[dependabot]

Bumps the github-actions group with 3 updates in the / directory: actions/setup-python, OpenHCSDev/python-introspect/.github/actions/validate-python-release and pypa/gh-action-pypi-publish.

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates OpenHCSDev/python-introspect/.github/actions/validate-python-release from 0.1.14 to 0.3.0

Release notes

Sourced from OpenHCSDev/python-introspect/.github/actions/validate-python-release's releases.

v0.3.0

What's Changed

• 0.3.0: a field that admits several classes stores its value under a member tag by @​trissim in OpenHCSDev/python-introspect#23

Full Changelog: OpenHCSDev/python-introspect@v0.2.8...v0.3.0

python-introspect 0.2.1

Fix recursive abstract Sequence dataclass decoding and validation on supported Python 3.10. Nested children use their declaring annotation namespace; Literal/Annotated values are preserved. Correct the project metadata release-readiness check.

Local qualification: 145 package tests pass on Python 3.10 and Python 3.12; seven project/release checks pass. Wheel and sdist pass Twine, and the annotated tag/artifact/checkout agree. This does not claim queued GitHub Actions or PyPI publication has completed.

Changelog

Sourced from OpenHCSDev/python-introspect/.github/actions/validate-python-release's changelog.

Changelog

0.2.2 is the first 0.2.x release published to PyPI. The 0.2.0 and 0.2.1 tags exist in git, but their publish runs were cancelled, so upgrading from PyPI goes straight from 0.1.16 to 0.2.2. The notes below cover every change in that jump.

0.3.0

Changed (the stored form of some fields changes; there is no reader for the old form):

• A dataclass field whose declared type admits several classes is stored as {tag: fields}, and dataclass_from_mapping reads the class from the tag. Before, the member of a union was guessed from which fields were present: two members with the same fields could not be told apart and the stored value did not say which class it was. Three declarations form such a family (MemberFamily.declared_by): a union with two or more dataclass members (other arms such as None or str stay untagged), an abstract dataclass (its concrete subclasses are the members), and a class whose metaclass is AutoRegisterMeta. The tag is the member's registry key when it is registered, so it survives a module move or a rename; otherwise it is the class name. The rule holds inside tuple, list, Sequence, Mapping, optional and Annotated declarations.
• An unknown tag is a ValueError naming the known members. A value whose class is not a member of the declared family is a TypeError when encoding. Two members with the same tag are a TypeError.
• to_jsonable reads the declared field types of every dataclass it encodes, so those annotations must resolve at run time (a name imported only under TYPE_CHECKING no longer encodes).

0.2.8

Added:

• RegisteredClassChoices validates in pydantic: a field annotated with it accepts a member class or its registry key, serializes to the key, and publishes the keys as a JSON-schema enum, so pydantic-built tool schemas (for example MCP) accept family-valued fields.

0.2.7

Added:

• dataclass_from_mapping decodes a field annotated type[Family], where Family is an AutoRegisterMeta family, from the registry key that to_jsonable writes for the class. A key outside the family fails loudly. Decoding goes through registered_class_from_key, which dispatches on the family's metaclass, so a family whose boundary spelling is not its registry key registers its own decoder.
• RegisteredClassChoices(family): the AnnotationChoices of a field holding one class of a registered family, labelled by registry key.

0.2.6

Added:

• FieldLabel: Annotated metadata declaring the display label of a field whose name does not read well to users, and declared_field_label to read it. Form and table builders derive every other label from the field name.

0.2.5

Fixed:

• Inline field documentation (a string literal under a dataclass field) is extracted again on Python 3.13 and later. Class source lookup used inspect._ClassFinder, a private helper that Python 3.13 removed, so every dataclass came back with no field help. Classes are now located by qualified name from the module AST directly. CI now tests Python 3.13.

0.2.4

Fixed:

• dataclass_from_mapping and validate_annotated_dataclass no longer raise RecursionError on Python 3.10 for fields declared with a recursive type alias such as V = str | list["V"] | dict[str, "V"]. Since 0.2.1, nested type strings were expanded on 3.10 with no stop, so a self-reference expanded forever. Expansion now stops at a self-reference and leaves it as a ForwardRef, which is what get_type_hints returns on Python 3.11 and later, so the decoder sees the same declaration on every version.

0.2.3

Added:

• AnnotationChoices: Annotated metadata declaring the finite values a field may hold. Annotation validation checks each value (or each item of a sequence value) against the declared choices, and declared_annotation_choices finds the declaration through Annotated, Optional and homogeneous containers for form builders; enum_input_values returns choice labels.
• type[X] annotations are validated: the value must be a class and a subclass of X.

0.2.2

Added:

• to_jsonable, with the JsonValue, JsonObject and JsonScalar aliases. It is the JSON-native encoder paired with dataclass_from_mapping: dataclasses are encoded by their declared fields, along with mappings, sequences, enums, paths (str(path)), callables (by import identity) and AutoRegisterMeta types (by registry key). More types can be added with to_jsonable.register.
• Module public-surface helpers: declared_public_names, exported_public_names, public_names_from_objects and is_declared_public_name.
• lazy_exports(globals(), {owner_module: names}). It installs a PEP 562 __getattr__/__dir__ pair and returns the exported names for __all__.

... (truncated)

Commits

• a9428c3 Merge pull request #23 from OpenHCSDev/feat/family-member-tag
• ba9c322 0.3.0: a field that admits several classes stores its value under a member tag
• a88fe56 Merge pull request #22 from OpenHCSDev/e1-registered-class-pydantic
• 47e33a2 RegisteredClassChoices publishes a named enum definition in JSON schema
• be47ec8 Decode registry keys without running the encoder
• 0d075a9 0.2.8: RegisteredClassChoices in pydantic
• 9543848 RegisteredClassChoices validates registry keys in pydantic
• 046a1f6 Merge pull request #20 from OpenHCSDev/k6-registered-class-decoding
• 1a74ca8 Decode registered classes from their registry key; RegisteredClassChoices; 0.2.7
• 82a9ce5 Merge pull request #21 from OpenHCSDev/refactor/U3-field-label
• Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
• 331eccb Upgrade certifi and sigstore
• f68fee4 💰 Sync the FUNDING config
• c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
• 9090099 🧪 Make smoke test deps hash-pinned in CI
• 34e40c2 📌 Bump pip-tools managed transitive deptrees
• e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
• dd8c5f4 🔧 Make pip-tools config available in container
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions