[dependabot]

Bumps the actions-maintenance group with 4 updates: actions/setup-python, durable-workflow/.github/.github/actions/bootstrap-patched-pip, durable-workflow/.github/.github/actions/verify-composer-trust and docker/login-action.

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates durable-workflow/.github/.github/actions/bootstrap-patched-pip from 75587fc33ff40c34f32ef777293dad56bb6f48c7 to 865cdb0ce4b6dd7ce84c61d5fda5b13e3e5ab7c2

Commits

• 865cdb0 Merge pull request #265 from durable-workflow/docs/ci-throughput-first
• 0342b63 docs: use organization Actions performance metrics
• 52b701a docs: prioritize CI throughput before adding PRs
• 64fd4a9 Merge pull request #263 from durable-workflow/docs/122-sdk-parity-entrypoints
• eafe495 Merge remote-tracking branch 'origin/main' into docs/122-sdk-parity-entrypoints
• 869a7d2 Merge pull request #262 from durable-workflow/docs/233-python-registry-delivery
• 149fec5 Clarify Rust playground scope and cleanup
• a6d7c56 Document SDK parity runner prerequisites and results
• 96a1d28 Document Python metrics registry delivery
• d5d5782 Merge pull request #261 from durable-workflow/docs/122-failover-operator-context
• Additional commits viewable in compare view

Updates durable-workflow/.github/.github/actions/verify-composer-trust from 75587fc33ff40c34f32ef777293dad56bb6f48c7 to 865cdb0ce4b6dd7ce84c61d5fda5b13e3e5ab7c2

Commits

• 865cdb0 Merge pull request #265 from durable-workflow/docs/ci-throughput-first
• 0342b63 docs: use organization Actions performance metrics
• 52b701a docs: prioritize CI throughput before adding PRs
• 64fd4a9 Merge pull request #263 from durable-workflow/docs/122-sdk-parity-entrypoints
• eafe495 Merge remote-tracking branch 'origin/main' into docs/122-sdk-parity-entrypoints
• 869a7d2 Merge pull request #262 from durable-workflow/docs/233-python-registry-delivery
• 149fec5 Clarify Rust playground scope and cleanup
• a6d7c56 Document SDK parity runner prerequisites and results
• 96a1d28 Document Python metrics registry delivery
• d5d5782 Merge pull request #261 from durable-workflow/docs/122-failover-operator-context
• Additional commits viewable in compare view

Updates docker/login-action from 4.6.0 to 4.7.0

Release notes

Sourced from docker/login-action's releases.

v4.7.0

• Preserve explicit ECR settings in registry-auth by @​crazy-max in docker/login-action#1089
• Use registry hosts for scoped credentials by @​crazy-max in docker/login-action#1088
• Raise Docker Hub OIDC max expiry to 6 hours by @​crazy-max in docker/login-action#1068
• Log Docker Hub OIDC token exchange progress by @​crazy-max in docker/login-action#1061
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1154.0 in docker/login-action#1093
• Bump @​docker/actions-toolkit from 0.94.0 to 0.107.0 in docker/login-action#1100
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/login-action#1077
• Bump csv-parse from 7.0.1 to 7.0.3 in docker/login-action#1078
• Bump handlebars from 4.7.9 to 4.7.10 in docker/login-action#1091
• Bump js-yaml from 5.2.2 to 5.5.0 in docker/login-action#1066
• Bump postcss from 8.5.22 to 8.5.26 in docker/login-action#1071
• Bump postcss-selector-parser from 7.1.1 to 7.1.6 in docker/login-action#1092
• Bump source-map-js from 1.2.1 to 1.2.2 in docker/login-action#1090
• Bump undici from 6.27.0 to 6.29.1 in docker/login-action#1085
• Bump uuid from 14.0.1 to 14.0.3 in docker/login-action#1096

Full Changelog: docker/login-action@v4.6.0...v4.7.0

Commits

• 81c6f93 Merge pull request #1100 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 1b16c8d Merge pull request #1096 from docker/dependabot/npm_and_yarn/uuid-14.0.3
• ac86b5e [dependabot skip] chore: update generated content
• 1476d84 build(deps): bump @​docker/actions-toolkit from 0.94.0 to 0.107.0
• 503cee6 Merge pull request #1095 from docker/dependabot/github_actions/actions/create...
• f093535 Merge pull request #1099 from docker/dependabot/github_actions/codecov/codeco...
• d5ae7f1 Merge pull request #1098 from docker/dependabot/github_actions/docker/bake-ac...
• 6f97507 Merge pull request #1097 from docker/dependabot/github_actions/docker/bake-ac...
• 006d61f Merge pull request #1094 from docker/dependabot/github_actions/codeql-actions...
• 93f5f52 Merge pull request #1093 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[rmcdaniel]

Security supply-chain review — hold exact head e3059d02426135219645bd54caba3f476893dd1a; do not bypass the failed central action-policy gate. This groups four independent privileged-action changes: (1) setup-python 6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 is not centrally approved and has an unresolved private Security review finding, so retain qualified 5fda3b95a4ea91299a34e894583c3862153e4b97; (2) the two internal-action changes to 865cdb0ce4b6dd7ce84c61d5fda5b13e3e5ab7c2 advance across unrelated repository history while their referenced action blobs are unchanged and the ref is not approved, so retain qualified 75587fc33ff40c34f32ef777293dad56bb6f48c7; and (3) evaluate docker/login-action 81c6f93d4bc991e510b342a00b419b3bb4efc5c6 independently because it receives registry credentials. Close this grouped PR. Any replacement must isolate one actual action delta, pass central source/bundle/permission qualification for its exact immutable SHA, and then pass the repository gates. Security details for the setup-python hold are intentionally retained in the private owning record rather than this public repository.

[rmcdaniel]

Closing this grouped update as requested by the recorded Security supply-chain review. Exact head e3059d0 failed the central action-policy gate and combines setup-python, two unrelated-history internal action refs, and credential-bearing docker/login-action. No gate is bypassed. Any replacement must isolate one action delta, use an approved immutable SHA, complete central source/bundle/permission qualification, and then pass the repository checks.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml