[dependabot]

Bumps the dependencies group with 3 updates in the / directory: prefix-dev/setup-pixi, actions/setup-python and pypa/gh-action-pypi-publish.

Updates prefix-dev/setup-pixi from 0.11.0 to 0.11.2

Release notes

Sourced from prefix-dev/setup-pixi's releases.

v0.11.2

What's Changed

🤷🏻 Other changes

• docs: Adjust workload-identity-audience section by @​pavelzw in prefix-dev/setup-pixi#293
• fix: Don't delete preinstalled pixi bin in cleanup by @​pavelzw in prefix-dev/setup-pixi#297
• fix(deps): bump undici, brace-expansion and handlebars by @​wolfv in prefix-dev/setup-pixi#295

Full Changelog: prefix-dev/setup-pixi@v0.11.1...v0.11.2

v0.11.1

What's Changed

🤷🏻 Other changes

• feat: Add auth-workload-identity inputs for OIDC login by @​pavelzw in prefix-dev/setup-pixi#292

Full Changelog: prefix-dev/setup-pixi@v0.11.0...v0.11.1

Commits

• ad1da64 fix(deps): bump undici, brace-expansion and handlebars (#295)
• 05a7f7a fix: Don't delete preinstalled pixi bin in cleanup (#297)
• f549d46 ci: use pixi exec instead of choco to install yq (#294)
• 4578022 docs: Adjust workload-identity-audience section (#293)
• a2789fe feat: Add auth-workload-identity inputs for OIDC login (#292)
• See full diff in compare view

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
• 331eccb Upgrade certifi and sigstore
• f68fee4 💰 Sync the FUNDING config
• c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
• 9090099 🧪 Make smoke test deps hash-pinned in CI
• 34e40c2 📌 Bump pip-tools managed transitive deptrees
• e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
• dd8c5f4 🔧 Make pip-tools config available in container
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Test and wheel workflows update pinned versions of Python setup, Pixi setup, and PyPI publishing actions. Other job configuration remains unchanged.

Changes: Test workflow action updates

Layer / File(s)	Summary
Update test workflow actions .github/workflows/test_docs.yml, .github/workflows/test_essenv.yml, .github/workflows/test_pytest.yml, .github/workflows/test_ruff.yml	Test workflows update prefix-dev/setup-pixi to v0.11.2. test_pytest.yml also updates actions/setup-python to v7.1.0.

Wheel workflow action updates

Layer / File(s)	Summary
Update wheel workflow actions .github/workflows/wheels-preview.yml, .github/workflows/wheels.yml	Both workflows update actions/setup-python to v7.1.0 and pypa/gh-action-pypi-publish to v1.14.3.

Priority: Low

Change: Other

Merge Risk: Minimal · up to 5ce87

The dependency updates are limited in scope and do not introduce an actionable merge-blocking risk.

Security architecture risk: Low · up to 5ce87

Publication gates, permissions, credential inputs, and build dependencies remain unchanged. No introduced security concern was established. The updated publisher still receives publishing credentials, and its internal failure behavior and external credential restrictions could not be verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed publisher executes at both the production and preview publishing boundaries, receiving PYPI_API_TOKEN or TESTPYPI_API_TOKEN respectively. The production release job also grants repository-content, attestation, and identity-token write permissions. Exposure beyond these configured workflows cannot be bounded without the actual token scopes and external authorization policies; the diff does not expand these configured privileges.

Trust Boundaries and Controls

• observed — The production release job remains gated to tag references or manual dispatch, while its publishing step separately requires a tag reference. Ordinary pull-request execution therefore does not satisfy the configured production publication gate. Preview execution remains triggered by master pushes or manual dispatch and publishes to TestPyPI. These controls predate the PR and are unchanged; external tag protection and dispatch authorization were not established.

Resilience and Maintainability Implications

• inferred — Build prerequisites, attestation-before-publication ordering, and skip-existing: true remain configured as before. This preserves the declared transition sequence and repeated-publication setting, but does not establish atomic publication or recovery guarantees. Behavior after partial upload, interruption, repetition, or concurrent runs depends on the upstream publisher and package registry, whose implementations were not compared.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		Title says the PR bumps the dependencies group across 1 directory with 3 updates. Diff bumps setup-pixi, setup-python, and gh-action-pypi-publish in workflow files. Title matches main change.
Description check		Description lists the three bumped actions with versions and release notes. Matches the workflow changes in the summary.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (6 skipped: 6 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}