[dependabot]

Bumps the actions group with 9 updates:

Package	From	To
jupyterlab/maintainer-tools/.github/actions/upload-coverage	1.0.0	1.1.0
jupyterlab/maintainer-tools/.github/actions/report-coverage	1.0.0	1.1.0
jupyterlab/maintainer-tools/.github/actions/base-setup	1.0.0	1.1.0
jupyterlab/maintainer-tools/.github/actions/make-sdist	1.0.0	1.1.0
jupyterlab/maintainer-tools/.github/actions/test-sdist	1.0.0	1.1.0
jupyterlab/maintainer-tools/.github/actions/check-links	1.0.0	1.1.0
jupyterlab/maintainer-tools/.github/actions/downstream-test	1.0.0	1.1.0
jupyterlab/maintainer-tools/.github/actions/enforce-label	1.0.0	1.1.0
zizmorcore/zizmor-action	0.6.4	0.7.1

Updates jupyterlab/maintainer-tools/.github/actions/upload-coverage from 1.0.0 to 1.1.0

Release notes

Sourced from jupyterlab/maintainer-tools/.github/actions/upload-coverage's releases.

v1.1.0

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

Changelog

Sourced from jupyterlab/maintainer-tools/.github/actions/upload-coverage's changelog.

Changelog

1.1.1

(Full Changelog)

Bugs fixed

• Do not set restore-keys when using global yarn cache in base-setup #313 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​krassowski (activity)

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

1.0.0

(Full Changelog)

Enhancements made

... (truncated)

Commits

• 925e40f Publish 1.1.0
• 6ac6c6e Remove restore-keys from the Python package manager cache (#312)
• 9ef9d99 base-setup: install hatch with uv pip when uv is the package manager (#307)
• See full diff in compare view

Updates jupyterlab/maintainer-tools/.github/actions/report-coverage from 1.0.0 to 1.1.0

Release notes

Sourced from jupyterlab/maintainer-tools/.github/actions/report-coverage's releases.

v1.1.0

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

Changelog

Sourced from jupyterlab/maintainer-tools/.github/actions/report-coverage's changelog.

Changelog

1.1.1

(Full Changelog)

Bugs fixed

• Do not set restore-keys when using global yarn cache in base-setup #313 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​krassowski (activity)

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

1.0.0

(Full Changelog)

Enhancements made

... (truncated)

Commits

• 925e40f Publish 1.1.0
• 6ac6c6e Remove restore-keys from the Python package manager cache (#312)
• 9ef9d99 base-setup: install hatch with uv pip when uv is the package manager (#307)
• See full diff in compare view

Updates jupyterlab/maintainer-tools/.github/actions/base-setup from 1.0.0 to 1.1.0

Release notes

Sourced from jupyterlab/maintainer-tools/.github/actions/base-setup's releases.

v1.1.0

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

Changelog

Sourced from jupyterlab/maintainer-tools/.github/actions/base-setup's changelog.

Changelog

1.1.1

(Full Changelog)

Bugs fixed

• Do not set restore-keys when using global yarn cache in base-setup #313 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​krassowski (activity)

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

1.0.0

(Full Changelog)

Enhancements made

... (truncated)

Commits

• 925e40f Publish 1.1.0
• 6ac6c6e Remove restore-keys from the Python package manager cache (#312)
• 9ef9d99 base-setup: install hatch with uv pip when uv is the package manager (#307)
• See full diff in compare view

Updates jupyterlab/maintainer-tools/.github/actions/make-sdist from 1.0.0 to 1.1.0

Release notes

Sourced from jupyterlab/maintainer-tools/.github/actions/make-sdist's releases.

v1.1.0

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

Changelog

Sourced from jupyterlab/maintainer-tools/.github/actions/make-sdist's changelog.

Changelog

1.1.1

(Full Changelog)

Bugs fixed

• Do not set restore-keys when using global yarn cache in base-setup #313 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​krassowski (activity)

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

1.0.0

(Full Changelog)

Enhancements made

... (truncated)

Commits

• 925e40f Publish 1.1.0
• 6ac6c6e Remove restore-keys from the Python package manager cache (#312)
• 9ef9d99 base-setup: install hatch with uv pip when uv is the package manager (#307)
• See full diff in compare view

Updates jupyterlab/maintainer-tools/.github/actions/test-sdist from 1.0.0 to 1.1.0

Release notes

Sourced from jupyterlab/maintainer-tools/.github/actions/test-sdist's releases.

v1.1.0

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

Changelog

Sourced from jupyterlab/maintainer-tools/.github/actions/test-sdist's changelog.

Changelog

1.1.1

(Full Changelog)

Bugs fixed

• Do not set restore-keys when using global yarn cache in base-setup #313 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​krassowski (activity)

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

1.0.0

(Full Changelog)

Enhancements made

... (truncated)

Commits

• 925e40f Publish 1.1.0
• 6ac6c6e Remove restore-keys from the Python package manager cache (#312)
• 9ef9d99 base-setup: install hatch with uv pip when uv is the package manager (#307)
• See full diff in compare view

Updates jupyterlab/maintainer-tools/.github/actions/check-links from 1.0.0 to 1.1.0

Release notes

Sourced from jupyterlab/maintainer-tools/.github/actions/check-links's releases.

v1.1.0

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

Changelog

Sourced from jupyterlab/maintainer-tools/.github/actions/check-links's changelog.

Changelog

1.1.1

(Full Changelog)

Bugs fixed

• Do not set restore-keys when using global yarn cache in base-setup #313 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​krassowski (activity)

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

1.0.0

(Full Changelog)

Enhancements made

... (truncated)

Commits

• 925e40f Publish 1.1.0
• 6ac6c6e Remove restore-keys from the Python package manager cache (#312)
• 9ef9d99 base-setup: install hatch with uv pip when uv is the package manager (#307)
• See full diff in compare view

Updates jupyterlab/maintainer-tools/.github/actions/downstream-test from 1.0.0 to 1.1.0

Release notes

Sourced from jupyterlab/maintainer-tools/.github/actions/downstream-test's releases.

v1.1.0

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

Changelog

Sourced from jupyterlab/maintainer-tools/.github/actions/downstream-test's changelog.

Changelog

1.1.1

(Full Changelog)

Bugs fixed

• Do not set restore-keys when using global yarn cache in base-setup #313 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​krassowski (activity)

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

1.0.0

(Full Changelog)

Enhancements made

... (truncated)

Commits

• 925e40f Publish 1.1.0
• 6ac6c6e Remove restore-keys from the Python package manager cache (#312)
• 9ef9d99 base-setup: install hatch with uv pip when uv is the package manager (#307)
• See full diff in compare view

Updates jupyterlab/maintainer-tools/.github/actions/enforce-label from 1.0.0 to 1.1.0

Release notes

Sourced from jupyterlab/maintainer-tools/.github/actions/enforce-label's releases.

v1.1.0

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

Changelog

Sourced from jupyterlab/maintainer-tools/.github/actions/enforce-label's changelog.

Changelog

1.1.1

(Full Changelog)

Bugs fixed

• Do not set restore-keys when using global yarn cache in base-setup #313 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​krassowski (activity)

1.1.0

(Full Changelog)

Enhancements made

• base-setup: install hatch with uv pip when uv is the package manager #307 (@​Carreau, @​krassowski)

Bugs fixed

• Remove restore-keys from the Python package manager cache #312 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​Darshan808 (activity) | @​krassowski (activity)

1.0.0

(Full Changelog)

Enhancements made

... (truncated)

Commits

• 925e40f Publish 1.1.0
• 6ac6c6e Remove restore-keys from the Python package manager cache (#312)
• 9ef9d99 base-setup: install hatch with uv pip when uv is the package manager (#307)
• See full diff in compare view

Updates zizmorcore/zizmor-action from 0.6.4 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (Description has been truncated