From a9ff12a1b74dbc41088435f3cd08655793705778 Mon Sep 17 00:00:00 2001 From: Brian O'Kelley Date: Fri, 30 Oct 2026 21:10:42 +0000 Subject: [PATCH] ci: pin pypa/gh-action-pypi-publish to v1.14.3 for GHSA-5xjx-3w67-w9x9 GHSA-5xjx-3w67-w9x9, published 2026-10-30, covers pypa/gh-action-pypi-publish up to 1.14.2: a revoked CA in the chain Sigstore uses for Trusted Publishing and PyPI attestations. zizmor's known-vulnerability audit now fails the Workflow security job on every branch. v1.14.3 is the first patched release, pinned by its commit. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/release-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index a5ac8f1db..33e758298 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -115,6 +115,6 @@ jobs: with: name: release-dist path: dist/ - - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 + - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: packages-dir: dist/