Update github-actions by renovate[bot] · Pull Request #10405 · python-pillow/Pillow

renovate · 2026-11-03T07:27:20Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
CodSpeedHQ/action	action	minor	`v5.5.0` → `v5.6.0`	`v5.6.1`
actions/download-artifact	action	patch	`v8.0.1` → `v8.0.2`
actions/setup-python	action	minor	`v7.0.0` → `v7.1.0`
actions/upload-artifact	action	patch	`v7.0.1` → `v7.0.2`
astral-sh/setup-uv	action	minor	`v10.2.0` → `v10.3.2`	`v10.3.3`
google/oss-fuzz (changelog)	action	digest	`187888a` → `3ceaf83`
pypa/gh-action-pypi-publish	action	patch	`v1.14.2` → `v1.14.3`
release-drafter/release-drafter	action	minor	`v7.7.0` → `v7.10.0`
scientific-python/upload-nightly-action	action	patch	`0.6.5` → `0.6.6`

Release Notes

CodSpeedHQ/action

`v5.6.0`

Compare Source

Bumps the CodSpeed runner to v5.6.0.

Highlights

More consistent CPU Simulation results

Changes to your CI environment, like a different path or an extra environment variable, no longer change the performance. Each benchmark now starts with the same memory layout, reducing the chance of false regressions.

🐛 Bug Fixes

Keep the user's HOME when wrapping commands with sudo by @lvaroqui in #588

⚙️ Internals

Bump pinned valgrind-codspeed to 3.26.0-0codspeed10 by @adriencaccia in #593
- fix(callgrind): suppress L3 warning for explicit LL settings by @not-matthias in CodSpeedHQ/valgrind-codspeed#52
- fix(initimg): stabilize Linux startup stack layout by @not-matthias in CodSpeedHQ/valgrind-codspeed#53

Full Runner Changelog:
https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

chore: bump runner version to 5.6.0 by @github-actions[bot] in #253

Full Changelog: CodSpeedHQ/action@v5.5.0...v5.6.0

actions/download-artifact

`v8.0.2`

Compare Source

What's Changed

Update the readme by @danwkennedy in #473
Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
Update @actions/artifact to 6.3.1 by @tunc-d in #492
Prepare download-artifact v8.0.2 by @tunc-d in #493

New Contributors

@tunc-d made their first contribution in #492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/setup-python

`v7.1.0`

Compare Source

What's Changed

Enhancements

Add mirror and mirror-token inputs for custom Python distribution sources by @luhenry in #1302
Improve error message clarity by @v-lmvysakh in #1351

Dependency Upgrade

Upgrade browserslist from 4.28.2 to 4.28.9 by @dependabot in #1353
Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in #1343
Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in #1342
Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in #1357
Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in #1359
Upgrade undici from 6.28.0 to 6.29.0 by @dependabot in #1364
Upgrade ts-jest from 29.4.11 to 29.4.14 by @dependabot in #1361
Upgrade brace-expansion from 5.0.9 to 5.0.12 by @dependabot in #1365
Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @dependabot in #1363
Upgrade @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @dependabot in #1369
Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #1345
Upgrade cache to 6.3.0 by @v-HarithaVattikuti in #1370
Resolve Basic Validation audit failures by @v-HarithaVattikuti in #1347
Resolve npm audit failures by @v-HarithaVattikuti in #1350

New Contributors

@luhenry made their first contribution in #1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

actions/upload-artifact

`v7.0.2`

Compare Source

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in #821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

astral-sh/setup-uv

`v10.3.2`: 🌈 update known checksums for 0.13.5

Compare Source

Changes

🧰 Maintenance

chore: update known checksums for 0.13.5 @github-actions[bot] (#1103)

📚 Documentation

docs: update version references to v10.3.1 @github-actions[bot] (#1102)

`v10.3.1`: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

fix: preserve cache error class names in save-cache bundle @dannyward630 (#1093)

🧰 Maintenance

chore: update known checksums for 0.13.4 @github-actions[bot] (#1099)
chore: update known checksums for 0.13.2/0.13.3 @github-actions[bot] (#1098)
chore: update known checksums for 0.13.1 @github-actions[bot] (#1094)
Verify npm dependency signatures before builds @zaniebot (#1027)

📚 Documentation

docs: cache-dependency-glob matches relative to the working directory @flange-ipb (#1092)
docs: update version references to v10.3.0 @github-actions[bot] (#1090)

⬆️ Dependency updates

chore(deps): roll up Dependabot updates @eifinger (#1101)

`v10.3.0`: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

Use macOS 15 runners for tests @charliermarsh (#1081)

🚀 Enhancements

Add python-arch support @zanieb (#1079)

🧰 Maintenance

chore: update known checksums for 0.13.0 @github-actions[bot] (#1089)
chore: update known checksums for 0.12.24 @github-actions[bot] (#1084)
chore: update known checksums for 0.12.23 @github-actions[bot] (#1082)
chore: update known checksums for 0.12.22 @github-actions[bot] (#1080)
chore: update known checksums for 0.12.21 @github-actions[bot] (#1078)
chore: update known checksums for 0.12.20 @github-actions[bot] (#1076)
chore: update known checksums for 0.12.19 @github-actions[bot] (#1068)
chore: update known checksums for 0.12.18 @github-actions[bot] (#1065)

⬆️ Dependency updates

chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 @dependabot[bot] (#1077)

pypa/gh-action-pypi-publish

`v1.14.3`

Compare Source

Keeping the community safe is a collaborative effort! 💛💙

[!important]
🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @sethmlarson 💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@webknjaz 💰 made sure the dependency tree within the action runtime uses hash-checking from now on via #420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

release-drafter/release-drafter

`v7.10.0`

Compare Source

What's Changed

New

feat(check-pr): validate base and proposed configuration (#1809) @jetersen
feat(replacers): select PR body sections by heading (#1808) @jetersen
feat: scope replacers to change titles (#1805) @jetersen
feat: scope replacers to pull request bodies (#1804) @jetersen
feat: add change-body-escapes (#1797) @jetersen

Dependency Updates

11 changes

chore(deps): update dependency knip to 6.39.0 (#1830) @renovate[bot]
chore(deps): update dependency @biomejs/biome to 2.5.15 (#1829) @renovate[bot]
chore(deps): update vitest to 5.0.3 (#1827) @renovate[bot]
chore(deps): lock file maintenance (#1826) @renovate[bot]
fix(deps): update dependency @octokit/plugin-paginate-rest to 16.0.0 (#1813) @renovate[bot]
chore(deps): update dependency @graphql-codegen/typescript-operations to 6.1.9 (#1818) @renovate[bot]
chore(deps): update dependency testcontainers to 12.2.0 (#1812) @renovate[bot]
chore(deps): update graphql-codegen (#1810) @renovate[bot]
fix(deps): update dependency undici to 6.29.0 (#1796) @renovate[bot]
chore(deps): update dependency @types/node to 24.19.0 (#1798) @renovate[bot]
chore(deps): update vitest to 5.0.2 (#1795) @renovate[bot]

Maintenance

fix: authorize publication at the original release commit (#1793) @jetersen
fix: handle missing release tags during discovery (#1792) @jetersen
fix: publish merged release PRs from main pushes (#1791) @jetersen
test: run GitLab conformance against GitLab CE 19.4.1 (#1825) @jetersen
test: use the GitLab image that caches Mustermann's encoded characters (#1824) @jetersen
ci: speed up forge conformance with a preseeded GitLab image (#1819) @jetersen
ci: run workflows on Ubuntu 26.04 and cache node_modules (#1823) @jetersen
test: expand coverage and reduce test runtime (#1794) @jetersen
ci: report actionlint findings on its workflow job (#1817) @jetersen
build: simplify tooling validation and coverage reporting (#1816) @jetersen
build: simplify workspace dependency checks (#1815) @jetersen
refactor: use runtime fetch in the public facade (#1800) @jetersen
test: allow dependency version updates in package consumer contract (#1799) @jetersen

Documentation

docs: simplify agent guidance and require the PR template (#1807) @jetersen
docs: summarize deployment options and add npm branding (#1802) @jetersen

New Contributors

No new contributors

Full Changelog: release-drafter/release-drafter@v7.9.0...v7.10.0

`v7.9.0`

Compare Source

What's Changed

New

feat(autolabeler): sync configured pull request labels (#1787) @jetersen
feat(autolabeler): support multiple labels, stop rules and fallback (#1785) @jetersen
feat: expose PR labels in Drafter and Check PR outputs (#1782) @jetersen
feat: add resolved tag template variable (#1784) @jetersen

Dependency Updates

ci(deps): update reviewdog/action-actionlint action to v1.77.0 (#1781) @renovate[bot]

Bug Fixes

fix(config): provide standard loading for the programmatic API (#1783) @jetersen
fix: skip the missing-baseline warning when from is set (#1789) @jmeridth

Maintenance

ci: dogfood Release Drafter and stage npm publishing (#1778) @jetersen
ci: lint GitHub Actions workflows with actionlint (#1780) @jetersen

New Contributors

No new contributors

Full Changelog: release-drafter/release-drafter@v7.8.0...v7.9.0

`v7.8.0`

Compare Source

What's Changed

Token authentication change

The token action input now takes precedence over env.GITHUB_TOKEN and defaults to ${{ github.token }}. Pass a PAT or GitHub App token through with.token, especially when publishing releases that should trigger downstream workflows:

with:
  token: ${{ secrets.PAT }}
  publish: true

New

feat: merge repeated changes with group-changes (#1725) @slawekjaranowski, @claude
feat(facade): wire multiforge adapters (#1709) @jetersen
feat(adapters): add GitLab REST adapter (#1708) @jetersen
feat(adapters): add Gitea and Forgejo REST adapters (#1707) @jetersen
feat: add config-driven check-pr validation (#1706) @jetersen
feat: move GitHub Actions into workspace (#1705) @jetersen
feat: add release-drafter CLI (#1704) @jetersen
feat: expose programmatic API (#1702) @jetersen
feat: add GitHub adapter (#1701) @jetersen
feat: extract forge-neutral core contract (#1699) @jetersen

Dependency Updates

36 changes

chore(deps): lock file maintenance (#1770) @renovate[bot]
chore(deps): update dependency vite to 8.3.1 (#1774) @renovate[bot]
chore(deps): update dependency @graphql-codegen/cli to 7.4.3 (#1776) @renovate[bot]
ci(deps): automerge tested maintenance and security updates (#1775) @jetersen
ci(deps): allow daily updates and fix hosted dependency checks (#1773) @jetersen
ci(deps): rebuild artifacts and prioritize confident updates (#1772) @jetersen
chore(deps): align Undici with the Actions toolkit (#1771) @jetersen
ci(deps): maintain lockfiles monthly and label security updates (#1769) @jetersen
fix(deps): update dependency undici to 8.11.2 (#1764) @renovate[bot], @jetersen
fix(deps): update octokit monorepo (major) (#1759) @renovate[bot], @jetersen
chore(deps): update npm tool constraint to 12.1.0 (#1763) @renovate[bot]
chore(deps): update vitest to 5.0.1 (#1755) @renovate[bot], @cchanche
ci(deps): update actions/stale action to v11.0.0 (#1757) @renovate[bot]
fix(deps): update dependency conventional-commits-parser to 7.1.2 (#1758) @renovate[bot], @github-actions[bot]
fix(deps): update dependency zod to 4.6.5 (#1754) @renovate[bot], @github-actions[bot]
chore(deps): switch to OpenAPI webhook types (#1761) @jetersen
fix(deps): update dependency verkit to 0.5.0 (#1753) @renovate[bot], @github-actions[bot]
chore(deps): update dependency dependency-cruiser to 18.4.0 (#1746) @renovate[bot], @cchanche
fix(deps): update octokit monorepo (#1744) @renovate[bot], @cchanche
chore(deps): update dependency @biomejs/biome to 2.5.14 (#1737) @renovate[bot], @cchanche
ci(deps): update actions/checkout digest to 3d3c42e (#1736) @renovate[bot], @cchanche
chore(deps): update dependency undici to 7.29.1 [security] (#1735) @renovate[bot], @github-actions[bot]
ci(deps): update actions/github-script action to v9.0.0 (#1756) @renovate[bot]
chore(deps): update node.js to v24.21.0 (#1751) @renovate[bot]
chore(deps): update graphql-codegen (#1750) @renovate[bot]
chore(deps): update dependency vite to 8.3.0 (#1749) @renovate[bot], @github-actions[bot]
chore(deps): update dependency knip to 6.38.0 (#1747) @renovate[bot]
chore(deps): update dependency testcontainers to 12.1.0 (#1748) @renovate[bot], @cchanche
chore(deps): update dependency @swc/core to 1.16.2 (#1745) @renovate[bot], @cchanche
fix(deps): update dependency yaml to 2.9.1 (#1743) @renovate[bot], @cchanche, @github-actions[bot]
chore(deps): update dependency rolldown-plugin-dts to 0.28.6 (#1742) @renovate[bot]
chore(deps): update dependency prettier to 3.9.9 (#1741) @renovate[bot]
chore(deps): update dependency nock to 14.0.17 (#1740) @renovate[bot], @cchanche
chore(deps): update vitest to 4.1.11 (#1739) @renovate[bot]
chore(deps): update dependency @types/node to 24.13.6 (#1738) @renovate[bot], @cchanche
chore(deps): update dependency vitest to 4.1.11 [security] (#1734) @renovate[bot]

Bug Fixes

fix(build): escape hidden Unicode in action bundles (#1777) @jetersen

Maintenance

ci: fix sticky comment action dependency lookup (#1768) @jetersen
ci: credit GraphQL codegen commits to GitHub Actions bot (#1766) @jetersen
ci: wait 90 days for npm tool constraint updates (#1765) @jetersen
ci: scope forge conformance to relevant dependencies (#1762) @jetersen
chore: update generated GraphQL types (#1690) @github-actions[bot], @cchanche, @jetersen
ci: add npm publishing workflow (#1733) @cchanche
test: add npm publication readiness (#1711) @jetersen
test: add real-forge conformance matrix (#1710) @jetersen
chore: remove migration leftovers (#1720) @jetersen
refactor: replace ignore with minimatch (#1719) @jetersen
refactor: remove regex-parser dependency (#1718) @jetersen
refactor: replace node-semver with verkit (#1703) @jetersen
build: establish Node 24 workspace and CI tooling (#1698) @jetersen
style: adapt prettier markdown formatting (#1689) @jetersen
chore: format markdown with prettier (#1688) @jetersen

Documentation

docs: add AI usage policy to the code of conduct (#1730) @cchanche
docs: add ADOPTERS.md (#1724) @ChrisJr404, @cchanche
docs: complete monorepo documentation pass (#1722) @jetersen

New Contributors

@ChrisJr404 made their first contribution in #1724

Full Changelog: release-drafter/release-drafter@v7.7.0...v7.8.0

scientific-python/upload-nightly-action

`v0.6.6`

Compare Source

What's Changed

CI: Update prefix-dev/setup-pixi GitHub Action to v0.11.2 by @matthewfeickert in #188
MNT: Update environment for certifi security fixes by @matthewfeickert in #187

Full Changelog: scientific-python/upload-nightly-action@0.6.5...0.6.6

Configuration

📅 Schedule: (UTC)

Branch creation
- On day 3 of the month (* * 3 * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update github-actions

2abdff5

renovate Bot added the Dependency label Nov 3, 2026

radarhere enabled auto-merge (squash) November 3, 2026 07:33

radarhere disabled auto-merge November 3, 2026 07:34

radarhere merged commit 394346c into main Nov 3, 2026
83 of 126 checks passed

radarhere deleted the renovate/github-actions branch November 3, 2026 07:36

Navigation Menu

Repository navigation

Update github-actions - #10405

Update github-actions#10405
radarhere merged 1 commit into
mainfrom
renovate/github-actions

renovate Bot commented Nov 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Nov 3, 2026

Release Notes

Highlights

More consistent CPU Simulation results

🐛 Bug Fixes

⚙️ Internals

What's Changed

What's Changed

New Contributors

What's Changed

Enhancements

Dependency Upgrade

New Contributors

What's Changed

New Contributors

v10.3.2: 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

📚 Documentation

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Changes

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.3.0: 🌈 Add Python architecture selection

Changes

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

🛠️ Security Tightening

What's Changed

New

Dependency Updates

Maintenance

Documentation

New Contributors

What's Changed

New

Dependency Updates

Bug Fixes

Maintenance

New Contributors

What's Changed

Token authentication change

New

Dependency Updates

Bug Fixes

Maintenance

Documentation

New Contributors

What's Changed

Configuration

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v10.3.2`: 🌈 update known checksums for 0.13.5

`v10.3.1`: 🌈 preserve cache error class names in save-cache bundle

`v10.3.0`: 🌈 Add Python architecture selection