[dependabot]

Bumps the actions group with 4 updates in the / directory: useblacksmith/checkout, astral-sh/setup-uv, CodSpeedHQ/action and pypa/gh-action-pypi-publish.

Updates useblacksmith/checkout from 1.8.1 to 1.8.2

Commits

• 2b9fe87 Refuse fork PR checkouts in pull_request_target/workflow_run unless allow-uns...
• cc2d27f Document customer privacy before publication (#64)
• 4a338d9 Log git mirror hydration contention as info instead of a warning (#60)
• See full diff in compare view

Updates astral-sh/setup-uv from 10.3.0 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @​eifinger (#1119)
• fix: allow whitespace in uv requirement specifiers @​soujasK (#1112)
• fix: resolve ~= specifiers with PEP 440 semantics @​soujasK (#1111)
• fix: only report a saved cache when saving succeeded @​soujasK (#1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @github-actions[bot] (#1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @​eifinger (#1113)
• docs: update version references to v10.3.2 @github-actions[bot] (#1104)

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

• chore: update known checksums for 0.13.5 @github-actions[bot] (#1103)

📚 Documentation

• docs: update version references to v10.3.1 @github-actions[bot] (#1102)

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

• fix: preserve cache error class names in save-cache bundle @​dannyward630 (#1093)

🧰 Maintenance

... (truncated)

Commits

• 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
• 0192b69 chore: update known checksums for 0.13.6 (#1117)
• 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
• 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
• 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
• 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
• 56618ca docs: update version references to v10.3.2 (#1104)
• 07a047e chore: update known checksums for 0.13.5 (#1103)
• e1b8536 docs: update version references to v10.3.1 (#1102)
• 18d369b chore(deps): roll up Dependabot updates (#1101)
• Additional commits viewable in compare view

Updates CodSpeedHQ/action from 5.5.0 to 5.6.1

Release notes

Sourced from CodSpeedHQ/action's releases.

v5.6.1

Bumps the CodSpeed runner to v5.6.1.

Fixes

• Walltime: the runner no longer hangs after the benchmark exits when a Python process forks and leaves a corrupted perf jitdump (#599)
• Simulation: stop the libpython symlink warning from firing falsely (#594)

🐛 Bug Fixes

• Stop the libpython symlink warning from firing falsely by @​not-matthias in #594

💼 Other

• Bump submodule to not loop on corrupted jit dump by @​GuillaumeLagrange in #599

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

• docs(examples): update the example workflows by @​SuperMuel in CodSpeedHQ/action#252
• chore: bump runner version to 5.6.1 by @​github-actions[bot] in CodSpeedHQ/action#254

New Contributors

• @​SuperMuel made their first contribution in CodSpeedHQ/action#252

Full Changelog: CodSpeedHQ/action@v5.6.0...v5.6.1

v5.6.0

Bumps the CodSpeed runner to v5.6.0.

Highlights

More consistent CPU Simulation results

Changes to your CI environment, like a different path or an extra environment variable, no longer change the performance. Each benchmark now starts with the same memory layout, reducing the chance of false regressions.

🐛 Bug Fixes

• Keep the user's HOME when wrapping commands with sudo by @​lvaroqui in #588

⚙️ Internals

• Bump pinned valgrind-codspeed to 3.26.0-0codspeed10 by @​adriencaccia in #593
  • fix(callgrind): suppress L3 warning for explicit LL settings by @​not-matthias in CodSpeedHQ/valgrind-codspeed#52
  • fix(initimg): stabilize Linux startup stack layout by @​not-matthias in CodSpeedHQ/valgrind-codspeed#53

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

... (truncated)

Commits

• 61efe07 Release v5.6.1 🚀
• 2dea609 chore: bump runner version to 5.6.1 (#254)
• e0fab22 docs(examples): update the example workflows (#252)
• 78102a4 Release v5.6.0 🚀
• 3bb0242 chore: bump runner version to 5.6.0 (#253)
• See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
• 331eccb Upgrade certifi and sigstore
• f68fee4 💰 Sync the FUNDING config
• c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
• 9090099 🧪 Make smoke test deps hash-pinned in CI
• 34e40c2 📌 Bump pip-tools managed transitive deptrees
• e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
• dd8c5f4 🔧 Make pip-tools config available in container
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[codspeed]

Merging this PR will not alter performance

✅ 46 untouched benchmarks

---

_{Comparing dependabot/github_actions/actions-ea00ff24a4 (7277756) with main (9da5a8d)}