From cec612f7414cad5287054336b30265e7e258b67b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 00:33:40 +0000 Subject: [PATCH 1/2] Bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3 Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.2 to 1.14.3. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/dc37677b2e1c63e2034f94d8a5b11f265b73ba33...7245906fb61fa33a13554f9d5fb856fe61758086) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/publish-first-cohort.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-first-cohort.yml b/.github/workflows/publish-first-cohort.yml index d8e920f..664ca18 100644 --- a/.github/workflows/publish-first-cohort.yml +++ b/.github/workflows/publish-first-cohort.yml @@ -238,7 +238,7 @@ jobs: path: dist - name: Publish the Python runtime with its PyPI attestation - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1 with: packages-dir: dist/pypi skip-existing: true From 1c0f537b2cc336e4c8d0047a90d44d8139bc2a4d Mon Sep 17 00:00:00 2001 From: jeremydixon22 Date: Mon, 26 Oct 2026 09:42:21 -0400 Subject: [PATCH 2/2] Authorize PyPI publisher security update --- scripts/verify-publication-policy.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/verify-publication-policy.py b/scripts/verify-publication-policy.py index 2b3a4b1..a357bb2 100644 --- a/scripts/verify-publication-policy.py +++ b/scripts/verify-publication-policy.py @@ -139,7 +139,7 @@ def main() -> int: "name: package-release-v0.3.4", 'SOURCE_DATE_EPOCH: "315532800"', "NuGet/login@8d196754b4036150537f80ac539e15c2f1028841", - "pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33", + "pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086", "skip-existing: true", "Verify public package availability", ):