From 846542671ae234b19170d7bcc4cd39937426b5c1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 06:35:28 +0000 Subject: [PATCH 1/3] Bump actions/setup-python from 6 to 7 in the github-actions group Bumps the github-actions group with 1 update: [actions/setup-python](https://github.com/actions/setup-python). Updates `actions/setup-python` from 6 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bb4afef..dbdad13 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: "3.11" cache: "pip" @@ -55,7 +55,7 @@ jobs: - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python-version }} cache: "pip" @@ -119,7 +119,7 @@ jobs: - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python-version }} cache: "pip" From 4dba07c3361714aa3a763f69a264e62bb464f11d Mon Sep 17 00:00:00 2001 From: DOKOS-TAYOS Date: Mon, 20 Jul 2026 10:50:01 +0200 Subject: [PATCH 2/3] test: expect setup-python@v7 in CI workflow contract Co-authored-by: Cursor --- tests/test_ci_workflow.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_ci_workflow.py b/tests/test_ci_workflow.py index c94c5c6..dc7ab82 100644 --- a/tests/test_ci_workflow.py +++ b/tests/test_ci_workflow.py @@ -164,7 +164,7 @@ def test_ci_workflow_declares_expected_jobs_and_runner_matrices() -> None: assert set(workflow["jobs"]) == {"smoke-minimal", "wheel-smoke", "lint-and-test"} assert workflow["permissions"]["contents"] == "read" assert workflow_text.count("uses: actions/checkout@v7") == 3 - assert workflow_text.count("uses: actions/setup-python@v6") == 3 + assert workflow_text.count("uses: actions/setup-python@v7") == 3 assert workflow["jobs"]["wheel-smoke"]["matrix"]["os"] == ["ubuntu-latest", "windows-latest"] assert workflow["jobs"]["wheel-smoke"]["matrix"]["python-version"] == ["3.12", "3.13"] assert workflow["jobs"]["lint-and-test"]["matrix"]["os"] == [ From b9f69cb2bb595daf69d3aec8fe78835bcad01f9f Mon Sep 17 00:00:00 2001 From: DOKOS-TAYOS Date: Mon, 20 Jul 2026 12:10:35 +0200 Subject: [PATCH 3/3] deps: bump setuptools to 83.0.0 for PYSEC-2026-3447 Co-authored-by: Cursor --- .github/dependabot.yml | 3 --- .github/workflows/ci.yml | 2 +- pyproject.toml | 2 +- requirements.dev.txt | 2 +- tests/test_engineering_baseline.py | 2 +- 5 files changed, 4 insertions(+), 7 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d836018..3788f26 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,9 +17,6 @@ updates: update-types: - "version-update:semver-patch" - "version-update:semver-minor" - - dependency-name: "setuptools" - versions: - - ">=82" - package-ecosystem: "github-actions" directory: "/" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dbdad13..1854044 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -61,7 +61,7 @@ jobs: cache: "pip" - name: Install build tool - run: python -m pip install build==1.5.0 twine==6.2.0 setuptools==81.0.0 + run: python -m pip install build==1.5.0 twine==6.2.0 setuptools==83.0.0 - name: Build package artifacts run: python scripts/verify.py package diff --git a/pyproject.toml b/pyproject.toml index e5ec4f9..dfdf9a3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -43,7 +43,7 @@ dev = [ "build>=1.5.0", "pytest>=9.0.3", "ruff>=0.15.13", - "setuptools>=81.0.0,<82", + "setuptools>=83.0.0", "pyright>=1.1.409", "pip-audit>=2.10", "twine>=6.0.0", diff --git a/requirements.dev.txt b/requirements.dev.txt index 7491a1f..b15afdf 100644 --- a/requirements.dev.txt +++ b/requirements.dev.txt @@ -12,7 +12,7 @@ pyright==1.1.409 pytest==9.0.3 quimb==1.14.0 ruff==0.15.13 -setuptools==81.0.0 +setuptools==83.0.0 tensorkrowch==1.1.6 tensornetwork==0.4.6 twine==6.2.0 diff --git a/tests/test_engineering_baseline.py b/tests/test_engineering_baseline.py index 163e4bb..6d52012 100644 --- a/tests/test_engineering_baseline.py +++ b/tests/test_engineering_baseline.py @@ -156,7 +156,7 @@ def test_dev_requirements_pin_verification_tools_and_use_editable_install() -> N "pytest==9.0.3", "quimb==1.14.0", "ruff==0.15.13", - "setuptools==81.0.0", + "setuptools==83.0.0", "tensorkrowch==1.1.6", "tensornetwork==0.4.6", "twine==6.2.0",