Bump the gh-actions group across 1 directory with 6 updates (#197)

dependabot[bot] · web-flow · commit 36fdf38dabe9 · 2026-05-12T14:26:34.000+02:00
Bumps the gh-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) | `3.3.0` | `3.4.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.0` | | [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.3` | `0.9.5` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` | Updates `pypa/cibuildwheel` from 3.3.0 to 3.4.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/cibuildwheel/releases">pypa/cibuildwheel's releases</a>.</em></p> <blockquote> <h2>v3.4.1</h2> <ul> <li>⚠️ Building for the experimental CPython 3.13 free-threading variant is now deprecated. That functionality will be removed in the next minor release. The <a href="https://cibuildwheel.pypa.io/en/stable/options/#enable"><code>enable</code></a> option <code>cpython-freethreading</code> is therefore also deprecated. Builds specifying <code>enable = &quot;all&quot;</code> no longer select <code>cpython-freethreading</code>. CPython 3.14 free-threading support remains available without the <code>enable</code> flag. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2787">#2787</a>)</li> <li>🐛 iOS builds will no longer skip <code>repair-wheel-command</code> if it's defined in config (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2761">#2761</a>)</li> <li>🐛 Fix bug causing <code>uv</code> to fail when environments define PYTHON_VERSION or UV_PYTHON, conflicting with our venvs (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2795">#2795</a>)</li> <li>✨ cibuildwheel prints the selected build identifiers at the start of the build. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2785">#2785</a>)</li> <li>🔐 The GitHub Action now references other actions with a full SHA (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2744">#2744</a>)</li> </ul> <h2>v3.4.0</h2> <ul> <li>🌟 You can now build wheels using <code>uv</code> as a build frontend. This should improve performance, especially if your project has lots of build dependencies. To use, set <a href="https://cibuildwheel.pypa.io/en/stable/options/#build-frontend"><code>build-frontend</code></a> to <code>uv</code>. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2322">#2322</a>)</li> <li>⚠️ We no longer support running on Travis CI. It may continue working but we don't run tests there anymore so we can't be sure. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2682">#2682</a>)</li> <li>✨ Improvements to building Rust wheels on Android (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2650">#2650</a>)</li> <li>🛠 Update Pyodide to 0.29.3 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2719">#2719</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2733">#2733</a>)</li> <li>🐛 Fix bug with the GitHub Action on Windows, where PATH was getting unnecessarily changed, causing issues with meson builds. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2723">#2723</a>)</li> <li>✨ Add support for quiet setting on <code>build</code> and <code>uv</code> from the cibuildwheel <code>build-verbosity</code> setting. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2737">#2737</a>)</li> <li>📚 Docs updates, including guidance on using Meson on Windows (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2718">#2718</a>)</li> </ul> <h2>v3.3.1</h2> <ul> <li>🛠 Update dependencies and container pins, including updating to CPython 3.14.2. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2708">#2708</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md">pypa/cibuildwheel's changelog</a>.</em></p> <blockquote> <hr /> <h2>title: Changelog</h2> <h1>Changelog</h1> <h3>v3.4.1</h3> <p><em>2 April 2026</em></p> <ul> <li>⚠️ Building for the experimental CPython 3.13 free-threading variant is now deprecated. That functionality will be removed in the next minor release. The <a href="https://cibuildwheel.pypa.io/en/stable/options/#enable"><code>enable</code></a> option <code>cpython-freethreading</code> is therefore also deprecated. Builds specifying <code>enable = &quot;all&quot;</code> no longer select <code>cpython-freethreading</code>. CPython 3.14 free-threading support remains available without the <code>enable</code> flag. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2787">#2787</a>)</li> <li>🐛 iOS builds will no longer skip <code>repair-wheel-command</code> if it's defined in config (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2761">#2761</a>)</li> <li>🐛 Fix bug causing <code>uv</code> to fail when environments define PYTHON_VERSION or UV_PYTHON, conflicting with our venvs (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2795">#2795</a>)</li> <li>✨ cibuildwheel prints the selected build identifiers at the start of the build. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2785">#2785</a>)</li> <li>🔐 The GitHub Action now references other actions with a full SHA (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2744">#2744</a>)</li> </ul> <h3>v3.4.0</h3> <p><em>5 March 2026</em></p> <ul> <li>🌟 You can now build wheels using <code>uv</code> as a build frontend. This should improve performance, especially if your project has lots of build dependencies. To use, set <a href="https://cibuildwheel.pypa.io/en/stable/options/#build-frontend"><code>build-frontend</code></a> to <code>uv</code>. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2322">#2322</a>)</li> <li>⚠️ We no longer support running on Travis CI. It may continue working but we don't run tests there anymore so we can't be sure. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2682">#2682</a>)</li> <li>✨ Improvements to building rust wheels on Android (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2650">#2650</a>)</li> <li>🛠 Update Pyodide to 0.29.3 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2719">#2719</a>, <a href="https://redirect.github.com/pypa/cibuildwheel/issues/2733">#2733</a>)</li> <li>🐛 Fix bug with the GitHub Action on Windows, where PATH was getting unnecessarily changed, causing issues with meson builds. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2723">#2723</a>)</li> <li>✨ Add support for quiet setting on <code>build</code> and <code>uv</code> from the cibuildwheel <code>build-verbosity</code> setting. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2737">#2737</a>)</li> <li>📚 Docs updates, including guidance on using Meson on Windows (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2718">#2718</a>)</li> </ul> <h3>v3.3.1</h3> <p><em>5 January 2026</em></p> <ul> <li>🛠 Update dependencies and container pins, including updating to CPython 3.14.2. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2708">#2708</a>)</li> </ul> <h3>v3.3.0</h3> <p><em>12 November 2025</em></p> <ul> <li>🐛 Fix an incompatibility with Docker v29 (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2660">#2660</a>)</li> <li>✨ Adds <code>test-runtime</code> option, to customise how tests on simulated/emulated environments are run (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2636">#2636</a>)</li> <li>✨ Adds support for new <code>manylinux_2_35</code> images on 32-bit ARM <code>armv7l</code>, offering better C++20 compatibility (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2656">#2656</a>)</li> <li>✨ <code>build[uv]</code> is now supported on Android (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2587">#2587</a>)</li> <li>✨ You can now install extras (such as <code>uv</code>) with a simple option on the GitHub Action (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2630">#2630</a>)</li> <li>✨ <code>{project}</code> and <code>{package}</code> placeholders are now supported in <code>repair-wheel-command</code> (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2589">#2589</a>)</li> <li>🛠 The versions set with <code>dependency-versions</code> no longer constrain packages specified by your <code>build-system.requires</code>. Previously, on platforms other than Linux, the constraints in this option would remain in the environment during the build. This has been tidied up make behaviour more consistent between platforms, and to prevent version conflicts. (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2583">#2583</a>)</li> <li>🛠 Improve the handling of <code>test-command</code> on Android, enabling more options to be passed (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2590">#2590</a>)</li> <li>📚 Docs improvements (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2618">#2618</a>)</li> </ul> <h3>v3.2.1</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/cibuildwheel/commit/8d2b08b68458a16aeb24b64e68a09ab1c8e82084"><code>8d2b08b</code></a> Bump version: v3.4.1</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/54b8a010d0e3b9d46d00af867716f4f8661b39ae"><code>54b8a01</code></a> deprecation: cp313t (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2787">#2787</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/097806b6b1bd3cdd7b139ac63b20f85f76d72082"><code>097806b</code></a> tests: fully type the test suite (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2794">#2794</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/643b30c796cbdb68e5364c4e6bdd210e836bda49"><code>643b30c</code></a> fix: avoid PYTHON_VERSION breaking uv if set (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2795">#2795</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/fffe2ca07d4e0898a2b87bd9172a66dc0b3d3796"><code>fffe2ca</code></a> chore(deps): bump j178/prek-action from 1.1.1 to 2.0.0 in the actions group (...</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/611194896a33e5c3b9f664e9c08336a24aed1dd0"><code>6111948</code></a> fix: zizmor &quot;code injection via template expansion&quot; (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2784">#2784</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/e478767d76bd66b189a4c7be9b86b307d5db238f"><code>e478767</code></a> chore: remove some string types (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2798">#2798</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/caf433b1371556dcd693666e03b28d8f3f2a1110"><code>caf433b</code></a> [Bot] Update dependencies (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2789">#2789</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/a257a3f78932d0ef69997304a2840f3515c1a966"><code>a257a3f</code></a> chore: remove remaining future annotations (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2799">#2799</a>)</li> <li><a href="https://github.com/pypa/cibuildwheel/commit/6df84da3e7028a2cb008ae762b20ee9b481cf898"><code>6df84da</code></a> chore: some cleanup and checks (<a href="https://redirect.github.com/pypa/cibuildwheel/issues/2792">#2792</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/cibuildwheel/compare/63fd63b352a9a8bdcc24791c9dbee952ee9a8abc...8d2b08b68458a16aeb24b64e68a09ab1c8e82084">compare view</a></li> </ul> </details> <br /> Updates `actions/upload-artifact` from 6.0.0 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update the readme with direct upload details by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li> <li>Readme: bump all the example versions to v7 by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></li> <li>Include changes in typespec/ts-http-runtime 0.3.5 by <a href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/797">actions/upload-artifact#797</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v7...v7.0.1">https://github.com/actions/upload-artifact/compare/v7...v7.0.1</a></p> <h2>v7.0.0</h2> <h2>v7 What's new</h2> <h3>Direct Uploads</h3> <p>Adds support for uploading single files directly (unzipped). Callers can set the new <code>archive</code> parameter to <code>false</code> to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The <code>name</code> parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.</p> <h3>ESM</h3> <p>To support new versions of the <code>@actions/*</code> packages, we've upgraded the package to ESM.</p> <h2>What's Changed</h2> <ul> <li>Add proxy integration test by <a href="https://github.com/Link"><code>@​Link</code></a>- in <a href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li> <li>Upgrade the module to ESM and bump dependencies by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/762">actions/upload-artifact#762</a></li> <li>Support direct file uploads by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/764">actions/upload-artifact#764</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Link"><code>@​Link</code></a>- made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v6...v7.0.0">https://github.com/actions/upload-artifact/compare/v6...v7.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"><code>043fb46</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/797">#797</a> from actions/yacaovsnc/update-dependency</li> <li><a href="https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94"><code>634250c</code></a> Include changes in typespec/ts-http-runtime 0.3.5</li> <li><a href="https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8"><code>e454baa</code></a> Readme: bump all the example versions to v7 (<a href="https://redirect.github.com/actions/upload-artifact/issues/796">#796</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e"><code>74fad66</code></a> Update the readme with direct upload details (<a href="https://redirect.github.com/actions/upload-artifact/issues/795">#795</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f"><code>bbbca2d</code></a> Support direct file uploads (<a href="https://redirect.github.com/actions/upload-artifact/issues/764">#764</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296"><code>589182c</code></a> Upgrade the module to ESM and bump dependencies (<a href="https://redirect.github.com/actions/upload-artifact/issues/762">#762</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5"><code>47309c9</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/754">#754</a> from actions/Link-/add-proxy-integration-tests</li> <li><a href="https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0"><code>02a8460</code></a> Add proxy integration test</li> <li>See full diff in <a href="https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a">compare view</a></li> </ul> </details> <br /> Updates `actions/download-artifact` from 7.0.0 to 8.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/download-artifact/releases">actions/download-artifact's releases</a>.</em></p> <blockquote> <h2>v8.0.1</h2> <h2>What's Changed</h2> <ul> <li>Support for CJK characters in the artifact name by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/471">actions/download-artifact#471</a></li> <li>Add a regression test for artifact name + content-type mismatches by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/472">actions/download-artifact#472</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v8...v8.0.1">https://github.com/actions/download-artifact/compare/v8...v8.0.1</a></p> <h2>v8.0.0</h2> <h2>v8 - What's new</h2> <blockquote> <p>[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.</p> </blockquote> <blockquote> <p>[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).</p> </blockquote> <h3>Direct downloads</h3> <p>To support direct uploads in <code>actions/upload-artifact</code>, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the <code>Content-Type</code> header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new <code>skip-decompress</code> parameter to <code>true</code>.</p> <h3>Enforced checks (breaking)</h3> <p>A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the <code>digest-mismatch</code> parameter. To be secure by default, we are now defaulting the behavior to <code>error</code> which will fail the workflow run.</p> <h3>ESM</h3> <p>To support new versions of the @actions/* packages, we've upgraded the package to ESM.</p> <h2>What's Changed</h2> <ul> <li>Don't attempt to un-zip non-zipped downloads by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/460">actions/download-artifact#460</a></li> <li>Add a setting to specify what to do on hash mismatch and default it to <code>error</code> by <a href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/461">actions/download-artifact#461</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v7...v8.0.0">https://github.com/actions/download-artifact/compare/v7...v8.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/download-artifact/commit/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"><code>3e5f45b</code></a> Add regression tests for CJK characters (<a href="https://redirect.github.com/actions/download-artifact/issues/471">#471</a>)</li> <li><a href="https://github.com/actions/download-artifact/commit/e6d03f67377d4412c7aa56a8e2e4988e6ec479dd"><code>e6d03f6</code></a> Add a regression test for artifact name + content-type mismatches (<a href="https://redirect.github.com/actions/download-artifact/issues/472">#472</a>)</li> <li><a href="https://github.com/actions/download-artifact/commit/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3"><code>70fc10c</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/461">#461</a> from actions/danwkennedy/digest-mismatch-behavior</li> <li><a href="https://github.com/actions/download-artifact/commit/f258da9a506b755b84a09a531814700b86ccfc62"><code>f258da9</code></a> Add change docs</li> <li><a href="https://github.com/actions/download-artifact/commit/ccc058e5fbb0bb2352213eaec3491e117cbc4a5c"><code>ccc058e</code></a> Fix linting issues</li> <li><a href="https://github.com/actions/download-artifact/commit/bd7976ba57ecea96e6f3df575eb922d11a12a9fd"><code>bd7976b</code></a> Add a setting to specify what to do on hash mismatch and default it to <code>error</code></li> <li><a href="https://github.com/actions/download-artifact/commit/ac21fcf45e0aaee541c0f7030558bdad38d77d6c"><code>ac21fcf</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/460">#460</a> from actions/danwkennedy/download-no-unzip</li> <li><a href="https://github.com/actions/download-artifact/commit/15999bff51058bc7c19b50ebbba518eaef7c26c0"><code>15999bf</code></a> Add note about package bumps</li> <li><a href="https://github.com/actions/download-artifact/commit/974686ed5098c7f9c9289ec946b9058e496a2561"><code>974686e</code></a> Bump the version to <code>v8</code> and add release notes</li> <li><a href="https://github.com/actions/download-artifact/commit/fbe48b1d2756394be4cd4358ed3bc1343b330e75"><code>fbe48b1</code></a> Update test names to make it clearer what they do</li> <li>Additional commits viewable in <a href="https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c">compare view</a></li> </ul> </details> <br /> Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/gh-action-pypi-publish/releases">pypa/gh-action-pypi-publish's releases</a>.