[dependabot]

Bumps pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3.

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
• 331eccb Upgrade certifi and sigstore
• f68fee4 💰 Sync the FUNDING config
• c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
• 9090099 🧪 Make smoke test deps hash-pinned in CI
• 34e40c2 📌 Bump pip-tools managed transitive deptrees
• e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
• dd8c5f4 🔧 Make pip-tools config available in container
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mergify]

Merge Protections

🟢 All 6 merge protections satisfied — ready to merge.

Show 6 satisfied protections

🟢 🤖 Continuous Integration

• all of:
  • check-success=Test with Python 3.10
  • check-success=Test with Python 3.11
  • check-success=Test with Python 3.12
  • check-success=Test with Python 3.13
  • check-success=Test with Python 3.14
  • check-success=semgrep

🟢 👀 Review Requirements

• any of:
  • author = dependabot[bot]
  • #approved-reviews-by>=1

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 🔎 Reviews

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[mergify]

✅ Merged into main as fd46b40 at 08:10 UTC

5 min in the queue, with no time running CI.

So far

• ✅ Entered the queue Tue 27 Oct, 08:05 · rule dependencies · triggered by merge protections
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged 08:10 · fd46b40 · fast-forward

Merge conditions: 13 of 13 met

This pull request

	Condition	Required by
✅	github-review-approved	GitHub branch protection and GitHub repository ruleset rule Require pull request for default branch
✅	title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:	Merge Protections rule Enforce conventional commit
✅	any of: author = dependabot[bot], #approved-reviews-by>=1	Merge Protections rule 👀 Review Requirements
✅	body ~= (?ms:.{48,})	Merge Protections rule 📕 PR description
✅	#changes-requested-reviews-by = 0	Merge Protections rule 🔎 Reviews
✅	#review-requested = 0	Merge Protections rule 🔎 Reviews
✅	#review-threads-unresolved = 0	Merge Protections rule 🔎 Reviews

The batch, tested in place

	Condition	Required by
✅	check-success=Test with Python 3.10	Merge Protections rule 🤖 Continuous Integration
✅	check-success=Test with Python 3.11	Merge Protections rule 🤖 Continuous Integration
✅	check-success=Test with Python 3.12	Merge Protections rule 🤖 Continuous Integration
✅	check-success=Test with Python 3.13	Merge Protections rule 🤖 Continuous Integration
✅	check-success=Test with Python 3.14	Merge Protections rule 🤖 Continuous Integration
✅	check-success=semgrep	Merge Protections rule 🤖 Continuous Integration

_{Times in UTC · dashboard · how the merge queue works}