Skip to content

Bump the actions group across 1 directory with 10 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df
Open

Bump the actions group across 1 directory with 10 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 12, 2026

Copy link
Copy Markdown

Bumps the actions group with 10 updates in the / directory:

PackageFromTo
actions/checkout7.0.07.0.1
mamba-org/setup-micromamba3.0.03.2.0
Parcels-code/pixi-lock/create-and-cache0.1.00.1.1
Parcels-code/pixi-lock/restore0.1.00.1.1
prefix-dev/setup-pixi0.9.60.10.1
zizmorcore/zizmor-action0.5.70.6.2
scientific-python/issue-from-pytest-log-action1.5.01.6.2
actions/labeler6.1.07.0.0
actions/setup-python6.3.07.0.0
pypa/gh-action-pypi-publish1.14.01.14.2

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates mamba-org/setup-micromamba from 3.0.0 to 3.2.0

Release notes

Sourced from mamba-org/setup-micromamba's releases.

v3.2.0

What's Changed

New features

Full Changelog: mamba-org/setup-micromamba@v3.1.0...v3.2.0

v3.1.0

What's Changed

New features

Documentation

Dependency updates

New Contributors

Full Changelog: mamba-org/setup-micromamba@v3.0.0...v3.1.0

Commits
  • d6abac3 feat: Support prereleases of micromamba (#310)
  • ce51e99 Bump the node group across 1 directory with 14 updates (#309)
  • fb7186a Support Windows ARM64 (win-arm64) (#269)
  • 60f1092 Bump the actions group with 3 updates (#312)
  • ed54f9b Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (#311)
  • 60b4c82 Bump the actions group across 1 directory with 5 updates (#308)
  • 63fffb4 Update README examples to use setup-micromamba v3 (#305)
  • 8959ca9 Bump the actions group with 3 updates (#299)
  • See full diff in compare view

Updates Parcels-code/pixi-lock/create-and-cache from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/create-and-cache's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates Parcels-code/pixi-lock/restore from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/restore's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates prefix-dev/setup-pixi from 0.9.6 to 0.10.1

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.10.1

What's Changed

⬆️ Dependency updates

🤷🏻 Other changes

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.10.0...v0.10.1

v0.10.0

What's Changed

💥 Breaking changes

⬆️ Dependency updates

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.9.6...v0.10.0

Commits
  • f00437f Update dependencies and add pnpm workspace configuration (#279)
  • d0c199d chore(deps): bump the gh-actions group with 3 updates (#276)
  • 2253d9c chore(deps): bump the gh-actions group with 3 updates (#273)
  • c5359a3 chore(deps): bump the nodejs group with 6 updates (#274)
  • a09b624 feat: change post-cleanup default to false (#272)
  • 947fc1f chore(deps): bump the nodejs group with 6 updates (#269)
  • 36c1c8c chore(deps): bump the gh-actions group with 2 updates (#268)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

v0.6.1

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

Updates scientific-python/issue-from-pytest-log-action from 1.5.0 to 1.6.2

Release notes

Sourced from scientific-python/issue-from-pytest-log-action's releases.

v1.6.2

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.6.1...v1.6.2

v1.6.0

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.5.0...v1.6.0

Commits

Updates actions/labeler from 6.1.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

Dependency Updates

Full Changelog: actions/labeler@v6.1.0...v6.2.0

Commits
  • bf12e9b feat: migrate to ESM and update dependencies (#949)
  • b8dd2d9 Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 (#942)
  • 53affe8 Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...
  • f612d9a Fix: Improve PR number validation and warning messages in input handling (#939)
  • See full diff in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager:@​webknjaz🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discusson Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 10 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [mamba-org/setup-micromamba](https://github.com/mamba-org/setup-micromamba) | `3.0.0` | `3.2.0` |
| [Parcels-code/pixi-lock/create-and-cache](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [Parcels-code/pixi-lock/restore](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.6` | `0.10.1` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` |
| [scientific-python/issue-from-pytest-log-action](https://github.com/scientific-python/issue-from-pytest-log-action) | `1.5.0` | `1.6.2` |
| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)
Updates `mamba-org/setup-micromamba` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/mamba-org/setup-micromamba/releases)
- [Commits](mamba-org/setup-micromamba@d7c9bd8...d6abac3)
Updates `Parcels-code/pixi-lock/create-and-cache` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `Parcels-code/pixi-lock/restore` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `prefix-dev/setup-pixi` from 0.9.6 to 0.10.1
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@5185adf...f00437f)
Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc)
Updates `scientific-python/issue-from-pytest-log-action` from 1.5.0 to 1.6.2
- [Release notes](https://github.com/scientific-python/issue-from-pytest-log-action/releases)
- [Commits](scientific-python/issue-from-pytest-log-action@v1.5.0...35b4e0a)
Updates `actions/labeler` from 6.1.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@f27b608...bf12e9b)
Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)
Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: mamba-org/setup-micromamba
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/create-and-cache
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/restore
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: prefix-dev/setup-pixi
dependency-version: 0.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: scientific-python/issue-from-pytest-log-action
dependency-version: 1.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: actions/labeler
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/setup-python
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Bump the actions group across 1 directory with 10 updates by dependabot[bot] · Pull Request #26 · slevang/xarray · GitHub
Skip to content

Bump the actions group across 1 directory with 10 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df
Open

Bump the actions group across 1 directory with 10 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 12, 2026

Copy link
Copy Markdown

Bumps the actions group with 10 updates in the / directory:

PackageFromTo
actions/checkout7.0.07.0.1
mamba-org/setup-micromamba3.0.03.2.0
Parcels-code/pixi-lock/create-and-cache0.1.00.1.1
Parcels-code/pixi-lock/restore0.1.00.1.1
prefix-dev/setup-pixi0.9.60.10.1
zizmorcore/zizmor-action0.5.70.6.2
scientific-python/issue-from-pytest-log-action1.5.01.6.2
actions/labeler6.1.07.0.0
actions/setup-python6.3.07.0.0
pypa/gh-action-pypi-publish1.14.01.14.2

