Bump the all-dependencies group across 1 directory with 8 updates by dependabot[bot] · Pull Request #221 · neutrons/python_project_template

dependabot · 2026-10-26T00:23:33Z

Bumps the all-dependencies group with 8 updates in the / directory:

Package	From	To
actions/setup-python	`7.0.0`	`7.1.0`
prefix-dev/setup-pixi	`0.11.0`	`0.11.2`
neutrons/gh-actions/pkg-install	`2.0`	`2.1`
neutrons/gh-actions/pkg-verify	`2.0`	`2.1`
neutrons/gh-actions/grype	`2.0`	`2.1`
neutrons/gh-actions/publish	`2.0`	`2.1`
neutrons/gh-actions/pkg-remove	`2.0`	`2.1`
pypa/gh-action-pypi-publish	`1.14.2`	`1.14.3`

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

Add mirror and mirror-token inputs for custom Python distribution sources by @luhenry in actions/setup-python#1302

Improve error message clarity by @v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

Upgrade browserslist from 4.28.2 to 4.28.9 by @dependabot in actions/setup-python#1353

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-python#1343

Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in actions/setup-python#1342

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-python#1357

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-python#1359

Upgrade undici from 6.28.0 to 6.29.0 by @dependabot in actions/setup-python#1364

Upgrade ts-jest from 29.4.11 to 29.4.14 by @dependabot in actions/setup-python#1361

Upgrade brace-expansion from 5.0.9 to 5.0.12 by @dependabot in actions/setup-python#1365

Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-python#1363

Upgrade @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @dependabot in actions/setup-python#1369

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-python#1345

Upgrade cache to 6.3.0 by @v-HarithaVattikuti in actions/setup-python#1370

Resolve Basic Validation audit failures by @v-HarithaVattikuti in actions/setup-python#1347

Resolve npm audit failures by @v-HarithaVattikuti in actions/setup-python#1350

New Contributors

@luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

6d4fd22 Cache upgrade to 6.3.0 (#1370)
ec52d0a Bump @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
e1be392 Bump @types/semver from 7.7.1 to 7.8.0 (#1359)
06da627 Bump @vercel/ncc from 0.44.0 to 0.45.0 (#1357)
af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
7aeabeb Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
Additional commits viewable in compare view

Updates prefix-dev/setup-pixi from 0.11.0 to 0.11.2

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.11.2

What's Changed

🤷🏻 Other changes

docs: Adjust workload-identity-audience section by @pavelzw in prefix-dev/setup-pixi#293

fix: Don't delete preinstalled pixi bin in cleanup by @pavelzw in prefix-dev/setup-pixi#297

fix(deps): bump undici, brace-expansion and handlebars by @wolfv in prefix-dev/setup-pixi#295

Full Changelog: prefix-dev/setup-pixi@v0.11.1...v0.11.2

v0.11.1

What's Changed

🤷🏻 Other changes

feat: Add auth-workload-identity inputs for OIDC login by @pavelzw in prefix-dev/setup-pixi#292

Full Changelog: prefix-dev/setup-pixi@v0.11.0...v0.11.1

Commits

ad1da64 fix(deps): bump undici, brace-expansion and handlebars (#295)
05a7f7a fix: Don't delete preinstalled pixi bin in cleanup (#297)
f549d46 ci: use pixi exec instead of choco to install yq (#294)
4578022 docs: Adjust workload-identity-audience section (#293)
a2789fe feat: Add auth-workload-identity inputs for OIDC login (#292)
See full diff in compare view

Updates neutrons/gh-actions/pkg-install from 2.0 to 2.1

Release notes

Sourced from neutrons/gh-actions/pkg-install's releases.

v2.1

What's Changed

Bump prefix-dev/setup-pixi from 0.10.0 to 0.10.1 in the all-dependencies group by @dependabot[bot] in neutrons/gh-actions#5

Install package only from local channel in pkg-install by @backmari in neutrons/gh-actions#7

New Contributors

@backmari made their first contribution in neutrons/gh-actions#7

Full Changelog: neutrons/gh-actions@v2.0...v2.1

Commits

46e28a7 Merge pull request #7 from neutrons/pin-local-channel
b41135b Add CI tests for pkg-install with a local channel
360ccbf Install package only from local channel in pkg-install
ad76177 Merge pull request #5 from neutrons/dependabot/github_actions/all-dependencie...
a4de142 Bump prefix-dev/setup-pixi in the all-dependencies group
See full diff in compare view

Updates neutrons/gh-actions/pkg-verify from 2.0 to 2.1

Release notes

Sourced from neutrons/gh-actions/pkg-verify's releases.

v2.1

What's Changed

Bump prefix-dev/setup-pixi from 0.10.0 to 0.10.1 in the all-dependencies group by @dependabot[bot] in neutrons/gh-actions#5

Install package only from local channel in pkg-install by @backmari in neutrons/gh-actions#7

New Contributors

@backmari made their first contribution in neutrons/gh-actions#7

Full Changelog: neutrons/gh-actions@v2.0...v2.1

Commits

46e28a7 Merge pull request #7 from neutrons/pin-local-channel
b41135b Add CI tests for pkg-install with a local channel
360ccbf Install package only from local channel in pkg-install
ad76177 Merge pull request #5 from neutrons/dependabot/github_actions/all-dependencie...
a4de142 Bump prefix-dev/setup-pixi in the all-dependencies group
See full diff in compare view

Updates neutrons/gh-actions/grype from 2.0 to 2.1

Release notes

Sourced from neutrons/gh-actions/grype's releases.

v2.1

What's Changed

Bump prefix-dev/setup-pixi from 0.10.0 to 0.10.1 in the all-dependencies group by @dependabot[bot] in neutrons/gh-actions#5

Install package only from local channel in pkg-install by @backmari in neutrons/gh-actions#7

New Contributors

@backmari made their first contribution in neutrons/gh-actions#7

Full Changelog: neutrons/gh-actions@v2.0...v2.1

Commits

46e28a7 Merge pull request #7 from neutrons/pin-local-channel
b41135b Add CI tests for pkg-install with a local channel
360ccbf Install package only from local channel in pkg-install
ad76177 Merge pull request #5 from neutrons/dependabot/github_actions/all-dependencie...
a4de142 Bump prefix-dev/setup-pixi in the all-dependencies group
See full diff in compare view

Updates neutrons/gh-actions/publish from 2.0 to 2.1

Release notes

Sourced from neutrons/gh-actions/publish's releases.

v2.1

What's Changed

Bump prefix-dev/setup-pixi from 0.10.0 to 0.10.1 in the all-dependencies group by @dependabot[bot] in neutrons/gh-actions#5

Install package only from local channel in pkg-install by @backmari in neutrons/gh-actions#7

New Contributors

@backmari made their first contribution in neutrons/gh-actions#7

Full Changelog: neutrons/gh-actions@v2.0...v2.1

Commits

46e28a7 Merge pull request #7 from neutrons/pin-local-channel
b41135b Add CI tests for pkg-install with a local channel
360ccbf Install package only from local channel in pkg-install
ad76177 Merge pull request #5 from neutrons/dependabot/github_actions/all-dependencie...
a4de142 Bump prefix-dev/setup-pixi in the all-dependencies group
See full diff in compare view

Updates neutrons/gh-actions/pkg-remove from 2.0 to 2.1

Release notes

Sourced from neutrons/gh-actions/pkg-remove's releases.

v2.1

What's Changed

Bump prefix-dev/setup-pixi from 0.10.0 to 0.10.1 in the all-dependencies group by @dependabot[bot] in neutrons/gh-actions#5

Install package only from local channel in pkg-install by @backmari in neutrons/gh-actions#7

New Contributors

@backmari made their first contribution in neutrons/gh-actions#7

Full Changelog: neutrons/gh-actions@v2.0...v2.1

Commits

46e28a7 Merge pull request #7 from neutrons/pin-local-channel
b41135b Add CI tests for pkg-install with a local channel
360ccbf Install package only from local channel in pkg-install
ad76177 Merge pull request #5 from neutrons/dependabot/github_actions/all-dependencie...
a4de142 Bump prefix-dev/setup-pixi in the all-dependencies group
See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
331eccb Upgrade certifi and sigstore
f68fee4 💰 Sync the FUNDING config
c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
9090099 🧪 Make smoke test deps hash-pinned in CI
34e40c2 📌 Bump pip-tools managed transitive deptrees
e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
dd8c5f4 🔧 Make pip-tools config available in container
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the all-dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` | | [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.11.0` | `0.11.2` | | [neutrons/gh-actions/pkg-install](https://github.com/neutrons/gh-actions) | `2.0` | `2.1` | | [neutrons/gh-actions/pkg-verify](https://github.com/neutrons/gh-actions) | `2.0` | `2.1` | | [neutrons/gh-actions/grype](https://github.com/neutrons/gh-actions) | `2.0` | `2.1` | | [neutrons/gh-actions/publish](https://github.com/neutrons/gh-actions) | `2.0` | `2.1` | | [neutrons/gh-actions/pkg-remove](https://github.com/neutrons/gh-actions) | `2.0` | `2.1` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` | Updates `actions/setup-python` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@5fda3b9...6d4fd22) Updates `prefix-dev/setup-pixi` from 0.11.0 to 0.11.2 - [Release notes](https://github.com/prefix-dev/setup-pixi/releases) - [Commits](prefix-dev/setup-pixi@9dabb60...ad1da64) Updates `neutrons/gh-actions/pkg-install` from 2.0 to 2.1 - [Release notes](https://github.com/neutrons/gh-actions/releases) - [Commits](neutrons/gh-actions@eb7a7c6...46e28a7) Updates `neutrons/gh-actions/pkg-verify` from 2.0 to 2.1 - [Release notes](https://github.com/neutrons/gh-actions/releases) - [Commits](neutrons/gh-actions@eb7a7c6...46e28a7) Updates `neutrons/gh-actions/grype` from 2.0 to 2.1 - [Release notes](https://github.com/neutrons/gh-actions/releases) - [Commits](neutrons/gh-actions@eb7a7c6...46e28a7) Updates `neutrons/gh-actions/publish` from 2.0 to 2.1 - [Release notes](https://github.com/neutrons/gh-actions/releases) - [Commits](neutrons/gh-actions@eb7a7c6...46e28a7) Updates `neutrons/gh-actions/pkg-remove` from 2.0 to 2.1 - [Release notes](https://github.com/neutrons/gh-actions/releases) - [Commits](neutrons/gh-actions@eb7a7c6...46e28a7) Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@dc37677...7245906) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: prefix-dev/setup-pixi dependency-version: 0.11.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: neutrons/gh-actions/pkg-install dependency-version: '2.1' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: neutrons/gh-actions/pkg-verify dependency-version: '2.1' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: neutrons/gh-actions/grype dependency-version: '2.1' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: neutrons/gh-actions/publish dependency-version: '2.1' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: neutrons/gh-actions/pkg-remove dependency-version: '2.1' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 26, 2026

KedoKudo approved these changes Oct 28, 2026

View reviewed changes

KedoKudo merged commit 202d615 into main Oct 28, 2026
9 checks passed

KedoKudo deleted the dependabot/github_actions/all-dependencies-f02bae2284 branch October 28, 2026 13:30

Navigation Menu

Repository navigation

Bump the all-dependencies group across 1 directory with 8 updates - #221

Bump the all-dependencies group across 1 directory with 8 updates#221
KedoKudo merged 1 commit into
mainfrom
dependabot/github_actions/all-dependencies-f02bae2284

dependabot Bot commented on behalf of github Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026

v7.1.0

What's Changed

Enhancements

Dependency Upgrade

New Contributors

v0.11.2

What's Changed

🤷🏻 Other changes

v0.11.1

What's Changed

🤷🏻 Other changes

v2.1

What's Changed

New Contributors

v2.1

What's Changed

New Contributors

v2.1

What's Changed

New Contributors

v2.1

What's Changed

New Contributors

v2.1

What's Changed

New Contributors

v1.14.3

🛠️ Security Tightening

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant