Skip to content

Bump the actions group across 1 directory with 12 updates - #27

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-6d863525dc
Closed

Bump the actions group across 1 directory with 12 updates#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-6d863525dc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the actions group with 12 updates in the / directory:

Package From To
actions/checkout 7.0.0 7.0.1
mamba-org/setup-micromamba 3.0.0 3.2.1
WyriHaximus/github-action-get-previous-tag 2.0.0 2.1.0
Parcels-code/pixi-lock/create-and-cache 0.1.0 0.1.1
Parcels-code/pixi-lock/restore 0.1.0 0.1.1
prefix-dev/setup-pixi 0.9.6 0.10.2
zizmorcore/zizmor-action 0.5.7 0.6.4
scientific-python/issue-from-pytest-log-action 1.5.0 1.6.2
actions/labeler 6.1.0 7.0.0
actions/setup-python 6.3.0 7.0.0
scientific-python/upload-nightly-action 0.6.4 0.6.5
pypa/gh-action-pypi-publish 1.14.0 1.14.2

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates mamba-org/setup-micromamba from 3.0.0 to 3.2.1

Release notes

Sourced from mamba-org/setup-micromamba's releases.

v3.2.1

What's Changed

Bug fixes

Full Changelog: mamba-org/setup-micromamba@v3.2.0...v3.2.1

v3.2.0

What's Changed

New features

Full Changelog: mamba-org/setup-micromamba@v3.1.0...v3.2.0

v3.1.0

What's Changed

New features

Documentation

Dependency updates

New Contributors

Full Changelog: mamba-org/setup-micromamba@v3.0.0...v3.1.0

Commits
  • f457c30 fix: Extract prerelease packages on Windows with --force-local (#315)
  • d6abac3 feat: Support prereleases of micromamba (#310)
  • ce51e99 Bump the node group across 1 directory with 14 updates (#309)
  • fb7186a Support Windows ARM64 (win-arm64) (#269)
  • 60f1092 Bump the actions group with 3 updates (#312)
  • ed54f9b Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (#311)
  • 60b4c82 Bump the actions group across 1 directory with 5 updates (#308)
  • 63fffb4 Update README examples to use setup-micromamba v3 (#305)
  • 8959ca9 Bump the actions group with 3 updates (#299)
  • See full diff in compare view

Updates WyriHaximus/github-action-get-previous-tag from 2.0.0 to 2.1.0

Release notes

Sourced from WyriHaximus/github-action-get-previous-tag's releases.

v2.1.0

  • Total issues resolved: 1
  • Total pull requests resolved: 9
  • Total contributors: 3

Bug 🐞

Dependencies 📦

Enhancement ✨

Commits
  • 83f26fe Merge pull request #83 from WyriHaximus/error-out-when-fallingback-to-fallbac...
  • b31e6da Error out when no tag is found and no fallback is provided.
  • 985f69b Merge pull request #92 from WyriHaximus/pin-github-workflows-v1.0.1
  • c2a003c Merge pull request #91 from WyriHaximus/replace-therussiankid92-gat-with-nick...
  • c988f4c Pin WyriHaximus/github-workflows release management to v1.0.1.
  • 57776e3 Replace therussiankid92/gat with nick-fields/assert-action.
  • 6b39768 Merge pull request #89 from WyriHaximus/renovate/update-github-tags-actions-c...
  • d6cbe9e chore(deps): update actions/checkout action to v7.0.1
  • 2df46c7 Merge pull request #84 from WyriHaximus/fix-1.4-tag-test
  • fea0316 Fix 1.4 tag test
  • Additional commits viewable in compare view

Updates Parcels-code/pixi-lock/create-and-cache from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/create-and-cache's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates Parcels-code/pixi-lock/restore from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/restore's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates prefix-dev/setup-pixi from 0.9.6 to 0.10.2

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.10.2

What's Changed

✨ New features

Full Changelog: prefix-dev/setup-pixi@v0.10.1...v0.10.2

v0.10.1

What's Changed

⬆️ Dependency updates

🤷🏻 Other changes

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.10.0...v0.10.1

v0.10.0

What's Changed

💥 Breaking changes

⬆️ Dependency updates

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.9.6...v0.10.0

Commits
  • d3f436a feat: Add support for linux-riscv64 (#282)
  • f00437f Update dependencies and add pnpm workspace configuration (#279)
  • d0c199d chore(deps): bump the gh-actions group with 3 updates (#276)
  • 2253d9c chore(deps): bump the gh-actions group with 3 updates (#273)
  • c5359a3 chore(deps): bump the nodejs group with 6 updates (#274)
  • a09b624 feat: change post-cleanup default to false (#272)
  • 947fc1f chore(deps): bump the nodejs group with 6 updates (#269)
  • 36c1c8c chore(deps): bump the gh-actions group with 2 updates (#268)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.4

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.4

Sponsorship is appreciated!

zizmor 1.30.1 is now the default version.

Release notes: zizmorcore/zizmor-action#1301

v0.6.3

zizmor 1.30.0 is now the default version.

Release notes: zizmorcore/zizmor-action#1300

v0.6.2

zizmor 1.29.0 is now the default version.

v0.6.1

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits
  • cc914d7 Sync zizmor versions (#166)
  • bae72b7 chore(deps): bump the github-actions group with 2 updates (#165)
  • 27604f9 chore(deps): bump the github-actions group with 2 updates (#164)
  • c41d665 README: bump pins (#163)
  • 70fb788 Sync zizmor versions (#162)
  • 7999d8c chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 in ...
  • 2ae1ce9 chore(deps): bump github/codeql-action/upload-sarif (#160)
  • 951a5ee Skip prerelease versions in sync-zizmor-versions workflow (#158)
  • 79f0191 chore(deps): bump github/codeql-action/upload-sarif (#156)
  • 26a3ae6 sync-zizmor-versions: retry up to 5 times (#155)
  • Additional commits viewable in compare view

Updates scientific-python/issue-from-pytest-log-action from 1.5.0 to 1.6.2

Release notes

Sourced from scientific-python/issue-from-pytest-log-action's releases.

v1.6.2

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.6.1...v1.6.2

v1.6.1

What's Changed

New Contributors

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.6.0...v1.6.1

v1.6.0

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.5.0...v1.6.0

Commits

Updates actions/labeler from 6.1.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

Dependency Updates

Full Changelog: actions/labeler@v6.1.0...v6.2.0

Commits
  • bf12e9b feat: migrate to ESM and update dependencies (#949)
  • b8dd2d9 Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 (#942)
  • 53affe8 Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...
  • f612d9a Fix: Improve PR number validation and warning messages in input handling (#939)
  • See full diff in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates scientific-python/upload-nightly-action from 0.6.4 to 0.6.5

Release notes

Sourced from scientific-python/upload-nightly-action's releases.

0.6.5

What's Changed

New Contributors

Full Changelog: scientific-python/upload-nightly-action@0.6.4...0.6.5

Commits
  • 16fa02e MNT: Update to pixi lock spec v7 and project version v0.6.5 (#183)
  • fd44fde chore: Move requirements file under tools/ (#182)
  • 1dbb7f3 Build(deps): Bump pygithub from 2.9.1 to 2.10.0 in the python group (#180)
  • 2ca17bd Build(deps): Bump prefix-dev/setup-pixi in the actions group (#179)
  • 1a97ddf Build(deps): Bump the actions group with 3 updates (#177)
  • c88d30e Add issue-opener when wheels are almost dead (#175)
  • d770301 Build(deps): Bump the actions group with 4 updates (#174)
  • 33e7342 Add details about the consequences of not regularly uploading wheels (#173)
  • 64f2a45 Build(deps): Bump the actions group with 3 updates (#170)
  • 9aaae99 Build(deps): Bump the actions group with 4 updates (#168)
  • Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore

@dependabot
Bump the actions group across 1 directory with 12 updates
223bfc7 
Bumps the actions group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [mamba-org/setup-micromamba](https://github.com/mamba-org/setup-micromamba) | `3.0.0` | `3.2.1` |
| [WyriHaximus/github-action-get-previous-tag](https://github.com/wyrihaximus/github-action-get-previous-tag) | `2.0.0` | `2.1.0` |
| [Parcels-code/pixi-lock/create-and-cache](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [Parcels-code/pixi-lock/restore](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.6` | `0.10.2` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.4` |
| [scientific-python/issue-from-pytest-log-action](https://github.com/scientific-python/issue-from-pytest-log-action) | `1.5.0` | `1.6.2` |
| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [scientific-python/upload-nightly-action](https://github.com/scientific-python/upload-nightly-action) | `0.6.4` | `0.6.5` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` |



Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

Updates `mamba-org/setup-micromamba` from 3.0.0 to 3.2.1
- [Release notes](https://github.com/mamba-org/setup-micromamba/releases)
- [Commits](mamba-org/setup-micromamba@d7c9bd8...f457c30)

Updates `WyriHaximus/github-action-get-previous-tag` from 2.0.0 to 2.1.0
- [Release notes](https://github.com/wyrihaximus/github-action-get-previous-tag/releases)
- [Commits](WyriHaximus/github-action-get-previous-tag@61819f3...83f26fe)

Updates `Parcels-code/pixi-lock/create-and-cache` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)

Updates `Parcels-code/pixi-lock/restore` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)

Updates `prefix-dev/setup-pixi` from 0.9.6 to 0.10.2
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@5185adf...d3f436a)

Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.4
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@192e21d...cc914d7)

Updates `scientific-python/issue-from-pytest-log-action` from 1.5.0 to 1.6.2
- [Release notes](https://github.com/scientific-python/issue-from-pytest-log-action/releases)
- [Commits](scientific-python/issue-from-pytest-log-action@v1.5.0...35b4e0a)

Updates `actions/labeler` from 6.1.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@f27b608...bf12e9b)

Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)

Updates `scientific-python/upload-nightly-action` from 0.6.4 to 0.6.5
- [Release notes](https://github.com/scientific-python/upload-nightly-action/releases)
- [Commits](scientific-python/upload-nightly-action@e76cfec...16fa02e)

Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: mamba-org/setup-micromamba
  dependency-version: 3.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: WyriHaximus/github-action-get-previous-tag
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/create-and-cache
  dependency-version: 0.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/restore
  dependency-version: 0.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: prefix-dev/setup-pixi
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: scientific-python/issue-from-pytest-log-action
  dependency-version: 1.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/labeler
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: scientific-python/upload-nightly-action
  dependency-version: 0.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 16, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 23, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 23, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-6d863525dc branch September 23, 2026 06:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants