[dependabot]

Bumps pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3.

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
• 331eccb Upgrade certifi and sigstore
• f68fee4 💰 Sync the FUNDING config
• c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
• 9090099 🧪 Make smoke test deps hash-pinned in CI
• 34e40c2 📌 Bump pip-tools managed transitive deptrees
• e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
• dd8c5f4 🔧 Make pip-tools config available in container
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codspeed]

Merging this PR will improve performance by 24.65%

2 warnings

⚠️ Walltime results may be unreliable

Some benchmarks used the Walltime instrument outside CodSpeed Macro Runners, which can make the results inconsistent.

Learn more about Macro Runners

See affected benchmarks

⚠️ Base and head ran on different runner types

Some benchmarks with significant performance changes were compared across different runner types, so the changes might not come from the code. Run base and head on the same runner type, or use CodSpeed Macro Runners for more stable results.

Learn more about Macro Runners

Open the report in CodSpeed to investigate

⚡ 2 improved benchmarks

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	test_cli	359.8 ms	274.6 ms	+31.03%
⚡	test_import	11 ms	9.3 ms	+18.57%

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.3 (a8988d5) with master (520a909)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.08%. Comparing base (520a909) to head (a8988d5).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1069   +/-   ##
=======================================
  Coverage   88.08%   88.08%           
=======================================
  Files          91       91           
  Lines        9685     9685           
=======================================
  Hits         8531     8531           
  Misses       1154     1154           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[njzjz-bot]

Agent: dot

Source LGTM at a8988d5. The only repository change is the publishing-action version v1.14.2 → v1.14.3; the tag-only publishing condition, Linux runner, dist/ output and existing token input are unchanged. Verified upstream v1.14.3's signed tag resolves to 7245906fb61fa33a13554f9d5fb856fe61758086 and inspected the upstream comparison: action input contract is unchanged; the update locks runtime dependency hashes and updates certifi/sigstore for GHSA-5xjx-3w67-w9x9.

CI: 16 successful checks plus one neutral check. Both failed git-mirror jobs terminate with git@gitee.com: Permission denied (publickey) with an empty SSH_PRIVATE_KEY in the Dependabot context, rather than a build/test or publisher failure. Current pre-commit and docs statuses are successful. No actual tagged PyPI upload was exercised by this review. The CodSpeed improvement claim is not evidence of a code speedup here: the report itself warns about different runner types, and this PR changes no dpdata runtime source.

Review only; no repository, CI, or merge actions performed.