From cda5765e0e7eadcfa67cdf4d9e37b09b868132af Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 00:02:49 +0000 Subject: [PATCH] chore(deps) Pin dependencies --- .github/workflows/ci.yml | 66 ++++++++++++------------- .github/workflows/codeql.yml | 2 +- .github/workflows/dependency-review.yml | 2 +- .github/workflows/release.yml | 2 +- 4 files changed, 36 insertions(+), 36 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cb73839..ac5276a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -70,10 +70,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: - python-version: "3.13" + python-version: "3.14.6" # Caches the pip download/wheel cache keyed on pyproject.toml. The # runtime has zero dependencies, but the dev extra pulls ruff, mypy, # pytest and their graph, and 19 jobs were each fetching it fresh. @@ -128,8 +128,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: ${{ matrix.python-version }} cache: pip @@ -149,7 +149,7 @@ jobs: # Only one leg uploads the artifact to avoid duplicates. if: always() && matrix.python-version == '3.13' # v4+: v3 was retired 2025-01-30 and now fails outright. - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 # Never fail the build on this. The coverage GATE is enforced inside # the test step by pytest-cov's --cov-fail-under, so by the time we # get here the number has already passed or failed; this upload only @@ -168,10 +168,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: - python-version: "3.13" + python-version: "3.14.6" # Caches the pip download/wheel cache keyed on pyproject.toml. The # runtime has zero dependencies, but the dev extra pulls ruff, mypy, # pytest and their graph, and 19 jobs were each fetching it fresh. @@ -196,10 +196,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: - python-version: "3.13" + python-version: "3.14.6" # Caches the pip download/wheel cache keyed on pyproject.toml. The # runtime has zero dependencies, but the dev extra pulls ruff, mypy, # pytest and their graph, and 19 jobs were each fetching it fresh. @@ -274,10 +274,10 @@ jobs: timeout-minutes: 15 needs: test steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: - python-version: "3.13" + python-version: "3.14.6" # Caches the pip download/wheel cache keyed on pyproject.toml. The # runtime has zero dependencies, but the dev extra pulls ruff, mypy, # pytest and their graph, and 19 jobs were each fetching it fresh. @@ -372,7 +372,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: # gitleaks needs full history to scan past commits, not just HEAD. fetch-depth: 0 @@ -405,7 +405,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 - name: TruffleHog (verified/unknown findings only) @@ -422,7 +422,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Install codespell # Into a venv: the runner image's system Python is externally # managed (PEP 668) and rejects a bare `pip install`. @@ -451,10 +451,10 @@ jobs: timeout-minutes: 10 if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: - python-version: "3.13" + python-version: "3.14.6" # Caches the pip download/wheel cache keyed on pyproject.toml. The # runtime has zero dependencies, but the dev extra pulls ruff, mypy, # pytest and their graph, and 19 jobs were each fetching it fresh. @@ -481,7 +481,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: markdownlint # Pinned to the same version .pre-commit-config.yaml uses, so # local and CI agree. Newer versions add rules (e.g. MD060) that @@ -495,7 +495,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Install lychee run: | case "$(uname -m)" in @@ -516,7 +516,7 @@ jobs: timeout-minutes: 10 if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Install lychee run: | case "$(uname -m)" in @@ -535,10 +535,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: - python-version: "3.13" + python-version: "3.14.6" # Caches the pip download/wheel cache keyed on pyproject.toml. The # runtime has zero dependencies, but the dev extra pulls ruff, mypy, # pytest and their graph, and 19 jobs were each fetching it fresh. @@ -586,10 +586,10 @@ jobs: timeout-minutes: 15 needs: test # don't bother if unit tests are broken steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: - python-version: "3.13" + python-version: "3.14.6" # Caches the pip download/wheel cache keyed on pyproject.toml. The # runtime has zero dependencies, but the dev extra pulls ruff, mypy, # pytest and their graph, and 19 jobs were each fetching it fresh. @@ -621,14 +621,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: # No token in the environment: this job runs no privileged step and # a checkout that leaves credentials behind is a needless one. persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: - python-version: "3.13" + python-version: "3.14.6" # Caches the pip download/wheel cache keyed on pyproject.toml. The # runtime has zero dependencies, but the dev extra pulls ruff, mypy, # pytest and their graph, and 19 jobs were each fetching it fresh. diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2fcbe6e..267af48 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -63,7 +63,7 @@ jobs: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Initialize CodeQL uses: github/codeql-action/init@v3 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 7833f33..1956b9e 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -40,7 +40,7 @@ jobs: # burying the result in the job log. pull-requests: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - # @v5, not @v4: this action publishes no `v4` floating major tag, # only v4.x.y specifics and v5.0.0, so `@v4` fails to resolve. uses: actions/dependency-review-action@v5 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9f8086f..9059692 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -65,7 +65,7 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: - python-version: "3.13" + python-version: "3.14.6" cache: pip cache-dependency-path: pyproject.toml