Skip to content

Bump the github-actions group across 2 directories with 6 updates - #3

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-b2d29a5bc6
Open

Bump the github-actions group across 2 directories with 6 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-b2d29a5bc6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown

Bumps the github-actions group with 6 updates in the / directory:

Package From To
hynek/build-and-inspect-python-package 3.0.1 3.0.2
CodSpeedHQ/action 5.4.0 5.6.0
astral-sh/setup-uv 10.3.0 10.3.2
prefix-dev/setup-pixi 0.11.0 0.11.2
actions/create-github-app-token 3.2.0 3.3.0
pypa/gh-action-pypi-publish 1.14.2 1.14.3
prefix-dev/setup-pixi 0.11.0 0.11.2

Bumps the github-actions group with 1 update in the /.github/actions/setup-env directory: prefix-dev/setup-pixi.

Updates hynek/build-and-inspect-python-package from 3.0.1 to 3.0.2

Release notes

Sourced from hynek/build-and-inspect-python-package's releases.

v3.0.2

This is a pure security dependency update brought to you by the number 4.

Changelog

Sourced from hynek/build-and-inspect-python-package's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

3.0.2 - 2026-10-21

3.0.1 - 2026-07-30

Fixed

  • To avoid uv configuration interference with the project that is being built, the installation of our own tools is now ran in a different directory. Additionally, UV_EXCLUDE_NEWER is unset. #240

3.0.0 - 2026-07-30

Security

  • Given the increase and supply-chain attacks and advancements in tooling (for example, pinact or GitHub's Dependabot), this action will stop force-tagging minor and micro releases. This means, there will be no @v3 or @v3.0 tag that gets updated and force-pushed with each update. Always tag with the full version and commit hash; use Zizmor to secure your actions if you can.

Changed

2.18.0 - 2026-05-11

Added

  • New input: skip-sdist to skip building the source distribution. #228

2.17.0 - 2026-03-27

... (truncated)

Commits

Updates CodSpeedHQ/action from 5.4.0 to 5.6.0

Release notes

Sourced from CodSpeedHQ/action's releases.

v5.6.0

Bumps the CodSpeed runner to v5.6.0.

Highlights

More consistent CPU Simulation results

Changes to your CI environment, like a different path or an extra environment variable, no longer change the performance. Each benchmark now starts with the same memory layout, reducing the chance of false regressions.

🐛 Bug Fixes

⚙️ Internals

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

Full Changelog: CodSpeedHQ/action@v5.5.0...v5.6.0

v5.5.0

Bumps the CodSpeed runner to v5.5.0.

This release adds support for Ubuntu 26.04, on both x86_64 and arm64. The officially supported distributions are now Ubuntu 22.04, 24.04 and 26.04, and Debian 12.

Profile uploads are also faster on GitHub-hosted runners, and archives larger than 5 GiB can now be uploaded.

Results from the Memory instrument are processed much faster and with less memory on large benchmarks.

This release also fixes a crash that could affect some pytest-codspeed benchmarks since v5.4.2.

🚀 Features

🐛 Bug Fixes

⚡ Performance

  • Stream memtrack frames and decode them in parallel when finding module events by @​not-matthias in #578

... (truncated)

Commits

Updates astral-sh/setup-uv from 10.3.0 to 10.3.2

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

📚 Documentation

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

Commits
  • 07a047e chore: update known checksums for 0.13.5 (#1103)
  • e1b8536 docs: update version references to v10.3.1 (#1102)
  • 18d369b chore(deps): roll up Dependabot updates (#1101)
  • 4ad2329 chore: update known checksums for 0.13.4 (#1099)
  • 4bc6759 chore: update known checksums for 0.13.2/0.13.3 (#1098)
  • c97f06e fix: preserve cache error class names in save-cache bundle (#1093)
  • 8ca4be0 chore: update known checksums for 0.13.1 (#1094)
  • b627d85 docs: cache-dependency-glob matches relative to the working directory (#1092)
  • f8c8897 Verify npm dependency signatures before builds (#1027)
  • f64d32b docs: update version references to v10.3.0 (#1090)
  • See full diff in compare view

Updates prefix-dev/setup-pixi from 0.11.0 to 0.11.2

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.11.2

What's Changed

🤷🏻 Other changes

Full Changelog: prefix-dev/setup-pixi@v0.11.1...v0.11.2

v0.11.1

What's Changed

🤷🏻 Other changes

Full Changelog: prefix-dev/setup-pixi@v0.11.0...v0.11.1

Commits
  • ad1da64 fix(deps): bump undici, brace-expansion and handlebars (#295)
  • 05a7f7a fix: Don't delete preinstalled pixi bin in cleanup (#297)
  • f549d46 ci: use pixi exec instead of choco to install yq (#294)
  • 4578022 docs: Adjust workload-identity-audience section (#293)
  • a2789fe feat: Add auth-workload-identity inputs for OIDC login (#292)
  • See full diff in compare view

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)
Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

Bug Fixes

  • deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • 64ab729 chore(main): release 3.3.0 (#402)
  • f3a828e ci: create signed dist commits in release workflow (#404)
  • 655017f docs: clarify when owner grants access to all repositories (#378)
  • 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
  • a47236f feat: update permission inputs (#399)
  • a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
  • d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
  • 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
  • e85f677 test: omit stack traces from snapshots (#401)
  • 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
  • Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

Commits
  • 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
  • 331eccb Upgrade certifi and sigstore
  • f68fee4 💰 Sync the FUNDING config
  • c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
  • 9090099 🧪 Make smoke test deps hash-pinned in CI
  • 34e40c2 📌 Bump pip-tools managed transitive deptrees
  • e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
  • dd8c5f4 🔧 Make pip-tools config available in container
  • See full diff in compare view

Updates prefix-dev/setup-pixi from 0.11.0 to 0.11.2

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.11.2

What's Changed

🤷🏻 Other changes

Full Changelog: prefix-dev/setup-pixi@v0.11.1...v0.11.2

v0.11.1

What's Changed

🤷🏻 Other changes

Full Changelog: prefix-dev/setup-pixi@v0.11.0...v0.11.1

Commits
  • ad1da64 fix(deps): bump undici, brace-expansion and handlebars (#295)
  • 05a7f7a fix: Don't delete preinstalled pixi bin in cleanup (#297)
  • f549d46 ci: use pixi exec instead of choco to install yq (#294)
  • 4578022 docs: Adjust workload-identity-audience section (#293)
  • a2789fe feat: Add auth-workload-identity inputs for OIDC login (#292)
  • See full diff in compare view

Updates prefix-dev/setup-pixi from 0.11.0 to 0.11.2

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.11.2

What's Changed

🤷🏻 Other changes

Full Changelog: prefix-dev/setup-pixi@v0.11.1...v0.11.2

v0.11.1

What's Changed

🤷🏻 Other changes

Full Changelog: prefix-dev/setup-pixi@v0.11.0...v0.11.1

Commits
  • ad1da64 fix(deps): bump undici, brace-expansion and handlebars (#295)
  • 05a7f7a fix: Don't delete preinstalled pixi bin in cleanup (#297)
  • f549d46 ci: use pixi exec instead of choco to install yq (#294)
  • 4578022 docs: Adjust workload-identity-audience section (#293)
  • a2789fe feat: Add auth-workload-identity inputs for OIDC login (#292)
  • See full diff in compare view

Updates prefix-dev/setup-pixi from 0.11.0 to 0.11.2

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.11.2

What's Changed

🤷🏻 Other changes

Full Changelog: prefix-dev/setup-pixi@v0.11.1...v0.11.2

v0.11.1

What's Changed

🤷🏻 Other changes

Full Changelog: prefix-dev/setup-pixi@v0.11.0...v0.11.1

Commits
  • ad1da64 fix(deps): bump undici, brace-expansion and handlebars (#295)
  • 05a7f7a fix: Don't delete preinstalled pixi bin in cleanup (#297)
  • f549d46 ci: use pixi exec instead of choco to install yq (#294)
  • 4578022 docs: Adjust workload-identity-audience section (#293)
  • a2789fe feat: Add auth-workload-identity inputs for OIDC login (#292)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the github-actions group across 2 directories with 6 updates
d9ba832 
Bumps the github-actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hynek/build-and-inspect-python-package](https://github.com/hynek/build-and-inspect-python-package) | `3.0.1` | `3.0.2` |
| [CodSpeedHQ/action](https://github.com/codspeedhq/action) | `5.4.0` | `5.6.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.3.0` | `10.3.2` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.11.0` | `0.11.2` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.11.0` | `0.11.2` |

Bumps the github-actions group with 1 update in the /.github/actions/setup-env directory: [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi).


Updates `hynek/build-and-inspect-python-package` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/hynek/build-and-inspect-python-package/releases)
- [Changelog](https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md)
- [Commits](hynek/build-and-inspect-python-package@2abe76d...67230f7)

Updates `CodSpeedHQ/action` from 5.4.0 to 5.6.0
- [Release notes](https://github.com/codspeedhq/action/releases)
- [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md)
- [Commits](CodSpeedHQ/action@c4fd08a...78102a4)

Updates `astral-sh/setup-uv` from 10.3.0 to 10.3.2
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@1c37ad0...07a047e)

Updates `prefix-dev/setup-pixi` from 0.11.0 to 0.11.2
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@9dabb60...ad1da64)

Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@bcd2ba4...64ab729)

Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@dc37677...7245906)

Updates `prefix-dev/setup-pixi` from 0.11.0 to 0.11.2
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@9dabb60...ad1da64)

Updates `prefix-dev/setup-pixi` from 0.11.0 to 0.11.2
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@9dabb60...ad1da64)

Updates `prefix-dev/setup-pixi` from 0.11.0 to 0.11.2
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@9dabb60...ad1da64)

---
updated-dependencies:
- dependency-name: hynek/build-and-inspect-python-package
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: CodSpeedHQ/action
  dependency-version: 5.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: prefix-dev/setup-pixi
  dependency-version: 0.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: prefix-dev/setup-pixi
  dependency-version: 0.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: prefix-dev/setup-pixi
  dependency-version: 0.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: prefix-dev/setup-pixi
  dependency-version: 0.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 29, 2026
@dependabot dependabot Bot mentioned this pull request Oct 29, 2026
Closed
@github-actions

github-actions Bot commented Oct 29, 2026

Copy link
Copy Markdown

Benchmark comparison: base (0001) vs head (0002)


------------- benchmark 'test_bench_add': 2 tests -------------
Name (time in ns)              Mean            StdDev          
---------------------------------------------------------------
test_bench_add (p/base)     56.7488 (1.0)      9.5039 (1.01)   
test_bench_add (p/head)     58.0233 (1.02)     9.3724 (1.0)    
---------------------------------------------------------------

Legend:
  Outliers: 1 Standard Deviation from Mean; 1.5 IQR (InterQuartile Range) from 1st Quartile and 3rd Quartile.
  OPS: Operations Per Second, computed as 1 / Mean

@codecov

codecov Bot commented Oct 29, 2026

Copy link
Copy Markdown

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants