[dependabot]

Bumps the github-actions group with 1 update: actions/setup-python.

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in https://github.com/actions/setup-python/pull/1302
• Improve error message clarity by @​v-lmvysakh in https://github.com/actions/setup-python/pull/1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in https://github.com/actions/setup-python/pull/1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in https://github.com/actions/setup-python/pull/1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in https://github.com/actions/setup-python/pull/1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in https://github.com/actions/setup-python/pull/1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in https://github.com/actions/setup-python/pull/1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in https://github.com/actions/setup-python/pull/1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in https://github.com/actions/setup-python/pull/1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in https://github.com/actions/setup-python/pull/1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in https://github.com/actions/setup-python/pull/1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in https://github.com/actions/setup-python/pull/1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in https://github.com/actions/setup-python/pull/1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in https://github.com/actions/setup-python/pull/1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in https://github.com/actions/setup-python/pull/1347
• Resolve npm audit failures by @​v-HarithaVattikuti in https://github.com/actions/setup-python/pull/1350

New Contributors

• @​luhenry made their first contribution in https://github.com/actions/setup-python/pull/1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

• .github/workflows/release.yml

[zoeyrose]

Back to draft until the merge-readiness gate passes: Repairing the shared Content validation evidence failure and refreshing independent review.

[zoeyrose]

Self-review

Fresh-context independent review covered the complete diff from 60398f91cd5dc7d0523e6f6b601e237efa84b7c0 to 12890c8d1a7f27bb0f365d28bb5316609f26be83, including the setup-python 7.1.0 immutable action pins, M1 generator, tests, provenance documentation, and affected workflows. No findings were identified.

The repair explicitly traverses non-merge source commits. It preserves all historical evidence rather than regenerating away three Seller.py commits that Git 2.56 omitted from Merchant.py history. The regression requires all 13 original commits through creation. Authored content, provenance records, package allowlists, and fail-closed validation remain unchanged.

Validation: seven focused M1 tests and complete inventory validation passed with Git 2.53 and Git 2.56. The independent reviewer compared all 179 stored histories (177 Python and two material histories) against original and fixed traversal; all matched byte-for-byte. git diff --check passed.

The aggregate python3 tools/validate.py passed on the integrated repair with Git 2.56: 187 tests, world/catalog/schema audits, provenance gates, and isolated runtime collection. Both PRs have identical content-validation source trees; their distinct dependency/workflow changes are covered by their current-head CI.

[zoeyrose]

Self-review

Fresh-context independent review covered the complete diff from 60398f91cd5dc7d0523e6f6b601e237efa84b7c0 to 5afc6648f91e5fe2eea3ee2a7442db98083379b4, including the setup-python 7.1.0 immutable action pins, M1 generator, tests, provenance documentation, and affected workflows. No findings were identified.

The repair explicitly traverses non-merge source commits. It preserves all historical evidence rather than regenerating away three Seller.py commits that Git 2.56 omitted from Merchant.py history. The regression requires all 13 original commits through creation. Authored content, provenance records, package allowlists, and fail-closed validation remain unchanged.

Validation: seven focused M1 tests and complete inventory validation passed with Git 2.53 and Git 2.56. The independent reviewer compared all 179 stored histories (177 Python and two material histories) against original and fixed traversal; all matched byte-for-byte. git diff --check passed.

The aggregate python3 tools/validate.py passed on the integrated repair with Git 2.56: 187 tests, world/catalog/schema audits, provenance gates, and isolated runtime collection. Both PRs have identical content-validation source trees; their distinct dependency/workflow changes are covered by their current-head CI.

Follow-up review verified that the final CI-refresh commit has an identical tree to previously reviewed 12890c8d1a7f27bb0f365d28bb5316609f26be83. It only creates a fresh check context after the reviewed correction of 17 Dependabot-generated link labels in the PR body; all hrefs and other prose are preserved. The existing metadata validator passes the corrected body. No source change occurred after aggregate validation.