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates mamba-org/setup-micromamba from 3.0.0 to 3.2.0

Release notes

Sourced from mamba-org/setup-micromamba's releases.

v3.2.0

What's Changed

New features

Full Changelog: mamba-org/setup-micromamba@v3.1.0...v3.2.0

v3.1.0

What's Changed

New features

Documentation

Dependency updates

New Contributors

Full Changelog: mamba-org/setup-micromamba@v3.0.0...v3.1.0

Commits
  • d6abac3 feat: Support prereleases of micromamba (#310)
  • ce51e99 Bump the node group across 1 directory with 14 updates (#309)
  • fb7186a Support Windows ARM64 (win-arm64) (#269)
  • 60f1092 Bump the actions group with 3 updates (#312)
  • ed54f9b Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (#311)
  • 60b4c82 Bump the actions group across 1 directory with 5 updates (#308)
  • 63fffb4 Update README examples to use setup-micromamba v3 (#305)
  • 8959ca9 Bump the actions group with 3 updates (#299)
  • See full diff in compare view

Updates Parcels-code/pixi-lock/create-and-cache from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/create-and-cache's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates Parcels-code/pixi-lock/restore from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/restore's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates prefix-dev/setup-pixi from 0.9.6 to 0.10.1

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.10.1

What's Changed

⬆️ Dependency updates

🤷🏻 Other changes

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.10.0...v0.10.1

v0.10.0

What's Changed

💥 Breaking changes

⬆️ Dependency updates

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.9.6...v0.10.0

Commits
  • f00437f Update dependencies and add pnpm workspace configuration (#279)
  • d0c199d chore(deps): bump the gh-actions group with 3 updates (#276)
  • 2253d9c chore(deps): bump the gh-actions group with 3 updates (#273)
  • c5359a3 chore(deps): bump the nodejs group with 6 updates (#274)
  • a09b624 feat: change post-cleanup default to false (#272)
  • 947fc1f chore(deps): bump the nodejs group with 6 updates (#269)
  • 36c1c8c chore(deps): bump the gh-actions group with 2 updates (#268)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

v0.6.1

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

Updates scientific-python/issue-from-pytest-log-action from 1.5.0 to 1.6.2

Release notes

Sourced from scientific-python/issue-from-pytest-log-action's releases.

v1.6.2

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.6.1...v1.6.2

v1.6.0

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.5.0...v1.6.0

Commits

Updates actions/labeler from 6.1.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

Dependency Updates

Full Changelog: actions/labeler@v6.1.0...v6.2.0

Commits
  • bf12e9b feat: migrate to ESM and update dependencies (#949)
  • b8dd2d9 Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 (#942)
  • 53affe8 Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...
  • f612d9a Fix: Improve PR number validation and warning messages in input handling (#939)
  • See full diff in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager:@​webknjaz🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discusson Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 10 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [mamba-org/setup-micromamba](https://github.com/mamba-org/setup-micromamba) | `3.0.0` | `3.2.0` |
| [Parcels-code/pixi-lock/create-and-cache](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [Parcels-code/pixi-lock/restore](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.6` | `0.10.1` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` |
| [scientific-python/issue-from-pytest-log-action](https://github.com/scientific-python/issue-from-pytest-log-action) | `1.5.0` | `1.6.2` |
| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)
Updates `mamba-org/setup-micromamba` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/mamba-org/setup-micromamba/releases)
- [Commits](mamba-org/setup-micromamba@d7c9bd8...d6abac3)
Updates `Parcels-code/pixi-lock/create-and-cache` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `Parcels-code/pixi-lock/restore` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `prefix-dev/setup-pixi` from 0.9.6 to 0.10.1
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@5185adf...f00437f)
Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc)
Updates `scientific-python/issue-from-pytest-log-action` from 1.5.0 to 1.6.2
- [Release notes](https://github.com/scientific-python/issue-from-pytest-log-action/releases)
- [Commits](scientific-python/issue-from-pytest-log-action@v1.5.0...35b4e0a)
Updates `actions/labeler` from 6.1.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@f27b608...bf12e9b)
Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)
Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: mamba-org/setup-micromamba
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/create-and-cache
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/restore
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: prefix-dev/setup-pixi
dependency-version: 0.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: scientific-python/issue-from-pytest-log-action
dependency-version: 1.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: actions/labeler
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/setup-python
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Force GitHub README to respect dark mode (function() { var style = document.createElement('style'); style.textContent = ' .markdown-body { color-scheme: dark light; } .markdown-body pre { background: #161b22 !important; } .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; } .markdown-body table th, .markdown-body table td { border-color: #30363d !important; } .markdown-body img { background: #0d1117; } .markdown-body blockquote { border-left-color: #8b949e; } .markdown-body hr { border-color: #30363d; } '; document.head.appendChild(style); })(); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Bump the actions group across 1 directory with 10 updates by dependabot[bot] · Pull Request #26 · slevang/xarray · GitHub
Skip to content

Bump the actions group across 1 directory with 10 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df
Open

Bump the actions group across 1 directory with 10 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 12, 2026

Copy link
Copy Markdown

Bumps the actions group with 10 updates in the / directory:

PackageFromTo
actions/checkout7.0.07.0.1
mamba-org/setup-micromamba3.0.03.2.0
Parcels-code/pixi-lock/create-and-cache0.1.00.1.1
Parcels-code/pixi-lock/restore0.1.00.1.1
prefix-dev/setup-pixi0.9.60.10.1
zizmorcore/zizmor-action0.5.70.6.2
scientific-python/issue-from-pytest-log-action1.5.01.6.2
actions/labeler6.1.07.0.0
actions/setup-python6.3.07.0.0
pypa/gh-action-pypi-publish1.14.01.14.2

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates mamba-org/setup-micromamba from 3.0.0 to 3.2.0

Release notes

Sourced from mamba-org/setup-micromamba's releases.

v3.2.0

What's Changed

New features

Full Changelog: mamba-org/setup-micromamba@v3.1.0...v3.2.0

v3.1.0

What's Changed

New features

Documentation

Dependency updates

New Contributors

Full Changelog: mamba-org/setup-micromamba@v3.0.0...v3.1.0

Commits
  • d6abac3 feat: Support prereleases of micromamba (#310)
  • ce51e99 Bump the node group across 1 directory with 14 updates (#309)
  • fb7186a Support Windows ARM64 (win-arm64) (#269)
  • 60f1092 Bump the actions group with 3 updates (#312)
  • ed54f9b Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (#311)
  • 60b4c82 Bump the actions group across 1 directory with 5 updates (#308)
  • 63fffb4 Update README examples to use setup-micromamba v3 (#305)
  • 8959ca9 Bump the actions group with 3 updates (#299)
  • See full diff in compare view

Updates Parcels-code/pixi-lock/create-and-cache from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/create-and-cache's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates Parcels-code/pixi-lock/restore from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/restore's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates prefix-dev/setup-pixi from 0.9.6 to 0.10.1

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.10.1

What's Changed

⬆️ Dependency updates

🤷🏻 Other changes

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.10.0...v0.10.1

v0.10.0

What's Changed

💥 Breaking changes

⬆️ Dependency updates

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.9.6...v0.10.0

Commits
  • f00437f Update dependencies and add pnpm workspace configuration (#279)
  • d0c199d chore(deps): bump the gh-actions group with 3 updates (#276)
  • 2253d9c chore(deps): bump the gh-actions group with 3 updates (#273)
  • c5359a3 chore(deps): bump the nodejs group with 6 updates (#274)
  • a09b624 feat: change post-cleanup default to false (#272)
  • 947fc1f chore(deps): bump the nodejs group with 6 updates (#269)
  • 36c1c8c chore(deps): bump the gh-actions group with 2 updates (#268)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

v0.6.1

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

Updates scientific-python/issue-from-pytest-log-action from 1.5.0 to 1.6.2

Release notes

Sourced from scientific-python/issue-from-pytest-log-action's releases.

v1.6.2

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.6.1...v1.6.2

v1.6.0

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.5.0...v1.6.0

Commits

Updates actions/labeler from 6.1.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

Dependency Updates

Full Changelog: actions/labeler@v6.1.0...v6.2.0

Commits
  • bf12e9b feat: migrate to ESM and update dependencies (#949)
  • b8dd2d9 Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 (#942)
  • 53affe8 Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...
  • f612d9a Fix: Improve PR number validation and warning messages in input handling (#939)
  • See full diff in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager:@​webknjaz🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discusson Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 10 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [mamba-org/setup-micromamba](https://github.com/mamba-org/setup-micromamba) | `3.0.0` | `3.2.0` |
| [Parcels-code/pixi-lock/create-and-cache](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [Parcels-code/pixi-lock/restore](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.6` | `0.10.1` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` |
| [scientific-python/issue-from-pytest-log-action](https://github.com/scientific-python/issue-from-pytest-log-action) | `1.5.0` | `1.6.2` |
| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)
Updates `mamba-org/setup-micromamba` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/mamba-org/setup-micromamba/releases)
- [Commits](mamba-org/setup-micromamba@d7c9bd8...d6abac3)
Updates `Parcels-code/pixi-lock/create-and-cache` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `Parcels-code/pixi-lock/restore` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `prefix-dev/setup-pixi` from 0.9.6 to 0.10.1
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@5185adf...f00437f)
Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc)
Updates `scientific-python/issue-from-pytest-log-action` from 1.5.0 to 1.6.2
- [Release notes](https://github.com/scientific-python/issue-from-pytest-log-action/releases)
- [Commits](scientific-python/issue-from-pytest-log-action@v1.5.0...35b4e0a)
Updates `actions/labeler` from 6.1.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@f27b608...bf12e9b)
Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)
Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: mamba-org/setup-micromamba
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/create-and-cache
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/restore
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: prefix-dev/setup-pixi
dependency-version: 0.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: scientific-python/issue-from-pytest-log-action
dependency-version: 1.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: actions/labeler
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/setup-python
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Highlight search terms from Google/DuckDuckGo/Bing referrer (function() { var ref = document.referrer; var terms = []; if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) { var url = new URL(ref); var q = url.searchParams.get('q') || url.searchParams.get('p'); if (q) { terms = q.split(/\s+/).filter(function(t) { return t.length > 2; }); } } if (terms.length === 0) return; var style = document.createElement('style'); style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }'; document.head.appendChild(style); function highlight(node) { if (node.nodeType === 3) { // text node var text = node.textContent; var found = false; terms.forEach(function(term) { var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Bump the actions group across 1 directory with 10 updates by dependabot[bot] · Pull Request #26 · slevang/xarray · GitHub
Skip to content

Bump the actions group across 1 directory with 10 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df
Open

Bump the actions group across 1 directory with 10 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 12, 2026

Copy link
Copy Markdown

Bumps the actions group with 10 updates in the / directory:

PackageFromTo
actions/checkout7.0.07.0.1
mamba-org/setup-micromamba3.0.03.2.0
Parcels-code/pixi-lock/create-and-cache0.1.00.1.1
Parcels-code/pixi-lock/restore0.1.00.1.1
prefix-dev/setup-pixi0.9.60.10.1
zizmorcore/zizmor-action0.5.70.6.2
scientific-python/issue-from-pytest-log-action1.5.01.6.2
actions/labeler6.1.07.0.0
actions/setup-python6.3.07.0.0
pypa/gh-action-pypi-publish1.14.01.14.2

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates mamba-org/setup-micromamba from 3.0.0 to 3.2.0

Release notes

Sourced from mamba-org/setup-micromamba's releases.

v3.2.0

What's Changed

New features

Full Changelog: mamba-org/setup-micromamba@v3.1.0...v3.2.0

v3.1.0

What's Changed

New features

Documentation

Dependency updates

New Contributors

Full Changelog: mamba-org/setup-micromamba@v3.0.0...v3.1.0

Commits
  • d6abac3 feat: Support prereleases of micromamba (#310)
  • ce51e99 Bump the node group across 1 directory with 14 updates (#309)
  • fb7186a Support Windows ARM64 (win-arm64) (#269)
  • 60f1092 Bump the actions group with 3 updates (#312)
  • ed54f9b Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (#311)
  • 60b4c82 Bump the actions group across 1 directory with 5 updates (#308)
  • 63fffb4 Update README examples to use setup-micromamba v3 (#305)
  • 8959ca9 Bump the actions group with 3 updates (#299)
  • See full diff in compare view

Updates Parcels-code/pixi-lock/create-and-cache from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/create-and-cache's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates Parcels-code/pixi-lock/restore from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/restore's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates prefix-dev/setup-pixi from 0.9.6 to 0.10.1

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.10.1

What's Changed

⬆️ Dependency updates

🤷🏻 Other changes

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.10.0...v0.10.1

v0.10.0

What's Changed

💥 Breaking changes

⬆️ Dependency updates

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.9.6...v0.10.0

Commits
  • f00437f Update dependencies and add pnpm workspace configuration (#279)
  • d0c199d chore(deps): bump the gh-actions group with 3 updates (#276)
  • 2253d9c chore(deps): bump the gh-actions group with 3 updates (#273)
  • c5359a3 chore(deps): bump the nodejs group with 6 updates (#274)
  • a09b624 feat: change post-cleanup default to false (#272)
  • 947fc1f chore(deps): bump the nodejs group with 6 updates (#269)
  • 36c1c8c chore(deps): bump the gh-actions group with 2 updates (#268)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

v0.6.1

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

Updates scientific-python/issue-from-pytest-log-action from 1.5.0 to 1.6.2

Release notes

Sourced from scientific-python/issue-from-pytest-log-action's releases.

v1.6.2

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.6.1...v1.6.2

v1.6.0

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.5.0...v1.6.0

Commits

Updates actions/labeler from 6.1.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

Dependency Updates

Full Changelog: actions/labeler@v6.1.0...v6.2.0

Commits
  • bf12e9b feat: migrate to ESM and update dependencies (#949)
  • b8dd2d9 Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 (#942)
  • 53affe8 Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...
  • f612d9a Fix: Improve PR number validation and warning messages in input handling (#939)
  • See full diff in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager:@​webknjaz🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discusson Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 10 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [mamba-org/setup-micromamba](https://github.com/mamba-org/setup-micromamba) | `3.0.0` | `3.2.0` |
| [Parcels-code/pixi-lock/create-and-cache](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [Parcels-code/pixi-lock/restore](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.6` | `0.10.1` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` |
| [scientific-python/issue-from-pytest-log-action](https://github.com/scientific-python/issue-from-pytest-log-action) | `1.5.0` | `1.6.2` |
| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)
Updates `mamba-org/setup-micromamba` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/mamba-org/setup-micromamba/releases)
- [Commits](mamba-org/setup-micromamba@d7c9bd8...d6abac3)
Updates `Parcels-code/pixi-lock/create-and-cache` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `Parcels-code/pixi-lock/restore` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `prefix-dev/setup-pixi` from 0.9.6 to 0.10.1
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@5185adf...f00437f)
Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc)
Updates `scientific-python/issue-from-pytest-log-action` from 1.5.0 to 1.6.2
- [Release notes](https://github.com/scientific-python/issue-from-pytest-log-action/releases)
- [Commits](scientific-python/issue-from-pytest-log-action@v1.5.0...35b4e0a)
Updates `actions/labeler` from 6.1.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@f27b608...bf12e9b)
Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)
Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: mamba-org/setup-micromamba
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/create-and-cache
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/restore
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: prefix-dev/setup-pixi
dependency-version: 0.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: scientific-python/issue-from-pytest-log-action
dependency-version: 1.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: actions/labeler
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/setup-python
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ' Bump the actions group across 1 directory with 10 updates by dependabot[bot] · Pull Request #26 · slevang/xarray · GitHub
Skip to content

Bump the actions group across 1 directory with 10 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df
Open

Bump the actions group across 1 directory with 10 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 12, 2026

Copy link
Copy Markdown

Bumps the actions group with 10 updates in the / directory:

PackageFromTo
actions/checkout7.0.07.0.1
mamba-org/setup-micromamba3.0.03.2.0
Parcels-code/pixi-lock/create-and-cache0.1.00.1.1
Parcels-code/pixi-lock/restore0.1.00.1.1
prefix-dev/setup-pixi0.9.60.10.1
zizmorcore/zizmor-action0.5.70.6.2
scientific-python/issue-from-pytest-log-action1.5.01.6.2
actions/labeler6.1.07.0.0
actions/setup-python6.3.07.0.0
pypa/gh-action-pypi-publish1.14.01.14.2

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates mamba-org/setup-micromamba from 3.0.0 to 3.2.0

Release notes

Sourced from mamba-org/setup-micromamba's releases.

v3.2.0

What's Changed

New features

Full Changelog: mamba-org/setup-micromamba@v3.1.0...v3.2.0

v3.1.0

What's Changed

New features

Documentation

Dependency updates

New Contributors

Full Changelog: mamba-org/setup-micromamba@v3.0.0...v3.1.0

Commits
  • d6abac3 feat: Support prereleases of micromamba (#310)
  • ce51e99 Bump the node group across 1 directory with 14 updates (#309)
  • fb7186a Support Windows ARM64 (win-arm64) (#269)
  • 60f1092 Bump the actions group with 3 updates (#312)
  • ed54f9b Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (#311)
  • 60b4c82 Bump the actions group across 1 directory with 5 updates (#308)
  • 63fffb4 Update README examples to use setup-micromamba v3 (#305)
  • 8959ca9 Bump the actions group with 3 updates (#299)
  • See full diff in compare view

Updates Parcels-code/pixi-lock/create-and-cache from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/create-and-cache's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates Parcels-code/pixi-lock/restore from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/restore's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates prefix-dev/setup-pixi from 0.9.6 to 0.10.1

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.10.1

What's Changed

⬆️ Dependency updates

🤷🏻 Other changes

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.10.0...v0.10.1

v0.10.0

What's Changed

💥 Breaking changes

⬆️ Dependency updates

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.9.6...v0.10.0

Commits
  • f00437f Update dependencies and add pnpm workspace configuration (#279)
  • d0c199d chore(deps): bump the gh-actions group with 3 updates (#276)
  • 2253d9c chore(deps): bump the gh-actions group with 3 updates (#273)
  • c5359a3 chore(deps): bump the nodejs group with 6 updates (#274)
  • a09b624 feat: change post-cleanup default to false (#272)
  • 947fc1f chore(deps): bump the nodejs group with 6 updates (#269)
  • 36c1c8c chore(deps): bump the gh-actions group with 2 updates (#268)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

v0.6.1

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

Updates scientific-python/issue-from-pytest-log-action from 1.5.0 to 1.6.2

Release notes

Sourced from scientific-python/issue-from-pytest-log-action's releases.

v1.6.2

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.6.1...v1.6.2

v1.6.0

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.5.0...v1.6.0

Commits

Updates actions/labeler from 6.1.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

Dependency Updates

Full Changelog: actions/labeler@v6.1.0...v6.2.0

Commits
  • bf12e9b feat: migrate to ESM and update dependencies (#949)
  • b8dd2d9 Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 (#942)
  • 53affe8 Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...
  • f612d9a Fix: Improve PR number validation and warning messages in input handling (#939)
  • See full diff in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager:@​webknjaz🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discusson Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 10 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [mamba-org/setup-micromamba](https://github.com/mamba-org/setup-micromamba) | `3.0.0` | `3.2.0` |
| [Parcels-code/pixi-lock/create-and-cache](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [Parcels-code/pixi-lock/restore](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.6` | `0.10.1` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` |
| [scientific-python/issue-from-pytest-log-action](https://github.com/scientific-python/issue-from-pytest-log-action) | `1.5.0` | `1.6.2` |
| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)
Updates `mamba-org/setup-micromamba` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/mamba-org/setup-micromamba/releases)
- [Commits](mamba-org/setup-micromamba@d7c9bd8...d6abac3)
Updates `Parcels-code/pixi-lock/create-and-cache` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `Parcels-code/pixi-lock/restore` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `prefix-dev/setup-pixi` from 0.9.6 to 0.10.1
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@5185adf...f00437f)
Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc)
Updates `scientific-python/issue-from-pytest-log-action` from 1.5.0 to 1.6.2
- [Release notes](https://github.com/scientific-python/issue-from-pytest-log-action/releases)
- [Commits](scientific-python/issue-from-pytest-log-action@v1.5.0...35b4e0a)
Updates `actions/labeler` from 6.1.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@f27b608...bf12e9b)
Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)
Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: mamba-org/setup-micromamba
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/create-and-cache
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/restore
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: prefix-dev/setup-pixi
dependency-version: 0.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: scientific-python/issue-from-pytest-log-action
dependency-version: 1.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: actions/labeler
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/setup-python
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Bump the actions group across 1 directory with 10 updates by dependabot[bot] · Pull Request #26 · slevang/xarray · GitHub
Skip to content

Bump the actions group across 1 directory with 10 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df
Open

Bump the actions group across 1 directory with 10 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 12, 2026

Copy link
Copy Markdown

Bumps the actions group with 10 updates in the / directory:

PackageFromTo
actions/checkout7.0.07.0.1
mamba-org/setup-micromamba3.0.03.2.0
Parcels-code/pixi-lock/create-and-cache0.1.00.1.1
Parcels-code/pixi-lock/restore0.1.00.1.1
prefix-dev/setup-pixi0.9.60.10.1
zizmorcore/zizmor-action0.5.70.6.2
scientific-python/issue-from-pytest-log-action1.5.01.6.2
actions/labeler6.1.07.0.0
actions/setup-python6.3.07.0.0
pypa/gh-action-pypi-publish1.14.01.14.2

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates mamba-org/setup-micromamba from 3.0.0 to 3.2.0

Release notes

Sourced from mamba-org/setup-micromamba's releases.

v3.2.0

What's Changed

New features

Full Changelog: mamba-org/setup-micromamba@v3.1.0...v3.2.0

v3.1.0

What's Changed

New features

Documentation

Dependency updates

New Contributors

Full Changelog: mamba-org/setup-micromamba@v3.0.0...v3.1.0

Commits
  • d6abac3 feat: Support prereleases of micromamba (#310)
  • ce51e99 Bump the node group across 1 directory with 14 updates (#309)
  • fb7186a Support Windows ARM64 (win-arm64) (#269)
  • 60f1092 Bump the actions group with 3 updates (#312)
  • ed54f9b Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (#311)
  • 60b4c82 Bump the actions group across 1 directory with 5 updates (#308)
  • 63fffb4 Update README examples to use setup-micromamba v3 (#305)
  • 8959ca9 Bump the actions group with 3 updates (#299)
  • See full diff in compare view

Updates Parcels-code/pixi-lock/create-and-cache from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/create-and-cache's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates Parcels-code/pixi-lock/restore from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/restore's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates prefix-dev/setup-pixi from 0.9.6 to 0.10.1

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.10.1

What's Changed

⬆️ Dependency updates

🤷🏻 Other changes

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.10.0...v0.10.1

v0.10.0

What's Changed

💥 Breaking changes

⬆️ Dependency updates

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.9.6...v0.10.0

Commits
  • f00437f Update dependencies and add pnpm workspace configuration (#279)
  • d0c199d chore(deps): bump the gh-actions group with 3 updates (#276)
  • 2253d9c chore(deps): bump the gh-actions group with 3 updates (#273)
  • c5359a3 chore(deps): bump the nodejs group with 6 updates (#274)
  • a09b624 feat: change post-cleanup default to false (#272)
  • 947fc1f chore(deps): bump the nodejs group with 6 updates (#269)
  • 36c1c8c chore(deps): bump the gh-actions group with 2 updates (#268)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

v0.6.1

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

Updates scientific-python/issue-from-pytest-log-action from 1.5.0 to 1.6.2

Release notes

Sourced from scientific-python/issue-from-pytest-log-action's releases.

v1.6.2

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.6.1...v1.6.2

v1.6.0

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.5.0...v1.6.0

Commits

Updates actions/labeler from 6.1.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

Dependency Updates

Full Changelog: actions/labeler@v6.1.0...v6.2.0

Commits
  • bf12e9b feat: migrate to ESM and update dependencies (#949)
  • b8dd2d9 Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 (#942)
  • 53affe8 Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...
  • f612d9a Fix: Improve PR number validation and warning messages in input handling (#939)
  • See full diff in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager:@​webknjaz🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discusson Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 10 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [mamba-org/setup-micromamba](https://github.com/mamba-org/setup-micromamba) | `3.0.0` | `3.2.0` |
| [Parcels-code/pixi-lock/create-and-cache](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [Parcels-code/pixi-lock/restore](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.6` | `0.10.1` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` |
| [scientific-python/issue-from-pytest-log-action](https://github.com/scientific-python/issue-from-pytest-log-action) | `1.5.0` | `1.6.2` |
| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)
Updates `mamba-org/setup-micromamba` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/mamba-org/setup-micromamba/releases)
- [Commits](mamba-org/setup-micromamba@d7c9bd8...d6abac3)
Updates `Parcels-code/pixi-lock/create-and-cache` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `Parcels-code/pixi-lock/restore` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `prefix-dev/setup-pixi` from 0.9.6 to 0.10.1
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@5185adf...f00437f)
Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc)
Updates `scientific-python/issue-from-pytest-log-action` from 1.5.0 to 1.6.2
- [Release notes](https://github.com/scientific-python/issue-from-pytest-log-action/releases)
- [Commits](scientific-python/issue-from-pytest-log-action@v1.5.0...35b4e0a)
Updates `actions/labeler` from 6.1.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@f27b608...bf12e9b)
Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)
Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: mamba-org/setup-micromamba
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/create-and-cache
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/restore
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: prefix-dev/setup-pixi
dependency-version: 0.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: scientific-python/issue-from-pytest-log-action
dependency-version: 1.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: actions/labeler
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/setup-python
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Bump the actions group across 1 directory with 10 updates by dependabot[bot] · Pull Request #26 · slevang/xarray · GitHub
Skip to content

Bump the actions group across 1 directory with 10 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df
Open

Bump the actions group across 1 directory with 10 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 12, 2026

Copy link
Copy Markdown

Bumps the actions group with 10 updates in the / directory:

PackageFromTo
actions/checkout7.0.07.0.1
mamba-org/setup-micromamba3.0.03.2.0
Parcels-code/pixi-lock/create-and-cache0.1.00.1.1
Parcels-code/pixi-lock/restore0.1.00.1.1
prefix-dev/setup-pixi0.9.60.10.1
zizmorcore/zizmor-action0.5.70.6.2
scientific-python/issue-from-pytest-log-action1.5.01.6.2
actions/labeler6.1.07.0.0
actions/setup-python6.3.07.0.0
pypa/gh-action-pypi-publish1.14.01.14.2

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates mamba-org/setup-micromamba from 3.0.0 to 3.2.0

Release notes

Sourced from mamba-org/setup-micromamba's releases.

v3.2.0

What's Changed

New features

Full Changelog: mamba-org/setup-micromamba@v3.1.0...v3.2.0

v3.1.0

What's Changed

New features

Documentation

Dependency updates

New Contributors

Full Changelog: mamba-org/setup-micromamba@v3.0.0...v3.1.0

Commits
  • d6abac3 feat: Support prereleases of micromamba (#310)
  • ce51e99 Bump the node group across 1 directory with 14 updates (#309)
  • fb7186a Support Windows ARM64 (win-arm64) (#269)
  • 60f1092 Bump the actions group with 3 updates (#312)
  • ed54f9b Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (#311)
  • 60b4c82 Bump the actions group across 1 directory with 5 updates (#308)
  • 63fffb4 Update README examples to use setup-micromamba v3 (#305)
  • 8959ca9 Bump the actions group with 3 updates (#299)
  • See full diff in compare view

Updates Parcels-code/pixi-lock/create-and-cache from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/create-and-cache's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates Parcels-code/pixi-lock/restore from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/restore's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates prefix-dev/setup-pixi from 0.9.6 to 0.10.1

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.10.1

What's Changed

⬆️ Dependency updates

🤷🏻 Other changes

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.10.0...v0.10.1

v0.10.0

What's Changed

💥 Breaking changes

⬆️ Dependency updates

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.9.6...v0.10.0

Commits
  • f00437f Update dependencies and add pnpm workspace configuration (#279)
  • d0c199d chore(deps): bump the gh-actions group with 3 updates (#276)
  • 2253d9c chore(deps): bump the gh-actions group with 3 updates (#273)
  • c5359a3 chore(deps): bump the nodejs group with 6 updates (#274)
  • a09b624 feat: change post-cleanup default to false (#272)
  • 947fc1f chore(deps): bump the nodejs group with 6 updates (#269)
  • 36c1c8c chore(deps): bump the gh-actions group with 2 updates (#268)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

v0.6.1

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

Updates scientific-python/issue-from-pytest-log-action from 1.5.0 to 1.6.2

Release notes

Sourced from scientific-python/issue-from-pytest-log-action's releases.

v1.6.2

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.6.1...v1.6.2

v1.6.0

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.5.0...v1.6.0

Commits

Updates actions/labeler from 6.1.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

Dependency Updates

Full Changelog: actions/labeler@v6.1.0...v6.2.0

Commits
  • bf12e9b feat: migrate to ESM and update dependencies (#949)
  • b8dd2d9 Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 (#942)
  • 53affe8 Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...
  • f612d9a Fix: Improve PR number validation and warning messages in input handling (#939)
  • See full diff in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager:@​webknjaz🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discusson Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 10 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [mamba-org/setup-micromamba](https://github.com/mamba-org/setup-micromamba) | `3.0.0` | `3.2.0` |
| [Parcels-code/pixi-lock/create-and-cache](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [Parcels-code/pixi-lock/restore](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.6` | `0.10.1` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` |
| [scientific-python/issue-from-pytest-log-action](https://github.com/scientific-python/issue-from-pytest-log-action) | `1.5.0` | `1.6.2` |
| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)
Updates `mamba-org/setup-micromamba` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/mamba-org/setup-micromamba/releases)
- [Commits](mamba-org/setup-micromamba@d7c9bd8...d6abac3)
Updates `Parcels-code/pixi-lock/create-and-cache` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `Parcels-code/pixi-lock/restore` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `prefix-dev/setup-pixi` from 0.9.6 to 0.10.1
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@5185adf...f00437f)
Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc)
Updates `scientific-python/issue-from-pytest-log-action` from 1.5.0 to 1.6.2
- [Release notes](https://github.com/scientific-python/issue-from-pytest-log-action/releases)
- [Commits](scientific-python/issue-from-pytest-log-action@v1.5.0...35b4e0a)
Updates `actions/labeler` from 6.1.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@f27b608...bf12e9b)
Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)
Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: mamba-org/setup-micromamba
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/create-and-cache
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/restore
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: prefix-dev/setup-pixi
dependency-version: 0.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: scientific-python/issue-from-pytest-log-action
dependency-version: 1.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: actions/labeler
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/setup-python
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Universal Dark Mode - works on any site (function() { var enabled = true; function applyDarkMode() { if (!enabled) return; // Create style element if it doesn't exist var style = document.getElementById('universal-dark-mode-style'); if (!style) { style = document.createElement('style'); style.id = 'universal-dark-mode-style'; document.head.appendChild(style); } // Dark mode CSS - inverts colors but preserves images/video style.textContent = ' /* Invert everything except media */ html { filter: invert(1) hue-rotate(180deg) !important; background: #1a1a2e !important; } /* Restore images, videos, iframes, canvas */ img, video, iframe, canvas, svg, picture, [style*="background-image"] { filter: invert(1) hue-rotate(180deg) !important; } /* Preserve specific elements that should not be inverted */ .no-dark-mode, .no-dark-mode *, [data-theme="light"], [data-theme="light"], .ace_editor, .ace_editor *, .CodeMirror, .CodeMirror *, .monaco-editor, .monaco-editor *, .markdown-body pre, .markdown-body pre *, .highlight, .highlight *, pre code, pre code * { filter: none !important; } /* Fix common UI elements */ .modal, .popup, .dropdown-menu, .tooltip, .popover { filter: invert(1) hue-rotate(180deg) !important; background: #2d2d44 !important; border-color: #444 !important; } /* Scrollbars */ ::-webkit-scrollbar { background: #1a1a2e !important; } ::-webkit-scrollbar-thumb { background: #444 !important; } ::-webkit-scrollbar-thumb:hover { background: #555 !important; } /* Selection */ ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; } ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; } '; } function removeDarkMode() { var style = document.getElementById('universal-dark-mode-style'); if (style) style.remove(); } // Toggle with Alt+Shift+D document.addEventListener('keydown', function(e) { if (e.altKey && e.shiftKey && e.key === 'D') { e.preventDefault(); enabled = !enabled; if (enabled) { applyDarkMode(); console.log('[Universal Dark Mode] Enabled'); } else { removeDarkMode(); console.log('[Universal Dark Mode] Disabled'); } } }); // Apply on load applyDarkMode(); // Re-apply on dynamic content var observer = new MutationObserver(function(mutations) { if (enabled && !document.getElementById('universal-dark-mode-style')) { applyDarkMode(); } }); observer.observe(document.head, { childList: true }); console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle'); })(); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })(); Bump the actions group across 1 directory with 10 updates by dependabot[bot] · Pull Request #26 · slevang/xarray · GitHub
Skip to content

Bump the actions group across 1 directory with 10 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df
Open

Bump the actions group across 1 directory with 10 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-43664f30df

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 12, 2026

Copy link
Copy Markdown

Bumps the actions group with 10 updates in the / directory:

PackageFromTo
actions/checkout7.0.07.0.1
mamba-org/setup-micromamba3.0.03.2.0
Parcels-code/pixi-lock/create-and-cache0.1.00.1.1
Parcels-code/pixi-lock/restore0.1.00.1.1
prefix-dev/setup-pixi0.9.60.10.1
zizmorcore/zizmor-action0.5.70.6.2
scientific-python/issue-from-pytest-log-action1.5.01.6.2
actions/labeler6.1.07.0.0
actions/setup-python6.3.07.0.0
pypa/gh-action-pypi-publish1.14.01.14.2

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates mamba-org/setup-micromamba from 3.0.0 to 3.2.0

Release notes

Sourced from mamba-org/setup-micromamba's releases.

v3.2.0

What's Changed

New features

Full Changelog: mamba-org/setup-micromamba@v3.1.0...v3.2.0

v3.1.0

What's Changed

New features

Documentation

Dependency updates

New Contributors

Full Changelog: mamba-org/setup-micromamba@v3.0.0...v3.1.0

Commits
  • d6abac3 feat: Support prereleases of micromamba (#310)
  • ce51e99 Bump the node group across 1 directory with 14 updates (#309)
  • fb7186a Support Windows ARM64 (win-arm64) (#269)
  • 60f1092 Bump the actions group with 3 updates (#312)
  • ed54f9b Bump actions/checkout from 6.0.2 to 6.0.3 in the actions group (#311)
  • 60b4c82 Bump the actions group across 1 directory with 5 updates (#308)
  • 63fffb4 Update README examples to use setup-micromamba v3 (#305)
  • 8959ca9 Bump the actions group with 3 updates (#299)
  • See full diff in compare view

Updates Parcels-code/pixi-lock/create-and-cache from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/create-and-cache's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates Parcels-code/pixi-lock/restore from 0.1.0 to 0.1.1

Release notes

Sourced from Parcels-code/pixi-lock/restore's releases.

v0.1.1

What's Changed

New Contributors

Full Changelog: xarray-contrib/pixi-lock@v0.1.0...v0.1.1

Commits

Updates prefix-dev/setup-pixi from 0.9.6 to 0.10.1

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.10.1

What's Changed

⬆️ Dependency updates

🤷🏻 Other changes

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.10.0...v0.10.1

v0.10.0

What's Changed

💥 Breaking changes

⬆️ Dependency updates

New Contributors

Full Changelog: prefix-dev/setup-pixi@v0.9.6...v0.10.0

Commits
  • f00437f Update dependencies and add pnpm workspace configuration (#279)
  • d0c199d chore(deps): bump the gh-actions group with 3 updates (#276)
  • 2253d9c chore(deps): bump the gh-actions group with 3 updates (#273)
  • c5359a3 chore(deps): bump the nodejs group with 6 updates (#274)
  • a09b624 feat: change post-cleanup default to false (#272)
  • 947fc1f chore(deps): bump the nodejs group with 6 updates (#269)
  • 36c1c8c chore(deps): bump the gh-actions group with 2 updates (#268)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.5.7 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

v0.6.1

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

Commits

Updates scientific-python/issue-from-pytest-log-action from 1.5.0 to 1.6.2

Release notes

Sourced from scientific-python/issue-from-pytest-log-action's releases.

v1.6.2

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.6.1...v1.6.2

v1.6.0

What's Changed

Full Changelog: scientific-python/issue-from-pytest-log-action@v1.5.0...v1.6.0

Commits

Updates actions/labeler from 6.1.0 to 7.0.0

Release notes

Sourced from actions/labeler's releases.

v7.0.0

What's Changed

Enhancements:

Full Changelog: actions/labeler@v6...v7.0.0

v6.2.0

What's Changed

Bug Fix

Dependency Updates

Full Changelog: actions/labeler@v6.1.0...v6.2.0

Commits
  • bf12e9b feat: migrate to ESM and update dependencies (#949)
  • b8dd2d9 Bump @​typescript-eslint/eslint-plugin from 8.59.1 to 8.61.1 (#942)
  • 53affe8 Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...
  • f612d9a Fix: Improve PR number validation and warning messages in input handling (#939)
  • See full diff in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager:@​webknjaz🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discusson Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 10 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [mamba-org/setup-micromamba](https://github.com/mamba-org/setup-micromamba) | `3.0.0` | `3.2.0` |
| [Parcels-code/pixi-lock/create-and-cache](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [Parcels-code/pixi-lock/restore](https://github.com/parcels-code/pixi-lock) | `0.1.0` | `0.1.1` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.6` | `0.10.1` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` |
| [scientific-python/issue-from-pytest-log-action](https://github.com/scientific-python/issue-from-pytest-log-action) | `1.5.0` | `1.6.2` |
| [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)
Updates `mamba-org/setup-micromamba` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/mamba-org/setup-micromamba/releases)
- [Commits](mamba-org/setup-micromamba@d7c9bd8...d6abac3)
Updates `Parcels-code/pixi-lock/create-and-cache` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `Parcels-code/pixi-lock/restore` from 0.1.0 to 0.1.1
- [Release notes](https://github.com/parcels-code/pixi-lock/releases)
- [Commits](xarray-contrib/pixi-lock@3849578...1fab4c1)
Updates `prefix-dev/setup-pixi` from 0.9.6 to 0.10.1
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@5185adf...f00437f)
Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc)
Updates `scientific-python/issue-from-pytest-log-action` from 1.5.0 to 1.6.2
- [Release notes](https://github.com/scientific-python/issue-from-pytest-log-action/releases)
- [Commits](scientific-python/issue-from-pytest-log-action@v1.5.0...35b4e0a)
Updates `actions/labeler` from 6.1.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@f27b608...bf12e9b)
Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)
Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: mamba-org/setup-micromamba
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/create-and-cache
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: Parcels-code/pixi-lock/restore
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: prefix-dev/setup-pixi
dependency-version: 0.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: scientific-python/issue-from-pytest-log-action
dependency-version: 1.6.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: actions/labeler
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: actions/setup-python
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants