Skip to content

chore(deps): bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3 - #109

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.3
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026 •

Copy link
Copy Markdown
Contributor

Bumps pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3.

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

Commits
  • 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
  • 331eccb Upgrade certifi and sigstore
  • f68fee4 💰 Sync the FUNDING config
  • c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
  • 9090099 🧪 Make smoke test deps hash-pinned in CI
  • 34e40c2 📌 Bump pip-tools managed transitive deptrees
  • e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
  • dd8c5f4 🔧 Make pip-tools config available in container
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 25, 2026
Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.2 to 1.14.3.
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@dc37677...7245906)

---
updated-dependencies:
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.3 branch from 7e66183 to 1745793 Compare October 25, 2026 15:16

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 potential issue.

Devin Review

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants