From 71c0113a5b9529807a93f2e11c9fc0ea0d35178a Mon Sep 17 00:00:00 2001 From: Daniel Lemire Date: Sat, 14 Nov 2026 10:22:19 -0500 Subject: [PATCH] Update pypa/gh-action-pypi-publish to v1.14.3 Versions up to 1.14.2 are affected by GHSA-5xjx-3w67-w9x9 (critical): revocation of a CA in the chain that Sigstore uses for Trusted Publishing and digital attestations. --- .github/workflows/buildwheels.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/buildwheels.yml b/.github/workflows/buildwheels.yml index cdd3b43..72ad5a4 100644 --- a/.github/workflows/buildwheels.yml +++ b/.github/workflows/buildwheels.yml @@ -72,7 +72,7 @@ jobs: path: dist merge-multiple: true - - uses: pypa/gh-action-pypi-publish@v1.13.0 + - uses: pypa/gh-action-pypi-publish@v1.14.3 with: user: __token__ password: ${{ secrets.PYPI_API_TOKEN }}