build(deps): bump the actions group across 1 directory with 6 updates (#48)

Bumps the actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` |
`5.0.0` |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) |
`0.8.3` | `0.9.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact)
| `4.6.1` | `4.6.2` |
|
[actions/download-artifact](https://github.com/actions/download-artifact)
| `4.1.9` | `5.0.0` |
|
[pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish)
| `1.12.4` | `1.13.0` |
|
[peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request)
| `7.0.7` | `7.0.8` |


Updates `actions/checkout` from 4.2.2 to 5.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
<li>Prepare v5.0.0 release by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2238">actions/checkout#2238</a></li>
</ul>
<h2>⚠️ Minimum Compatible Runner Version</h2>
<p><strong>v2.327.1</strong><br />
<a
href="https://github.com/actions/runner/releases/tag/v2.327.1">Release
Notes</a></p>
<p>Make sure your runner is updated to this version or newer to use this
release.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4...v5.0.0">https://github.com/actions/checkout/compare/v4...v5.0.0</a></p>
<h2>v4.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
<li>Prepare release v4.3.0 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2237">actions/checkout#2237</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/motss"><code>@​motss</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li><a href="https://github.com/mouismail"><code>@​mouismail</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li><a href="https://github.com/benwells"><code>@​benwells</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4...v4.3.0">https://github.com/actions/checkout/compare/v4...v4.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>V5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>V4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<h2>v4.2.0</h2>
<ul>
<li>Add Ref and Commit outputs by <a
href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
<li>Dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
<a
href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
</ul>
<h2>v4.1.7</h2>
<ul>
<li>Bump the minor-npm-dependencies group across 1 directory with 4
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
<li>Bump actions/checkout from 3 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
<li>Check out other refs/* by commit by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
<li>Pin actions/checkout's own workflows to a known, good, stable
version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
</ul>
<h2>v4.1.6</h2>
<ul>
<li>Check platform to set archive extension appropriately by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
</ul>
<h2>v4.1.5</h2>
<ul>
<li>Update NPM dependencies by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li>
<li>Bump github/codeql-action from 2 to 3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li>
<li>Bump actions/setup-node from 1 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li>
<li>Bump actions/upload-artifact from 2 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li>
<li>README: Suggest <code>user.email</code> to be
<code>41898282+github-actions[bot]@users.noreply.github.com</code> by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1707">actions/checkout#1707</a></li>
</ul>
<h2>v4.1.4</h2>
<ul>
<li>Disable <code>extensions.worktreeConfig</code> when disabling
<code>sparse-checkout</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1692">actions/checkout#1692</a></li>
<li>Add dependabot config by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1688">actions/checkout#1688</a></li>
<li>Bump the minor-actions-dependencies group with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1693">actions/checkout#1693</a></li>
<li>Bump word-wrap from 1.2.3 to 1.2.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1643">actions/checkout#1643</a></li>
</ul>
<h2>v4.1.3</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8"><code>08c6903</code></a>
Prepare v5.0.0 release (<a
href="https://redirect.github.com/actions/checkout/issues/2238">#2238</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/9f265659d3bb64ab1440b03b12f4d47a24320917"><code>9f26565</code></a>
Update actions checkout to use node 24 (<a
href="https://redirect.github.com/actions/checkout/issues/2226">#2226</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/08eba0b27e820071cde6df949e0beb9ba4906955"><code>08eba0b</code></a>
Prepare release v4.3.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2237">#2237</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/631c7dc4f80f88219c5ee78fee08c6b62fac8da1"><code>631c7dc</code></a>
Update package dependencies (<a
href="https://redirect.github.com/actions/checkout/issues/2236">#2236</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/8edcb1bdb4e267140fa742c62e395cd74f332709"><code>8edcb1b</code></a>
Update CODEOWNERS for actions (<a
href="https://redirect.github.com/actions/checkout/issues/2224">#2224</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/09d2acae674a48949e3602304ab46fd20ae0c42f"><code>09d2aca</code></a>
Update README.md (<a
href="https://redirect.github.com/actions/checkout/issues/2194">#2194</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/85e6279cec87321a52edac9c87bce653a07cf6c2"><code>85e6279</code></a>
Adjust positioning of user email note and permissions heading (<a
href="https://redirect.github.com/actions/checkout/issues/2044">#2044</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/009b9ae9e446ad8d9b8c809870b0fbcc5e03573e"><code>009b9ae</code></a>
Documentation update - add recommended permissions to Readme (<a
href="https://redirect.github.com/actions/checkout/issues/2043">#2043</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/cbb722410c2e876e24abbe8de2cc27693e501dcb"><code>cbb7224</code></a>
Update README.md (<a
href="https://redirect.github.com/actions/checkout/issues/1977">#1977</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/3b9b8c884f6b4bb4d5be2779c26374abadae0871"><code>3b9b8c8</code></a>
docs: update README.md (<a
href="https://redirect.github.com/actions/checkout/issues/1971">#1971</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/11bd71901bbe5b1630ceea73d27597364c9af683...08c6903cd8c0fde910a37f88322edcfb5dd907a8">compare
view</a></li>
</ul>
</details>
<br />

Updates `prefix-dev/setup-pixi` from 0.8.3 to 0.9.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prefix-dev/setup-pixi/releases">prefix-dev/setup-pixi's
releases</a>.</em></p>
<blockquote>
<h2>v0.9.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>✨ New features</h3>
<ul>
<li>Add pypi-keyring-provider option by <a
href="https://github.com/olivier-lacroix"><code>@​olivier-lacroix</code></a>
in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/220">prefix-dev/setup-pixi#220</a></li>
<li>Add possibility to install global environments by <a
href="https://github.com/olivier-lacroix"><code>@​olivier-lacroix</code></a>
in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/221">prefix-dev/setup-pixi#221</a></li>
</ul>
<h3>⬆️ Dependency updates</h3>
<ul>
<li>chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 in the
gh-actions group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/222">prefix-dev/setup-pixi#222</a></li>
<li>chore(deps): bump the nodejs group with 7 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/223">prefix-dev/setup-pixi#223</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/olivier-lacroix"><code>@​olivier-lacroix</code></a>
made their first contribution in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/220">prefix-dev/setup-pixi#220</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prefix-dev/setup-pixi/compare/v0.9.0...v0.9.1">https://github.com/prefix-dev/setup-pixi/compare/v0.9.0...v0.9.1</a></p>
<h2>v0.9.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>⬆️ Dependency updates</h3>
<ul>
<li>chore(deps): bump the nodejs group with 7 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/218">prefix-dev/setup-pixi#218</a></li>
</ul>
<h3>🤷🏻 Other changes</h3>
<ul>
<li>chore: Bump to node 24 by <a
href="https://github.com/pavelzw"><code>@​pavelzw</code></a> in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/219">prefix-dev/setup-pixi#219</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prefix-dev/setup-pixi/compare/v0.8.14...v0.9.0">https://github.com/prefix-dev/setup-pixi/compare/v0.8.14...v0.9.0</a></p>
<h2>v0.8.14</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>✨ New features</h3>
<ul>
<li>feat: Replace pixi-url-bearer-token by pixi-url-headers by <a
href="https://github.com/ytausch"><code>@​ytausch</code></a> in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/217">prefix-dev/setup-pixi#217</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prefix-dev/setup-pixi/compare/v0.8.13...v0.8.14">https://github.com/prefix-dev/setup-pixi/compare/v0.8.13...v0.8.14</a></p>
<h2>v0.8.13</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>✨ New features</h3>
<ul>
<li>feat: Allow specifying inputs as environment variables by <a
href="https://github.com/ytausch"><code>@​ytausch</code></a> in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/214">prefix-dev/setup-pixi#214</a></li>
<li>feat: Add Support for Handlebars Templates in pixi-url by <a
href="https://github.com/ytausch"><code>@​ytausch</code></a> in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/213">prefix-dev/setup-pixi#213</a></li>
</ul>
<h3>🤷🏻 Other changes</h3>
<ul>
<li>test: Enable failure tests by <a
href="https://github.com/ytausch"><code>@​ytausch</code></a> in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/215">prefix-dev/setup-pixi#215</a></li>
<li>test: Skip tests with secrets on fork PRs by <a
href="https://github.com/ytausch"><code>@​ytausch</code></a> in <a
href="https://redirect.github.com/prefix-dev/setup-pixi/pull/216">prefix-dev/setup-pixi#216</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prefix-dev/setup-pixi/commit/194d461b21b6c5717c722ffc597fa91ed2ff29fa"><code>194d461</code></a>
Add possibility to install global environments (<a
href="https://redirect.github.com/prefix-dev/setup-pixi/issues/221">#221</a>)</li>
<li><a
href="https://github.com/prefix-dev/setup-pixi/commit/40ab2611f4eafbe621579a3bd70c65108a131250"><code>40ab261</code></a>
chore(deps): bump the nodejs group with 7 updates (<a
href="https://redirect.github.com/prefix-dev/setup-pixi/issues/223">#223</a>)</li>
<li><a
href="https://github.com/prefix-dev/setup-pixi/commit/83ecca31f5d8a25174c5879467107d1fec1acc2a"><code>83ecca3</code></a>
chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 in the gh-actions
grou...</li>
<li><a
href="https://github.com/prefix-dev/setup-pixi/commit/ba511d50901b71279439567b2367dc44e2be46c5"><code>ba511d5</code></a>
Add pypi-keyring-provider option (<a
href="https://redirect.github.com/prefix-dev/setup-pixi/issues/220">#220</a>)</li>
<li><a
href="https://github.com/prefix-dev/setup-pixi/commit/fef5c9568ca6c4ff7707bf840ab0692ba3f08293"><code>fef5c95</code></a>
chore: Bump to node 24 (<a
href="https://redirect.github.com/prefix-dev/setup-pixi/issues/219">#219</a>)</li>
<li><a
href="https://github.com/prefix-dev/setup-pixi/commit/62618497c3c11422d76e7a2f392da48e6942e39c"><code>6261849</code></a>
chore(deps): bump the nodejs group with 7 updates (<a
href="https://redirect.github.com/prefix-dev/setup-pixi/issues/218">#218</a>)</li>
<li><a
href="https://github.com/prefix-dev/setup-pixi/commit/8ca4608ef7f4daeb54f5205b20d0b7cb42f11143"><code>8ca4608</code></a>
feat: Replace pixi-url-bearer-token by pixi-url-headers (<a
href="https://redirect.github.com/prefix-dev/setup-pixi/issues/217">#217</a>)</li>
<li><a
href="https://github.com/prefix-dev/setup-pixi/commit/b1ab8f237b57292b58384631d89ce0b0863766bc"><code>b1ab8f2</code></a>
feat: Add Support for Handlebars Templates in pixi-url (<a
href="https://redirect.github.com/prefix-dev/setup-pixi/issues/213">#213</a>)</li>
<li><a
href="https://github.com/prefix-dev/setup-pixi/commit/d7951c27cdb1438c87386c56ad0053f2a0ffeaf5"><code>d7951c2</code></a>
test: Skip tests with secrets on fork PRs (<a
href="https://redirect.github.com/prefix-dev/setup-pixi/issues/216">#216</a>)</li>
<li><a
href="https://github.com/prefix-dev/setup-pixi/commit/4522f6409dd913d9a28fa71c3a2cf0d70b092bf6"><code>4522f64</code></a>
feat: Allow specifying inputs as environment variables (<a
href="https://redirect.github.com/prefix-dev/setup-pixi/issues/214">#214</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/prefix-dev/setup-pixi/compare/92815284c57faa15cd896c4d5cfb2d59f32dc43d...194d461b21b6c5717c722ffc597fa91ed2ff29fa">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/upload-artifact` from 4.6.1 to 4.6.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v4.6.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Update to use artifact 2.3.2 package &amp; prepare for new
upload-artifact release by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/685">actions/upload-artifact#685</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/685">actions/upload-artifact#685</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v4...v4.6.2">https://github.com/actions/upload-artifact/compare/v4...v4.6.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/ea165f8d65b6e75b540449e92b4886f43607fa02"><code>ea165f8</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/685">#685</a>
from salmanmkc/salmanmkc/3-new-upload-artifacts-release</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/08396203c179e13c71b9754ce3472ed71842eec0"><code>0839620</code></a>
Prepare for new release of actions/upload-artifact with new toolkit
cache ver...</li>
<li>See full diff in <a
href="https://github.com/actions/upload-artifact/compare/4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1...ea165f8d65b6e75b540449e92b4886f43607fa02">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/download-artifact` from 4.1.9 to 5.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/download-artifact/releases">actions/download-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/407">actions/download-artifact#407</a></li>
<li>BREAKING fix: inconsistent path behavior for single artifact
downloads by ID by <a
href="https://github.com/GrantBirki"><code>@​GrantBirki</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/416">actions/download-artifact#416</a></li>
</ul>
<h2>v5.0.0</h2>
<h3>🚨 Breaking Change</h3>
<p>This release fixes an inconsistency in path behavior for single
artifact downloads by ID. <strong>If you're downloading single artifacts
by ID, the output path may change.</strong></p>
<h4>What Changed</h4>
<p>Previously, <strong>single artifact downloads</strong> behaved
differently depending on how you specified the artifact:</p>
<ul>
<li><strong>By name</strong>: <code>name: my-artifact</code> → extracted
to <code>path/</code> (direct)</li>
<li><strong>By ID</strong>: <code>artifact-ids: 12345</code> → extracted
to <code>path/my-artifact/</code> (nested)</li>
</ul>
<p>Now both methods are consistent:</p>
<ul>
<li><strong>By name</strong>: <code>name: my-artifact</code> → extracted
to <code>path/</code> (unchanged)</li>
<li><strong>By ID</strong>: <code>artifact-ids: 12345</code> → extracted
to <code>path/</code> (fixed - now direct)</li>
</ul>
<h4>Migration Guide</h4>
<h5>✅ No Action Needed If:</h5>
<ul>
<li>You download artifacts by <strong>name</strong></li>
<li>You download <strong>multiple</strong> artifacts by ID</li>
<li>You already use <code>merge-multiple: true</code> as a
workaround</li>
</ul>
<h5>⚠️ Action Required If:</h5>
<p>You download <strong>single artifacts by ID</strong> and your
workflows expect the nested directory structure.</p>
<p><strong>Before v5 (nested structure):</strong></p>
<pre lang="yaml"><code>- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/
</code></pre>
<blockquote>
<p>Where <code>my-artifact</code> is the name of the artifact you
previously uploaded</p>
</blockquote>
<p><strong>To maintain old behavior (if needed):</strong></p>
<pre lang="yaml"><code>&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/download-artifact/commit/634f93cb2916e3fdff6788551b99b062d0335ce0"><code>634f93c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/416">#416</a>
from actions/single-artifact-id-download-path</li>
<li><a
href="https://github.com/actions/download-artifact/commit/b19ff4302770b82aa4694b63703b547756dacce6"><code>b19ff43</code></a>
refactor: resolve download path correctly in artifact download tests
(mainly ...</li>
<li><a
href="https://github.com/actions/download-artifact/commit/e262cbee4ab8c473c61c59a81ad8e9dc760e90db"><code>e262cbe</code></a>
bundle dist</li>
<li><a
href="https://github.com/actions/download-artifact/commit/bff23f9308ceb2f06d673043ea6311519be6a87b"><code>bff23f9</code></a>
update docs</li>
<li><a
href="https://github.com/actions/download-artifact/commit/fff8c148a8fdd56aa81fcb019f0b5f6c65700c4d"><code>fff8c14</code></a>
fix download path logic when downloading a single artifact by id</li>
<li><a
href="https://github.com/actions/download-artifact/commit/448e3f862ab3ef47aa50ff917776823c9946035b"><code>448e3f8</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/407">#407</a>
from actions/nebuk89-patch-1</li>
<li><a
href="https://github.com/actions/download-artifact/commit/47225c44b359a5155efdbbbc352041b3e249fb1b"><code>47225c4</code></a>
Update README.md</li>
<li><a
href="https://github.com/actions/download-artifact/commit/d3f86a106a0bac45b974a628896c90dbdf5c8093"><code>d3f86a1</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/404">#404</a>
from actions/robherley/v4.3.0</li>
<li><a
href="https://github.com/actions/download-artifact/commit/fc02353415da80201a0da48ab47022efd7725d11"><code>fc02353</code></a>
prep for v4.3.0 release</li>
<li><a
href="https://github.com/actions/download-artifact/commit/77454371a433f370a16d329ef7db197f700a7a8f"><code>7745437</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/402">#402</a>
from actions/joshmgross/download-by-id-example</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/download-artifact/compare/cc203385981b70ca67e1cc392babf9cc229d5806...634f93cb2916e3fdff6788551b99b062d0335ce0">compare
view</a></li>
</ul>
</details>
<br />

Updates `pypa/gh-action-pypi-publish` from 1.12.4 to 1.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/gh-action-pypi-publish/releases">pypa/gh-action-pypi-publish's
releases</a>.</em></p>
<blockquote>
<h2>v1.13.0</h2>
<!-- raw HTML omitted -->
<blockquote>
<p>[!important]
🚨 This release includes fixes for <a
href="https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-vxmw-7h4f-hqxh">GHSA-vxmw-7h4f-hqxh</a>
discovered by <a
href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a
href="https://github.com/sponsors/woodruffw">💰</a>.
We've also integrated <a href="http://zizmor.sh">Zizmor</a> to catch
similar issues in the future and you should too.</p>
</blockquote>
<h2>✨ New Stuff</h2>
<p><a href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a
href="https://github.com/sponsors/woodruffw">💰</a> updated the README to
no longer mention the attestations feature being experimental in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/347">#347</a>:
it's been rather stable for a year already 🎉
He also added more diagnostic output which includes printing out the
GitHub Environment claim via <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/371">#371</a>
and warning about the unsupported reusable workflows configurations <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/306">#306</a>,
when using Trusted Publishing.</p>
<blockquote>
<p>[!tip]
The official support for reusable workflows is currently blocked on
changes to PyPI. To get updates about progress on the action side, you
may want to subscribe to <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/166">#166</a>.
At PyCon US 2025 Sprints, <a
href="https://github.com/facutuesca"><code>@​facutuesca</code></a><a
href="https://github.com/sponsors/facutuesca">💰</a>, <a
href="https://github.com/miketheman"><code>@​miketheman</code></a><a
href="https://github.com/sponsors/miketheman">💰</a>, <a
href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a
href="https://github.com/sponsors/woodruffw">💰</a> and I<a
href="https://github.com/sponsors/webknjaz">💰</a> spent several hours
IRL brainstorming how to fix this and migrate projects that happen to
rely on an obscure corner case with reusable workflows that temporarily
allows them to function by accident.
The result of that discussion is posted @ <a
href="https://redirect.github.com/pypi/warehouse/issues/11096#issuecomment-2895081700">pypi/warehouse#11096</a>.
Note that this is a volunteer-led effort and there is no ETA. If you
need this soon, make your employer sponsor the PSF and maybe they'll be
able to hire somebody for this work on Warehouse.</p>
</blockquote>
<p>In addition to that, <a
href="https://github.com/konstin"><code>@​konstin</code></a><a
href="https://github.com/sponsors/konstin">💰</a> sent <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/378">#378</a>
to pin <code>actions/setup-python</code> to a SHA hash. This makes
<code>pypi-publish</code> compatible with new GitHub policies that allow
organizations to mandate hash-pinning actions used in workflows.</p>
<h2>🛠️ Internal Dependencies</h2>
<p><a href="https://github.com/webknjaz"><code>@​webknjaz</code></a><a
href="https://github.com/sponsors/webknjaz">💰</a> made a bunch of
updates to the action runtime which includes bumping it to Python 3.13
in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/331">#331</a>
and updating the dependency tree across the board.
<code>pip-with-requires-python</code> is no longer being installed (<a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/332">#332</a>).
Some related bumps were contributed by <a
href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a
href="https://github.com/sponsors/woodruffw">💰</a> (<a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/359">#359</a>)
and <a
href="https://github.com/kurtmckee"><code>@​kurtmckee</code></a><a
href="https://github.com/sponsors/kurtmckee">💰</a> sent a
contributor-facing PR, bumping the linting configuration via <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/335">#335</a>.</p>
<h2>💪 New Contributors</h2>
<ul>
<li><a href="https://github.com/kurtmckee"><code>@​kurtmckee</code></a>
made their first contribution in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/335">#335</a></li>
<li><a href="https://github.com/konstin"><code>@​konstin</code></a> made
their first contribution in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/378">#378</a></li>
</ul>
<p><strong>🪞 Full Diff</strong>: <a
href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.12.4...v1.13.0">https://github.com/pypa/gh-action-pypi-publish/compare/v1.12.4...v1.13.0</a></p>
<p><strong>🧔‍♂️ Release Manager:</strong> <a
href="https://github.com/sponsors/webknjaz"><code>@​webknjaz</code></a>
<a href="https://stand-with-ukraine.pp.ua">🇺🇦</a></p>
<p><strong>💬 Discuss</strong> <a
href="https://bsky.app/profile/webknjaz.me/post/3lxxzvzhvfc2e">on
Bluesky 🦋</a>, <a
href="https://mastodon.social/@webknjaz/115143522527224444">on Mastodon
🐘</a> and <a
href="https://github.com/pypa/gh-action-pypi-publish/discussions/379">on
GitHub</a>.</p>
<p><a href="https://github.com/sponsors/webknjaz"><img
src="https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&amp;logoColor=%23EA4AAA&amp;label=Sponsor&amp;color=2a313c"
alt="GH Sponsors badge" /></a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e"><code>ed0c539</code></a>
📦📌 Bump the pinned dependency tree</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/77db1b7cf7dcea2e403bb4350516284282740dd6"><code>77db1b7</code></a>
Merge branch PR <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/306">#306</a>,
GHSA-vxmw-7h4f-hqxh fix and PR <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/378">#378</a>
into unstable/v1</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/280b3a1b7e38a360b85b4ee41645d27b79bde3fc"><code>280b3a1</code></a>
Alias <code>typing as t</code> in imports</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/e380240d7e3673f460e0621686f33fbbf9594e85"><code>e380240</code></a>
Use <code>object</code> in place of <code>typing.Any</code> in
annotations</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/e50bff6eb477e46de0cbacc0693737ecb690eb0f"><code>e50bff6</code></a>
Deduplicate claim ref lookup</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/decbc9a5d448364aa64c211724dc79a2cefcab2a"><code>decbc9a</code></a>
Hint people to subscribe to <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/166">#166</a>
for notifications</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/8208ad36a18e6fdd644f6ad69dc70c833d8af633"><code>8208ad3</code></a>
Ask not to report bugs with reusable workflow</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/ff0fef5bdb66aa250f741d5d8b00a8b78b9dffd5"><code>ff0fef5</code></a>
🧪 Scope WPS202 suppression to specific files</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/1293b8c325b5f9abcab5160ee3553de2ee6a883f"><code>1293b8c</code></a>
Use yamllint disable line length lint</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/ed01280d14b6f9a0edaa1a5494d8f7ffed709083"><code>ed01280</code></a>
Linter (different rule)</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/gh-action-pypi-publish/compare/76f52bc884231f62b9a034ebfe128415bbaabdfc...ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e">compare
view</a></li>
</ul>
</details>
<br />

Updates `peter-evans/create-pull-request` from 7.0.7 to 7.0.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/peter-evans/create-pull-request/releases">peter-evans/create-pull-request's
releases</a>.</em></p>
<blockquote>
<h2>Create Pull Request v7.0.8</h2>
<h2>What's Changed</h2>
<ul>
<li>build(deps-dev): bump ts-jest from 29.2.5 to 29.2.6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/3751">peter-evans/create-pull-request#3751</a></li>
<li>build(deps-dev): bump eslint-import-resolver-typescript from 3.8.1
to 3.8.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/3752">peter-evans/create-pull-request#3752</a></li>
<li>build(deps): bump <code>@​octokit/plugin-paginate-rest</code> from
11.4.2 to 11.4.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/3753">peter-evans/create-pull-request#3753</a></li>
<li>build(deps-dev): bump prettier from 3.5.1 to 3.5.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/3754">peter-evans/create-pull-request#3754</a></li>
<li>fix: suppress output for some git operations by <a
href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in
<a
href="https://redirect.github.com/peter-evans/create-pull-request/pull/3776">peter-evans/create-pull-request#3776</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/peter-evans/create-pull-request/compare/v7.0.7...v7.0.8">https://github.com/peter-evans/create-pull-request/compare/v7.0.7...v7.0.8</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/271a8d0340265f705b14b6d32b9829c1cb33d45e"><code>271a8d0</code></a>
fix: suppress output for some git operations (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/3776">#3776</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/6f7efd1c24d02e0d947dd3f6f9618019afb36781"><code>6f7efd1</code></a>
test: update cpr-example-command</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/13c47c574799c8eb0a033eba252619135e70f392"><code>13c47c5</code></a>
build(deps-dev): bump prettier from 3.5.1 to 3.5.2 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/3754">#3754</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/63e58290d72e889603c931363c5169ba1bbe3fed"><code>63e5829</code></a>
build(deps): bump <code>@​octokit/plugin-paginate-rest</code> from
11.4.2 to 11.4.3 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/3753">#3753</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/a92c90fcab983421cc9bc736a06daea58c68d0db"><code>a92c90f</code></a>
build(deps-dev): bump eslint-import-resolver-typescript (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/3752">#3752</a>)</li>
<li><a
href="https://github.com/peter-evans/create-pull-request/commit/b23b62d48799ec46790610dd74b29cb9ba2eef30"><code>b23b62d</code></a>
build(deps-dev): bump ts-jest from 29.2.5 to 29.2.6 (<a
href="https://redirect.github.com/peter-evans/create-pull-request/issues/3751">#3751</a>)</li>
<li>See full diff in <a
href="https://github.com/peter-evans/create-pull-request/compare/dd2324fc52d5d43c699a5636bcf19fceaa70c284...271a8d0340265f705b14b6d32b9829c1cb33d45e">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/build.yml

@@ -13,16 +13,16 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Setup pixi
-        uses: prefix-dev/setup-pixi@92815284c57faa15cd896c4d5cfb2d59f32dc43d # v0.8.3
+        uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
         with:
           environments: build
       - name: Build package
         run: |
           pixi run -e build python -m build --no-isolation .
       - name: Upload package
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: artifact
           path: dist/*
@@ -39,9 +39,9 @@ jobs:
       contents: write
     environment: pypi
     steps:
-      - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: artifact
           path: dist
       - name: Publish package on PyPi
-        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

.github/workflows/bump-lockfile.yml

@@ -14,17 +14,17 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Set up pixi
-        uses: prefix-dev/setup-pixi@92815284c57faa15cd896c4d5cfb2d59f32dc43d # v0.8.3
+        uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
         with:
           run-install: false
       - name: Update lockfiles
         run: |
           set -o pipefail
           pixi update --json | pixi exec pixi-diff-to-markdown >> diff.md
       - name: Create pull request
-        uses: peter-evans/create-pull-request@dd2324fc52d5d43c699a5636bcf19fceaa70c284 # v7.0.7
+        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: Update pixi lockfile

.github/workflows/ci.yml

@@ -30,9 +30,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Setup pixi
-        uses: prefix-dev/setup-pixi@92815284c57faa15cd896c4d5cfb2d59f32dc43d # v0.8.3
+        uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
         with:
           environments: ${{ matrix.env }}
       - name: Install repository
@@ -49,9 +49,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Setup pixi
-        uses: prefix-dev/setup-pixi@92815284c57faa15cd896c4d5cfb2d59f32dc43d # v0.8.3
+        uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
         with:
           environments: lint default
       - name: pre-commit

.github/workflows/docs.yml

@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download source
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Install Python
-        uses: prefix-dev/setup-pixi@92815284c57faa15cd896c4d5cfb2d59f32dc43d # v0.8.3
+        uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
         with:
           environments: docs
       - name: Install repository