[dependabot]: Bump the actions group with 3 updates (#13998)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: mne[bot] <50266005+mne-bot@users.noreply.github.com>
Co-authored-by: Eric Larson <larson.eric.d@gmail.com>

Author: 3 people

.github/workflows/autofix.yml

@@ -12,10 +12,10 @@ jobs:
     name: Autoupdate changelog entry and headers
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
       - run: pip install --upgrade towncrier pygithub gitpython numpy
       - run: python ./.github/actions/rename_towncrier/rename_towncrier.py
       - run: python ./tools/dev/ensure_headers.py

.github/workflows/autopush.yml

@@ -11,7 +11,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: true
           token: ${{ secrets.MNE_BOT_TOKEN }}

.github/workflows/check_changelog.yml

@@ -13,7 +13,7 @@ jobs:
     name: Check towncrier entry in doc/changes/dev/
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - uses: scientific-python/action-towncrier-changelog@v2

.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
       with:
         persist-credentials: false
 

.github/workflows/credit.yml

@@ -17,10 +17,10 @@ jobs:
       GH_TOKEN: ${{ secrets.MNE_BOT_TOKEN }}
       GITHUB_TOKEN: ${{ secrets.MNE_BOT_TOKEN }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
       - run: pip install pygithub -e .
       - run: python tools/dev/update_credit_json.py
       - run: git add -f doc/sphinxext/prs/*.json

.github/workflows/release.yml

@@ -16,11 +16,11 @@ jobs:
   package:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip packaging build twine

.github/workflows/spec_zero.yml

@@ -25,7 +25,7 @@ jobs:
       run:
         shell: bash -el {0}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: true
       - name: Triage SSH

.github/workflows/tests.yml

@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.14'
       - uses: pre-commit/action@v3.0.1
@@ -91,7 +91,7 @@ jobs:
             python: '3.14t'  # free-threaded
             kind: pip-ft
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -118,7 +118,7 @@ jobs:
           pyvista: false
           wm: false
       # Python (if pip)
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python }}
         if: startswith(matrix.kind, 'pip') || matrix.kind == 'minimal'
@@ -152,7 +152,7 @@ jobs:
       - run: python ./tools/github_actions_check_old_env.py
         if: matrix.kind == 'old'
       # Minimal commands on Linux (macOS stalls)
-      - uses: actions/cache@v5
+      - uses: actions/cache@v5.0.5
         with:
           key: minimal-commands-1
           path: ~/minimal_cmds
@@ -167,7 +167,7 @@ jobs:
         run: MNE_SKIP_TESTING_DATASET_TESTS=true pytest -m "not (ultraslowtest or pgtest)" --tb=short --cov=mne --cov-report xml -vv -rfE mne/
         if: matrix.kind == 'minimal'
       - run: ./tools/get_testing_version.sh
-      - uses: actions/cache@v5
+      - uses: actions/cache@v5.0.5
         with:
           key: ${{ env.TESTING_VERSION }}
           path: ~/mne_data

environment.yml

@@ -39,7 +39,7 @@ dependencies:
   - numpy >=1.26,<3
   - openmeeg >=2.5.7
   - packaging
-  - pandas >=2.2
+  - pandas >=2.2,!=3.0.4
   - pillow
   - pip
   - pooch >=1.5

pyproject.toml

@@ -38,7 +38,7 @@ doc-full = ["rpy2", {include-group = "doc"}]
 # Dependencies in a separate group for uv lockfile generation, currently only used for
 # the 'old' environment CI test run
 lockfile_extras = [
-  "pandas >= 2.2",  # released 2024-01-20, will become 2.3 on 2027-06-05
+  "pandas >= 2.2,!=3.0.4",  # released 2024-01-20, will become 2.3 on 2027-06-05
   "scikit-learn >= 1.5",  # released 2024-05-21, will become 1.6 on 2026-12-09
 ]
 test = [
@@ -169,7 +169,7 @@ full-no-qt = [
   "nilearn",
   "numba >= 0.35",
   "openmeeg >= 2.5.7",
-  "pandas >= 2.2",  # released 2024-01-20, will become 2.3 on 2027-06-05
+  "pandas >= 2.2,!=3.0.4",  # released 2024-01-20, will become 2.3 on 2027-06-05
   "pillow",  # for `Brain.save_image` and `mne.Report`
   "pyarrow",  # only needed to avoid a deprecation warning in pandas
   "pybv",