Shard release publishing and signing across a gated matrix - #13226
Merged
Conversation
The release job signed every built dist (PyPI attestations plus the standalone Sigstore step) in a single job, reusing one short-lived OIDC identity for the whole set. With the large wheel matrix that loop runs ~5 minutes, right at the OIDC token lifetime, so it now fails partway through with sigstore.oidc.ExpiredIdentity (pypa/gh-action-pypi-publish#307). Keep the GitHub Release creation in the deploy job and move publishing and signing into a separate publish matrix split into two shards. Each shard is its own job with a fresh OIDC identity and signs only half the dists, well under the token lifetime. The split is deterministic and every step is idempotent, so a single failed shard can be re-run on its own.
psf-chronographer
Bot
added
the
bot:chronographer:provided
bdraco
added
backport-3.14
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #13226 +/- ##
==========================================
+ Coverage 98.73% 98.98% +0.25%
==========================================
Files 131 131
Lines 48993 48993
Branches 2550 2550
==========================================
+ Hits 48372 48496 +124
+ Misses 483 373 -110
+ Partials 138 124 -14
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
Both shards target the protected pypi environment; running them in parallel keeps both deployments pending at once so a required reviewer approves them in one review instead of one prompt per shard. Each shard uploads a disjoint set of dists, so the concurrent GitHub Release asset uploads do not collide.
Contributor
|
|
Merging this PR will not alter performance
Comparing 
Footnotes
|
Keep the pypi environment on the deploy job so a required reviewer must approve before the GitHub Release is created, restoring the approval gate that gated release creation before this split; the publish shards remain gated by the same environment before anything reaches PyPI. Derive the shard count from strategy.job-total and the shard index from strategy.job-index so the matrix list is the single source of truth and there is no separate SHARDS constant to drift out of sync.
Contributor
|
|
Member
|
Did that just create the GH release in the PR? |
Member
Author
|
no. it was created an hour ago |
Member
Oh yeah, misreading.. |
Creating the GitHub Release is reversible, so it does not need the required-reviewer prompt; only the irreversible PyPI upload does. Dropping environment: pypi from the deploy job leaves a single approval gate on the publish shards, which run in parallel and are therefore pending together, so a reviewer approves both in one review.
Both the GitHub Release and the PyPI upload are install vectors, so both must sit behind the required-reviewer approval. Splitting them into a gated deploy job and a gated publish job meant two sequential approvals. Put release creation and publishing in one gated matrix instead. Shard 0 creates the Release and the other shards wait for it; each shard then publishes and signs only its own disjoint share. Because the shards run in parallel and all target the pypi environment, they are pending together and a reviewer approves them in a single review, so the release keeps one approval that now gates both Release creation and the PyPI upload.
Name the matrix entries '1 of 2' / '2 of 2' instead of shard 0/1, and drive the split from strategy.job-index / job-total (GROUP_INDEX / GROUP_COUNT) so the labels are the only literals. GROUPS collided with the bash builtin array, which would have broken the modulo; use non-special names. Query the releases API and branch on the HTTP 404 status rather than grepping gh's prose 'release not found', and make the wait loop re-raise on any non-404 error instead of retrying for the whole timeout.
- Derive the split index and count from the 'N of M' matrix label instead of strategy.job-index / job-total, so the matrix list is the only source of truth and the partition is robust to future include/exclude entries (those renumber the global job counters). - Check out the repo only in the release-creating group; the others just publish and sign from dist/ and never read the tree. - Hoist the shared TAG to a job-level env; keep GITHUB_TOKEN scoped to the steps that need it so third-party actions do not see it. - Add set -euo pipefail to the release-existence shell blocks to match the existing gh api convention in this workflow.
bdraco
changed the title
Contributor
|
|
Both groups run action-gh-release against the same release. Note in the workflow that this is safe: disjoint file shares mean asset names never collide, and with no body/name inputs the action preserves existing release metadata (verified in v3.0.2 source), so the concurrent metadata updates are identical no-ops, and the Wait step guarantees the release already exists.
Member
Author
|
Thanks for the review. Both points addressed: Warning 1 (description vs diff): the description was stale; it now describes what the diff ships, a single gated Suggestion 1 (concurrent release updates): checked against action-gh-release v3.0.2 source. With no body or name inputs it preserves the existing release metadata by reading it and writing it back rather than clearing it ( |
Contributor
PR Review — Shard release publishing and signing across a gated matrixSolid, well-reasoned CI fix — merge-ready with two minor forward-looking nits. The sharding logic is correct and the prior review's blocker is now resolved.
Automated review by Kōan (Claude) |
Contributor
Backport to 3.14: 💔 cherry-picking failed — conflicts found❌ Failed to cleanly apply 76bb64e on top of patchback/backports/3.14/76bb64eb27fec484fa8a176d9d1c41c027c4d2ad/pr-13226 Backporting merged PR #13226 into master
🤖 @patchback |
Contributor
Backport to 3.15: 💚 backport PR created✅ Backport PR branch: Backported as #13227 🤖 @patchback |
bagowix
pushed a commit
to bagowix/aiohttp
that referenced
this pull request
Aug 6, 2026
Bumps [pip](https://github.com/pypa/pip) from 26.0.1 to 26.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p> <blockquote> <h1>26.1 (2026-04-26)</h1> <h2>Deprecations and Removals</h2> <ul> <li>Drop support for Python 3.9. (<code>[#13795](pypa/pip#13795) <https://github.com/pypa/pip/issues/13795></code>_)</li> </ul> <h2>Features</h2> <ul> <li>Add experimental support to read requirements from standardized pylock.toml files (<code>-r pylock.toml</code>). (<code>[#13876](pypa/pip#13876) <https://github.com/pypa/pip/issues/13876></code>_)</li> <li>Allow <code>--uploaded-prior-to</code> to accept a duration in days (e.g., <code>P3D</code> for 3 days ago). (<code>[#13674](pypa/pip#13674) <https://github.com/pypa/pip/issues/13674></code>_)</li> </ul> <h2>Enhancements</h2> <ul> <li>Speed up dependency resolution when there are complex conflicts. (<code>[#13859](pypa/pip#13859) <https://github.com/pypa/pip/issues/13859></code>_)</li> <li>Reduce memory usage when resolving large dependency trees. (<code>[#13843](pypa/pip#13843) <https://github.com/pypa/pip/issues/13843></code>_)</li> <li>Emit a deprecation warning when pip imports an unexpected module after installation of a distribution has started. (<code>[#13912](pypa/pip#13912) <https://github.com/pypa/pip/issues/13912></code>_)</li> <li>Allow URL constraints to apply to requirements with extras. (<code>[aio-libs#12018](pypa/pip#12018) <https://github.com/pypa/pip/issues/12018></code>_)</li> <li>Allow unpinned requirements to use hashes from constraints. Constraints like <code>{name}=={version} --hash=...</code> feeds into hash verification for a corresponding requirement. (<code>[aio-libs#9243](pypa/pip#9243) <https://github.com/pypa/pip/issues/9243></code>_)</li> <li>Improve conflict reports that involve direct URLs. (<code>[#13932](pypa/pip#13932) <https://github.com/pypa/pip/issues/13932></code>_)</li> <li>Show all errors instead of first error for faulty <code>dependency_groups</code> definitions. (<code>[#13917](pypa/pip#13917) <https://github.com/pypa/pip/issues/13917></code>_)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Fix recovery hint for missing RECORD file to use <code>--ignore-installed</code> instead of <code>--force-reinstall</code>. (<code>[aio-libs#12645](pypa/pip#12645) <https://github.com/pypa/pip/issues/12645></code>_)</li> <li>Fix misleading error message when a constraint file cannot be opened. (<code>[aio-libs#13226](pypa/pip#13226) <https://github.com/pypa/pip/issues/13226></code>_)</li> <li>Show the filename rather than the full URL when downloading files from non-PyPI indexes in non-verbose mode. (<code>[aio-libs#13494](pypa/pip#13494) <https://github.com/pypa/pip/issues/13494></code>_)</li> <li>Remove the adjacent <code>__pycache__</code> directory when a .py file is removed. (<code>[#13725](pypa/pip#13725) <https://github.com/pypa/pip/issues/13725></code>_)</li> <li>Force UTF-8 encoding for :pep:<code>723</code> metadata. (<code>[#13861](pypa/pip#13861) <https://github.com/pypa/pip/issues/13861></code>_)</li> <li>Minor performance improvement when filtering candidates during resolution. (<code>[#13916](pypa/pip#13916) <https://github.com/pypa/pip/issues/13916></code>_)</li> <li>Fix a hang on Windows when stdout is closed during verbose output. (<code>[#13927](pypa/pip#13927) <https://github.com/pypa/pip/issues/13927></code>_)</li> <li>Common path prefixes are determined by path segment, not character by character. (<code>[#13847](pypa/pip#13847) <https://github.com/pypa/pip/issues/13847></code>_)</li> <li>Fix installing <code>.tar.gz</code> source distributions that look like a zip file. (<code>[#13867](pypa/pip#13867) <https://github.com/pypa/pip/issues/13867></code>_)</li> </ul> <h2>Vendored Libraries</h2> <ul> <li>Upgrade certifi to 2026.2.25</li> <li>Upgrade packaging to 26.2</li> <li>Upgrade requests to 2.33.1</li> <li>Upgrade tomli to 2.3.1</li> <li>Upgrade urllib3 to 2.6.3</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/pip/commit/90b2b3e0f7ef75c485155716d904e51654575803"><code>90b2b3e</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/193f289a6201f801b23885297332461ac8a65b6b"><code>193f289</code></a> Update AUTHORS.txt</li> <li><a href="https://github.com/pypa/pip/commit/63c3709071c9596d7f4676502a90a3b06f241772"><code>63c3709</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13876">#13876</a> from sbidoul/install-from-pylock-reqs-sbi</li> <li><a href="https://github.com/pypa/pip/commit/e5fe7023ffe74a5895571eaf57bdd2989018fbf2"><code>e5fe702</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13949">#13949</a> from pypa/revert-13888-resolver-editable-links</li> <li><a href="https://github.com/pypa/pip/commit/122a14a8cd3dae7b3e959641f0b45849d4b21618"><code>122a14a</code></a> Revert "Allow editable installs to satisfy direct-URL dependencies (<a href="https://redirect.github.com/pypa/pip/issues/13888">#13888</a>)"</li> <li><a href="https://github.com/pypa/pip/commit/c3352524aae95ae959d4727dda5b5c65752261b3"><code>c335252</code></a> -r pylock.toml: add pip-wheel -r pylock.toml test</li> <li><a href="https://github.com/pypa/pip/commit/ba2fc12b7f386d89e233bdfd49e7b89d1af57ad1"><code>ba2fc12</code></a> -r pylock.toml: proper error with remote pylock.toml containing directory ent...</li> <li><a href="https://github.com/pypa/pip/commit/747c4ae88837a8bb13946fe9d1b612c162a2e3df"><code>747c4ae</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13948">#13948</a> from ichard26/reword-news</li> <li><a href="https://github.com/pypa/pip/commit/3517841c5e2d92e04dbef52c61a8fa967c059efa"><code>3517841</code></a> -r pylock: refine filename pylock-ness test</li> <li><a href="https://github.com/pypa/pip/commit/2f7ad8caeed4471e63958df6cacba3a66a215588"><code>2f7ad8c</code></a> -r pylock.toml: fix crash with pip wheel and pip lock</li> <li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/26.0.1...26.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
bagowix
pushed a commit
to bagowix/aiohttp
that referenced
this pull request
Aug 6, 2026
Bumps [pip](https://github.com/pypa/pip) from 26.0.1 to 26.1.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p> <blockquote> <h1>26.1.1 (2026-05-04)</h1> <h2>Bug Fixes</h2> <ul> <li>Fix issue where uninstallation left behind empty directories. Revert the removal of the adjacent <code>__pycache__</code> directory when a .py file is removed. (<code>[#13973](pypa/pip#13973) <https://github.com/pypa/pip/issues/13973></code>_)</li> </ul> <h1>26.1 (2026-04-26)</h1> <h2>Deprecations and Removals</h2> <ul> <li>Drop support for Python 3.9. (<code>[#13795](pypa/pip#13795) <https://github.com/pypa/pip/issues/13795></code>_)</li> </ul> <h2>Features</h2> <ul> <li>Add experimental support to read requirements from standardized pylock.toml files (<code>-r pylock.toml</code>). (<code>[#13876](pypa/pip#13876) <https://github.com/pypa/pip/issues/13876></code>_)</li> <li>Allow <code>--uploaded-prior-to</code> to accept a duration in days (e.g., <code>P3D</code> for 3 days ago). (<code>[#13674](pypa/pip#13674) <https://github.com/pypa/pip/issues/13674></code>_)</li> </ul> <h2>Enhancements</h2> <ul> <li>Speed up dependency resolution when there are complex conflicts. (<code>[#13859](pypa/pip#13859) <https://github.com/pypa/pip/issues/13859></code>_)</li> <li>Reduce memory usage when resolving large dependency trees. (<code>[#13843](pypa/pip#13843) <https://github.com/pypa/pip/issues/13843></code>_)</li> <li>Emit a deprecation warning when pip imports an unexpected module after installation of a distribution has started. (<code>[#13912](pypa/pip#13912) <https://github.com/pypa/pip/issues/13912></code>_)</li> <li>Allow URL constraints to apply to requirements with extras. (<code>[aio-libs#12018](pypa/pip#12018) <https://github.com/pypa/pip/issues/12018></code>_)</li> <li>Allow unpinned requirements to use hashes from constraints. Constraints like <code>{name}=={version} --hash=...</code> feeds into hash verification for a corresponding requirement. (<code>[aio-libs#9243](pypa/pip#9243) <https://github.com/pypa/pip/issues/9243></code>_)</li> <li>Improve conflict reports that involve direct URLs. (<code>[#13932](pypa/pip#13932) <https://github.com/pypa/pip/issues/13932></code>_)</li> <li>Show all errors instead of first error for faulty <code>dependency_groups</code> definitions. (<code>[#13917](pypa/pip#13917) <https://github.com/pypa/pip/issues/13917></code>_)</li> </ul> <h2>Bug Fixes</h2> <ul> <li>Fix recovery hint for missing RECORD file to use <code>--ignore-installed</code> instead of <code>--force-reinstall</code>. (<code>[aio-libs#12645](pypa/pip#12645) <https://github.com/pypa/pip/issues/12645></code>_)</li> <li>Fix misleading error message when a constraint file cannot be opened. (<code>[aio-libs#13226](pypa/pip#13226) <https://github.com/pypa/pip/issues/13226></code>_)</li> <li>Show the filename rather than the full URL when downloading files from non-PyPI indexes in non-verbose mode. (<code>[aio-libs#13494](pypa/pip#13494) <https://github.com/pypa/pip/issues/13494></code>_)</li> <li>Remove the adjacent <code>__pycache__</code> directory when a .py file is removed. (<code>[#13725](pypa/pip#13725) <https://github.com/pypa/pip/issues/13725></code>_)</li> <li>Force UTF-8 encoding for :pep:<code>723</code> metadata. (<code>[#13861](pypa/pip#13861) <https://github.com/pypa/pip/issues/13861></code>_)</li> <li>Minor performance improvement when filtering candidates during resolution. (<code>[#13916](pypa/pip#13916) <https://github.com/pypa/pip/issues/13916></code>_)</li> <li>Fix a hang on Windows when stdout is closed during verbose output. (<code>[#13927](pypa/pip#13927) <https://github.com/pypa/pip/issues/13927></code>_)</li> <li>Common path prefixes are determined by path segment, not character by character. (<code>[#13847](pypa/pip#13847) <https://github.com/pypa/pip/issues/13847></code>_)</li> <li>Fix installing <code>.tar.gz</code> source distributions that look like a zip file. (<code>[#13867](pypa/pip#13867) <https://github.com/pypa/pip/issues/13867></code>_)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/pip/commit/4432a371c6471e6a93c3eb39b3e9ab2b876b13b9"><code>4432a37</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/4943e17e7dd079b3f58e88009d10308f2c55a3ed"><code>4943e17</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13973">#13973</a> from pypa/revert-13725-vfazio-remove-all-optimizati...</li> <li><a href="https://github.com/pypa/pip/commit/e9e7b90f35bfcd3c9e4ff93e0f0cc1b90f59aa68"><code>e9e7b90</code></a> Add news</li> <li><a href="https://github.com/pypa/pip/commit/0ff696479aa07ea5ca78b08d205ae23854b6e0e8"><code>0ff6964</code></a> Revert "Remove <strong>pycache</strong> when package is removed"</li> <li><a href="https://github.com/pypa/pip/commit/cc6b082d6b9350d96c5a24337b12b7a42846c410"><code>cc6b082</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13951">#13951</a> from sbidoul/release/26.1</li> <li><a href="https://github.com/pypa/pip/commit/b2671f1cb340f33db300f0bffc062402bce3eca0"><code>b2671f1</code></a> Bump for development</li> <li><a href="https://github.com/pypa/pip/commit/90b2b3e0f7ef75c485155716d904e51654575803"><code>90b2b3e</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/193f289a6201f801b23885297332461ac8a65b6b"><code>193f289</code></a> Update AUTHORS.txt</li> <li><a href="https://github.com/pypa/pip/commit/63c3709071c9596d7f4676502a90a3b06f241772"><code>63c3709</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13876">#13876</a> from sbidoul/install-from-pylock-reqs-sbi</li> <li><a href="https://github.com/pypa/pip/commit/e5fe7023ffe74a5895571eaf57bdd2989018fbf2"><code>e5fe702</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13949">#13949</a> from pypa/revert-13888-resolver-editable-links</li> <li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/26.0.1...26.1.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
alexolivier
pushed a commit
to cerbos/query-plan-adapters
that referenced
this pull request
Aug 7, 2026
This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [actions/setup-java](https://redirect.github.com/actions/setup-java) | action | minor | `v5.6.0` → `v5.7.0` |  |  | | [convex](https://convex.dev) ([source](https://redirect.github.com/get-convex/convex-backend/tree/HEAD/npm-packages/convex)) | devDependencies | minor | [`1.42.3` → `1.43.0`](https://renovatebot.com/diffs/npm/convex/1.42.3/1.43.0) |  |  | | [github.com/testcontainers/testcontainers-go](https://redirect.github.com/testcontainers/testcontainers-go) | require | minor | `v0.43.0` → `v0.44.0` |  |  | | [github.com/testcontainers/testcontainers-go/modules/mysql](https://redirect.github.com/testcontainers/testcontainers-go) | require | minor | `v0.43.0` → `v0.44.0` |  |  | | [github.com/testcontainers/testcontainers-go/modules/postgres](https://redirect.github.com/testcontainers/testcontainers-go) | require | minor | `v0.43.0` → `v0.44.0` |  |  | | [gradle/actions](https://redirect.github.com/gradle/actions) | action | minor | `v6.2.0` → `v6.3.0` |  |  | | [mongoose](https://mongoosejs.com) ([source](https://redirect.github.com/Automattic/mongoose)) | devDependencies | minor | [`9.8.1` → `9.9.1`](https://renovatebot.com/diffs/npm/mongoose/9.8.1/9.9.1) |  |  | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` |  |  | | [start-server-and-test](https://redirect.github.com/bahmutov/start-server-and-test) | devDependencies | patch | [`3.0.11` → `3.0.12`](https://renovatebot.com/diffs/npm/start-server-and-test/3.0.11/3.0.12) |  |  | | [org.hibernate.orm:hibernate-core](https://hibernate.org/orm) ([source](https://redirect.github.com/hibernate/hibernate-orm)) | dependencies | patch | `6.6.54.Final` → `6.6.55.Final` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/15) for more information. --- ### Release Notes <details> <summary>actions/setup-java (actions/setup-java)</summary> ### [`v5.7.0`](https://redirect.github.com/actions/setup-java/compare/v5.6.0...v5.7.0) [Compare Source](https://redirect.github.com/actions/setup-java/compare/v5.6.0...v5.7.0) </details> <details> <summary>get-convex/convex-backend (convex)</summary> ### [`v1.43.0`](https://redirect.github.com/get-convex/convex-backend/blob/HEAD/npm-packages/convex/CHANGELOG.md#1430) - Added new `npx convex deployment usage` and `npx convex deployment usage-limits` CLI commands to view a deployment’s current resource usage, and view or edit deployment usage limits. - When defining hourly cron jobs, you can now omit the `minuteUTC` parameter. When omitted, Convex will automatically choose a stable start time within the scheduled hour, avoiding concentrating jobs at the top of the hour. - Mutations can now reference their upcoming [commit timestamp](https://docs.convex.dev/database/advanced/commit-timestamp) with `ctx.db.vars.commitTs`. While the mutation is running, `ctx.db.vars.commitTs` is a placeholder symbol that is replaced with a Int64 value at commit time that is guaranteed to strictly follow commit order, unlike the `_creationTime` system field. This low-level primitive is helpful for advanced use cases such as implementing efficient FIFO queues. - Added a new `v.commitTs()` validator that accepts either the upcoming commit timestamp placeholder, or a Int64 commit timestamp. - The Convex CLI is now able to find the right TypeScript compiler when using side-by-side TypeScript 6 and 7 installation. (This setup is used in codebases that want to use the native TypeScript 7 compiler but still need access to the TypeScript compiler JavaScript API.) - Deprecated the `typescriptCompiler` parameter in `convex.json`. This parameter was only necessary when using the TypeScript Native Preview ([@​typescript/native-preview](https://redirect.github.com/typescript/native-preview)). With TypeScript 7, Convex automatically picks the right binary. - When a component only uses environment variables that are all optional, it’s now possible to omit the `env` argument from `app.use(component, { … })`. - Fixed a bug where `app.use()` failed to require a second argument when a component has required environment variables (e.g. `app.use(component, { env: { REQUIRED_VAR: "value" } })`). - Fixed a bug in `usePaginatedQuery_experimental` where page splits were handled incorrectly. </details> <details> <summary>testcontainers/testcontainers-go (github.com/testcontainers/testcontainers-go)</summary> ### [`v0.44.0`](https://redirect.github.com/testcontainers/testcontainers-go/releases/tag/v0.44.0) [Compare Source](https://redirect.github.com/testcontainers/testcontainers-go/compare/v0.43.0...v0.44.0) ##### What's Changed ##### 🔒 Security - security: fix Dependabot alerts for grpc and OTel ([#​3835](https://redirect.github.com/testcontainers/testcontainers-go/issues/3835)) [@​mdelapenya](https://redirect.github.com/mdelapenya) ##### 🚀 Features - feat: allow overriding the session ID ([#​3051](https://redirect.github.com/testcontainers/testcontainers-go/issues/3051)) [@​jcmfernandes](https://redirect.github.com/jcmfernandes) - feat: add Azure SQL Edge module ([#​3787](https://redirect.github.com/testcontainers/testcontainers-go/issues/3787)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add S3Mock module ([#​3781](https://redirect.github.com/testcontainers/testcontainers-go/issues/3781)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Fake-GCS-Server module ([#​3770](https://redirect.github.com/testcontainers/testcontainers-go/issues/3770)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Typesense module ([#​3786](https://redirect.github.com/testcontainers/testcontainers-go/issues/3786)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Firebird module ([#​3771](https://redirect.github.com/testcontainers/testcontainers-go/issues/3771)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add CouchDB module ([#​3768](https://redirect.github.com/testcontainers/testcontainers-go/issues/3768)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Mosquitto module ([#​3774](https://redirect.github.com/testcontainers/testcontainers-go/issues/3774)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Papercut-SMTP module ([#​3777](https://redirect.github.com/testcontainers/testcontainers-go/issues/3777)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Timeplus module ([#​3784](https://redirect.github.com/testcontainers/testcontainers-go/issues/3784)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Solr module ([#​3783](https://redirect.github.com/testcontainers/testcontainers-go/issues/3783)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add SFTP module ([#​3782](https://redirect.github.com/testcontainers/testcontainers-go/issues/3782)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add RavenDB module ([#​3780](https://redirect.github.com/testcontainers/testcontainers-go/issues/3780)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add QuestDB module ([#​3779](https://redirect.github.com/testcontainers/testcontainers-go/issues/3779)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Presto module ([#​3778](https://redirect.github.com/testcontainers/testcontainers-go/issues/3778)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add OrientDB module ([#​3776](https://redirect.github.com/testcontainers/testcontainers-go/issues/3776)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Nginx module ([#​3775](https://redirect.github.com/testcontainers/testcontainers-go/issues/3775)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Mailpit module ([#​3773](https://redirect.github.com/testcontainers/testcontainers-go/issues/3773)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add Trino module ([#​3785](https://redirect.github.com/testcontainers/testcontainers-go/issues/3785)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add KurrentDB module ([#​3772](https://redirect.github.com/testcontainers/testcontainers-go/issues/3772)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add CrateDB module ([#​3769](https://redirect.github.com/testcontainers/testcontainers-go/issues/3769)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add ActiveMQ Classic module ([#​3767](https://redirect.github.com/testcontainers/testcontainers-go/issues/3767)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - feat: add ability to chain WithConfigModifier, WithEndpointSettingsModifier and WithHostConfigModifier ([#​3733](https://redirect.github.com/testcontainers/testcontainers-go/issues/3733)) [@​LaurentGoderre](https://redirect.github.com/LaurentGoderre) ##### 🐛 Bug Fixes - fix: escape the container name in the Docker name filter ([#​3837](https://redirect.github.com/testcontainers/testcontainers-go/issues/3837)) [@​jcmfernandes](https://redirect.github.com/jcmfernandes) - fix: should print max information by default ([#​3459](https://redirect.github.com/testcontainers/testcontainers-go/issues/3459)) [@​strowk](https://redirect.github.com/strowk) - fix: read exec exit code only after draining the output stream ([#​3766](https://redirect.github.com/testcontainers/testcontainers-go/issues/3766)) [@​dean-island](https://redirect.github.com/dean-island) - fix: properly wait for Ryuk startup when reusing reaper ([#​3761](https://redirect.github.com/testcontainers/testcontainers-go/issues/3761)) [@​karsov](https://redirect.github.com/karsov) - fix(openfga): remove playground wait from Run and up image to v1.18.0 ([#​3745](https://redirect.github.com/testcontainers/testcontainers-go/issues/3745)) [@​selvakannanjr](https://redirect.github.com/selvakannanjr) ##### 📖 Documentation - docs: fix incomplete CleanupContainer documentation ([#​3826](https://redirect.github.com/testcontainers/testcontainers-go/issues/3826)) [@​Hashim1999164](https://redirect.github.com/Hashim1999164) - docs: fix typo in SkipIfProviderIsNotHealthy docstring ([#​3764](https://redirect.github.com/testcontainers/testcontainers-go/issues/3764)) [@​salandered](https://redirect.github.com/salandered) - chore: update modules usage metrics (2026-07) ([#​3759](https://redirect.github.com/testcontainers/testcontainers-go/issues/3759)) @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) - chore: update usage metrics (2026-07) ([#​3757](https://redirect.github.com/testcontainers/testcontainers-go/issues/3757)) @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) - chore(metrics): usage metrics for modules ([#​3737](https://redirect.github.com/testcontainers/testcontainers-go/issues/3737)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - docs(site): add missing languages and reorder docs navigation ([#​3735](https://redirect.github.com/testcontainers/testcontainers-go/issues/3735)) [@​mdelapenya](https://redirect.github.com/mdelapenya) ##### 🧹 Housekeeping - chore: update usage metrics (2026-08) ([#​3830](https://redirect.github.com/testcontainers/testcontainers-go/issues/3830)) @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) - chore: update modules usage metrics (2026-08) ([#​3831](https://redirect.github.com/testcontainers/testcontainers-go/issues/3831)) @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) - fix: correct indentation in dependabot.yml ([#​3808](https://redirect.github.com/testcontainers/testcontainers-go/issues/3808)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - chore(compose): use require instead of assert for service name checks ([#​3765](https://redirect.github.com/testcontainers/testcontainers-go/issues/3765)) [@​sunghyun1999](https://redirect.github.com/sunghyun1999) - chore: update usage metrics (2026-07) ([#​3757](https://redirect.github.com/testcontainers/testcontainers-go/issues/3757)) @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) - chore(wait): replace manual StrategyTarget mocks with generated mockery mocks ([#​3603](https://redirect.github.com/testcontainers/testcontainers-go/issues/3603)) [@​mateenali66](https://redirect.github.com/mateenali66) - chore: use testify's require instead of assert ([#​3740](https://redirect.github.com/testcontainers/testcontainers-go/issues/3740)) [@​TheRodzz](https://redirect.github.com/TheRodzz) - fix(metrics): harden collect.go and modules workflow ([#​3738](https://redirect.github.com/testcontainers/testcontainers-go/issues/3738)) [@​mdelapenya](https://redirect.github.com/mdelapenya) ##### 📦 Dependency updates - chore(deps): bump slackapi/slack-github-action from 3.0.3 to 4.0.0 ([#​3788](https://redirect.github.com/testcontainers/testcontainers-go/issues/3788)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 ([#​3789](https://redirect.github.com/testcontainers/testcontainers-go/issues/3789)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump docker/setup-docker-action from 5.1.0 to 5.4.0 ([#​3790](https://redirect.github.com/testcontainers/testcontainers-go/issues/3790)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(azurite): tidy module dependencies ([#​3838](https://redirect.github.com/testcontainers/testcontainers-go/issues/3838)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - security: fix Dependabot alerts for grpc and OTel ([#​3835](https://redirect.github.com/testcontainers/testcontainers-go/issues/3835)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1.6.0 to 1.8.0 in /modules/azure ([#​3805](https://redirect.github.com/testcontainers/testcontainers-go/issues/3805)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets from 1.4.0 to 1.5.0 in /modules/azure ([#​3806](https://redirect.github.com/testcontainers/testcontainers-go/issues/3806)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /modules/weaviate ([#​3820](https://redirect.github.com/testcontainers/testcontainers-go/issues/3820)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /modules/qdrant ([#​3821](https://redirect.github.com/testcontainers/testcontainers-go/issues/3821)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 in /modules/grafana-lgtm ([#​3822](https://redirect.github.com/testcontainers/testcontainers-go/issues/3822)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.82.1 in /modules/gcloud ([#​3823](https://redirect.github.com/testcontainers/testcontainers-go/issues/3823)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /modules/compose ([#​3824](https://redirect.github.com/testcontainers/testcontainers-go/issues/3824)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore: propagate azcore dependency update to azurite module ([#​3818](https://redirect.github.com/testcontainers/testcontainers-go/issues/3818)) [@​mdelapenya](https://redirect.github.com/mdelapenya) - chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.21.1 to 1.22.0 in /modules/azure ([#​3809](https://redirect.github.com/testcontainers/testcontainers-go/issues/3809)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 ([#​3791](https://redirect.github.com/testcontainers/testcontainers-go/issues/3791)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.5 to 4.26.6 ([#​3750](https://redirect.github.com/testcontainers/testcontainers-go/issues/3750)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/data/azcosmos from 1.4.1 to 1.5.0 in /modules/azure ([#​3810](https://redirect.github.com/testcontainers/testcontainers-go/issues/3810)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.17.5 to 1.19.29 in /modules/localstack ([#​3812](https://redirect.github.com/testcontainers/testcontainers-go/issues/3812)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.28 to 1.19.29 in /modules/s3mock ([#​3813](https://redirect.github.com/testcontainers/testcontainers-go/issues/3813)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.17.46 to 1.19.29 in /modules/scylladb ([#​3814](https://redirect.github.com/testcontainers/testcontainers-go/issues/3814)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 in /modules/azure ([#​3811](https://redirect.github.com/testcontainers/testcontainers-go/issues/3811)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 in /modules/azure ([#​3794](https://redirect.github.com/testcontainers/testcontainers-go/issues/3794)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump github.com/go-stomp/stomp/v3 from 3.0.5 to 3.1.5 in /modules/artemis ([#​3801](https://redirect.github.com/testcontainers/testcontainers-go/issues/3801)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 in /modules/azure ([#​3803](https://redirect.github.com/testcontainers/testcontainers-go/issues/3803)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump software.sslmate.com/src/go-pkcs12 from 0.6.0 to 0.7.3 in /modules/cassandra ([#​3804](https://redirect.github.com/testcontainers/testcontainers-go/issues/3804)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 in /modules/elasticsearch ([#​3796](https://redirect.github.com/testcontainers/testcontainers-go/issues/3796)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 in /modules/kafka ([#​3797](https://redirect.github.com/testcontainers/testcontainers-go/issues/3797)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump github.com/arangodb/go-driver/v2 from 2.1.3 to 2.3.1 in /modules/arangodb ([#​3800](https://redirect.github.com/testcontainers/testcontainers-go/issues/3800)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.54.0 in /modules/dex ([#​3795](https://redirect.github.com/testcontainers/testcontainers-go/issues/3795)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump github.com/aerospike/aerospike-client-go/v8 from 8.6.0 to 8.7.0 in /modules/aerospike ([#​3799](https://redirect.github.com/testcontainers/testcontainers-go/issues/3799)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /modules/dex ([#​3763](https://redirect.github.com/testcontainers/testcontainers-go/issues/3763)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 in /modules/dex ([#​3758](https://redirect.github.com/testcontainers/testcontainers-go/issues/3758)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 in /modulegen ([#​3751](https://redirect.github.com/testcontainers/testcontainers-go/issues/3751)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/mod from 0.33.0 to 0.37.0 in /modules/redpanda ([#​3756](https://redirect.github.com/testcontainers/testcontainers-go/issues/3756)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golangci/golangci-lint-action from 7.0.0 to 9.3.0 ([#​3748](https://redirect.github.com/testcontainers/testcontainers-go/issues/3748)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump tj-actions/changed-files from 47.0.1 to 47.0.6 ([#​3746](https://redirect.github.com/testcontainers/testcontainers-go/issues/3746)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump SonarSource/sonarqube-scan-action from 5.1.0 to 8.2.0 ([#​3747](https://redirect.github.com/testcontainers/testcontainers-go/issues/3747)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0 ([#​3749](https://redirect.github.com/testcontainers/testcontainers-go/issues/3749)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/text from 0.34.0 to 0.38.0 in /modulegen ([#​3752](https://redirect.github.com/testcontainers/testcontainers-go/issues/3752)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/mod from 0.33.0 to 0.37.0 in /modules/elasticsearch ([#​3753](https://redirect.github.com/testcontainers/testcontainers-go/issues/3753)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/mod from 0.33.0 to 0.37.0 in /modules/kafka ([#​3754](https://redirect.github.com/testcontainers/testcontainers-go/issues/3754)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump golang.org/x/mod from 0.33.0 to 0.37.0 in /modules/localstack ([#​3755](https://redirect.github.com/testcontainers/testcontainers-go/issues/3755)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump actions/github-script from 7.0.1 to 9.0.0 ([#​3675](https://redirect.github.com/testcontainers/testcontainers-go/issues/3675)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump pymdown-extensions from 10.16.1 to 10.21.3 ([#​3707](https://redirect.github.com/testcontainers/testcontainers-go/issues/3707)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump go.mongodb.org/mongo-driver/v2 from 2.3.0 to 2.4.2 in /modules/mongodb ([#​3730](https://redirect.github.com/testcontainers/testcontainers-go/issues/3730)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): bump go.mongodb.org/mongo-driver from 1.14.0 to 1.17.7 in /modules/weaviate ([#​3731](https://redirect.github.com/testcontainers/testcontainers-go/issues/3731)) @​[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) - chore(deps): update moby to latest version ([#​3736](https://redirect.github.com/testcontainers/testcontainers-go/issues/3736)) [@​Steven-Harris](https://redirect.github.com/Steven-Harris) </details> <details> <summary>gradle/actions (gradle/actions)</summary> ### [`v6.3.0`](https://redirect.github.com/gradle/actions/releases/tag/v6.3.0) [Compare Source](https://redirect.github.com/gradle/actions/compare/v6.2.0...v6.3.0) #### Highlights ##### Enhanced Caching: Windows fixes and a cache-protocol bump This release updates `gradle-actions-caching` to **v1.0.0** (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows: - **Cache entries failed to store at all on Windows.**. Every entry failed with `Path Validation Error: Path(s) specified in the action for caching do(es) not exist`, even though the Gradle User Home was fully intact. Nothing was stored, so every downstream job ran against an empty Gradle User Home. The cause was a nested, unpatched copy of `@actions/glob` combined with a silently swallowed `require()` in the bundle, which left Windows path separators unnormalized. - **Cache cleanup deleted instrumented jars that were in use.** A bug in key hashing for paths shorter than 64 characters made cleanup judge freshly created `caches/jars-9` entries as unused and remove them, so the `instrumented-jars` entry was never saved and every job re-instrumented its classpaths. Also included: cache entry names are now consistent between the save and restore reports — restore previously fell back to showing the raw glob pattern (e.g. `/home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/`) instead of `dependencies`. > \[!IMPORTANT] > **Existing cache entries are invalidated by this release.** The cache protocol > version was bumped to `v2`, so the first run after upgrading will be a cache miss > and will repopulate the cache. No configuration changes are required. ##### Basic caching warns instead of failing silently The basic (open-source) caching provider now emits a warning and reports `(Entry not saved: save failed)` in the Job Summary when a cache save fails, rather than reporting success ([#​1028](https://redirect.github.com/gradle/actions/issues/1028)). ##### Dependency submission works with Isolated Projects `dependency-submission` now disables Isolated Projects via a promoted property, so dependency graph generation works on builds that enable it ([#​1025](https://redirect.github.com/gradle/actions/issues/1025)). Thanks to [@​reinsch82](https://redirect.github.com/reinsch82) for the contribution. ##### Updated defaults - Injected Develocity Gradle plugin: **4.4.2 → 4.5.0** - 36 new known-good wrapper checksums added for `wrapper-validation` #### What's Changed - Render configuration-cache status in the caching Job Summary by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​989](https://redirect.github.com/gradle/actions/pull/989) - Update gradle-actions-caching library to v0.8.0 by [@​bot-githubaction](https://redirect.github.com/bot-githubaction) in [#​993](https://redirect.github.com/gradle/actions/pull/993) - Support experimental project-entry caching (configuration-cache + build-logic) by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​994](https://redirect.github.com/gradle/actions/pull/994) - Update gradle-actions-caching library to v0.9.0 by [@​bot-githubaction](https://redirect.github.com/bot-githubaction) in [#​996](https://redirect.github.com/gradle/actions/pull/996) - Disable Isolated Projects via promoted property in dependency-submission by [@​reinsch82](https://redirect.github.com/reinsch82) in [#​1025](https://redirect.github.com/gradle/actions/pull/1025) - Add Windows coverage for caching via a new smoke-test suite by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1027](https://redirect.github.com/gradle/actions/pull/1027) - Fix basic caching smoke test on Windows, and warn on save failure by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1028](https://redirect.github.com/gradle/actions/pull/1028) - Move non-smoke restore-gradle-home tests back to the integ-test suite by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1032](https://redirect.github.com/gradle/actions/pull/1032) - Bump npm-dependencies group with TypeScript 6.0.3, [@​types/node](https://redirect.github.com/types/node) 24.x, and security fixes by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1033](https://redirect.github.com/gradle/actions/pull/1033) - Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5.0 by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1034](https://redirect.github.com/gradle/actions/pull/1034) - Update gradle-actions-caching library to v1.0.0 by [@​bot-githubaction](https://redirect.github.com/bot-githubaction) in [#​1029](https://redirect.github.com/gradle/actions/pull/1029) - Bump the npm-dependencies group across 1 directory with 2 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1037](https://redirect.github.com/gradle/actions/pull/1037) - Bump the github-actions group across 2 directories with 9 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1024](https://redirect.github.com/gradle/actions/pull/1024) #### New Contributors - [@​reinsch82](https://redirect.github.com/reinsch82) made their first contribution in [#​1025](https://redirect.github.com/gradle/actions/pull/1025) **Full Changelog**: <gradle/actions@v6.2.0...v6.3.0> </details> <details> <summary>Automattic/mongoose (mongoose)</summary> ### [`v9.9.1`](https://redirect.github.com/Automattic/mongoose/blob/HEAD/CHANGELOG.md#991--2026-07-31) [Compare Source](https://redirect.github.com/Automattic/mongoose/compare/9.9.0...9.9.1) \================== - fix(query): avoid path collision when excluding subdocuments with nested `select: false` paths [#​12798](https://redirect.github.com/Automattic/mongoose/issues/12798) [BIGSUS24](https://redirect.github.com/BIGSUS24) - types(model): apply schema-level lean to find() [#​16413](https://redirect.github.com/Automattic/mongoose/issues/16413) - types(model): support overriding schema-level `lean` with `lean: false` [#​16413](https://redirect.github.com/Automattic/mongoose/issues/16413) ### [`v9.9.0`](https://redirect.github.com/Automattic/mongoose/blob/HEAD/CHANGELOG.md#990--2026-07-30) [Compare Source](https://redirect.github.com/Automattic/mongoose/compare/9.8.1...9.9.0) \================== - perf(document): improve toObject perf with faster string checks and avoiding unnecessary isSelected on paths with no getters [#​16407](https://redirect.github.com/Automattic/mongoose/issues/16407) [#​16373](https://redirect.github.com/Automattic/mongoose/issues/16373) [#​16385](https://redirect.github.com/Automattic/mongoose/issues/16385) - perf(model): improve insertMany() performance and general change tracking performance [#​16370](https://redirect.github.com/Automattic/mongoose/issues/16370) - perf(timestamps): avoid adding $setOnInsert for createdAt unless upsert set [#​16411](https://redirect.github.com/Automattic/mongoose/issues/16411) - perf: improve toObject() performance [#​16408](https://redirect.github.com/Automattic/mongoose/issues/16408) [#​16405](https://redirect.github.com/Automattic/mongoose/issues/16405) [#​16378](https://redirect.github.com/Automattic/mongoose/issues/16378) [#​14394](https://redirect.github.com/Automattic/mongoose/issues/14394) [BIGSUS24](https://redirect.github.com/BIGSUS24) - types: add discriminator key to each member of embedded discriminator enum- [#​16412](https://redirect.github.com/Automattic/mongoose/issues/16412) [#​16045](https://redirect.github.com/Automattic/mongoose/issues/16045) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>bahmutov/start-server-and-test (start-server-and-test)</summary> ### [`v3.0.12`](https://redirect.github.com/bahmutov/start-server-and-test/releases/tag/v3.0.12) [Compare Source](https://redirect.github.com/bahmutov/start-server-and-test/compare/v3.0.11...v3.0.12) ##### Bug Fixes - **deps:** update dependency wait-on to v9.1.0 ([#​518](https://redirect.github.com/bahmutov/start-server-and-test/issues/518)) ([61074e6](https://redirect.github.com/bahmutov/start-server-and-test/commit/61074e6662228e579190cf40087c802f252dccfe)) </details> <details> <summary>hibernate/hibernate-orm (org.hibernate.orm:hibernate-core)</summary> ### [`v6.6.55.Final`](https://redirect.github.com/hibernate/hibernate-orm/compare/6.6.54...6.6.55) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - "after 9am and before 5pm Monday" 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cerbos/query-plan-adapters). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/qusat
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.44` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/qusat). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-software/amazon-braket-qdmi-device
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [munich-quantum-toolkit/workflows](https://redirect.github.com/munich-quantum-toolkit/workflows) | action | patch | `v2.2.1` → `v2.2.2` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>munich-quantum-toolkit/workflows (munich-quantum-toolkit/workflows)</summary> ### [`v2.2.2`](https://redirect.github.com/munich-quantum-toolkit/workflows/releases/tag/v2.2.2): MQT Reusable Workflows 2.2.2 Release [Compare Source](https://redirect.github.com/munich-quantum-toolkit/workflows/compare/v2.2.1...v2.2.2) #### 👀 What Changed *Please refer to the [changelog](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/CHANGELOG.md) and the [upgrade guide](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/UPGRADING.md) for a structured overview of the changes.* #### 📄 Documentation - 🔖 Prepare release of `v2.2.2` ([#​431](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/431)) (**[@​denialhaag](https://redirect.github.com/denialhaag)**) - 📝 Document cibuildwheel v4 migration cleanup ([#​424](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/424)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) #### ⬆️ Dependencies <details> <summary>6 changes</summary> - ⬆️🩹 Update minor stable updates ([#​430](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/430)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​429](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/429)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update release-drafter/release-drafter action to v7.7.0 ([#​428](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/428)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update pre-commit hook rvben/rumdl-pre-commit to v0.2.45 ([#​427](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/427)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​426](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/426)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - 📝 Update templated files to v1.4.2 ([#​425](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/425)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) </details> **Full Changelog**: <munich-quantum-toolkit/workflows@v2.2.1...v2.2.2> </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-software/amazon-braket-qdmi-device). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/scpd
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/scpd). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/ionshuttler
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [munich-quantum-toolkit/workflows](https://redirect.github.com/munich-quantum-toolkit/workflows) | action | patch | `v2.2.1` → `v2.2.2` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>munich-quantum-toolkit/workflows (munich-quantum-toolkit/workflows)</summary> ### [`v2.2.2`](https://redirect.github.com/munich-quantum-toolkit/workflows/releases/tag/v2.2.2): MQT Reusable Workflows 2.2.2 Release [Compare Source](https://redirect.github.com/munich-quantum-toolkit/workflows/compare/v2.2.1...v2.2.2) #### 👀 What Changed *Please refer to the [changelog](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/CHANGELOG.md) and the [upgrade guide](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/UPGRADING.md) for a structured overview of the changes.* #### 📄 Documentation - 🔖 Prepare release of `v2.2.2` ([#​431](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/431)) (**[@​denialhaag](https://redirect.github.com/denialhaag)**) - 📝 Document cibuildwheel v4 migration cleanup ([#​424](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/424)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) #### ⬆️ Dependencies <details> <summary>6 changes</summary> - ⬆️🩹 Update minor stable updates ([#​430](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/430)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​429](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/429)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update release-drafter/release-drafter action to v7.7.0 ([#​428](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/428)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update pre-commit hook rvben/rumdl-pre-commit to v0.2.45 ([#​427](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/427)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​426](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/426)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - 📝 Update templated files to v1.4.2 ([#​425](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/425)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) </details> **Full Changelog**: <munich-quantum-toolkit/workflows@v2.2.1...v2.2.2> </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/ionshuttler). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/qmap
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/qmap). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> --------- Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/qecc
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [munich-quantum-toolkit/workflows](https://redirect.github.com/munich-quantum-toolkit/workflows) | action | patch | `v2.2.1` → `v2.2.2` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>munich-quantum-toolkit/workflows (munich-quantum-toolkit/workflows)</summary> ### [`v2.2.2`](https://redirect.github.com/munich-quantum-toolkit/workflows/releases/tag/v2.2.2): MQT Reusable Workflows 2.2.2 Release [Compare Source](https://redirect.github.com/munich-quantum-toolkit/workflows/compare/v2.2.1...v2.2.2) #### 👀 What Changed *Please refer to the [changelog](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/CHANGELOG.md) and the [upgrade guide](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/UPGRADING.md) for a structured overview of the changes.* #### 📄 Documentation - 🔖 Prepare release of `v2.2.2` ([#​431](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/431)) (**[@​denialhaag](https://redirect.github.com/denialhaag)**) - 📝 Document cibuildwheel v4 migration cleanup ([#​424](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/424)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) #### ⬆️ Dependencies <details> <summary>6 changes</summary> - ⬆️🩹 Update minor stable updates ([#​430](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/430)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​429](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/429)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update release-drafter/release-drafter action to v7.7.0 ([#​428](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/428)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update pre-commit hook rvben/rumdl-pre-commit to v0.2.45 ([#​427](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/427)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​426](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/426)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - 📝 Update templated files to v1.4.2 ([#​425](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/425)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) </details> **Full Changelog**: <munich-quantum-toolkit/workflows@v2.2.1...v2.2.2> </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/qecc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/yaqs
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [munich-quantum-toolkit/workflows](https://redirect.github.com/munich-quantum-toolkit/workflows) | action | patch | `v2.2.1` → `v2.2.2` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>munich-quantum-toolkit/workflows (munich-quantum-toolkit/workflows)</summary> ### [`v2.2.2`](https://redirect.github.com/munich-quantum-toolkit/workflows/releases/tag/v2.2.2): MQT Reusable Workflows 2.2.2 Release [Compare Source](https://redirect.github.com/munich-quantum-toolkit/workflows/compare/v2.2.1...v2.2.2) #### 👀 What Changed *Please refer to the [changelog](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/CHANGELOG.md) and the [upgrade guide](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/UPGRADING.md) for a structured overview of the changes.* #### 📄 Documentation - 🔖 Prepare release of `v2.2.2` ([#​431](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/431)) (**[@​denialhaag](https://redirect.github.com/denialhaag)**) - 📝 Document cibuildwheel v4 migration cleanup ([#​424](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/424)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) #### ⬆️ Dependencies <details> <summary>6 changes</summary> - ⬆️🩹 Update minor stable updates ([#​430](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/430)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​429](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/429)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update release-drafter/release-drafter action to v7.7.0 ([#​428](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/428)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update pre-commit hook rvben/rumdl-pre-commit to v0.2.45 ([#​427](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/427)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​426](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/426)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - 📝 Update templated files to v1.4.2 ([#​425](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/425)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) </details> **Full Changelog**: <munich-quantum-toolkit/workflows@v2.2.1...v2.2.2> </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/yaqs). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/bench
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [munich-quantum-toolkit/workflows](https://redirect.github.com/munich-quantum-toolkit/workflows) | action | patch | `v2.2.1` → `v2.2.2` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>munich-quantum-toolkit/workflows (munich-quantum-toolkit/workflows)</summary> ### [`v2.2.2`](https://redirect.github.com/munich-quantum-toolkit/workflows/releases/tag/v2.2.2): MQT Reusable Workflows 2.2.2 Release [Compare Source](https://redirect.github.com/munich-quantum-toolkit/workflows/compare/v2.2.1...v2.2.2) #### 👀 What Changed *Please refer to the [changelog](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/CHANGELOG.md) and the [upgrade guide](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/UPGRADING.md) for a structured overview of the changes.* #### 📄 Documentation - 🔖 Prepare release of `v2.2.2` ([#​431](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/431)) (**[@​denialhaag](https://redirect.github.com/denialhaag)**) - 📝 Document cibuildwheel v4 migration cleanup ([#​424](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/424)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) #### ⬆️ Dependencies <details> <summary>6 changes</summary> - ⬆️🩹 Update minor stable updates ([#​430](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/430)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​429](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/429)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update release-drafter/release-drafter action to v7.7.0 ([#​428](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/428)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update pre-commit hook rvben/rumdl-pre-commit to v0.2.45 ([#​427](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/427)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​426](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/426)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - 📝 Update templated files to v1.4.2 ([#​425](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/425)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) </details> **Full Changelog**: <munich-quantum-toolkit/workflows@v2.2.1...v2.2.2> </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/bench). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/syrec
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/syrec). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/qcec
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.44` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/qcec). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/ddsim
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/ddsim). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> --------- Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/core-plugins-catalyst
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/core-plugins-catalyst). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/problemsolver
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@types/react](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react)) | [`19.2.17` → `19.2.18`](https://renovatebot.com/diffs/npm/@types%2freact/19.2.17/19.2.18) |  |  | devDependencies | patch | | | [actions/attest](https://redirect.github.com/actions/attest) | `v4.2.0` → `v4.2.1` |  |  | action | patch | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | `v0.16.0` → `v0.16.1` |  |  | repository | patch | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | `v0.0.63` → `v0.0.65` |  |  | repository | patch | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | `2026.07.20` → `2026.07.28` |  |  | repository | patch | `2026.08.05` (+1) | | [munich-quantum-toolkit/workflows](https://redirect.github.com/munich-quantum-toolkit/workflows) | `v2.2.1` → `v2.2.2` |  |  | action | patch | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | `v1.14.1` → `v1.14.2` |  |  | action | patch | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | `v0.2.43` → `v0.2.47` |  |  | repository | patch | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>munich-quantum-toolkit/workflows (munich-quantum-toolkit/workflows)</summary> ### [`v2.2.2`](https://redirect.github.com/munich-quantum-toolkit/workflows/releases/tag/v2.2.2): MQT Reusable Workflows 2.2.2 Release [Compare Source](https://redirect.github.com/munich-quantum-toolkit/workflows/compare/v2.2.1...v2.2.2) #### 👀 What Changed *Please refer to the [changelog](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/CHANGELOG.md) and the [upgrade guide](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/UPGRADING.md) for a structured overview of the changes.* #### 📄 Documentation - 🔖 Prepare release of `v2.2.2` ([#​431](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/431)) (**[@​denialhaag](https://redirect.github.com/denialhaag)**) - 📝 Document cibuildwheel v4 migration cleanup ([#​424](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/424)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) #### ⬆️ Dependencies <details> <summary>6 changes</summary> - ⬆️🩹 Update minor stable updates ([#​430](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/430)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​429](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/429)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update release-drafter/release-drafter action to v7.7.0 ([#​428](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/428)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update pre-commit hook rvben/rumdl-pre-commit to v0.2.45 ([#​427](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/427)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​426](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/426)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - 📝 Update templated files to v1.4.2 ([#​425](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/425)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) </details> **Full Changelog**: <munich-quantum-toolkit/workflows@v2.2.1...v2.2.2> </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/problemsolver). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJqYXZhc2NyaXB0IiwicHJlLWNvbW1pdCJdfQ==--> --------- Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/qudits
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/qudits). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to munich-quantum-toolkit/predictor
that referenced
this pull request
Aug 8, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [munich-quantum-toolkit/workflows](https://redirect.github.com/munich-quantum-toolkit/workflows) | action | patch | `v2.2.1` → `v2.2.2` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.48` | `v0.2.52` (+3) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>munich-quantum-toolkit/workflows (munich-quantum-toolkit/workflows)</summary> ### [`v2.2.2`](https://redirect.github.com/munich-quantum-toolkit/workflows/releases/tag/v2.2.2): MQT Reusable Workflows 2.2.2 Release [Compare Source](https://redirect.github.com/munich-quantum-toolkit/workflows/compare/v2.2.1...v2.2.2) ##### 👀 What Changed *Please refer to the [changelog](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/CHANGELOG.md) and the [upgrade guide](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/UPGRADING.md) for a structured overview of the changes.* ##### 📄 Documentation - 🔖 Prepare release of `v2.2.2` ([#​431](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/431)) (**[@​denialhaag](https://redirect.github.com/denialhaag)**) - 📝 Document cibuildwheel v4 migration cleanup ([#​424](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/424)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) ##### ⬆️ Dependencies <details> <summary>6 changes</summary> - ⬆️🩹 Update minor stable updates ([#​430](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/430)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​429](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/429)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update release-drafter/release-drafter action to v7.7.0 ([#​428](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/428)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update pre-commit hook rvben/rumdl-pre-commit to v0.2.45 ([#​427](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/427)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​426](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/426)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - 📝 Update templated files to v1.4.2 ([#​425](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/425)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) </details> **Full Changelog**: <munich-quantum-toolkit/workflows@v2.2.1...v2.2.2> </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.48`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.48) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.47...v0.2.48) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.48> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/predictor). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
thedevappsecguy
pushed a commit
to thedevappsecguy/skill-scanner
that referenced
this pull request
Aug 9, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | [zizmorcore/zizmor-action](https://redirect.github.com/zizmorcore/zizmor-action) | action | patch | `v0.6.0` → `v0.6.2` | --- ### Release Notes <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>zizmorcore/zizmor-action (zizmorcore/zizmor-action)</summary> ### [`v0.6.2`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.6.2) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.1...v0.6.2) zizmor 1.29.0 is now the default version. ### [`v0.6.1`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.6.1) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.0...v0.6.1) zizmor 1.28.0 is now the default version used by the action. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/thedevappsecguy/skill-scanner). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4xMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
iloveitaly
pushed a commit
to iloveitaly/openapi-python-client
that referenced
this pull request
Aug 10, 2026
…enapi-generators#1476) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | --- ### Release Notes <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/openapi-generators/openapi-python-client). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
charithe
pushed a commit
to cerbos/cerbos-sdk-python
that referenced
this pull request
Aug 10, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | --- ### Release Notes <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cerbos/cerbos-sdk-python). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
ekalra-meltano
pushed a commit
to meltano/meltano
that referenced
this pull request
Aug 10, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) | action | patch | `v5.0.1` → `v5.0.2` | `v5.0.3` | | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | patch | `v4.37.3` → `v4.37.4` | `v4.37.6` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | --- ### Release Notes <details> <summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary> ### [`v5.0.2`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.0.2) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.0.1...v5.0.2) #### What's Changed - feat: add cycle-estimation and exclude-allocations inputs by [@​not-matthias](https://redirect.github.com/not-matthias) in [#​229](https://redirect.github.com/CodSpeedHQ/action/pull/229) **Full Changelog**: <CodSpeedHQ/action@v5.0.1...v5.0.2> </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v4.37.4`](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/meltano/meltano). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
linusschulte
pushed a commit
to linusschulte/ionshuttler
that referenced
this pull request
Aug 10, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/attest](https://redirect.github.com/actions/attest) | action | patch | `v4.2.0` → `v4.2.1` | `v4.2.2` | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | repository | patch | `v0.16.0` → `v0.16.1` | `v0.16.2` | | [astral-sh/ty-pre-commit](https://redirect.github.com/astral-sh/ty-pre-commit) | repository | patch | `v0.0.63` → `v0.0.65` | `v0.0.69` (+3) | | [henryiii/validate-pyproject-schema-store](https://redirect.github.com/henryiii/validate-pyproject-schema-store) | repository | patch | `2026.07.20` → `2026.07.28` | `2026.08.05` (+1) | | [munich-quantum-toolkit/workflows](https://redirect.github.com/munich-quantum-toolkit/workflows) | action | patch | `v2.2.1` → `v2.2.2` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [rvben/rumdl-pre-commit](https://redirect.github.com/rvben/rumdl-pre-commit) | repository | patch | `v0.2.43` → `v0.2.47` | `v0.2.52` (+4) | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/attest (actions/attest)</summary> ### [`v4.2.1`](https://redirect.github.com/actions/attest/releases/tag/v4.2.1) [Compare Source](https://redirect.github.com/actions/attest/compare/v4.2.0...v4.2.1) ##### What's Changed - Bump tar from 7.5.17 to 7.5.21 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​459](https://redirect.github.com/actions/attest/pull/459) - fix: strip OCI image tag when pushing attestation to registry by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​464](https://redirect.github.com/actions/attest/pull/464) **Full Changelog**: <actions/attest@v4.2.0...v4.2.1> </details> <details> <summary>astral-sh/ruff-pre-commit (astral-sh/ruff-pre-commit)</summary> ### [`v0.16.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.1) </details> <details> <summary>astral-sh/ty-pre-commit (astral-sh/ty-pre-commit)</summary> ### [`v0.0.65`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.65) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.64...v0.0.65) See: <https://github.com/astral-sh/ty/releases/tag/0.0.65> ### [`v0.0.64`](https://redirect.github.com/astral-sh/ty-pre-commit/releases/tag/v0.0.64) [Compare Source](https://redirect.github.com/astral-sh/ty-pre-commit/compare/v0.0.63...v0.0.64) See: <https://github.com/astral-sh/ty/releases/tag/0.0.64> </details> <details> <summary>henryiii/validate-pyproject-schema-store (henryiii/validate-pyproject-schema-store)</summary> ### [`v2026.07.28`](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) [Compare Source](https://redirect.github.com/henryiii/validate-pyproject-schema-store/compare/2026.07.20...2026.07.28) </details> <details> <summary>munich-quantum-toolkit/workflows (munich-quantum-toolkit/workflows)</summary> ### [`v2.2.2`](https://redirect.github.com/munich-quantum-toolkit/workflows/releases/tag/v2.2.2): MQT Reusable Workflows 2.2.2 Release [Compare Source](https://redirect.github.com/munich-quantum-toolkit/workflows/compare/v2.2.1...v2.2.2) #### 👀 What Changed *Please refer to the [changelog](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/CHANGELOG.md) and the [upgrade guide](https://redirect.github.com/munich-quantum-toolkit/workflows/blob/main/UPGRADING.md) for a structured overview of the changes.* #### 📄 Documentation - 🔖 Prepare release of `v2.2.2` ([#​431](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/431)) (**[@​denialhaag](https://redirect.github.com/denialhaag)**) - 📝 Document cibuildwheel v4 migration cleanup ([#​424](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/424)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) #### ⬆️ Dependencies <details> <summary>6 changes</summary> - ⬆️🩹 Update minor stable updates ([#​430](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/430)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​429](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/429)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update release-drafter/release-drafter action to v7.7.0 ([#​428](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/428)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update pre-commit hook rvben/rumdl-pre-commit to v0.2.45 ([#​427](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/427)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - ⬆️🩹 Update patch updates ([#​426](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/426)) (**@​[renovate\[bot\]](https://redirect.github.com/apps/renovate)**) - 📝 Update templated files to v1.4.2 ([#​425](https://redirect.github.com/munich-quantum-toolkit/workflows/pull/425)) (**[@​burgholzer](https://redirect.github.com/burgholzer)**) </details> **Full Changelog**: <munich-quantum-toolkit/workflows@v2.2.1...v2.2.2> </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>rvben/rumdl-pre-commit (rvben/rumdl-pre-commit)</summary> ### [`v0.2.47`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.47) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.46...v0.2.47) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.47> ### [`v0.2.46`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.46) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.45...v0.2.46) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.46> ### [`v0.2.45`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.45) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.44...v0.2.45) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.45> ### [`v0.2.44`](https://redirect.github.com/rvben/rumdl-pre-commit/releases/tag/v0.2.44) [Compare Source](https://redirect.github.com/rvben/rumdl-pre-commit/compare/v0.2.43...v0.2.44) See: <https://github.com/rvben/rumdl/releases/tag/v0.2.44> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/ionshuttler). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJwcmUtY29tbWl0Il19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
wgordon17
pushed a commit
to gordon-code/jinja2-git-dir
that referenced
this pull request
Aug 12, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) | action | patch | `v7.0.0` → `v7.0.1` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | | [renovatebot/github-action](https://redirect.github.com/renovatebot/github-action) | action | minor | `v46.1.20` → `v46.2.0` | `v46.2.2` (+1) | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](https://redirect.github.com/actions/checkout/compare/v7...v7.0.1) - Skip running unsafe pr check if input is default by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2518](https://redirect.github.com/actions/checkout/pull/2518) - Trim only ascii whitespace for branch by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2521](https://redirect.github.com/actions/checkout/pull/2521) - Escape values passed to --unset by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2530](https://redirect.github.com/actions/checkout/pull/2530) - Various dependency updates </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> ##### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. ##### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> ##### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>renovatebot/github-action (renovatebot/github-action)</summary> ### [`v46.2.0`](https://redirect.github.com/renovatebot/github-action/releases/tag/v46.2.0) [Compare Source](https://redirect.github.com/renovatebot/github-action/compare/v46.1.21...v46.2.0) ##### Features - **deps:** Update ghcr.io/renovatebot/renovate Docker tag to v44 ([#​1067](https://redirect.github.com/renovatebot/github-action/issues/1067)) ([efa6654](https://redirect.github.com/renovatebot/github-action/commit/efa66542b141f41a69921c360bd114828dede0d3)) ##### Documentation - update references to renovatebot/github-action to v46.1.21 ([66c62f6](https://redirect.github.com/renovatebot/github-action/commit/66c62f63f2c3421614d095425958eedf3cc04d5e)) ##### Miscellaneous Chores - **deps:** update dependency lint-staged to v17.1.1 ([403000c](https://redirect.github.com/renovatebot/github-action/commit/403000c150cbd7d4db2cb878ab66aa42ac6334cb)) - **deps:** update dependency prettier to v3.9.6 ([6787cf2](https://redirect.github.com/renovatebot/github-action/commit/6787cf234f64324b859ccc5e114502d2874c3132)) - **deps:** update dependency typescript-eslint to v8.65.0 ([656e12f](https://redirect.github.com/renovatebot/github-action/commit/656e12f088834d925552fc033316416ff08e0c64)) ##### Continuous Integration - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.283.0 ([560e916](https://redirect.github.com/renovatebot/github-action/commit/560e916d9c7cce71747db50c8a0bcc0afe51a1e0)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.284.0 ([92c373e](https://redirect.github.com/renovatebot/github-action/commit/92c373e9b7513cd0f5df722cb31278ca5ba5ed90)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.284.1 ([b0f9fee](https://redirect.github.com/renovatebot/github-action/commit/b0f9fee8f9e958e395896a25fb03ca676a70d1e2)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.0 ([bfb9d5d](https://redirect.github.com/renovatebot/github-action/commit/bfb9d5d946fb4cdf47c1cdd6ac1c862f594e9682)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.3 ([91ba9dc](https://redirect.github.com/renovatebot/github-action/commit/91ba9dcb5bb72c71271fc26c63091ef4cba219f9)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.4 ([e41061b](https://redirect.github.com/renovatebot/github-action/commit/e41061becfb2ab7ec537b00b7d7551fd58ed22f9)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.6 ([e8a7a1c](https://redirect.github.com/renovatebot/github-action/commit/e8a7a1cf58613503b896d69e0c35d616370b51d3)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.7 ([7a22a55](https://redirect.github.com/renovatebot/github-action/commit/7a22a554ffad16018e2fa2f53d38091ba9178177)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.286.0 ([7590e1e](https://redirect.github.com/renovatebot/github-action/commit/7590e1eb8e006917e8b8a312ab6f6c254bb796fd)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.286.1 ([cae6616](https://redirect.github.com/renovatebot/github-action/commit/cae6616a21e987edd1928b477910d377d07f3c45)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.287.0 ([#​1066](https://redirect.github.com/renovatebot/github-action/issues/1066)) ([4f87158](https://redirect.github.com/renovatebot/github-action/commit/4f871588a5a0fc837cf0be6ffbad04c212656b37)) ### [`v46.1.21`](https://redirect.github.com/renovatebot/github-action/releases/tag/v46.1.21) [Compare Source](https://redirect.github.com/renovatebot/github-action/compare/v46.1.20...v46.1.21) ##### Documentation - mention that `GITHUB_TOKEN` can be used ([#​1064](https://redirect.github.com/renovatebot/github-action/issues/1064)) ([13e8ee8](https://redirect.github.com/renovatebot/github-action/commit/13e8ee89b4e14623621c2cbb1d3728cbb7f66f9e)) - update references to actions/checkout to v6.1.0 ([fab6a17](https://redirect.github.com/renovatebot/github-action/commit/fab6a173e5b2f00c44c8afc066eead098667defe)) - update references to renovatebot/github-action to v46.1.20 ([9296462](https://redirect.github.com/renovatebot/github-action/commit/92964626c0369295ecfd9ce622a6503fe9a1ee3a)) ##### Miscellaneous Chores - **deps:** update dependency lint-staged to v17.1.0 ([f528fd4](https://redirect.github.com/renovatebot/github-action/commit/f528fd49697f048bff3e78beb78e3348c4f1f82b)) - **deps:** update dependency semantic-release to v25.0.7 ([8771fb6](https://redirect.github.com/renovatebot/github-action/commit/8771fb6190ee4f69fc2c9fd86380183939af6eba)) - **deps:** update dependency semantic-release to v25.0.8 ([9efb0fc](https://redirect.github.com/renovatebot/github-action/commit/9efb0fc3591ad7f115013d3172b03b034ae47791)) - **deps:** update dependency typescript-eslint to v8.64.0 ([4eed979](https://redirect.github.com/renovatebot/github-action/commit/4eed9790e9ec35cf9873bb1ad5b36e6c6c0a89e8)) ##### Build System - **deps:** lock file maintenance ([6e7b049](https://redirect.github.com/renovatebot/github-action/commit/6e7b0490db45d668a49b4f30332574e85f9980e4)) ##### Continuous Integration - **deps:** update actions/checkout action to v6.1.0 ([c4fc050](https://redirect.github.com/renovatebot/github-action/commit/c4fc0503fed82cbb167925d6d56dedca82430c57)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.272.1 ([9355a07](https://redirect.github.com/renovatebot/github-action/commit/9355a07357b9cc52f1b0d7d5c81b3091302078ca)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.272.3 ([91aae03](https://redirect.github.com/renovatebot/github-action/commit/91aae033e3159f90ad5e6b2d7e2123ba04f845e7)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.272.4 ([be1b582](https://redirect.github.com/renovatebot/github-action/commit/be1b5827263420e16101d4820cc358563ffc3663)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.272.5 ([1885f40](https://redirect.github.com/renovatebot/github-action/commit/1885f40b83e6a2b5d4d3b3cf9b7d783c807635f1)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.272.6 ([99c53af](https://redirect.github.com/renovatebot/github-action/commit/99c53af241909d290a2386f9a22a70735f9cbbbb)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.272.9 ([3946100](https://redirect.github.com/renovatebot/github-action/commit/39461003f609a8744f012ee974560d0f4918341c)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.273.0 ([143ca70](https://redirect.github.com/renovatebot/github-action/commit/143ca705453c47f6d7d96d7e2e676d666cfd06d6)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.274.0 ([b25398a](https://redirect.github.com/renovatebot/github-action/commit/b25398aa76e4e6b64c791571bdf014f04fc1ba70)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.275.0 ([d84cbc1](https://redirect.github.com/renovatebot/github-action/commit/d84cbc1eebc9c39765a20710713a519e221a9f8a)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.275.1 ([42a4757](https://redirect.github.com/renovatebot/github-action/commit/42a4757e5ff4b75648e7dc1818e66168a541676f)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.275.2 ([f53dbc7](https://redirect.github.com/renovatebot/github-action/commit/f53dbc746dd50b9bb37c7739628307e3368b3dca)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.277.0 ([091f8fd](https://redirect.github.com/renovatebot/github-action/commit/091f8fd6eb95dcd983259c82cab4aa460bda72d5)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.277.1 ([c5ab157](https://redirect.github.com/renovatebot/github-action/commit/c5ab157131cb61c6d4a734181015e0bb56f79012)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.278.2 ([0ffec41](https://redirect.github.com/renovatebot/github-action/commit/0ffec41f725c2d1804e176d71078f9167f3a80aa)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.278.3 ([9586883](https://redirect.github.com/renovatebot/github-action/commit/9586883060bd23f5b1cd4df737e8e9ef06a61f73)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.278.4 ([a571ddf](https://redirect.github.com/renovatebot/github-action/commit/a571ddf5ed7adf965c5398a1faef20d2112c2c22)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.278.5 ([b018556](https://redirect.github.com/renovatebot/github-action/commit/b01855692256f96b03021c0d8d47fa92217e6449)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.279.0 ([f5099e2](https://redirect.github.com/renovatebot/github-action/commit/f5099e2e70be84cef5bb45f4b44fb8f68bc09b2b)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.279.1 ([0a6a7a9](https://redirect.github.com/renovatebot/github-action/commit/0a6a7a9c0178ff43eccabbee6100982eb7a78715)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.280.0 ([c97e3db](https://redirect.github.com/renovatebot/github-action/commit/c97e3db92060fbea1c0e290e6f8f84e4551277be)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.280.2 ([b8f0962](https://redirect.github.com/renovatebot/github-action/commit/b8f09624f972544d854ba37c9f122d4964c249f9)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.280.3 ([1194ce5](https://redirect.github.com/renovatebot/github-action/commit/1194ce5c21c6ee5e09d02c1dfc7ee1c59b1cac81)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.280.4 ([2fbf14d](https://redirect.github.com/renovatebot/github-action/commit/2fbf14d2b8b6b5bcfdd1cb93a50f2b7eaa03be4e)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.280.5 ([9f45e34](https://redirect.github.com/renovatebot/github-action/commit/9f45e34eaf443293225c703de5c1190a480938f0)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.281.0 ([e1ffcae](https://redirect.github.com/renovatebot/github-action/commit/e1ffcae52591d14f6b2b1ea82d7d817d283e533a)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.281.1 ([8ebe465](https://redirect.github.com/renovatebot/github-action/commit/8ebe46564f6dd45291e0a1f4893618e4cf4b32a6)) - **deps:** update ghcr.io/zizmorcore/zizmor docker tag to v1.28.0 ([#​1065](https://redirect.github.com/renovatebot/github-action/issues/1065)) ([05b68f0](https://redirect.github.com/renovatebot/github-action/commit/05b68f08694f8378ced945d273ef6c57ec4621b7)) - **deps:** update zizmorcore/zizmor-action action to v0.6.1 ([344a7d4](https://redirect.github.com/renovatebot/github-action/commit/344a7d44ea46ef8ca656394e569794b6932b867f)) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 08:59 AM, only on Monday (`* 0-8 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzIuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==--> Co-authored-by: khepri-bot[bot] <269588972+khepri-bot[bot]@users.noreply.github.com>
edgarrmondragon
pushed a commit
to isjiajia01/meltano
that referenced
this pull request
Aug 13, 2026
…o#10229) This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) | action | patch | `v5.0.1` → `v5.0.2` | `v5.0.3` | | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | patch | `v4.37.3` → `v4.37.4` | `v4.37.6` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | --- ### Release Notes <details> <summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary> ### [`v5.0.2`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.0.2) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.0.1...v5.0.2) #### What's Changed - feat: add cycle-estimation and exclude-allocations inputs by [@&meltano#8203;not-matthias](https://redirect.github.com/not-matthias) in [#&meltano#8203;229](https://redirect.github.com/CodSpeedHQ/action/pull/229) **Full Changelog**: <CodSpeedHQ/action@v5.0.1...v5.0.2> </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v4.37.4`](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@&meltano#8203;takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#&meltano#8203;416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @&meltano#8203;facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #&meltano#8203;417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@&meltano#8203;facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@&meltano#8203;davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#&meltano#8203;415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@&meltano#8203;takluyver](https://redirect.github.com/takluyver) made their first contribution in [#&meltano#8203;416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@&meltano#8203;webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@&meltano#8203;davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@&meltano#8203;Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#&meltano#8203;415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@&meltano#8203;bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@&meltano#8203;miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@&meltano#8203;jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@&meltano#8203;woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/meltano/meltano). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
edgarrmondragon
pushed a commit
to isjiajia01/meltano
that referenced
this pull request
Aug 13, 2026
…o#10229) This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) | action | patch | `v5.0.1` → `v5.0.2` | `v5.0.3` | | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | patch | `v4.37.3` → `v4.37.4` | `v4.37.6` (+1) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | | --- ### Release Notes <details> <summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary> ### [`v5.0.2`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.0.2) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.0.1...v5.0.2) #### What's Changed - feat: add cycle-estimation and exclude-allocations inputs by [@&meltano#8203;not-matthias](https://redirect.github.com/not-matthias) in [#&meltano#8203;229](https://redirect.github.com/CodSpeedHQ/action/pull/229) **Full Changelog**: <CodSpeedHQ/action@v5.0.1...v5.0.2> </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v4.37.4`](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@&meltano#8203;takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#&meltano#8203;416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @&meltano#8203;facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #&meltano#8203;417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@&meltano#8203;facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@&meltano#8203;davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#&meltano#8203;415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@&meltano#8203;takluyver](https://redirect.github.com/takluyver) made their first contribution in [#&meltano#8203;416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@&meltano#8203;webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@&meltano#8203;davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@&meltano#8203;Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#&meltano#8203;415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@&meltano#8203;bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@&meltano#8203;miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@&meltano#8203;jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@&meltano#8203;woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/meltano/meltano). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
wesm
pushed a commit
to kenn-io/agentsview
that referenced
this pull request
Aug 15, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [Swatinem/rust-cache](https://redirect.github.com/Swatinem/rust-cache) | action | patch | `v2.9.1` → `v2.9.2` | | | [actions/cache](https://redirect.github.com/actions/cache) | action | major | `v4.3.0` → `v6.1.0` | | | [actions/checkout](https://redirect.github.com/actions/checkout) | action | patch | `v7.0.0` → `v7.0.1` | | | [actions/setup-go](https://redirect.github.com/actions/setup-go) | action | major | `v6.5.0` → `v7.0.0` | | | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | major | `v6.4.0` → `v7.0.0` | | | [actions/setup-python](https://redirect.github.com/actions/setup-python) | action | major | `v6.3.0` → `v7.0.0` | | | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | action | major | `v8.2.0` → `v9.0.0` | `v10.0.1` (+1) | | [docker/build-push-action](https://redirect.github.com/docker/build-push-action) | action | minor | `v7.2.0` → `v7.3.0` | | | [docker/login-action](https://redirect.github.com/docker/login-action) | action | minor | `v4.2.0` → `v4.6.0` | | | [docker/metadata-action](https://redirect.github.com/docker/metadata-action) | action | minor | `v6.1.0` → `v6.2.0` | | | [docker/setup-buildx-action](https://redirect.github.com/docker/setup-buildx-action) | action | minor | `v4.1.0` → `v4.2.0` | | | [docker/setup-qemu-action](https://redirect.github.com/docker/setup-qemu-action) | action | minor | `v4.1.0` → `v4.2.0` | | | [dtolnay/rust-toolchain](https://redirect.github.com/dtolnay/rust-toolchain) ([changelog](https://redirect.github.com/dtolnay/rust-toolchain/compare/4cda84d5c5c54efe2404f9d843567869ab1699d4..4360b52568e2003a75bf9bc1d59f33a8e3fc893c)) | action | digest | `4cda84d` → `4360b52` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.0` → `v1.14.2` | | | [softprops/action-gh-release](https://redirect.github.com/softprops/action-gh-release) | action | patch | `v3.0.1` → `v3.0.2` | | --- ### Release Notes <details> <summary>Swatinem/rust-cache (Swatinem/rust-cache)</summary> ### [`v2.9.2`](https://redirect.github.com/Swatinem/rust-cache/releases/tag/v2.9.2) [Compare Source](https://redirect.github.com/Swatinem/rust-cache/compare/v2.9.1...v2.9.2) ##### What's Changed - Typofix by [@​23Skidoo](https://redirect.github.com/23Skidoo) in [#​316](https://redirect.github.com/Swatinem/rust-cache/pull/316) - fix: include target names in build/ and .fingerprint/ cleanup by [@​eitsupi](https://redirect.github.com/eitsupi) in [#​317](https://redirect.github.com/Swatinem/rust-cache/pull/317) - fix: include cdylib/rlib/dylib/staticlib targets in build and fingerprint cleanup by [@​eitsupi](https://redirect.github.com/eitsupi) in [#​320](https://redirect.github.com/Swatinem/rust-cache/pull/320) - Scan content of `$CARGO_HOME/bin` on restore instead of relying on `cargo install` metadata by [@​clechasseur](https://redirect.github.com/clechasseur) in [#​325](https://redirect.github.com/Swatinem/rust-cache/pull/325) - docs: Update checkout action version to latest by [@​sondrelg](https://redirect.github.com/sondrelg) in [#​345](https://redirect.github.com/Swatinem/rust-cache/pull/345) - Fix Windows cache path validation after Rollup migration by [@​eitsupi](https://redirect.github.com/eitsupi) in [#​355](https://redirect.github.com/Swatinem/rust-cache/pull/355) - fix: support Cargo V2 build dir layout by [@​claytonwramsey](https://redirect.github.com/claytonwramsey) in [#​371](https://redirect.github.com/Swatinem/rust-cache/pull/371) ##### New Contributors - [@​23Skidoo](https://redirect.github.com/23Skidoo) made their first contribution in [#​316](https://redirect.github.com/Swatinem/rust-cache/pull/316) - [@​eitsupi](https://redirect.github.com/eitsupi) made their first contribution in [#​317](https://redirect.github.com/Swatinem/rust-cache/pull/317) - [@​clechasseur](https://redirect.github.com/clechasseur) made their first contribution in [#​325](https://redirect.github.com/Swatinem/rust-cache/pull/325) - [@​sondrelg](https://redirect.github.com/sondrelg) made their first contribution in [#​345](https://redirect.github.com/Swatinem/rust-cache/pull/345) - [@​claytonwramsey](https://redirect.github.com/claytonwramsey) made their first contribution in [#​371](https://redirect.github.com/Swatinem/rust-cache/pull/371) **Full Changelog**: <Swatinem/rust-cache@v2.9.1...v2.9.2> </details> <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://redirect.github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.1.0) ##### What's Changed - Bump [@​actions/cache](https://redirect.github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@​jasongin](https://redirect.github.com/jasongin) in [#​1768](https://redirect.github.com/actions/cache/pull/1768) **Full Changelog**: <actions/cache@v6...v6.1.0> ### [`v6.0.0`](https://redirect.github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@​Samirat](https://redirect.github.com/Samirat) in [#​1760](https://redirect.github.com/actions/cache/pull/1760) **Full Changelog**: <actions/cache@v5...v6.0.0> ### [`v6`](https://redirect.github.com/actions/cache/compare/v5.0.5...v6.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.1.0...v6.0.0) ### [`v5.1.0`](https://redirect.github.com/actions/cache/releases/tag/v5.1.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.0.5...v5.1.0) ##### What's Changed - Bump [@​actions/cache](https://redirect.github.com/actions/cache) to v5.1.0 - handle read-only cache access by [@​jasongin](https://redirect.github.com/jasongin) in [#​1775](https://redirect.github.com/actions/cache/pull/1775) **Full Changelog**: <actions/cache@v5...v5.1.0> ### [`v5.0.5`](https://redirect.github.com/actions/cache/releases/tag/v5.0.5) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.0.4...v5.0.5) ##### What's Changed - Update ts-http-runtime dependency by [@​yacaovsnc](https://redirect.github.com/yacaovsnc) in [#​1747](https://redirect.github.com/actions/cache/pull/1747) **Full Changelog**: <actions/cache@v5...v5.0.5> ### [`v5.0.4`](https://redirect.github.com/actions/cache/releases/tag/v5.0.4) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.0.3...v5.0.4) ##### What's Changed - Add release instructions and update maintainer docs by [@​Link-](https://redirect.github.com/Link-) in [#​1696](https://redirect.github.com/actions/cache/pull/1696) - Potential fix for code scanning alert no. 52: Workflow does not contain permissions by [@​Link-](https://redirect.github.com/Link-) in [#​1697](https://redirect.github.com/actions/cache/pull/1697) - Fix workflow permissions and cleanup workflow names / formatting by [@​Link-](https://redirect.github.com/Link-) in [#​1699](https://redirect.github.com/actions/cache/pull/1699) - docs: Update examples to use the latest version by [@​XZTDean](https://redirect.github.com/XZTDean) in [#​1690](https://redirect.github.com/actions/cache/pull/1690) - Fix proxy integration tests by [@​Link-](https://redirect.github.com/Link-) in [#​1701](https://redirect.github.com/actions/cache/pull/1701) - Fix cache key in examples.md for bun.lock by [@​RyPeck](https://redirect.github.com/RyPeck) in [#​1722](https://redirect.github.com/actions/cache/pull/1722) - Update dependencies & patch security vulnerabilities by [@​Link-](https://redirect.github.com/Link-) in [#​1738](https://redirect.github.com/actions/cache/pull/1738) ##### New Contributors - [@​XZTDean](https://redirect.github.com/XZTDean) made their first contribution in [#​1690](https://redirect.github.com/actions/cache/pull/1690) - [@​RyPeck](https://redirect.github.com/RyPeck) made their first contribution in [#​1722](https://redirect.github.com/actions/cache/pull/1722) **Full Changelog**: <actions/cache@v5...v5.0.4> ### [`v5.0.3`](https://redirect.github.com/actions/cache/releases/tag/v5.0.3) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.0.2...v5.0.3) ##### What's Changed - Bump `@actions/cache` to v5.0.5 (Resolves: <https://github.com/actions/cache/security/dependabot/33>) - Bump `@actions/core` to v2.0.3 **Full Changelog**: <actions/cache@v5...v5.0.3> ### [`v5.0.2`](https://redirect.github.com/actions/cache/releases/tag/v5.0.2): v.5.0.2 [Compare Source](https://redirect.github.com/actions/cache/compare/v5.0.1...v5.0.2) ##### v5.0.2 ##### What's Changed When creating cache entries, 429s returned from the cache service will not be retried. ### [`v5.0.1`](https://redirect.github.com/actions/cache/releases/tag/v5.0.1) [Compare Source](https://redirect.github.com/actions/cache/compare/v5...v5.0.1) > \[!IMPORTANT] > **`actions/cache@v5` runs on the Node.js 24 runtime and requires a minimum Actions Runner version of `2.327.1`.** > > If you are using self-hosted runners, ensure they are updated before upgrading. *** ##### v5.0.1 ##### What's Changed - fix: update [@​actions/cache](https://redirect.github.com/actions/cache) for Node.js 24 punycode deprecation by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1685](https://redirect.github.com/actions/cache/pull/1685) - prepare release v5.0.1 by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1686](https://redirect.github.com/actions/cache/pull/1686) ##### v5.0.0 ##### What's Changed - Upgrade to use node24 by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1630](https://redirect.github.com/actions/cache/pull/1630) - Prepare v5.0.0 release by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1684](https://redirect.github.com/actions/cache/pull/1684) **Full Changelog**: <actions/cache@v5...v5.0.1> ### [`v5.0.0`](https://redirect.github.com/actions/cache/releases/tag/v5.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v5...v5) > \[!IMPORTANT] > **`actions/cache@v5` runs on the Node.js 24 runtime and requires a minimum Actions Runner version of `2.327.1`.** > > If you are using self-hosted runners, ensure they are updated before upgrading. *** ##### What's Changed - Upgrade to use node24 by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1630](https://redirect.github.com/actions/cache/pull/1630) - Prepare v5.0.0 release by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1684](https://redirect.github.com/actions/cache/pull/1684) **Full Changelog**: <actions/cache@v4.3.0...v5.0.0> ### [`v5`](https://redirect.github.com/actions/cache/compare/v4.3.0...v5) [Compare Source](https://redirect.github.com/actions/cache/compare/v4.3.0...v5) </details> <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](https://redirect.github.com/actions/checkout/compare/v7.0.0...v7.0.1) - Bump github/codeql-action from 3 to 4 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2475](https://redirect.github.com/actions/checkout/pull/2475) - Bump actions/setup-node from 4 to 6 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2477](https://redirect.github.com/actions/checkout/pull/2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2478](https://redirect.github.com/actions/checkout/pull/2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2479](https://redirect.github.com/actions/checkout/pull/2479) - Bump actions/checkout from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2488](https://redirect.github.com/actions/checkout/pull/2488) - Bump actions/upload-artifact from 4 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2476](https://redirect.github.com/actions/checkout/pull/2476) - eslint 9 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2474](https://redirect.github.com/actions/checkout/pull/2474) - Bump the minor-actions-dependencies group with 2 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2499](https://redirect.github.com/actions/checkout/pull/2499) - skip running unsafe pr check if input is default by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2518](https://redirect.github.com/actions/checkout/pull/2518) - trim only ascii whitespace for branch by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2521](https://redirect.github.com/actions/checkout/pull/2521) - escape values passed to --unset by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2530](https://redirect.github.com/actions/checkout/pull/2530) </details> <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-go/compare/v7.0.0...v7.0.0) ##### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://redirect.github.com/priyagupta108) in [#​763](https://redirect.github.com/actions/setup-go/pull/763) - chore(deps): bump [@​actions/cache](https://redirect.github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://redirect.github.com/philip-gai) in [#​771](https://redirect.github.com/actions/setup-go/pull/771) ##### New Contributors - [@​philip-gai](https://redirect.github.com/philip-gai) made their first contribution in [#​771](https://redirect.github.com/actions/setup-go/pull/771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> ### [`v7`](https://redirect.github.com/actions/setup-go/compare/v6.5.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-go/compare/v6.5.0...v7.0.0) </details> <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v7.0.0...v7.0.0) ##### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@​gowridurgad](https://redirect.github.com/gowridurgad) in [#​1577](https://redirect.github.com/actions/setup-node/pull/1577) - Migrate to ESM and upgrade dependencies by [@​gowridurgad](https://redirect.github.com/gowridurgad) in [#​1574](https://redirect.github.com/actions/setup-node/pull/1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@​gowridurgad](https://redirect.github.com/gowridurgad) in [#​1558](https://redirect.github.com/actions/setup-node/pull/1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@​deiga](https://redirect.github.com/deiga) in [#​1548](https://redirect.github.com/actions/setup-node/pull/1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@​chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#​1536](https://redirect.github.com/actions/setup-node/pull/1536) - docs: Update restore-only cache documentation by [@​priya-kinthali](https://redirect.github.com/priya-kinthali) in [#​1550](https://redirect.github.com/actions/setup-node/pull/1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@​chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#​1567](https://redirect.github.com/actions/setup-node/pull/1567) ##### Dependency update: - Upgrade [@​actions/cache](https://redirect.github.com/actions/cache) to 5.1.0, log cache write denied by [@​jasongin](https://redirect.github.com/jasongin) in [#​1569](https://redirect.github.com/actions/setup-node/pull/1569) ##### New Contributors - [@​chiranjib-swain](https://redirect.github.com/chiranjib-swain) made their first contribution in [#​1536](https://redirect.github.com/actions/setup-node/pull/1536) - [@​deiga](https://redirect.github.com/deiga) made their first contribution in [#​1548](https://redirect.github.com/actions/setup-node/pull/1548) - [@​jasongin](https://redirect.github.com/jasongin) made their first contribution in [#​1569](https://redirect.github.com/actions/setup-node/pull/1569) **Full Changelog**: <actions/setup-node@v6...v7.0.0> ### [`v7`](https://redirect.github.com/actions/setup-node/compare/v6.5.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.5.0...v7.0.0) ### [`v6.5.0`](https://redirect.github.com/actions/setup-node/releases/tag/v6.5.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.4.0...v6.5.0) ##### What's Changed - Update [@​actions/cache](https://redirect.github.com/actions/cache) to 5.1.0 and add security overrides for undici and fast-xml-parser by [@​HarithaVattikuti](https://redirect.github.com/HarithaVattikuti) in [#​1579](https://redirect.github.com/actions/setup-node/pull/1579) **Full Changelog**: <actions/setup-node@v6.4.0...v6.5.0> </details> <details> <summary>actions/setup-python (actions/setup-python)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/setup-python/compare/v6.3.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-python/compare/v7.0.0...v7.0.0) ### [`v7`](https://redirect.github.com/actions/setup-python/compare/v6.3.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-python/compare/v6.3.0...v7.0.0) </details> <details> <summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary> ### [`v9.0.0`](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.2...v9.0.0) [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.2...v9.0.0) ### [`v8.3.2`](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.1...v8.3.2) [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.1...v8.3.2) ### [`v8.3.1`](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.0...v8.3.1) [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.0...v8.3.1) ### [`v8.3.0`](https://redirect.github.com/astral-sh/setup-uv/compare/v8.2.0...v8.3.0) [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v8.2.0...v8.3.0) </details> <details> <summary>docker/build-push-action (docker/build-push-action)</summary> ### [`v7.3.0`](https://redirect.github.com/docker/build-push-action/compare/v7.2.0...v7.3.0) [Compare Source](https://redirect.github.com/docker/build-push-action/compare/v7.2.0...v7.3.0) </details> <details> <summary>docker/login-action (docker/login-action)</summary> ### [`v4.6.0`](https://redirect.github.com/docker/login-action/compare/v4.5.2...v4.6.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.2...v4.6.0) ### [`v4.5.2`](https://redirect.github.com/docker/login-action/compare/v4.5.1...v4.5.2) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.1...v4.5.2) ### [`v4.5.1`](https://redirect.github.com/docker/login-action/compare/v4.5.0...v4.5.1) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.0...v4.5.1) ### [`v4.5.0`](https://redirect.github.com/docker/login-action/compare/v4.4.0...v4.5.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.4.0...v4.5.0) ### [`v4.4.0`](https://redirect.github.com/docker/login-action/compare/v4.3.0...v4.4.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.3.0...v4.4.0) ### [`v4.3.0`](https://redirect.github.com/docker/login-action/releases/tag/v4.3.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.2.0...v4.3.0) - Preserve names in esbuild bundle by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1022](https://redirect.github.com/docker/login-action/pull/1022) - Bump [@​aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://redirect.github.com/aws-sdk/client-ecr-public) to 3.1076.0 [#​999](https://redirect.github.com/docker/login-action/pull/999) [#​1030](https://redirect.github.com/docker/login-action/pull/1030) - Bump [@​docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit) from 0.90.0 to 0.92.0 in [#​1004](https://redirect.github.com/docker/login-action/pull/1004) [#​1027](https://redirect.github.com/docker/login-action/pull/1027) - Bump [@​sigstore/core](https://redirect.github.com/sigstore/core) from 3.1.0 to 3.2.1 in [#​1023](https://redirect.github.com/docker/login-action/pull/1023) - Bump [@​sigstore/verify](https://redirect.github.com/sigstore/verify) from 3.1.0 to 3.1.1 in [#​1029](https://redirect.github.com/docker/login-action/pull/1029) - Bump http-proxy-agent and https-proxy-agent to 9.1.0 in [#​1017](https://redirect.github.com/docker/login-action/pull/1017) - Bump js-yaml from 4.1.1 to 5.2.0 in [#​1028](https://redirect.github.com/docker/login-action/pull/1028) - Bump sigstore from 4.1.0 to 4.1.1 in [#​1031](https://redirect.github.com/docker/login-action/pull/1031) - Bump tmp from 0.2.5 to 0.2.7 in [#​1002](https://redirect.github.com/docker/login-action/pull/1002) - Bump undici from 6.24.1 to 6.27.0 in [#​1020](https://redirect.github.com/docker/login-action/pull/1020) - Bump vite from 7.3.3 to 7.3.6 in [#​1019](https://redirect.github.com/docker/login-action/pull/1019) **Full Changelog**: <docker/login-action@v4.2.0...v4.3.0> </details> <details> <summary>docker/metadata-action (docker/metadata-action)</summary> ### [`v6.2.0`](https://redirect.github.com/docker/metadata-action/compare/v6.1.0...v6.2.0) [Compare Source](https://redirect.github.com/docker/metadata-action/compare/v6.1.0...v6.2.0) </details> <details> <summary>docker/setup-buildx-action (docker/setup-buildx-action)</summary> ### [`v4.2.0`](https://redirect.github.com/docker/setup-buildx-action/releases/tag/v4.2.0) [Compare Source](https://redirect.github.com/docker/setup-buildx-action/compare/v4.1.0...v4.2.0) - Preserve names in esbuild bundle by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​572](https://redirect.github.com/docker/setup-buildx-action/pull/572) - Bump [@​actions/core](https://redirect.github.com/actions/core) from 3.0.0 to 3.0.1 in [#​551](https://redirect.github.com/docker/setup-buildx-action/pull/551) - Bump [@​docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit) from 0.90.0 to 0.92.0 in [#​557](https://redirect.github.com/docker/setup-buildx-action/pull/557) [#​580](https://redirect.github.com/docker/setup-buildx-action/pull/580) - Bump [@​sigstore/core](https://redirect.github.com/sigstore/core) from 3.1.0 to 3.2.1 in [#​573](https://redirect.github.com/docker/setup-buildx-action/pull/573) - Bump [@​sigstore/verify](https://redirect.github.com/sigstore/verify) from 3.1.0 to 3.1.1 in [#​576](https://redirect.github.com/docker/setup-buildx-action/pull/576) - Bump js-yaml from 4.1.1 to 5.2.0 in [#​562](https://redirect.github.com/docker/setup-buildx-action/pull/562) - Bump sigstore from 4.1.0 to 4.1.1 in [#​577](https://redirect.github.com/docker/setup-buildx-action/pull/577) - Bump tmp from 0.2.5 to 0.2.7 in [#​556](https://redirect.github.com/docker/setup-buildx-action/pull/556) - Bump undici from 6.25.0 to 6.27.0 in [#​570](https://redirect.github.com/docker/setup-buildx-action/pull/570) - Bump vite from 7.3.2 to 7.3.6 in [#​569](https://redirect.github.com/docker/setup-buildx-action/pull/569) **Full Changelog**: <docker/setup-buildx-action@v4.1.0...v4.2.0> </details> <details> <summary>docker/setup-qemu-action (docker/setup-qemu-action)</summary> ### [`v4.2.0`](https://redirect.github.com/docker/setup-qemu-action/compare/v4.1.0...v4.2.0) [Compare Source](https://redirect.github.com/docker/setup-qemu-action/compare/v4.1.0...v4.2.0) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 ### [`v1.14.1`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.1) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.0...v1.14.1) <p align="right"><i>This release was cut at <a href="https://ep2026.europython.eu/sprints/">EuroPython 2026 Sprints</a></i></p> #### 🛠️ Internal Dependencies [@​adisivaprasad](https://redirect.github.com/adisivaprasad)[💰](https://redirect.github.com/sponsors/adisivaprasad) helped get rid of the GitHub Actions runner warning about the old Node 20 runtime being used by updating `actions/setup-python` from v5.6.0 to v6.2.0 in [#​408](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408). #### 💪 New Contributors - [@​adisivaprasad](https://redirect.github.com/adisivaprasad) made their first contribution in [#​408](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408) - [@​jylenhof](https://redirect.github.com/jylenhof)[💰](https://redirect.github.com/sponsors/jylenhof) followed up and reminded us to actually cut this release in [#​413](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/413) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.0...v1.14.1> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​jylenhof](https://redirect.github.com/jylenhof)[💰](https://redirect.github.com/sponsors/jylenhof) for reminding me to work on this release! **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrd7jpnxc22d), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/116970132515797444) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/414 </details> <details> <summary>softprops/action-gh-release (softprops/action-gh-release)</summary> ### [`v3.0.2`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v3.0.2) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v3.0.1...v3.0.2) `3.0.2` is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since `3.0.1`. This release fixes [#​795](https://redirect.github.com/softprops/action-gh-release/issues/795), [#​438](https://redirect.github.com/softprops/action-gh-release/issues/438), and [#​803](https://redirect.github.com/softprops/action-gh-release/issues/803). The upload transport hardening covers the historical failure reported in [#​790](https://redirect.github.com/softprops/action-gh-release/issues/790), although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to [#​786](https://redirect.github.com/softprops/action-gh-release/issues/786) and does not claim a reproducible release-creation fix. ##### What's Changed ##### Exciting New Features 🎉 - feat: improve release error reporting and test coverage by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​813](https://redirect.github.com/softprops/action-gh-release/pull/813) ##### Bug fixes 🐛 - fix: publish existing draft releases as prereleases by [@​godfengliang](https://redirect.github.com/godfengliang) in [#​801](https://redirect.github.com/softprops/action-gh-release/pull/801) - fix: upload small checksum assets reliably by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​815](https://redirect.github.com/softprops/action-gh-release/pull/815) - fix: replace existing release assets on Gitea by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​816](https://redirect.github.com/softprops/action-gh-release/pull/816) - fix: clarify release creation 404 errors by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​817](https://redirect.github.com/softprops/action-gh-release/pull/817) ##### Other Changes 🔄 - chore(deps): upgrade TypeScript to 7 by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​812](https://redirect.github.com/softprops/action-gh-release/pull/812) - chore(deps): remove unused TypeScript tooling by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​814](https://redirect.github.com/softprops/action-gh-release/pull/814) - dependency, Node 24 pin, and CI maintenance merged since `3.0.1` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/kenn-io/agentsview). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yOS41IiwidXBkYXRlZEluVmVyIjoiNDQuMjkuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>
juju4
pushed a commit
to juju4/python-openobserve
that referenced
this pull request
Aug 16, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.0` → `v1.14.2` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 ### [`v1.14.1`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.1) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.0...v1.14.1) <p align="right"><i>This release was cut at <a href="https://ep2026.europython.eu/sprints/">EuroPython 2026 Sprints</a></i></p> #### 🛠️ Internal Dependencies [@​adisivaprasad](https://redirect.github.com/adisivaprasad)[💰](https://redirect.github.com/sponsors/adisivaprasad) helped get rid of the GitHub Actions runner warning about the old Node 20 runtime being used by updating `actions/setup-python` from v5.6.0 to v6.2.0 in [#​408](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408). #### 💪 New Contributors - [@​adisivaprasad](https://redirect.github.com/adisivaprasad) made their first contribution in [#​408](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408) - [@​jylenhof](https://redirect.github.com/jylenhof)[💰](https://redirect.github.com/sponsors/jylenhof) followed up and reminded us to actually cut this release in [#​413](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/413) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.0...v1.14.1> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​jylenhof](https://redirect.github.com/jylenhof)[💰](https://redirect.github.com/sponsors/jylenhof) for reminding me to work on this release! **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrd7jpnxc22d), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/116970132515797444) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/414 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/juju4/python-openobserve). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMjkuNSIsInRhcmdldEJyYW5jaCI6ImRldmVsIiwibGFiZWxzIjpbImF1dG9tZXJnZSJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot
added a commit
to dominodatalab/cucu
that referenced
this pull request
Aug 17, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---|---| | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.1` → `v1.14.2` | |  |  | | [uv_build](https://pypi.org/project/uv/) ([source](https://redirect.github.com/astral-sh/uv), [changelog](https://redirect.github.com/astral-sh/uv/blob/main/CHANGELOG.md)) | build-system.requires | minor | `>=0.11.1,<0.12.0` → `>=0.12.1,<0.13.0` | `0.12.5` (+3) |  |  | --- ### Release Notes <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 </details> <details> <summary>astral-sh/uv (uv_build)</summary> ### [`v0.12.1`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0121) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.12.0...0.12.1) Released on 2026-07-31. ##### Enhancements - Add package-specific pre-release policies with `--prerelease-package` ([#​20837](https://redirect.github.com/astral-sh/uv/pull/20837)) - Support local HTML files as flat indexes ([#​20802](https://redirect.github.com/astral-sh/uv/pull/20802)) - Add Xonsh virtual environment activation scripts (`activate.xsh`) ([#​19740](https://redirect.github.com/astral-sh/uv/pull/19740)) - Preserve filesystem paths passed to `uv add --index` when updating `pyproject.toml` ([#​20817](https://redirect.github.com/astral-sh/uv/pull/20817)) ##### Preview features - Add automatic fixes to `uv check` with `--fix` ([#​20793](https://redirect.github.com/astral-sh/uv/pull/20793)) - Avoid rejecting unchanged metadata-free lockfiles when workspace dependencies share direct sources ([#​20847](https://redirect.github.com/astral-sh/uv/pull/20847)) - Honor direct URL constraints when validating metadata-free lockfiles ([#​20796](https://redirect.github.com/astral-sh/uv/pull/20796)) - Ignore malformed PEP 723 scripts discovered during project checks ([#​20784](https://redirect.github.com/astral-sh/uv/pull/20784)) - Use ty's native script exclusion in `uv check` ([#​20742](https://redirect.github.com/astral-sh/uv/pull/20742)) ##### Performance - Parse canonical uv lockfiles directly, with a fallback for other valid TOML syntax ([#​20648](https://redirect.github.com/astral-sh/uv/pull/20648)) - Accelerate SHA-256 hashing on non-Windows ARM64 platforms ([#​20805](https://redirect.github.com/astral-sh/uv/pull/20805)) ##### Bug fixes - Flush shell startup file updates before `uv tool update-shell` and `uv python update-shell` exit ([#​20842](https://redirect.github.com/astral-sh/uv/pull/20842)) - Make workspace-root dependency groups available to commands run from workspace members ([#​20840](https://redirect.github.com/astral-sh/uv/pull/20840)) - Resolve `--find-links` paths in requirements files relative to the containing file ([#​20832](https://redirect.github.com/astral-sh/uv/pull/20832)) - Respect configured indexes in `uv tool list --outdated` ([#​20770](https://redirect.github.com/astral-sh/uv/pull/20770)) ##### Documentation - Document Astral GPU indexes in the PyTorch guide ([#​20785](https://redirect.github.com/astral-sh/uv/pull/20785)) - Use consistent dependency-group argument descriptions throughout the CLI documentation ([#​20823](https://redirect.github.com/astral-sh/uv/pull/20823)) ### [`v0.12.0`](https://redirect.github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0120) [Compare Source](https://redirect.github.com/astral-sh/uv/compare/0.11.33...0.12.0) Released on 2026-07-28. Since we released uv [0.11.0](https://redirect.github.com/astral-sh/uv/releases/tag/0.11.0) in March, we've accumulated changes that improve correctness, safety, and compatibility with specifications, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution. **We expect most users to be able to upgrade without making changes.** There are no breaking changes to the configuration of the [uv build backend](https://docs.astral.sh/uv/concepts/build-backend/). If your `[build-system]` table includes an upper bound on `uv_build`, update it from `<0.12` to `<0.13` to allow `uv_build` 0.12: ```toml requires = ["uv_build>=0.11.32,<0.13"] ``` ##### Breaking changes - **Define build systems by default with `uv init`** ([#​19197](https://redirect.github.com/astral-sh/uv/pull/19197)) Projects created with `uv init` now declare a build system and are packaged by default. This was the default project layout all the way back in [v0.3](https://redirect.github.com/astral-sh/uv/releases/tag/0.3.0), but we found that the use of the `hatchling` build system was confusing to newcomers and consequently dropped use of a build system by default in [v0.4](https://redirect.github.com/astral-sh/uv/releases/tag/0.4.0). Since then, we've created our own build system (`uv_build`) with tight integration with uv and are excited to restore the default to a best-practice project layout. Previously, `uv init example` created an unpackaged layout containing `main.py` and a `pyproject.toml` without a build system. The project could declare dependencies but was not itself installed into its virtual environment. Now, `uv init example` defines a `[build-system]` using `uv_build`, places application source code in `src/example`, and includes a `[project.scripts]` entry named `example`. Defining a build system allows the project to be imported from tests or other code, installed as a dependency, and run as a command: ```console $ uv init example $ cd example $ uv run example Hello from example! ``` Existing projects are unaffected. Use [`uv init --no-package example`](https://docs.astral.sh/uv/concepts/projects/init/#creating-a-project-without-a-build-system) to create the previous unpackaged layout without a build system. See the [project creation documentation](https://docs.astral.sh/uv/concepts/projects/init/#applications) for more details. This stabilizes the `packaged-init` preview feature. - **Reject unsupported source distribution and wheel archive formats** ([#​18927](https://redirect.github.com/astral-sh/uv/pull/18927)) [PEP 625](https://peps.python.org/pep-0625/) requires [source distributions](https://docs.astral.sh/uv/concepts/resolution/#source-distribution) to use `.tar.gz` archives. Previously, uv also accepted legacy formats such as `.tar.bz2` and `.tar.xz`. Those formats are now rejected, including when referenced by an existing lockfile. Legacy `.zip` source distributions remain supported for backwards compatibility. Wheels and other ZIP archives can no longer contain entries compressed with bzip2, LZMA, or XZ. Entries must use the stored, DEFLATE, or zstd compression methods. Removing support for uncommon compression methods reduces uv's compression dependencies and the attack surface exposed when processing untrusted packages. You cannot opt out of this behavior. If you depend on a legacy source distribution that uses an unsupported format, we recommend rebuilding it as a `.tar.gz` archive and regenerating any lockfile containing references to the legacy archive. - **Reject wheel files that could replace the Python interpreter** ([#​20748](https://redirect.github.com/astral-sh/uv/pull/20748), [#​20749](https://redirect.github.com/astral-sh/uv/pull/20749)) uv already rejected wheel entry points named `python`, but case variants such as `Python` were still accepted. On case-insensitive filesystems, including common macOS and Windows setups, these entry points could overwrite the virtual environment's interpreter. Wheels could also place interpreter files in their `.data/scripts` directory or in paths such as `.data/data/bin/python`, bypassing the entry-point check and replacing the interpreter during installation. uv now rejects case-insensitive variants of reserved interpreter names and wheel data files that would be installed over an interpreter. This includes names such as `Python`, `python.py`, and `Python.exe`, along with other reserved interpreter names and their versioned variants. You cannot opt out of these checks. Rename conflicting entry points or wheel data files and rebuild the affected wheel. - **Prefer stable releases before falling back to pre-releases** ([#​19993](https://redirect.github.com/astral-sh/uv/pull/19993)) A dependency can introduce a [pre-release requirement](https://docs.astral.sh/uv/concepts/resolution/#pre-release-handling) after resolution starts. uv previously required each package's pre-release eligibility to be known before resolution began: the default `if-necessary-or-explicit` mode allowed them for direct requirements that explicitly requested a pre-release, or for packages that only published pre-releases. This meant that a pre-release requirement discovered in a dependency's metadata, e.g., `example>=2.0.0b1`, would fail to resolve even when a compatible pre-release existed. To resolve it, you had to add that dependency as a direct requirement or allow pre-releases across your entire dependency graph. The default mode is now `if-necessary`. uv tries stable candidates first and falls back to pre-releases when no stable candidate satisfies the active constraints. Like pip, uv now supports [pre-release requirements discovered transitively](https://docs.astral.sh/uv/pip/compatibility/#pre-release-compatibility), but can select different versions than previous uv releases when both stable and pre-release candidates are available. You can opt out of automatic pre-release selection with `--prerelease disallow`. Alternatively, `--prerelease allow` considers pre-releases without first preferring stable releases, and `--prerelease explicit` only allows them for direct requirements that mention a pre-release. The old `if-necessary-or-explicit` mode distinguished between explicitly requested pre-releases and packages with no stable releases. That distinction is unnecessary now that `if-necessary` handles both cases, including transitive requirements. The old name remains available as an alias but is deprecated and will be removed in a future release. - **Respect `--require-hashes` directives in `requirements.txt`** ([#​19336](https://redirect.github.com/astral-sh/uv/pull/19336)) Previously, `uv pip install` and `uv pip sync` warned about `--require-hashes` inside a `requirements.txt` file but still installed dependencies without checking their hashes. Now, the directive enables hash-checking mode, just as if `--require-hashes` had been passed on the command line. For example, this requirements file is no longer accepted because the requirement is neither pinned nor hashed: ```text --require-hashes anyio ``` You cannot opt out while the directive is present. Pin every requirement with `==` and provide its hash, or remove `--require-hashes` if hash checking is not intended. - **Reject MD5-only hashes in hash-checking mode** ([#​20758](https://redirect.github.com/astral-sh/uv/pull/20758)) Previously, `uv pip install --require-hashes` and `uv pip sync --require-hashes` accepted requirements whose only available digest used MD5. MD5 is not collision-resistant, so relying on it undermined installations that require hash verification and differed from pip's behavior. Hash-checking mode now requires at least one secure digest for every requirement. For example, the following requirement is rejected unless a secure hash, such as SHA-256, is also supplied: ```text anyio==4.0.0 --hash=md5:420d85e19168705cdf0223621b18831a ``` A secure hash can be supplied directly on the requirement or in a matching constraints file. Ordinary hash verification without `--require-hashes` continues to support MD5. You cannot opt out while hash checking is required. Regenerate affected hashes with SHA-256 or another supported secure hash. - **Reject invalid `pylock.toml` files and artifacts** ([#​20402](https://redirect.github.com/astral-sh/uv/pull/20402), [#​20440](https://redirect.github.com/astral-sh/uv/pull/20440), [#​20443](https://redirect.github.com/astral-sh/uv/pull/20443)) uv now validates additional requirements from the [`pylock.toml` specification](https://packaging.python.org/en/latest/specifications/pylock-toml/): - The `packages` array must be present. Previously, uv interpreted a missing array as an empty lockfile, so `uv pip sync` could uninstall an environment instead of rejecting malformed input. An explicitly empty `packages = []` array remains valid. - Lockfile filenames must be `pylock.toml` or a single-name variant such as `pylock.dev.toml`. Names such as `pylock..toml` and `pylock.foo.bar.toml` are rejected. - If a wheel, source distribution, or other artifact declares a `size`, the downloaded or cached artifact must match. Previously, an incorrect size was accepted when the hash was correct. Sizes reported by package indexes remain advisory. You cannot opt out of these checks. Regenerate malformed lockfiles, rename invalid filenames, and either correct or remove an incorrect optional `size` value. - **Honor explicit certificate overrides even when no certificates can be loaded** ([#​20741](https://redirect.github.com/astral-sh/uv/pull/20741), [#​20767](https://redirect.github.com/astral-sh/uv/pull/20767)) Previously, uv ignored [`SSL_CERT_FILE` or `SSL_CERT_DIR`](https://docs.astral.sh/uv/concepts/authentication/certificates/#custom-certificates) values that pointed to missing or inaccessible paths, empty files or directories, or sources without valid certificates. Instead, it fell back to its default trust roots, potentially allowing HTTPS connections that the configured override was intended to reject. Now, any non-empty `SSL_CERT_FILE` or `SSL_CERT_DIR` value replaces uv's default certificate roots, even when no valid certificates can be loaded. In that case, HTTPS requests fail because no certificates are trusted. This applies to package downloads and remote scripts, including GitHub Gists. Fix or unset the certificate override. Unsetting it restores the default trust store; empty environment-variable values continue to be ignored. - **Support pip-compatible `--cert` handling in `uv pip`** ([#​20418](https://redirect.github.com/astral-sh/uv/pull/20418)) The `uv pip` interface now accepts [`--cert <path>`](https://docs.astral.sh/uv/concepts/authentication/certificates/#custom-certificates), e.g.: ```console $ uv pip install --cert ./company-ca.pem example ``` As in pip, the provided PEM bundle replaces all other certificate sources for that invocation, including system certificates and `SSL_CERT_FILE` or `SSL_CERT_DIR`. This change has no effect unless you pass `--cert`. Include the necessary certificate authorities in the bundle. `--cert` is only supported by `uv pip` commands; other uv commands continue to use their existing certificate configuration. - **Discover projects relative to the script passed to `uv run`** ([#​20225](https://redirect.github.com/astral-sh/uv/pull/20225)) Previously, `uv run project/script.py` discovered its project from the current directory, even when the script belonged to another project. uv now starts project and workspace discovery from the script's directory instead. For example, running `uv run other-project/script.py` now uses `other-project` and its dependencies. This fixes scripts that previously failed because their own dependencies were not installed, but can select a different environment than before. You can opt out of script-relative discovery by selecting a project explicitly, e.g., `uv run --project . other-project/script.py`. This stabilizes the `target-workspace-discovery` preview feature. - **Require `--force` before clearing a directory that is not a virtual environment** ([#​20225](https://redirect.github.com/astral-sh/uv/pull/20225)) `uv venv --clear` previously removed any existing target directory, even if it was not a virtual environment. uv emitted a warning but still deleted the directory and its contents. Now, uv refuses to clear directories that do not contain a virtual environment. You can opt out of this safety check by explicitly passing `--force`, e.g., `uv venv --clear --force ./not-a-virtualenv`. This stabilizes the `venv-safe-clear` preview feature. - **Reject `--project` when initializing a project** ([#​20225](https://redirect.github.com/astral-sh/uv/pull/20225)) `--project` selects an existing project, so it is not meaningful when initializing a new one. Previously, `uv init --project example` warned and initialized `example` anyway; if a positional path was also provided, `--project` was ignored. This usage is now an error. Use `uv init example` to initialize a project at the requested path, or `uv init --directory example` to change the working directory first. This stabilizes the `init-project-flag` preview feature. - **Reject missing or invalid `--project` paths** ([#​20225](https://redirect.github.com/astral-sh/uv/pull/20225)) uv previously warned when `--project` referred to a missing directory or a file other than `pyproject.toml`, but then attempted to continue. This could produce confusing errors later or run against an unintended project. Now, `uv run --project missing python` fails immediately instead of continuing. You cannot opt out of this behavior. Create the directory first or select an existing project. Passing `--project path/to/pyproject.toml` remains supported and selects the file's parent directory. This stabilizes the `project-directory-must-exist` preview feature. - **Skip distributions with non-normalized filenames when publishing** ([#​20225](https://redirect.github.com/astral-sh/uv/pull/20225)) Distribution filenames must use [normalized package names](https://packaging.python.org/en/latest/specifications/name-normalization/) and versions. For example, a wheel for version `1.01.0` should be named `example-1.1.0-py3-none-any.whl`, not `example-1.01.0-py3-none-any.whl`. Previously, `uv publish` warned about non-normalized filenames but still attempted to upload them. It now skips the affected wheels and source distributions instead. You cannot opt out of this behavior. Rebuild distributions with normalized filenames before publishing. This stabilizes the `publish-require-normalized` preview feature. - **Classify Conda environments named `base` and `root` by their paths** ([#​20225](https://redirect.github.com/astral-sh/uv/pull/20225)) Conda environments named `base` or `root` were previously assumed to be the base Conda environment, even when they were ordinary child environments. uv now recognizes child Conda environments named `base` or `root` based on their paths, as it already does for other names. You can opt out of automatic interpreter selection by requesting an interpreter explicitly with `--python /path/to/python`. This stabilizes the `special-conda-env-names` preview feature. - **Reject broken `.venv` symlinks during environment discovery** ([#​20433](https://redirect.github.com/astral-sh/uv/pull/20433)) Previously, uv could ignore a broken `.venv` symlink and continue searching parent directories for another virtual environment. As a result, commands such as `uv pip install` could unexpectedly modify an unrelated ancestor environment. uv now stops at a broken `.venv` symlink and reports its exact path. Errors encountered while reading virtual environment metadata, including permission failures, are also reported immediately instead of being ignored. You cannot opt out of this behavior. Repair or remove the broken `.venv` symlink and correct any permissions that prevent uv from inspecting the environment. - **Reinstall matching installed Python patch versions instead of upgrading implicitly** ([#​20659](https://redirect.github.com/astral-sh/uv/pull/20659)) Before [Python upgrades](https://docs.astral.sh/uv/guides/install-python/#upgrading-python-versions) were supported, `uv python install 3.12 --reinstall` doubled as a way to install the latest Python 3.12 patch release. Now that `--upgrade` is available, `--reinstall` reinstalls the matching patch releases that are already present. For example, if Python 3.12.6 and 3.12.7 are installed, `uv python install 3.12 --reinstall` reinstalls both versions instead of installing the latest available 3.12 release. You can recover the previous upgrade behavior with `uv python install 3.12 --upgrade`. Combine `--upgrade --reinstall` to reinstall only the latest patch. - **Require `--upgrade-group` to name an existing dependency group** ([#​18957](https://redirect.github.com/astral-sh/uv/pull/18957)) Previously, `uv lock --upgrade-group docs` silently succeeded even if no `docs` [dependency group](https://docs.astral.sh/uv/concepts/projects/dependencies/#dependency-groups) existed. uv now validates the requested group against the project, its workspace members, and workspace-level dependency groups. You cannot opt out of this behavior. Correct the group name or add it to `[dependency-groups]`. Legacy `tool.uv.dev-dependencies` still satisfies `--upgrade-group dev`. - **Resolve relative indexes and find-links against `--directory`** ([#​20740](https://redirect.github.com/astral-sh/uv/pull/20740)) The `--directory` option changes the directory in which uv operates. Previously, relative index and find-links paths supplied on the command line were still resolved against the original working directory. uv now resolves `--index`, `--default-index`, `--index-url`, `--extra-index-url`, and `--find-links` relative to the directory selected by `--directory`. For example: ```console $ uv add --directory project --index ./packages example ``` This now uses `project/packages` instead of `./packages` in the original working directory. Absolute paths and indexes loaded from configuration files are unaffected. To preserve the previous target, pass an absolute path or adjust the relative path, e.g., `--index ../packages`. - **Preserve absolute paths provided to `uv add`** ([#​18402](https://redirect.github.com/astral-sh/uv/pull/18402)) `uv add` previously converted every local dependency into a project-relative path, even when the original request used an absolute path or a literal `file://` URL. It now preserves the form of the request in `pyproject.toml` and `uv.lock`: ```console $ uv add ../library # remains relative $ uv add /projects/library # remains absolute ``` Absolute paths make a project less portable. Use a relative path to avoid recording an absolute path. URLs containing expanded variables retain their existing relative-path behavior. - **Remove older PyPy distributions that are only available as bzip2 archives** ([#​20423](https://redirect.github.com/astral-sh/uv/pull/20423)) Older PyPy patch releases that are only distributed as `.tar.bz2` archives are no longer available through `uv python install`. These releases require unsupported bzip2 archives. The latest PyPy release for each supported Python minor version is available as a gzip-compressed archive and remains supported. For example, `uv python list 3.10 --all-versions` still includes the latest PyPy 3.10 release, but older bzip2-only patch releases are omitted. You cannot opt out of this behavior. Request a newer PyPy patch release instead. - **Omit excluded-package comments when annotations are disabled** ([#​20085](https://redirect.github.com/astral-sh/uv/pull/20085)) `uv pip compile --no-annotate` suppresses comments describing the generated requirements file. Previously, a footer listing packages excluded with `--unsafe-package` was still included, even though annotations were disabled. That footer is now omitted. You can recover the footer by removing `--no-annotate`. ##### Stabilizations - **TOML 1.0-compatible source distributions** ([#​20225](https://redirect.github.com/astral-sh/uv/pull/20225)) `uv_build` now writes a TOML 1.0-compatible `pyproject.toml` when building source distributions, allowing older Python build frontends to consume projects that use newer TOML syntax. The original project file remains available in the archive as `pyproject.toml.orig`. This stabilizes the `toml-backwards-compatibility` preview feature. - **Automatic open-file limit adjustment on Unix** ([#​20225](https://redirect.github.com/astral-sh/uv/pull/20225)) On Linux and macOS, uv now attempts to raise the soft open-file limit at startup toward the hard limit, capped at 1,048,576 descriptors. The new limit also applies to subprocesses and reduces failures caused by running out of file descriptors. If the limit cannot be raised, uv continues running with the existing limit. This stabilizes the `adjust-ulimit` preview feature. ##### Preview features - Allow `uv upgrade` to target multiple packages, upgrade all production dependencies, and exclude selected dependencies ([#​20338](https://redirect.github.com/astral-sh/uv/pull/20338)) ##### Bug fixes - Include extras activated by dependency groups when evaluating conflicts ([#​20237](https://redirect.github.com/astral-sh/uv/pull/20237)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/dominodatalab/cucu). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yNC4wIiwidXBkYXRlZEluVmVyIjoiNDQuMjkuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
rhuanbarreto
pushed a commit
to archgate/cli
that referenced
this pull request
Aug 21, 2026
This PR contains the following updates: | Package | Type | Update | Change | Pending | OpenSSF | |---|---|---|---|---|---| | [TrigenSoftware/simple-release-action](https://redirect.github.com/TrigenSoftware/simple-release-action) | action | patch | `v2.0.8` → `v2.0.9` | | [](https://securityscorecards.dev/viewer/?uri=github.com/TrigenSoftware/simple-release-action) | | [actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance) | action | minor | `v4.1.1` → `v4.2.2` | | [](https://securityscorecards.dev/viewer/?uri=github.com/actions/attest-build-provenance) | | [actions/checkout](https://redirect.github.com/actions/checkout) | action | patch | `v7.0.0` → `v7.0.1` | | [](https://securityscorecards.dev/viewer/?uri=github.com/actions/checkout) | | [actions/setup-java](https://redirect.github.com/actions/setup-java) | action | minor | `v5.6.0` → `v5.7.0` | | [](https://securityscorecards.dev/viewer/?uri=github.com/actions/setup-java) | | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | patch | `v4.37.1` → `v4.37.7` | `v4.37.8` | [](https://securityscorecards.dev/viewer/?uri=github.com/github/codeql-action) | | [ossf/scorecard-action](https://redirect.github.com/ossf/scorecard-action) | action | patch | `v2.4.3` → `v2.4.4` | | [](https://securityscorecards.dev/viewer/?uri=github.com/ossf/scorecard-action) | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.0` → `v1.14.2` | | [](https://securityscorecards.dev/viewer/?uri=github.com/pypa/gh-action-pypi-publish) | | [ruby/setup-ruby](https://redirect.github.com/ruby/setup-ruby) | action | minor | `v1.319.0` → `v1.321.0` | | [](https://securityscorecards.dev/viewer/?uri=github.com/ruby/setup-ruby) | | [zizmorcore/zizmor-action](https://redirect.github.com/zizmorcore/zizmor-action) | action | patch | `v0.6.0` → `v0.6.2` | | [](https://securityscorecards.dev/viewer/?uri=github.com/zizmorcore/zizmor-action) | --- ### Release Notes <details> <summary>TrigenSoftware/simple-release-action (TrigenSoftware/simple-release-action)</summary> ### [`v2.0.9`](https://redirect.github.com/TrigenSoftware/simple-release-action/releases/tag/v2.0.9) [Compare Source](https://redirect.github.com/TrigenSoftware/simple-release-action/compare/v2.0.8...v2.0.9) ##### Bug Fixes - install pinned addon dependency version correctly ([114ce1d](https://redirect.github.com/TrigenSoftware/simple-release-action/commit/114ce1d312107d48fa54cbd98b74b990d0581344)) </details> <details> <summary>actions/attest-build-provenance (actions/attest-build-provenance)</summary> ### [`v4.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.2.2) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2) > \[!NOTE] > As of version 4, `actions/attest-build-provenance` is simply a wrapper on top of [`actions/attest`](https://redirect.github.com/actions/attest). > > Existing applications may continue to use the `attest-build-provenance` action, but new implementations should use `actions/attest` instead. ##### What's Changed - Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​862](https://redirect.github.com/actions/attest-build-provenance/pull/862) **Full Changelog**: <actions/attest-build-provenance@v4.1.1...v4.2.2> </details> <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](https://redirect.github.com/actions/checkout/compare/v7...v7.0.1) - Bump github/codeql-action from 3 to 4 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2475](https://redirect.github.com/actions/checkout/pull/2475) - Bump actions/setup-node from 4 to 6 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2477](https://redirect.github.com/actions/checkout/pull/2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2478](https://redirect.github.com/actions/checkout/pull/2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2479](https://redirect.github.com/actions/checkout/pull/2479) - Bump actions/checkout from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2488](https://redirect.github.com/actions/checkout/pull/2488) - Bump actions/upload-artifact from 4 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2476](https://redirect.github.com/actions/checkout/pull/2476) - eslint 9 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2474](https://redirect.github.com/actions/checkout/pull/2474) - Bump the minor-actions-dependencies group with 2 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2499](https://redirect.github.com/actions/checkout/pull/2499) - skip running unsafe pr check if input is default by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2518](https://redirect.github.com/actions/checkout/pull/2518) - trim only ascii whitespace for branch by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2521](https://redirect.github.com/actions/checkout/pull/2521) - escape values passed to --unset by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2530](https://redirect.github.com/actions/checkout/pull/2530) </details> <details> <summary>actions/setup-java (actions/setup-java)</summary> ### [`v5.7.0`](https://redirect.github.com/actions/setup-java/compare/v5.6.0...v5.7.0) [Compare Source](https://redirect.github.com/actions/setup-java/compare/v5.6.0...v5.7.0) </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v4.37.7`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.7) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.6...v4.37.7) - Update default CodeQL bundle version to [2.26.3](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#​4085](https://redirect.github.com/github/codeql-action/pull/4085) ### [`v4.37.6`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.6) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.5...v4.37.6) - Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#​4070](https://redirect.github.com/github/codeql-action/pull/4070) ### [`v4.37.5`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.5) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.4...v4.37.5) - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#​4061](https://redirect.github.com/github/codeql-action/pull/4061) ### [`v4.37.4`](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4) ### [`v4.37.3`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.3) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.2...v4.37.3) No user facing changes. ### [`v4.37.2`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.2) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.1...v4.37.2) - The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#​4023](https://redirect.github.com/github/codeql-action/pull/4023) - The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#​4007](https://redirect.github.com/github/codeql-action/pull/4007) </details> <details> <summary>ossf/scorecard-action (ossf/scorecard-action)</summary> ### [`v2.4.4`](https://redirect.github.com/ossf/scorecard-action/releases/tag/v2.4.4) [Compare Source](https://redirect.github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4) #### What's Changed This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the [Scorecard v5.4.0 release notes](https://redirect.github.com/ossf/scorecard/releases/tag/v5.4.0) and the [Scorecard v5.5.0 release notes](https://redirect.github.com/ossf/scorecard/releases/tag/v5.5.0). - log POST failures instead of failing entire action by [@​spencerschrock](https://redirect.github.com/spencerschrock) in [#​1625](https://redirect.github.com/ossf/scorecard-action/pull/1625) **Full Changelog**: <ossf/scorecard-action@v2.4.3...v2.4.4> </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 ### [`v1.14.1`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.1) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.0...v1.14.1) <p align="right"><i>This release was cut at <a href="https://ep2026.europython.eu/sprints/">EuroPython 2026 Sprints</a></i></p> #### 🛠️ Internal Dependencies [@​adisivaprasad](https://redirect.github.com/adisivaprasad)[💰](https://redirect.github.com/sponsors/adisivaprasad) helped get rid of the GitHub Actions runner warning about the old Node 20 runtime being used by updating `actions/setup-python` from v5.6.0 to v6.2.0 in [#​408](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408). #### 💪 New Contributors - [@​adisivaprasad](https://redirect.github.com/adisivaprasad) made their first contribution in [#​408](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408) - [@​jylenhof](https://redirect.github.com/jylenhof)[💰](https://redirect.github.com/sponsors/jylenhof) followed up and reminded us to actually cut this release in [#​413](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/413) **🪞 Full Diff**: <pypa/gh-action-pypi-publish@v1.14.0...v1.14.1> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​jylenhof](https://redirect.github.com/jylenhof)[💰](https://redirect.github.com/sponsors/jylenhof) for reminding me to work on this release! **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrd7jpnxc22d), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/116970132515797444) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/414 </details> <details> <summary>ruby/setup-ruby (ruby/setup-ruby)</summary> ### [`v1.321.0`](https://redirect.github.com/ruby/setup-ruby/releases/tag/v1.321.0) [Compare Source](https://redirect.github.com/ruby/setup-ruby/compare/v1.320.0...v1.321.0) #### What's Changed - Add jruby-10.1.1.0 by [@​ruby-builder-bot](https://redirect.github.com/ruby-builder-bot) in [#​932](https://redirect.github.com/ruby/setup-ruby/pull/932) **Full Changelog**: <ruby/setup-ruby@v1.320.0...v1.321.0> ### [`v1.320.0`](https://redirect.github.com/ruby/setup-ruby/releases/tag/v1.320.0) [Compare Source](https://redirect.github.com/ruby/setup-ruby/compare/v1.319.0...v1.320.0) #### What's Changed - Update CRuby releases on Windows by [@​ruby-builder-bot](https://redirect.github.com/ruby-builder-bot) in [#​931](https://redirect.github.com/ruby/setup-ruby/pull/931) **Full Changelog**: <ruby/setup-ruby@v1.319.0...v1.320.0> </details> <details> <summary>zizmorcore/zizmor-action (zizmorcore/zizmor-action)</summary> ### [`v0.6.2`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.6.2) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.1...v0.6.2) zizmor 1.29.0 is now the default version. ### [`v0.6.1`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.6.1) [Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.0...v0.6.1) zizmor 1.28.0 is now the default version used by the action. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Oslo) - Branch creation - Between 12:00 AM and 05:59 AM, between day 25 and 31 of the month, and on Sunday (`* 0-5 25-31 * 0`) - Automerge - Between 12:00 AM and 05:59 AM, between day 25 and 31 of the month, and on Sunday (`* 0-5 25-31 * 0`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/archgate/cli). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What do these changes do?
The release signed every dist in a single
deployjob: the PyPI publish step signs a PEP 740 attestation for each dist, and the standalone Sigstore step signs them again for the GitHub Release. Both mint one short lived OIDC identity per job and reuse it for the whole set. With the current wheel matrix that loop takes about five minutes, right at the OIDC token lifetime, so it now fails partway through withsigstore.oidc.ExpiredIdentity(pypa/gh-action-pypi-publish#307). The v3.14.3 release hit this on several attempts.This turns the
deployjob into a matrix of groups. Each group is its own job, so it mints a fresh OIDC identity and signs only its share of the dists, comfortably under the token lifetime. The groups run in parallel; the first one creates the GitHub Release and the others wait for it, then each group publishes and signs its own disjoint share.Both the GitHub Release and the PyPI upload are install vectors, so both stay behind the required-reviewer
pypienvironment. Because every group targets that environment and they are pending at the same time, a reviewer approves them in a single review, so a release still needs exactly one approval and it now gates both Release creation and the PyPI upload. If a reviewer declines, nothing is created or published.The split is deterministic and every step is idempotent, so a flaky run can be re-run and still complete:
LC_ALL=C) sort, so a given dist always lands in the same group, and re-running one failed group reprocesses exactly its own share without touching another group's dists;skip-existing: true, so already uploaded dists are skipped on a retry;softprops/action-gh-releaseoverwrites signature assets by default, so re-uploads are clean;Make Releaseis guarded by an existence check that branches on the HTTP 404 status rather than on gh's wording.Are there changes in behavior for the user?
No end user impact. This only changes how the release workflow publishes and signs dists.
Is it a substantial burden for the maintainers to support this?
No, it splits one job into a small gated matrix. Worth a look during review:
N of Mmatrix label, which is the single source of truth; to add a group, extend the matrix list (e.g.1 of 3..3 of 3) and re-check that a group's share still signs under the token lifetime as the wheel matrix grows. Keepgroupthe only matrix axis, since the label-derived split assumes the first label is job-index 0;pypienvironment are unchanged, so the PyPI trusted publisher identity still matches.Related issue number
Refs pypa/gh-action-pypi-publish#307.
Checklist
CONTRIBUTORS.txt(already present)CHANGES/folderValidation
Cannot be exercised without a real tagged release (trusted publishing plus OIDC), so it was validated statically:
The dist partition was checked in bash 5: for 16 dists, two groups keep 8 and 8 with no overlap and full coverage; a three group split keeps 6, 5, 5.
Drafted with Claude Code (Fable 5); reviewed by @bdraco.