</em></p> <blockquote> <h2>v1.14.0</h2>  <h2>✨ What's Changed</h2> <p>The main change in this release is that <code>verbose</code> and <code>print-hash</code> inputs are now on by default. This was contributed by <a href="https://github.com/whitequark"><code>@​whitequark</code></a><a href="https://github.com/sponsors/whitequark">💰</a> in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/397">#397</a>.</p> <h2>📝 Docs</h2> <p><a href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a href="https://github.com/sponsors/woodruffw">💰</a> updated the mentions of PEP 740 to stop implying that it might be experimental (it hasn't been for quite a while!) in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/388">#388</a> and <a href="https://github.com/him2him2"><code>@​him2him2</code></a><a href="https://github.com/sponsors/him2him2">💰</a> brushed up some grammar in the README and SECURITY docs via <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/395">#395</a>.</p> <h2>🛠️ Internal Updates</h2> <p><a href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a href="https://github.com/sponsors/woodruffw">💰</a> bumped <code>sigstore</code> and <code>pypi-attestations</code> in the lock file (<a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/391">#391</a>) and <a href="https://github.com/webknjaz"><code>@​webknjaz</code></a><a href="https://github.com/sponsors/webknjaz">💰</a> added infra for using type annotations in the project (<a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/381">#381</a>).</p> <h2>💪 New Contributors</h2> <ul> <li><a href="https://github.com/him2him2"><code>@​him2him2</code></a> made their first contribution in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/395">#395</a></li> <li><a href="https://github.com/whitequark"><code>@​whitequark</code></a> made their first contribution in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/397">#397</a></li> </ul> <p><strong>🪞 Full Diff</strong>: <a href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.13.0...v1.14.0">https://github.com/pypa/gh-action-pypi-publish/compare/v1.13.0...v1.14.0</a></p> <p><strong>🧔‍♂️ Release Manager:</strong> <a href="https://github.com/sponsors/webknjaz"><code>@​webknjaz</code></a> <a href="https://stand-with-ukraine.pp.ua">🇺🇦</a></p> <p><strong>🙏 Special Thanks</strong> to <a href="https://github.com/facutuesca"><code>@​facutuesca</code></a><a href="https://github.com/sponsors/facutuesca">💰</a> and <a href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a href="https://github.com/sponsors/woodruffw">💰</a> for helping maintain this project when <a href="https://github.com/sponsors/webknjaz">I</a> can't!</p> <p><strong>💬 Discuss</strong> <a href="https://bsky.app/profile/webknjaz.me/post/3mivwsz3qzk2e">on Bluesky 🦋</a>, <a href="https://mastodon.social/@webknjaz/116363779997051422">on Mastodon 🐘</a> and <a href="https://github.com/pypa/gh-action-pypi-publish/discussions/404">on GitHub</a>.</p> <p><a href="https://github.com/sponsors/webknjaz"><img src="https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&amp;logoColor=%23EA4AAA&amp;label=Sponsor&amp;color=2a313c" alt="GH Sponsors badge" /></a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/cef221092ed1bacb1cc03d23a2d87d1d172e277b"><code>cef2210</code></a> Merge pull request <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/397">#397</a> from whitequark/patch-1</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/b4595e2555a031e2fd6f0bbded4e7918eaa2724e"><code>b4595e2</code></a> Enable <code>verbose</code> and <code>print-hash</code> by default.</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/e2bab26859796ee5c3bf97b8f394ce1e6570e906"><code>e2bab26</code></a> Merge pull request <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/395">#395</a> from him2him2/docs/fix-typos-and-grammar</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/7495c384ec7a0240a28e568e7ffc60af1629585d"><code>7495c38</code></a> docs: fix typos and grammar in README and SECURITY</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/03f86fee9ac21f854951f5c6e2a02c2a1324aec7"><code>03f86fe</code></a> Merge pull request <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/388">#388</a> from woodruffw-forks/ww/rm-experimental</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/4c78f1c53c55c528d8abd83df933ae92bd4c1d8c"><code>4c78f1c</code></a> Merge branch 'unstable/v1' into ww/rm-experimental</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/b5a6e8ba2611ad0c810f383eed9e6629eb0b3b2f"><code>b5a6e8b</code></a> deps: bump sigstore and pypi-attestations</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/a48a03e758da35722b0d159dae23e0440d0fcce2"><code>a48a03e</code></a> remove another experimental mention</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/8087a88a46924f78608905d7841a170e749524ce"><code>8087a88</code></a> action: remove a lingering mention of PEP 740 being experimental</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/3317ede93a4981d0fc490510c6fcf8bf0e92ed05"><code>3317ede</code></a> 🧪 Integrate actionlint via pre-commit framework</li> <li>Additional commits viewable in <a href="https://github.com/pypa/gh-action-pypi-publish/compare/ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e...cef221092ed1bacb1cc03d23a2d87d1d172e277b">compare view</a></li> </ul> </details> <br /> Updates `prefix-dev/setup-pixi` from 0.9.3 to 0.9.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prefix-dev/setup-pixi/releases">prefix-dev/setup-pixi's releases</a>.</em></p> <blockquote> <h2>v0.9.4</h2>  <h2>What's Changed</h2> <h3>✨ New features</h3> <ul> <li>Implement working directory setup by <a href="https://github.com/retrry"><code>@​retrry</code></a> in <a href="https://redirect.github.com/prefix-dev/setup-pixi/pull/236">prefix-dev/setup-pixi#236</a></li> <li>Add support for TOML 1.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prefix-dev/setup-pixi/pull/244">prefix-dev/setup-pixi#244</a></li> </ul> <h3>👷🏻 CI</h3> <ul> <li>ci: Remove macos-13 tests by <a href="https://github.com/pavelzw"><code>@​pavelzw</code></a> in <a href="https://redirect.github.com/prefix-dev/setup-pixi/pull/240">prefix-dev/setup-pixi#240</a></li> </ul> <h3>⬆️ Dependency updates</h3> <ul> <li>chore(deps): bump the gh-actions group with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prefix-dev/setup-pixi/pull/238">prefix-dev/setup-pixi#238</a></li> <li>chore(deps): bump the nodejs group with 9 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prefix-dev/setup-pixi/pull/239">prefix-dev/setup-pixi#239</a></li> <li>chore(deps): bump the gh-actions group with 5 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prefix-dev/setup-pixi/pull/243">prefix-dev/setup-pixi#243</a></li> <li>chore(deps): bump the nodejs group with 10 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prefix-dev/setup-pixi/pull/244">prefix-dev/setup-pixi#244</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/retrry"><code>@​retrry</code></a> made their first contribution in <a href="https://redirect.github.com/prefix-dev/setup-pixi/pull/236">prefix-dev/setup-pixi#236</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prefix-dev/setup-pixi/compare/v0.9.3...v0.9.4">https://github.com/prefix-dev/setup-pixi/compare/v0.9.3...v0.9.4</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prefix-dev/setup-pixi/commit/1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0"><code>1b2de7f</code></a> chore(deps): bump dependencies (<a href="https://redirect.github.com/prefix-dev/setup-pixi/issues/259">#259</a>)</li> <li><a href="https://github.com/prefix-dev/setup-pixi/commit/6ef69835bb9bacb9f63c891ec2d1f8d6d5061452"><code>6ef6983</code></a> chore(deps): bump the nodejs group with 10 dependencies (<a href="https://redirect.github.com/prefix-dev/setup-pixi/issues/257">#257</a>)</li> <li><a href="https://github.com/prefix-dev/setup-pixi/commit/e6477eb81d0d3577538a63578287524653fb5c23"><code>e6477eb</code></a> chore(deps): bump Quantco/ui-actions from 1.0.18 to 1.0.19 in the gh-actions ...