request #610 from actions/nebuk89-patch-1
  • 1ae9958 Update README.md
  • Additional commits viewable in compare view

Updates actions/first-interaction from 1.3.0 to 3.1.0

Release notes

Sourced from actions/first-interaction's releases.

v3.1.0

What's Changed

Full Changelog: actions/first-interaction@v3.0...v3.1.0

v3.0.0

What's Changed

New Contributors

Full Changelog: actions/first-interaction@v2...v3.0.0

v2.0.0

What's Changed

... (truncated)

Commits
  • 1c46889 Merge pull request #363 from actions/dependabot/npm_and_yarn/npm-development-...
  • 76a99dd Disable checks for dist
  • 2ead13c Bump the npm-development group across 1 directory with 10 updates
  • 2e8e200 Merge pull request #361 from actions/dependabot/npm_and_yarn/rollup/rollup-li...
  • df55979 Merge pull request #357 from actions/dependabot/npm_and_yarn/octokit/types-15...
  • c056c18 Bump @​rollup/rollup-linux-x64-gnu from 4.50.2 to 4.52.3
  • dac371d Bump @​octokit/types from 14.1.0 to 15.0.0
  • 33689d3 Merge pull request #354 from actions/ncalteen/event
  • 8e69b57 Merge branch 'main' into ncalteen/event
  • 69c5373 Merge pull request #351 from actions/dependabot/npm_and_yarn/github/local-act...
  • Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.12.4 to 1.13.0

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.13.0

[!important] 🚨 This release includes fixes for GHSA-vxmw-7h4f-hqxh discovered by @​woodruffw💰. We've also integrated Zizmor to catch similar issues in the future and you should too.

✨ New Stuff

@​woodruffw💰 updated the README to no longer mention the attestations feature being experimental in #347: it's been rather stable for a year already 🎉 He also added more diagnostic output which includes printing out the GitHub Environment claim via #371 and warning about the unsupported reusable workflows configurations #306, when using Trusted Publishing.

[!tip] The official support for reusable workflows is currently blocked on changes to PyPI. To get updates about progress on the action side, you may want to subscribe to #166. At PyCon US 2025 Sprints, @​facutuesca💰, @​miketheman💰, @​woodruffw💰 and I💰 spent several hours IRL brainstorming how to fix this and migrate projects that happen to rely on an obscure corner case with reusable workflows that temporarily allows them to function by accident. The result of that discussion is posted @ pypi/warehouse#11096. Note that this is a volunteer-led effort and there is no ETA. If you need this soon, make your employer sponsor the PSF and maybe they'll be able to hire somebody for this work on Warehouse.

In addition to that, @​konstin💰 sent #378 to pin actions/setup-python to a SHA hash. This makes pypi-publish compatible with new GitHub policies that allow organizations to mandate hash-pinning actions used in workflows.

🛠️ Internal Dependencies

@​webknjaz💰 made a bunch of updates to the action runtime which includes bumping it to Python 3.13 in #331 and updating the dependency tree across the board. pip-with-requires-python is no longer being installed (#332). Some related bumps were contributed by @​woodruffw💰 (#359) and @​kurtmckee💰 sent a contributor-facing PR, bumping the linting configuration via #335.

💪 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.12.4...v1.13.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

Commits

Updates pypa/cibuildwheel from 2.23.1 to 3.2.1

Release notes

Sourced from pypa/cibuildwheel's releases.

v3.2.1

  • 🛠 Update to CPython 3.14.0 final (#2614)
  • 🐛 Fix the default MACOSX_DEPLOYMENT_TARGET on Python 3.14 (#2613)
  • 📚 Docs improvements (#2617)

v3.2.0

  • ✨ Adds GraalPy v25 (Python 3.12) support (#2597)
  • 🛠 Update to CPython 3.14.0rc3 (#2602)
  • 🛠 Adds CPython 3.14.0 prerelease support for Android, and a number of improvements to Android builds (#2568, #2591)
  • 🛠 Improvements to testing on Android, passing environment markers when installing the venv, and providing more debug output when build-verbosity is set (#2575)
  • ⚠️ PyPy 3.10 was moved to pypy-eol in the enable option, as it is now end-of-life. (#2521)
  • 📚 Docs improvements (#2574, #2601, #2598)

v3.1.4

  • ✨ Add a --clean-cache command to clean up our cache (#2489)
  • 🛠 Update Python to 3.14rc2 and other patch version bumps (#2542, #2556)
  • 🛠 Update Pyodide to 0.28.2 (#2562, #2558)
  • 🐛 Fix resolution with pyodide-build when dependency-versions is set (#2548)
  • 🐛 Set CMAKE_FIND_ROOT_PATH_MODE_PACKAGE to BOTH on Android (#2547)
  • 🐛 Add patchelf dependency for platforms that can build Android wheels (#2552)
  • 🐛 Ignore empty values for CIBW_ARCHS like most other environment variables (#2541)
  • 💼 The color and suggest_on_error argparse options are now default in 3.14rc1+ (#2554)
  • 💼 Use the virtualenv release URL instead of blob URL (should be more robust) (#2555)
  • 🧪 For iOS, lowering to macos-14 is needed for now due to issues with GitHub's runner images (#2557)
  • 🧪 Split out platforms iOS and Android in our tests (#2519)
  • 🧪 Fix and enable doctests (#2546)
  • 📚 Impro...

    Description has been truncated

Bumps the actions group with 10 updates in the /.github/workflows directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `5` |
| [scientific-python/action-towncrier-changelog](https://github.com/scientific-python/action-towncrier-changelog) | `1` | `2` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5` | `6` |
| [actions/labeler](https://github.com/actions/labeler) | `5.0.0` | `6.0.1` |
| [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `8.0.0` |
| [actions/first-interaction](https://github.com/actions/first-interaction) | `1.3.0` | `3.1.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.12.4` | `1.13.0` |
| [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) | `2.23.1` | `3.2.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `5.0.0` |
| [conda-incubator/setup-miniconda](https://github.com/conda-incubator/setup-miniconda) | `3.1.1` | `3.2.0` |



Updates `actions/checkout` from 4 to 5
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v5)

Updates `scientific-python/action-towncrier-changelog` from 1 to 2
- [Release notes](https://github.com/scientific-python/action-towncrier-changelog/releases)
- [Changelog](https://github.com/scientific-python/action-towncrier-changelog/blob/main/check_changelog.py)
- [Commits](scientific-python/action-towncrier-changelog@v1...v2)

Updates `actions/setup-python` from 5 to 6
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v6)

Updates `actions/labeler` from 5.0.0 to 6.0.1
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@8558fd7...634933e)

Updates `actions/github-script` from 7.0.1 to 8.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@60a0d83...ed59741)

Updates `actions/first-interaction` from 1.3.0 to 3.1.0
- [Release notes](https://github.com/actions/first-interaction/releases)
- [Commits](actions/first-interaction@34f15e8...1c46889)

Updates `pypa/gh-action-pypi-publish` from 1.12.4 to 1.13.0
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@76f52bc...ed0c539)

Updates `pypa/cibuildwheel` from 2.23.1 to 3.2.1
- [Release notes](https://github.com/pypa/cibuildwheel/releases)
- [Changelog](https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md)
- [Commits](pypa/cibuildwheel@42728e8...9c00cb4)

Updates `actions/upload-artifact` from 4.6.2 to 5.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...330a01c)

Updates `conda-incubator/setup-miniconda` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/conda-incubator/setup-miniconda/releases)
- [Changelog](https://github.com/conda-incubator/setup-miniconda/blob/main/CHANGELOG.md)
- [Commits](conda-incubator/setup-miniconda@505e639...8352349)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: scientific-python/action-towncrier-changelog
  dependency-version: '2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/labeler
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/first-interaction
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: pypa/cibuildwheel
  dependency-version: 3.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: conda-incubator/setup-miniconda
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 3, 2025

Labels

The following labels could not be found: 03 - Maintenance, Build / CI, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants