[dependabot]

Bumps pypa/gh-action-pypi-publish from 1.14.1 to 1.14.3.

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

... (truncated)

Commits

• 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
• 331eccb Upgrade certifi and sigstore
• f68fee4 💰 Sync the FUNDING config
• c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
• 9090099 🧪 Make smoke test deps hash-pinned in CI
• 34e40c2 📌 Bump pip-tools managed transitive deptrees
• e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
• dd8c5f4 🔧 Make pip-tools config available in container
• dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
• 8b2f234 Bump pypi-attestations and sigstore
• Additional commits viewable in compare view

[Copilot]

🟢 Approval recommended

No active review issues were identified for the publishing-action update.

No open issues 🎉

What changed in this PR

Updates the publishing action used by geoh5py’s release workflows from v1.14.1 to v1.14.3, incorporating upstream security fixes and dependency updates.

Changes:

• Updates the commit-pinned action in both PyPI and TestPyPI workflows.
• Preserves existing publishing inputs and repository destinations.

File	Description
.github/​workflows/​python_deploy_prod.yml	Updates the PyPI publishing action to v1.14.3.
.github/​workflows/​python_deploy_dev.yml	Updates the TestPyPI publishing action to v1.14.3.

_{Review effort: Balanced}

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.