</li> <li><a href="https://github.com/prefix-dev/setup-pixi/commit/33be5bafa68042a7d0747866e21e5a686bf961a1"><code>33be5ba</code></a> chore(deps): bump the nodejs group with 7 updates (<a href="https://redirect.github.com/prefix-dev/setup-pixi/issues/250">#250</a>)</li> <li><a href="https://github.com/prefix-dev/setup-pixi/commit/72f90fea0c1ead4b05cd43c746f64a247a189855"><code>72f90fe</code></a> chore(deps): bump the gh-actions group across 1 directory with 3 updates (<a href="https://redirect.github.com/prefix-dev/setup-pixi/issues/253">#253</a>)</li> <li><a href="https://github.com/prefix-dev/setup-pixi/commit/c0d7209ec39354d7aa1f4c6081153c49a466ef35"><code>c0d7209</code></a> Fix broken authentication documentation link (<a href="https://redirect.github.com/prefix-dev/setup-pixi/issues/252">#252</a>)</li> <li><a href="https://github.com/prefix-dev/setup-pixi/commit/f1fb10f03bfd87dba0433ed26b4aeac79314f100"><code>f1fb10f</code></a> docs: Mention cooldown in dependabot config (<a href="https://redirect.github.com/prefix-dev/setup-pixi/issues/247">#247</a>)</li> <li><a href="https://github.com/prefix-dev/setup-pixi/commit/a0af7a228712d6121d37aba47adf55c1332c9c2e"><code>a0af7a2</code></a> Implement working directory setup (<a href="https://redirect.github.com/prefix-dev/setup-pixi/issues/236">#236</a>)</li> <li><a href="https://github.com/prefix-dev/setup-pixi/commit/51b98037a96d8c8de9468a767400f984d173fd90"><code>51b9803</code></a> chore(deps): bump the nodejs group with 10 updates (<a href="https://redirect.github.com/prefix-dev/setup-pixi/issues/244">#244</a>)</li> <li><a href="https://github.com/prefix-dev/setup-pixi/commit/54b8d307031379c3ead4fd566993bb2587e9a4f5"><code>54b8d30</code></a> chore(deps): bump the gh-actions group with 5 updates (<a href="https://redirect.github.com/prefix-dev/setup-pixi/issues/243">#243</a>)</li> <li>Additional commits viewable in <a href="https://github.com/prefix-dev/setup-pixi/compare/82d477f15f3a381dbcc8adc1206ce643fe110fb7...1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0">compare view</a></li> </ul> </details> <br /> Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/peter-evans/create-pull-request/releases">peter-evans/create-pull-request's releases</a>.</em></p> <blockquote> <h2>Create Pull Request v8.1.1</h2> <h2>What's Changed</h2> <ul> <li>build(deps-dev): bump the npm group with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4305">peter-evans/create-pull-request#4305</a></li> <li>build(deps): bump minimatch by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4311">peter-evans/create-pull-request#4311</a></li> <li>build(deps): bump the github-actions group with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4316">peter-evans/create-pull-request#4316</a></li> <li>build(deps): bump <code>@​tootallnate/once</code> and jest-environment-jsdom by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4323">peter-evans/create-pull-request#4323</a></li> <li>build(deps-dev): bump undici from 6.23.0 to 6.24.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4328">peter-evans/create-pull-request#4328</a></li> <li>build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4334">peter-evans/create-pull-request#4334</a></li> <li>build(deps): bump picomatch by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4339">peter-evans/create-pull-request#4339</a></li> <li>build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4344">peter-evans/create-pull-request#4344</a></li> <li>build(deps-dev): bump the npm group with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4349">peter-evans/create-pull-request#4349</a></li> <li>fix: retry post-creation API calls on 422 eventual consistency errors by <a href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4356">peter-evans/create-pull-request#4356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/peter-evans/create-pull-request/compare/v8.1.0...v8.1.1">https://github.com/peter-evans/create-pull-request/compare/v8.1.0...v8.1.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/peter-evans/create-pull-request/commit/5f6978faf089d4d20b00c7766989d076bb2fc7f1"><code>5f6978f</code></a> fix: retry post-creation API calls on 422 eventual consistency errors (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4356">#4356</a>)</li> <li><a href="https://github.com/peter-evans/create-pull-request/commit/d32e88dac789dcc7906e7d26f69f24116fa9c97d"><code>d32e88d</code></a> build(deps-dev): bump the npm group with 3 updates (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4349">#4349</a>)</li> <li><a href="https://github.com/peter-evans/create-pull-request/commit/8170bccad11c0df62542c04dcaefe36d342dfd39"><code>8170bcc</code></a> build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4344">#4344</a>)</li> <li><a href="https://github.com/peter-evans/create-pull-request/commit/00418193b417f888dbf1d993c5c0d31d27fdc7de"><code>0041819</code></a> build(deps): bump picomatch (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4339">#4339</a>)</li> <li><a href="https://github.com/peter-evans/create-pull-request/commit/b993918c8536b6d44706130734d5456879762b27"><code>b993918</code></a> build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4334">#4334</a>)</li> <li><a href="https://github.com/peter-evans/create-pull-request/commit/36d7c8468b48f9c2f8f29e260e82f10d4b90d2bd"><code>36d7c84</code></a> build(deps-dev): bump undici from 6.23.0 to 6.24.0 (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4328">#4328</a>)</li> <li><a href="https://github.com/peter-evans/create-pull-request/commit/a45d1fb447fcaf601166e405fd4f335cde1a8aa8"><code>a45d1fb</code></a> build(deps): bump <code>@​tootallnate/once</code> and jest-environment-jsdom (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4323">#4323</a>)</li> <li><a href="https://github.com/peter-evans/create-pull-request/commit/3499eb61835cc0015c0b786e203d74b1e8f55e43"><code>3499eb6</code></a> build(deps): bump the github-actions group with 2 updates (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4316">#4316</a>)</li> <li><a href="https://github.com/peter-evans/create-pull-request/commit/3f3b473b8c148f5a7520efb4d1f9a70eea3d9d1f"><code>3f3b473</code></a> build(deps): bump minimatch (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4311">#4311</a>)</li> <li><a href="https://github.com/peter-evans/create-pull-request/commit/6699836a213cf8b28c4f0408a404a6ac79d4458a"><code>6699836</code></a> build(deps-dev): bump the npm group with 2 updates (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4305">#4305</a>)</li> <li>See full diff in <a href="https://github.com/peter-evans/create-pull-request/compare/c0f553fe549906ede9cf27b5156039d195d2ece0...5f6978faf089d4d20b00c7766989d076bb2fc7f1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
diff --git a/.github/workflows/build_and_publish.yml b/.github/workflows/build_and_publish.yml
@@ -23,11 +23,11 @@ jobs:
           fetch-depth: 0
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@63fd63b352a9a8bdcc24791c9dbee952ee9a8abc # v3.3.0
+        uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1
         env:
           CIBW_SKIP: pp*
 
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pytsql-wheel-${{ matrix.os }}
           path: ./wheelhouse/*.whl
@@ -44,7 +44,7 @@ jobs:
       - name: Build sdist
         run: pipx run build --sdist
 
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pytsql-sdist
           path: dist/*.tar.gz
@@ -60,10 +60,10 @@ jobs:
       contents: write
     if: github.event_name == 'release' && github.event.action == 'published'
     steps:
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: pytsql-*
           merge-multiple: true
           path: dist
 
-      - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -10,7 +10,7 @@ jobs:
       - name: Checkout branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up pixi
-        uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
+        uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0 # v0.9.5
         with:
           environments: default lint
       - name: pre-commit
@@ -41,7 +41,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up pixi
-        uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
+        uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0 # v0.9.5
         with:
           environments: ${{ matrix.env }}
       - name: Run unit tests
@@ -83,7 +83,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up pixi
-        uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
+        uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0 # v0.9.5
         with:
           environments: ${{ matrix.env }}
       - name: Install msodbcsql17 driver
diff --git a/.github/workflows/update_grammar.yml b/.github/workflows/update_grammar.yml
@@ -15,7 +15,7 @@ jobs:
               with:
                 fetch-depth: 0
             - name: Set up pixi
-              uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
+              uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0 # v0.9.5
               with:
                 environments: grammar
             - name: Download ANTLR
@@ -27,7 +27,7 @@ jobs:
               run:
                 pixi run -e grammar pip install .
             - name: Create Pull Request
-              uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+              uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
               with:
                 delete-branch: true
                 title: "Autoupdate grammar targets based on antlr/grammars-v4's TSQL grammar definition"
