From 28949e27371b68cda70e4b22c5d1842d526a8a06 Mon Sep 17 00:00:00 2001 From: Brian O'Kelley Date: Sat, 31 Oct 2026 00:51:16 +0000 Subject: [PATCH] ci: pin pypa/gh-action-pypi-publish to v1.14.3 for GHSA-5xjx-3w67-w9x9 The advisory, critical, covers every version up to 1.14.2, after revocation of a CA in the Sigstore chain used for Trusted Publishing and PyPI attestations. Same change as #1748 on next. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/release-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 61e9de55f..8f60b6a11 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -106,6 +106,6 @@ jobs: with: name: release-dist path: dist/ - - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 + - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: packages-dir: dist/