From 374743bbc2b010f6af0d813f28f2b44800197612 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:06:37 +0000 Subject: [PATCH 1/2] Bump actions/setup-python from 6.3.0 to 7.0.0 (#13216) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0.
Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: https://github.com/actions/setup-python/compare/v6...v7.0.0

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-python&package-manager=github_actions&previous-version=6.3.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci-cd.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index e393b06a1f9..795192b2352 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -71,7 +71,7 @@ jobs: make sync-direct-runtime-deps git diff --exit-code -- requirements/runtime-deps.in - name: Setup Python - uses: actions/setup-python@v6.3.0 + uses: actions/setup-python@v7.0.0 with: python-version: 3.11 - name: Cache PyPI @@ -465,7 +465,7 @@ jobs: submodules: true - name: Setup Python 3.13.2 id: python-install - uses: actions/setup-python@v6.3.0 + uses: actions/setup-python@v7.0.0 with: python-version: 3.13.2 cache: pip @@ -517,7 +517,7 @@ jobs: submodules: true - name: Setup Python id: python-install - uses: actions/setup-python@v6.3.0 + uses: actions/setup-python@v7.0.0 with: python-version: '3.12' - name: Install dependencies @@ -606,7 +606,7 @@ jobs: with: submodules: true - name: Setup Python - uses: actions/setup-python@v6.3.0 + uses: actions/setup-python@v7.0.0 - name: Install build tooling and cython run: >- python -m @@ -707,7 +707,7 @@ jobs: fi shell: bash - name: Setup Python - uses: actions/setup-python@v6.3.0 + uses: actions/setup-python@v7.0.0 with: python-version: 3.x - name: Install build tooling and cython From 62f0f908d6975e2f9a85072d8d4a60471401b98b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:22:14 +0000 Subject: [PATCH 2/2] Bump pip-tools from 7.5.3 to 7.6.0 (#13218) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [pip-tools](https://github.com/jazzband/pip-tools) from 7.5.3 to 7.6.0.
Release notes

Sourced from pip-tools's releases.

v7.6.0

2026-07-13

Features

  • The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by @​Dzhud.

    PRs and issues: #1142

  • Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by @​miettal.

    PRs and issues: #2288

  • pip-tools is now compatible with pip 26.1 -- @​gaborbernat.

    PRs and issues: #2379

Improved documentation

  • Fixed the contents sidebar for the index doc -- by @​sirosen.

    PRs and issues: #2169

  • pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

    Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

    PRs and issues: #2318

  • pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

    -- by @​sirosen

Contributor-facing changes

  • CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by @​sirosen.

    PRs and issues: #2079, #2132, #2348

  • pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

    Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

    PRs and issues: #2278, #2318

  • Started running {pypi}zizmor as a part of CI pipelines to improve security of how we configure GitHub Actions CI/CD -- by @​webknjaz.

    PRs and issues: #2327

  • pip-tools docs now support GitHub Flavored Markdown admonition blocks -- by @​webknjaz.

... (truncated)

Changelog

Sourced from pip-tools's changelog.

v7.6.0

2026-07-13

Features

  • The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by {user}Dzhud.

    PRs and issues: {issue}1142

  • Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by {user}miettal.

    PRs and issues: {issue}2288

  • pip-tools is now compatible with pip 26.1 -- {user}gaborbernat.

    PRs and issues: {issue}2379

Improved documentation

  • Fixed the contents sidebar for the index doc -- by {user}sirosen.

    PRs and issues: {issue}2169

  • pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by {user}sirosen.

    Thanks to {user}0cjs, {user}gpshead, {user}mr-c, {user}samdoran, {user}webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

    PRs and issues: {issue}2318

  • pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

    -- by {user}sirosen

Contributor-facing changes

  • CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by {user}sirosen.

    PRs and issues: {issue}2079, {issue}2132, {issue}2348

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip-tools&package-manager=pip&previous-version=7.5.3&new-version=7.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index d827aa789dc..5225eda445d 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -163,7 +163,7 @@ pathspec==1.1.1 # via mypy pip==26.1.2 # via pip-tools -pip-tools==7.5.3 +pip-tools==7.6.0 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in diff --git a/requirements/dev.txt b/requirements/dev.txt index d593f882898..f7c36f8d7b4 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -160,7 +160,7 @@ pathspec==1.1.1 # via mypy pip==26.1.2 # via pip-tools -pip-tools==7.5.3 +pip-tools==7.6.0 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in