[dependabot]

Bumps the actions-minor-and-patch group with 3 updates: docker/setup-buildx-action, docker/build-push-action and pypa/gh-action-pypi-publish.

Updates docker/setup-buildx-action from 4.3.0 to 4.4.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.1

• Skip BuildKit image pre-pulls for explicit endpoints by @​crazy-max in docker/setup-buildx-action#624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

• Use official Buildx releases for cloud driver by @​crazy-max in docker/setup-buildx-action#606
• Pull BuildKit image before builder creation by @​crazy-max in docker/setup-buildx-action#609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in docker/setup-buildx-action#620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614
• Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

Commits

• f87e599 Merge pull request #624 from crazy-max/skip-pull-with-endpoint
• e700274 chore: update generated content
• 3061c91 skip BuildKit image pre-pulls for explicit endpoints
• 594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
• bd6e702 chore: update generated content
• 6268c9d pull BuildKit image before builder creation
• e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
• 533ed8e build(deps): bump the codeql-actions group with 2 updates
• bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
• d5079fb chore: update generated content
• Additional commits viewable in compare view

Updates docker/build-push-action from 7.3.0 to 7.4.0

Release notes

Sourced from docker/build-push-action's releases.

v7.4.0

• Use the shared error helper for Buildx commands by @​crazy-max in docker/build-push-action#1620
• Prevent workflow command injection in metadata logs by @​crazy-max in docker/build-push-action#1617
• Bump @​docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/build-push-action#1614 docker/build-push-action#1618 docker/build-push-action#1621
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/build-push-action#1609
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/build-push-action#1592
• Bump csv-parse from 7.0.0 to 7.0.2 in docker/build-push-action#1613
• Bump js-yaml from 4.3.0 to 4.3.2 in docker/build-push-action#1605 docker/build-push-action#1615
• Bump nanoid from 3.3.16 to 3.3.18 in docker/build-push-action#1611
• Bump postcss from 8.5.10 to 8.5.25 in docker/build-push-action#1590
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/build-push-action#1606
• Bump sigstore from 4.1.0 to 4.1.1 in docker/build-push-action#1577
• Bump undici from 6.27.0 to 6.28.0 in docker/build-push-action#1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

Commits

• c3c9e26 Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 459b674 [dependabot skip] chore: update generated content
• 4dedcb2 chore(deps): Bump @​docker/actions-toolkit from 0.99.0 to 0.100.0
• 379bf63 Merge pull request #1620 from crazy-max/buildx-error-message
• 9877975 chore: update generated content
• 7ed0556 use the shared Buildx error summary helper
• 91670ba Merge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 80dbc86 [dependabot skip] chore: update generated content
• 50cac3a chore(deps): Bump @​docker/actions-toolkit from 0.98.0 to 0.99.0
• 03b4d6c Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands
• Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
• 331eccb Upgrade certifi and sigstore
• f68fee4 💰 Sync the FUNDING config
• c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
• 9090099 🧪 Make smoke test deps hash-pinned in CI
• 34e40c2 📌 Bump pip-tools managed transitive deptrees
• e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
• dd8c5f4 🔧 Make pip-tools config available in container
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Chores
  • Updated the automation used for Linux end-to-end testing and PyPI publishing. These changes affect how builds and releases are carried out; no user-facing functionality changes are included.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d27d98cb-5b1d-4f26-bea9-d385e0469d90

📥 Commits

Reviewing files that changed from the base of the PR and between a1933b3 and bb09c14.

📒 Files selected for processing: 2

• .github/workflows/e2e.yml
• .github/workflows/publish-to-pypi.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

📝 Walkthrough

Two GitHub Actions workflows update pinned action revisions. The Linux E2E workflow updates its Docker action versions. The PyPI publishing workflow changes the pinned action commit while keeping the release/v1 tag.

Changes: Linux E2E action updates

Layer / File(s)	Summary
Update Linux E2E action pins .github/workflows/e2e.yml	The workflow updates docker/setup-buildx-action from v4.3.0 to v4.4.1 and docker/build-push-action from v7.3.0 to v7.4.0.

PyPI publishing action update

Layer / File(s)	Summary
Update PyPI publishing action pin .github/workflows/publish-to-pypi.yml	The workflow changes the pinned pypa/gh-action-pypi-publish commit. The release/v1 tag remains unchanged.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Suggested reviewers: gorandodig, nejcs

Merge Risk: ⚪ Minimal · up to bb09c

No actionable risk from these workflow pin updates remains; the PR is mergeable after normal checks.

Security architecture risk: 🔵 Low · up to bb09c

The action updates leave the declared workflow permissions and execution boundaries unchanged. A pre-existing absence of explicit CI token permissions remains; actual privileges depend on repository settings. No new privilege expansion is demonstrated.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Findings and Attack Paths

• observed — The retained low-severity finding concerns absent explicit workflow permissions. That configuration predates this PR. The supplied security assessment leaves exploit reachability unknown, and the comparison does not demonstrate newly increased authority or exposure.

Trust Boundaries and Controls

• inferred — The configured trust boundary remains execution of third-party action code within the existing CI job. Determining whether inherited authority permits repository writes or consequential downstream actions requires effective token settings and upstream behavior that were not established here.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately summarizes the pull request as a CI dependency update that bumps three GitHub Actions.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}