Merge branch 'pyca:main' into dm/mldsa65-aws-lc

Author: DarkaMaul

.github/bin/bump_dependency.py

@@ -35,12 +35,11 @@ def version_key(tag: str) -> tuple[int, ...]:
     return sorted(tags, key=version_key)[-1]
 
 
-def get_current_version_from_file(file_path: str, pattern: str) -> str:
+def get_current_versions_from_file(file_path: str, pattern: str) -> list[str]:
     with open(file_path) as f:
         content = f.read()
 
-    match = re.search(pattern, content)
-    return match.group(1)
+    return re.findall(pattern, content)
 
 
 def update_file_version(
@@ -148,22 +147,23 @@ def main() -> int:
 
     args = parser.parse_args()
 
-    current_version = get_current_version_from_file(
-        args.file_path, args.current_version_pattern
-    )
-
     if args.tag:
         latest_version = get_remote_latest_tag(args.repo_url, args.tag_pattern)
     else:
         latest_version = get_remote_commit_sha(args.repo_url, args.branch)
 
-    if current_version == latest_version:
-        print(f"{args.name}: No update needed (current: {current_version})")
+    current_versions = get_current_versions_from_file(
+        args.file_path, args.current_version_pattern
+    )
+
+    if all(v == latest_version for v in current_versions):
+        print(f"{args.name}: No update needed (current: {latest_version})")
         if not args.commit_message_fd:
             with open(os.environ["GITHUB_OUTPUT"], "a") as f:
                 f.write("HAS_UPDATES=false\n")
         return 0
 
+    current_version = next(v for v in current_versions if v != latest_version)
     print(
         f"{args.name}: Update available "
         f"({current_version} -> {latest_version})"

.github/workflows/ci.yml

@@ -97,7 +97,7 @@ jobs:
           CONFIG_FLAGS: ${{ matrix.PYTHON.OPENSSL.CONFIG_FLAGS }}
         if: matrix.PYTHON.OPENSSL
       - name: Load OpenSSL cache
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         id: ossl-cache
         timeout-minutes: 2
         with:

ci-constraints-requirements.txt

@@ -18,7 +18,7 @@ build==1.2.2.post1 ; python_full_version < '3.9'
     # via
     #   cryptography (pyproject.toml)
     #   check-sdist
-build==1.4.1 ; python_full_version >= '3.9'
+build==1.4.2 ; python_full_version >= '3.9'
     # via
     #   cryptography (pyproject.toml)
     #   check-sdist
@@ -128,7 +128,7 @@ mypy==1.19.1 ; python_full_version >= '3.9'
     # via cryptography (pyproject.toml)
 mypy-extensions==1.1.0
     # via mypy
-nh3==0.3.3
+nh3==0.3.4
     # via readme-renderer
 nox==2026.2.9
     # via cryptography (pyproject.toml)