Skip to content

Bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3 - #2347

Merged
dmah42 merged 1 commit into
mainfrom
dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.3
Oct 27, 2026
Merged

dmah42 merged 1 commit into
mainfrom
dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

Bumps pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3.

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

Commits
  • 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
  • 331eccb Upgrade certifi and sigstore
  • f68fee4 💰 Sync the FUNDING config
  • c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
  • 9090099 🧪 Make smoke test deps hash-pinned in CI
  • 34e40c2 📌 Bump pip-tools managed transitive deptrees
  • e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
  • dd8c5f4 🔧 Make pip-tools config available in container
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 23, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.3 branch 2 times, most recently from a17f4a1 to 1ee5049 Compare October 27, 2026 12:15
Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.2 to 1.14.3.
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@dc37677...7245906)

---
updated-dependencies:
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.3 branch from 1ee5049 to c0e0111 Compare October 27, 2026 12:25
@dmah42

dmah42 commented Oct 27, 2026

Copy link
Copy Markdown
Member

bazel failure is due to a cache issue. bazel cache was stored as one version (24.04) and used by another (26.04) as there's an active rollout on latest right now. i'll resolve on main before landing this.

@dmah42
dmah42 merged commit fbd4537 into main Oct 27, 2026
128 of 133 checks passed
@dmah42
dmah42 deleted the dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.3 branch October 27, 2026 17:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant