dependabot[bot] opened a new pull request, #4744: URL: https://github.com/apache/iggy/pull/4744
Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.3.0` | `10.3.2` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.28` | `2.87.32` | | [rust-lang/crates-io-auth-action](https://github.com/rust-lang/crates-io-auth-action) | `1.0.5` | `1.0.6` | | [loadingalias/cargo-rail-action](https://github.com/loadingalias/cargo-rail-action) | `11.0.1` | `12.0.0` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` | Updates `actions/setup-python` from 7.0.0 to 7.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-python/releases";>actions/setup-python's releases</a>.</em></p> <blockquote> <h2>v7.1.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Add <code>mirror</code> and <code>mirror-token</code> inputs for custom Python distribution sources by <a href="https://github.com/luhenry";><code>@luhenry</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1302";>actions/setup-python#1302</a></li> <li>Improve error message clarity by <a href="https://github.com/v-lmvysakh";><code>@v-lmvysakh</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1351";>actions/setup-python#1351</a></li> </ul> <h3>Dependency Upgrade</h3> <ul> <li>Upgrade browserslist from 4.28.2 to 4.28.9 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1353";>actions/setup-python#1353</a></li> <li>Upgrade <code>@typescript-eslint/parser</code> from 8.62.0 to 8.70.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1343";>actions/setup-python#1343</a></li> <li>Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1342";>actions/setup-python#1342</a></li> <li>Upgrade <code>@vercel/ncc</code> from 0.44.0 to 0.45.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1357";>actions/setup-python#1357</a></li> <li>Upgrade <code>@types/semver</code> from 7.7.1 to 7.8.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1359";>actions/setup-python#1359</a></li> <li>Upgrade undici from 6.28.0 to 6.29.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1364";>actions/setup-python#1364</a></li> <li>Upgrade ts-jest from 29.4.11 to 29.4.14 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1361";>actions/setup-python#1361</a></li> <li>Upgrade brace-expansion from 5.0.9 to 5.0.12 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1365";>actions/setup-python#1365</a></li> <li>Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1363";>actions/setup-python#1363</a></li> <li>Upgrade <code>@typescript-eslint/eslint-plugin</code> from 8.62.0 to 8.71.1 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1369";>actions/setup-python#1369</a></li> <li>Upgrade actions/checkout from 7.0.0 to 7.0.1 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1345";>actions/setup-python#1345</a></li> <li>Upgrade cache to 6.3.0 by <a href="https://github.com/v-HarithaVattikuti";><code>@v-HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1370";>actions/setup-python#1370</a></li> <li>Resolve Basic Validation audit failures by <a href="https://github.com/v-HarithaVattikuti";><code>@v-HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1347";>actions/setup-python#1347</a></li> <li>Resolve npm audit failures by <a href="https://github.com/v-HarithaVattikuti";><code>@v-HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1350";>actions/setup-python#1350</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/luhenry";><code>@luhenry</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1302";>actions/setup-python#1302</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v7.0.0...v7.1.0";>https://github.com/actions/setup-python/compare/v7.0.0...v7.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-python/commit/6d4fd22b20465ccc0f7354476588e8df7c9ca0e0";><code>6d4fd22</code></a> Cache upgrade to 6.3.0 (<a href="https://redirect.github.com/actions/setup-python/issues/1370";>#1370</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/ec52d0af729a7c50ced4261d17a07916f43f5b8e";><code>ec52d0a</code></a> Bump <code>@typescript-eslint/eslint-plugin</code> from 8.62.0 to 8.71.1 (<a href="https://redirect.github.com/actions/setup-python/issues/1369";>#1369</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/ff73b2463e2f3baa703f830da214b8dfeeaeccf8";><code>ff73b24</code></a> Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (<a href="https://redirect.github.com/actions/setup-python/issues/1363";>#1363</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/0e40890053525508c059c61932a6b8614f9e95db";><code>0e40890</code></a> Bump brace-expansion from 5.0.9 to 5.0.12 (<a href="https://redirect.github.com/actions/setup-python/issues/1365";>#1365</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/3892123fbe74688ccc83ec7c465dc688359e5199";><code>3892123</code></a> Bump ts-jest from 29.4.11 to 29.4.14 (<a href="https://redirect.github.com/actions/setup-python/issues/1361";>#1361</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/660965736c4aecc62797ea07d351a3c259f14660";><code>6609657</code></a> Bump undici from 6.28.0 to 6.29.0 (<a href="https://redirect.github.com/actions/setup-python/issues/1364";>#1364</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/e1be392b26fb1917a7b2c455817e4b4dad6544ce";><code>e1be392</code></a> Bump <code>@types/semver</code> from 7.7.1 to 7.8.0 (<a href="https://redirect.github.com/actions/setup-python/issues/1359";>#1359</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/06da6279cdbca41027908073e81a4544dc79c06b";><code>06da627</code></a> Bump <code>@vercel/ncc</code> from 0.44.0 to 0.45.0 (<a href="https://redirect.github.com/actions/setup-python/issues/1357";>#1357</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/af9bcc7548695e66d75709de6f29e337624b8de8";><code>af9bcc7</code></a> Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (<a href="https://redirect.github.com/actions/setup-python/issues/1342";>#1342</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/7aeabeba5501120d873c50398519dbfd0657031c";><code>7aeabeb</code></a> Bump <code>@typescript-eslint/parser</code> from 8.62.0 to 8.70.0 (<a href="https://redirect.github.com/actions/setup-python/issues/1343";>#1343</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-python/compare/v7.0.0...v7.1.0";>compare view</a></li> </ul> </details> <br /> Updates `astral-sh/setup-uv` from 10.3.0 to 10.3.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases";>astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.3.2 🌈 update known checksums for 0.13.5</h2> <h2>Changes</h2> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.13.5 @<a href="https://github.com/apps/github-actions";>github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1103";>#1103</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v10.3.1 @<a href="https://github.com/apps/github-actions";>github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1102";>#1102</a>)</li> </ul> <h2>v10.3.1 🌈 preserve cache error class names in save-cache bundle</h2> <h2>Changes</h2> <p>This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn</p> <p><code>##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.</code></p> <h2>🐛 Bug fixes</h2> <ul> <li>fix: preserve cache error class names in save-cache bundle <a href="https://github.com/dannyward630";><code>@dannyward630</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1093";>#1093</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.13.4 @<a href="https://github.com/apps/github-actions";>github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1099";>#1099</a>)</li> <li>chore: update known checksums for 0.13.2/0.13.3 @<a href="https://github.com/apps/github-actions";>github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1098";>#1098</a>)</li> <li>chore: update known checksums for 0.13.1 @<a href="https://github.com/apps/github-actions";>github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1094";>#1094</a>)</li> <li>Verify npm dependency signatures before builds <a href="https://github.com/zaniebot";><code>@zaniebot</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1027";>#1027</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: cache-dependency-glob matches relative to the working directory <a href="https://github.com/flange-ipb";><code>@flange-ipb</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1092";>#1092</a>)</li> <li>docs: update version references to v10.3.0 @<a href="https://github.com/apps/github-actions";>github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1090";>#1090</a>)</li> </ul> <h2>⬆️ Dependency updates</h2> <ul> <li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger";><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1101";>#1101</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/07a047e608db84b3d8c06cd9a7c7dcc9c355c18e";><code>07a047e</code></a> chore: update known checksums for 0.13.5 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1103";>#1103</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/e1b85369e72750369c935b004eccf97311bdf5dc";><code>e1b8536</code></a> docs: update version references to v10.3.1 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1102";>#1102</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/18d369b23da25a81e9458561248e1aafff6a70fa";><code>18d369b</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1101";>#1101</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/4ad2329c1e377d882fcae221cd1d17e7c0ad788e";><code>4ad2329</code></a> chore: update known checksums for 0.13.4 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1099";>#1099</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/4bc6759c82322ff7efa28de54a45404ca6869912";><code>4bc6759</code></a> chore: update known checksums for 0.13.2/0.13.3 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1098";>#1098</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/c97f06e356bcca1b426f396ef93ec35ce149ce7b";><code>c97f06e</code></a> fix: preserve cache error class names in save-cache bundle (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1093";>#1093</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8ca4be000bfa5f8e6aaa01d8470878c90aa728d3";><code>8ca4be0</code></a> chore: update known checksums for 0.13.1 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1094";>#1094</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/b627d85691ead579b598a36169571b1c7123526f";><code>b627d85</code></a> docs: cache-dependency-glob matches relative to the working directory (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1092";>#1092</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f8c88970fcd8fff8e97bc62edc5f5c073a0527fe";><code>f8c8897</code></a> Verify npm dependency signatures before builds (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1027";>#1027</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f64d32b1cd6cc11405a74665b3dfb7bb86fea9f0";><code>f64d32b</code></a> docs: update version references to v10.3.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1090";>#1090</a>)</li> <li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/1c37ad07a6a961277cf70c0d37d6f313000f5884...07a047e608db84b3d8c06cd9a7c7dcc9c355c18e";>compare view</a></li> </ul> </details> <br /> Updates `taiki-e/install-action` from 2.87.28 to 2.87.32 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases";>taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.87.32</h2> <ul> <li> <p>Update <code>wild@latest</code> to 0.11.0.</p> </li> <li> <p>Update <code>vacuum@latest</code> to 0.35.2.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.9.5.</p> </li> <li> <p>Update <code>sccache@latest</code> to 0.19.0.</p> </li> <li> <p>Update <code>release-plz@latest</code> to 0.4.1.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.10.19.</p> </li> <li> <p>Update <code>knope@latest</code> to 0.23.2.</p> </li> <li> <p>Update <code>dprint@latest</code> to 0.64.3.</p> </li> <li> <p>Update <code>cargo-vet@latest</code> to 0.10.3.</p> </li> <li> <p>Update <code>cargo-sort@latest</code> to 2.1.4.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.26.1.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.6.3.</p> </li> </ul> <h2>2.87.31</h2> <ul> <li> <p>Downgrade <code>cargo-sort@latest</code> to 2.1.3.</p> </li> <li> <p>Update <code>vacuum@latest</code> to 0.35.0.</p> </li> <li> <p>Update <code>xh@latest</code> to 0.26.3.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.13.5.</p> </li> <li> <p>Update <code>ubi@latest</code> to 0.13.0.</p> </li> <li> <p>Update <code>trivy@latest</code> to 0.76.1.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.9.0.</p> </li> <li> <p>Update <code>release-plz@latest</code> to 0.3.174.</p> </li> <li> <p>Update <code>prek@latest</code> to 0.5.7.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.10.17.</p> </li> <li> <p>Update <code>jaq@latest</code> to 3.1.2.</p> </li> <li> <p>Update <code>espup@latest</code> to 0.17.1.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md";>taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.87.32] - 2026-10-26</h2> <ul> <li> <p>Update <code>wild@latest</code> to 0.11.0.</p> </li> <li> <p>Update <code>vacuum@latest</code> to 0.35.2.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.9.5.</p> </li> <li> <p>Update <code>sccache@latest</code> to 0.19.0.</p> </li> <li> <p>Update <code>release-plz@latest</code> to 0.4.1.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.10.19.</p> </li> <li> <p>Update <code>knope@latest</code> to 0.23.2.</p> </li> <li> <p>Update <code>dprint@latest</code> to 0.64.3.</p> </li> <li> <p>Update <code>cargo-vet@latest</code> to 0.10.3.</p> </li> <li> <p>Update <code>cargo-sort@latest</code> to 2.1.4.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.26.1.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.6.3.</p> </li> </ul> <h2>[2.87.31] - 2026-10-23</h2> <ul> <li> <p>Downgrade <code>cargo-sort@latest</code> to 2.1.3.</p> </li> <li> <p>Update <code>vacuum@latest</code> to 0.35.0.</p> </li> <li> <p>Update <code>xh@latest</code> to 0.26.3.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.13.5.</p> </li> <li> <p>Update <code>ubi@latest</code> to 0.13.0.</p> </li> <li> <p>Update <code>trivy@latest</code> to 0.76.1.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.9.0.</p> </li> <li> <p>Update <code>release-plz@latest</code> to 0.3.174.</p> </li> <li> <p>Update <code>prek@latest</code> to 0.5.7.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.10.17.</p> </li> <li> <p>Update <code>jaq@latest</code> to 3.1.2.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/5488ac5a951645ce95062214902ac4b6bc1a1037";><code>5488ac5</code></a> Release 2.87.32</li> <li><a href="https://github.com/taiki-e/install-action/commit/688322dd8dfd7f9d8217a7c2ac457d4fa2fe3436";><code>688322d</code></a> ci: Mark cargo-vet as glibc_pre_2_34_incompat</li> <li><a href="https://github.com/taiki-e/install-action/commit/cebf56e0546f8cbe3a317a3dbc527e4cb5c8c3a1";><code>cebf56e</code></a> Update <code>wild@latest</code> to 0.11.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/84f1fb195ce4aaeb61ac0c67fc39e032938542b9";><code>84f1fb1</code></a> Update <code>vacuum@latest</code> to 0.35.2</li> <li><a href="https://github.com/taiki-e/install-action/commit/22b4d72da777df58c5ce1018d97c3436f2b40413";><code>22b4d72</code></a> Update trunk manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/4aa26a3b8bcd9925bd25797b31dcb5647804e8de";><code>4aa26a3</code></a> Update <code>tombi@latest</code> to 1.9.5</li> <li><a href="https://github.com/taiki-e/install-action/commit/354bf5e1fe5e0639198bcea068b705c2f3714614";><code>354bf5e</code></a> Update <code>sccache@latest</code> to 0.19.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/89eb2014d3d6cb70abda0a573687a03fafa32b12";><code>89eb201</code></a> Update <code>release-plz@latest</code> to 0.4.1</li> <li><a href="https://github.com/taiki-e/install-action/commit/304ba0dcffc8ad84cdb9f3d7c359b2a4223c2a42";><code>304ba0d</code></a> Update <code>mise@latest</code> to 2026.10.19</li> <li><a href="https://github.com/taiki-e/install-action/commit/104910e39f1be359337b9c0b2069bc5749f06c0d";><code>104910e</code></a> Update <code>knope@latest</code> to 0.23.2</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.87.28...v2.87.32";>compare view</a></li> </ul> </details> <br /> Updates `rust-lang/crates-io-auth-action` from 1.0.5 to 1.0.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rust-lang/crates-io-auth-action/releases";>rust-lang/crates-io-auth-action's releases</a>.</em></p> <blockquote> <h2>v1.0.6</h2> <h2>What's Changed</h2> <p>update dependencies</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/rust-lang/crates-io-auth-action/compare/v1.0.5...v1.0.6";>https://github.com/rust-lang/crates-io-auth-action/compare/v1.0.5...v1.0.6</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rust-lang/crates-io-auth-action/commit/3268eb413133e2960fa4ae0e963ca76380c54cd9";><code>3268eb4</code></a> Merge pull request <a href="https://redirect.github.com/rust-lang/crates-io-auth-action/issues/278";>#278</a> from marcoienibot/chore/update-dependencies-2026-10</li> <li><a href="https://github.com/rust-lang/crates-io-auth-action/commit/e901356a3cd2b980059ee9644711d227e8862d1f";><code>e901356</code></a> chore(deps): update dependencies and GitHub Actions</li> <li><a href="https://github.com/rust-lang/crates-io-auth-action/commit/9c067fc5d5c254b33978fed918cb50c032549d0e";><code>9c067fc</code></a> Merge pull request <a href="https://redirect.github.com/rust-lang/crates-io-auth-action/issues/277";>#277</a> from rust-lang/renovate/msw-3.x</li> <li><a href="https://github.com/rust-lang/crates-io-auth-action/commit/9b550056ac91ae0f72334751818b46c567171f2b";><code>9b55005</code></a> chore(deps): update dependency msw to v3</li> <li><a href="https://github.com/rust-lang/crates-io-auth-action/commit/4920f0933d6c80323414a03df1731d6678d52a1b";><code>4920f09</code></a> Merge pull request <a href="https://redirect.github.com/rust-lang/crates-io-auth-action/issues/276";>#276</a> from rust-lang/renovate/major-github-actions</li> <li><a href="https://github.com/rust-lang/crates-io-auth-action/commit/04dcccbba582c5bbe3fc8e2bf779f7ba2d75efac";><code>04dcccb</code></a> chore(deps): update github actions</li> <li><a href="https://github.com/rust-lang/crates-io-auth-action/commit/82864bf380abd3e242c564a5ba58dd29d6265b00";><code>82864bf</code></a> Merge pull request <a href="https://redirect.github.com/rust-lang/crates-io-auth-action/issues/274";>#274</a> from rust-lang/renovate/major-vitest-monorepo</li> <li><a href="https://github.com/rust-lang/crates-io-auth-action/commit/2bd8e07944ebe5a067087231d8410f9631aedc02";><code>2bd8e07</code></a> chore(deps): update dependency vitest to v5</li> <li><a href="https://github.com/rust-lang/crates-io-auth-action/commit/f14f407dad32919804d8e0550a5e471a82249cee";><code>f14f407</code></a> Merge pull request <a href="https://redirect.github.com/rust-lang/crates-io-auth-action/issues/271";>#271</a> from rust-lang/renovate/github-actions</li> <li><a href="https://github.com/rust-lang/crates-io-auth-action/commit/0205d6ca26140976a4c250a7707cd2231f83bcca";><code>0205d6c</code></a> chore(deps): update github actions</li> <li>Additional commits viewable in <a href="https://github.com/rust-lang/crates-io-auth-action/compare/c6f97d42243bad5fab37ca0427f495c86d5b1a18...3268eb413133e2960fa4ae0e963ca76380c54cd9";>compare view</a></li> </ul> </details> <br /> Updates `loadingalias/cargo-rail-action` from 11.0.1 to 12.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/loadingalias/cargo-rail-action/releases";>loadingalias/cargo-rail-action's releases</a>.</em></p> <blockquote> <h2>cargo-rail-action v12.0.0</h2> <h2>[12.0.0] - 2026-10-16</h2> <ul> <li> <p>Run the stateless <code>cargo rail release</code> from Cargo-Rail 0.32. The release Action installs Cargo-Rail and runs <code>cargo rail release --yes</code>. When the <code>dry-run</code> input is <code>true</code>, it passes <code>--dry-run</code> instead of <code>--yes</code>. When you run the Action again, it finishes an interrupted release.</p> <ul> <li>Before you upgrade, migrate a <code>.config/rail.toml</code> that has a <code>[release]</code> table. Follow <a href="https://github.com/loadingalias/cargo-rail/blob/main/docs/releases.md#upgrade-from-cargo-rail-031";>Upgrade from Cargo-Rail 0.31</a>.</li> <li>Inputs are <code>crates</code>, <code>bump</code>, <code>pull-request</code>, <code>dry-run</code>, <code>token</code>, and <code>version</code>. This release removes the <code>packages</code>, <code>publish</code>, and <code>review</code> inputs.</li> <li>Outputs are <code>state</code>, <code>commit</code>, <code>tags</code> (a JSON array), and <code>pull-request</code>. This release removes the <code>transaction-id</code>, <code>release-sha</code>, and <code>run-url</code> outputs. A pending check on the commit being released fails the step.</li> <li>The values of <code>state</code> change. In v11, <code>state</code> was <code>active</code>, <code>complete</code>, or <code>aborted</code>. In v12, <code>state</code> is <code>nothing_to_release</code>, <code>planned</code>, <code>pull_request</code>, <code>awaiting_checks</code>, <code>awaiting_assets</code>, or <code>released</code>. Cargo-Rail also has <code>cancelled</code>, but it does not report it with the <code>--yes</code> or <code>--dry-run</code> that the Action passes. Update each workflow condition that compares <code>state</code>.</li> <li>The Action passes the <code>token</code> input to Cargo-Rail as <code>GH_TOKEN</code> and as process-scoped Git configuration. Cargo-Rail uses the token for the GitHub API and for Git access to <code>origin</code>, including the release push. Build scripts that run during packaging or API checks do not receive it. This requires Cargo-Rail 0.32.0, which v12 installs. The checkout keeps no credentials. The release commit uses the <code>github-actions[bot]</code> identity unless the checkout configures one.</li> <li>The new <code>release/asset</code> Action attests files and attaches them to the draft release that <code>cargo rail release</code> waits for.</li> <li>This release removes the release-record validator, the <code>release-record-v11</code> schema, and the reviewed-merge path through <code>pull_request_target</code>. Release workflows no longer pass <code>transaction</code>, <code>intent</code>, or <code>source</code> dispatch inputs.</li> <li>The <code>v{major}</code> alias follows each major release without a change to the configuration.</li> </ul> </li> <li> <p>The cache action accepts the <code>recovery_action</code> field that Cargo-Rail reports for an unhealthy installation. The action now rejects such an installation for its state, instead of for an unknown field.</p> </li> <li> <p>The job record schema <code>schemas/cache-job-v1.schema.json</code> accepts every exact stable Cargo-Rail version. The cache report and the cache status schema already accepted them. Before this change, the job record schema accepted only Cargo-Rail 0.26 releases.</p> </li> <li> <p>Bootstrap errors name the Action release that runs, instead of v10.</p> </li> <li> <p>Qualify the planner, setup, cache, and release Actions with Cargo-Rail 0.32.0. Pin its verified release source and tooling, and install that version by default. Cargo-Rail 0.32.0 rejects compiler adapter packs from 0.30 and 0.31, and it rejects retired <code>[release]</code> keys. Its release notes list every change.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/loadingalias/cargo-rail-action/blob/main/CHANGELOG.md";>loadingalias/cargo-rail-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>[12.0.0] - 2026-10-16</h2> <ul> <li> <p>Run the stateless <code>cargo rail release</code> from Cargo-Rail 0.32. The release Action installs Cargo-Rail and runs <code>cargo rail release --yes</code>. When the <code>dry-run</code> input is <code>true</code>, it passes <code>--dry-run</code> instead of <code>--yes</code>. When you run the Action again, it finishes an interrupted release.</p> <ul> <li>Before you upgrade, migrate a <code>.config/rail.toml</code> that has a <code>[release]</code> table. Follow <a href="https://github.com/loadingalias/cargo-rail/blob/main/docs/releases.md#upgrade-from-cargo-rail-031";>Upgrade from Cargo-Rail 0.31</a>.</li> <li>Inputs are <code>crates</code>, <code>bump</code>, <code>pull-request</code>, <code>dry-run</code>, <code>token</code>, and <code>version</code>. This release removes the <code>packages</code>, <code>publish</code>, and <code>review</code> inputs.</li> <li>Outputs are <code>state</code>, <code>commit</code>, <code>tags</code> (a JSON array), and <code>pull-request</code>. This release removes the <code>transaction-id</code>, <code>release-sha</code>, and <code>run-url</code> outputs. A pending check on the commit being released fails the step.</li> <li>The values of <code>state</code> change. In v11, <code>state</code> was <code>active</code>, <code>complete</code>, or <code>aborted</code>. In v12, <code>state</code> is <code>nothing_to_release</code>, <code>planned</code>, <code>pull_request</code>, <code>awaiting_checks</code>, <code>awaiting_assets</code>, or <code>released</code>. Cargo-Rail also has <code>cancelled</code>, but it does not report it with the <code>--yes</code> or <code>--dry-run</code> that the Action passes. Update each workflow condition that compares <code>state</code>.</li> <li>The Action passes the <code>token</code> input to Cargo-Rail as <code>GH_TOKEN</code> and as process-scoped Git configuration. Cargo-Rail uses the token for the GitHub API and for Git access to <code>origin</code>, including the release push. Build scripts that run during packaging or API checks do not receive it. This requires Cargo-Rail 0.32.0, which v12 installs. The checkout keeps no credentials. The release commit uses the <code>github-actions[bot]</code> identity unless the checkout configures one.</li> <li>The new <code>release/asset</code> Action attests files and attaches them to the draft release that <code>cargo rail release</code> waits for.</li> <li>This release removes the release-record validator, the <code>release-record-v11</code> schema, and the reviewed-merge path through <code>pull_request_target</code>. Release workflows no longer pass <code>transaction</code>, <code>intent</code>, or <code>source</code> dispatch inputs.</li> <li>The <code>v{major}</code> alias follows each major release without a change to the configuration.</li> </ul> </li> <li> <p>The cache action accepts the <code>recovery_action</code> field that Cargo-Rail reports for an unhealthy installation. The action now rejects such an installation for its state, instead of for an unknown field.</p> </li> <li> <p>The job record schema <code>schemas/cache-job-v1.schema.json</code> accepts every exact stable Cargo-Rail version. The cache report and the cache status schema already accepted them. Before this change, the job record schema accepted only Cargo-Rail 0.26 releases.</p> </li> <li> <p>Bootstrap errors name the Action release that runs, instead of v10.</p> </li> <li> <p>Qualify the planner, setup, cache, and release Actions with Cargo-Rail 0.32.0. Pin its verified release source and tooling, and install that version by default. Cargo-Rail 0.32.0 rejects compiler adapter packs from 0.30 and 0.31, and it rejects retired <code>[release]</code> keys. Its release notes list every change.</p> </li> </ul> <h2>[11.0.1] - 2026-10-11</h2> <ul> <li>Qualify the planner, setup, cache, and release Actions with Cargo-Rail 0.31.1. Pin its verified release source and tooling, and install that version by default. This adopts corrected release status and undeclared independent lockfile diagnostics without changing the stored contracts.</li> </ul> <h2>[11.0.0] - 2026-10-11</h2> <ul> <li>Qualify Cargo-Rail 0.31.0 and its release execution record v11.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/loadingalias/cargo-rail-action/commit/fd41439dfa862939e6928cb98d7e76de580f673c";><code>fd41439</code></a> chore(release): cargo-rail-action v12.0.0</li> <li><a href="https://github.com/loadingalias/cargo-rail-action/commit/77ea983156b03d6fb9526c81b09dd691fc098763";><code>77ea983</code></a> fix(action): adopt Cargo-Rail 0.32.0</li> <li><a href="https://github.com/loadingalias/cargo-rail-action/commit/84b8f12b6925b753c90c908914c39e8c802a7df1";><code>84b8f12</code></a> docs: require the released state and attestation reads in release workflows</li> <li><a href="https://github.com/loadingalias/cargo-rail-action/commit/977634ce3e33789d1287ab387755e849cec5322a";><code>977634c</code></a> ci(release): verify asset provenance and require a published release</li> <li><a href="https://github.com/loadingalias/cargo-rail-action/commit/75de439c8869e28a8ec1c60e2431834aa9ed329e";><code>75de439</code></a> ci: qualify the Action against the Cargo-Rail 0.32 release candidate</li> <li><a href="https://github.com/loadingalias/cargo-rail-action/commit/e11f5e9764a7d134b909045041a5efc3adb6b77d";><code>e11f5e9</code></a> docs: describe the v12 release runner as Cargo-Rail 0.32 runs it</li> <li><a href="https://github.com/loadingalias/cargo-rail-action/commit/2377dd484de31f94e569ae760a2a8856ba27def2";><code>2377dd4</code></a> fix(cache): accept every Cargo-Rail version in job records and the recovery_a...</li> <li><a href="https://github.com/loadingalias/cargo-rail-action/commit/2520c15a9d23e2f4b9f6690285148da9c4f0effd";><code>2520c15</code></a> ci: use Cargo-Rail tooling and candidate on Rust 1.99.0</li> <li><a href="https://github.com/loadingalias/cargo-rail-action/commit/ec30df47595a778a8f0d4449dbd1c64c26e9cbc7";><code>ec30df4</code></a> ci: use Cargo-Rail tooling that stays on Rust 1.98.1</li> <li><a href="https://github.com/loadingalias/cargo-rail-action/commit/9e916070f388aa85ef6ffc2b13d2a24f0812e6da";><code>9e91607</code></a> ci: use Cargo-Rail tooling that runs Python through uv, on Rust 1.99.0</li> <li>Additional commits viewable in <a href="https://github.com/loadingalias/cargo-rail-action/compare/2104429578cfeef1a6a5beb379c2202e0310df78...fd41439dfa862939e6928cb98d7e76de580f673c";>compare view</a></li> </ul> </details> <br /> Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/gh-action-pypi-publish/releases";>pypa/gh-action-pypi-publish's releases</a>.</em></p> <blockquote> <h2>v1.14.3</h2> <!-- raw HTML omitted --> <blockquote> <p>[!important] 🚨 This release includes fixes for <a href="https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9";>GHSA-5xjx-3w67-w9x9</a> patched up by <a href="https://github.com/sethmlarson";><code>@sethmlarson</code></a><a href="https://github.com/sponsors/sethmlarson";>💰</a> in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/427";>#427</a> and in other places across the ecosystem.</p> <p>Additional ecosystem and related mitigations beyond you might want to watch out for:</p> <ul> <li><a href="https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576";>https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576</a></li> <li><a href="https://emudhra.we-have-a-problem.com";>https://emudhra.we-have-a-problem.com</a></li> </ul> </blockquote> <h2>🛠️ Security Tightening</h2> <p><a href="https://github.com/webknjaz";><code>@webknjaz</code></a><a href="https://github.com/sponsors/webknjaz";>💰</a> made sure the dependency tree within the action runtime uses hash-checking from now on via <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/pull/420";>pypa/gh-action-pypi-publish#420</a>.</p> <p><strong>🪞 Full Diff</strong>: <a href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3";>https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3</a></p> <p><strong>🧔♂️ Release Manager:</strong> <a href="https://github.com/sponsors/webknjaz";><code>@webknjaz</code></a> <a href="https://stand-with-ukraine.pp.ua";>🇺🇦</a></p> <p><strong>💬 Discuss</strong> <a href="https://bsky.app/profile/webknjaz.me/post/3mydcjweyak2f";>on Bluesky 🦋</a>, <a href="https://mastodon.social/@webknjaz/117474743338290807";>on Mastodon 🐘</a> and <a href="https://github.com/pypa/gh-action-pypi-publish/discussions/429";>on GitHub</a>.</p> <p><a href="https://github.com/sponsors/webknjaz";><img src="https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c"; alt="GH Sponsors badge" /></a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/7245906fb61fa33a13554f9d5fb856fe61758086";><code>7245906</code></a> Merge pull request <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/427";>#427</a> from sethmlarson/certifi-sigstore</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/331eccb0e13a5c1124ed9f414a079ef2bef1095f";><code>331eccb</code></a> Upgrade certifi and sigstore</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/f68fee44f9faa979857cda34894b750df5f571ca";><code>f68fee4</code></a> 💰 Sync the FUNDING config</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/c0d6f8e4af2ad8247a7da213b199ea78dac8395e";><code>c0d6f8e</code></a> Merge branch 'integrity/runtime/deptree' into unstable/v1</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/909009990f9cf7e7c6a64e602638cf9e91af47f8";><code>9090099</code></a> 🧪 Make smoke test deps hash-pinned in CI</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/34e40c24acd7b4a9150956d646c8c7ba667a14f3";><code>34e40c2</code></a> 📌 Bump pip-tools managed transitive deptrees</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/e800ed547ac29cbc9324311809e2f36fe82148f9";><code>e800ed5</code></a> 👷 Enable hash-checking in the runtime deptree 🔗</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/dd8c5f4f1f65ddf01533969008446145facc7b02";><code>dd8c5f4</code></a> 🔧 Make pip-tools config available in container</li> <li>See full diff in <a href="https://github.com/pypa/gh-action-pypi-publish/compare/dc37677b2e1c63e2034f94d8a5b11f265b73ba33...7245906fb61fa33a13554f9d5fb856fe61758086";>compare view</a></li> </ul> </details> <br /> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
