Bumps the github-actions group with 5 updates:

Package	From	To
python-semantic-release/python-semantic-release	10.6.1	10.6.2
python-semantic-release/publish-action	10.6.1	10.6.2
pypa/gh-action-pypi-publish	1.14.1	1.14.2
actions/stale	10.4.0	11.0.0
mikepenz/action-junit-report	6.4.2	6.5.0

Updates python-semantic-release/python-semantic-release from 10.6.1 to 10.6.2

Release notes

Sourced from python-semantic-release/python-semantic-release's releases.

v10.6.2 (2026-08-28)

This release is published under the MIT License.

🪲 Bug Fixes

• cmd-changelog: Fix reading of TOML when file was created on Windows (9a56ace)

• config: Validate commit author in config internally (PR#1477, 10afa8e)

⚙️ Build System

• deps: Adjust importlib use to maintain 3.8 support (59fea4f)

• deps: Bump rich requirement from v14.0+ to v15.0+ (PR#1464, abd942d)

• deps: Bump tomlkit requirement to ~=0.15.0 (PR#1463, 429588d)

✅ Resolved Issues

• #1476: Bug: GitPython v3.1.60 removed Actor.name_email_regex, breaking every config load

---

Detailed Changes: v10.6.1...v10.6.2

---

Installable artifacts are available from:

• PyPi Registry

• GitHub Release Assets

Changelog

Sourced from python-semantic-release/python-semantic-release's changelog.

.. _changelog:

========= CHANGELOG

.. _changelog-v10.6.2:

v10.6.2 (2026-08-28)

🪲 Bug Fixes

• cmd-changelog: Fix reading of TOML when file was created on Windows (9a56ace_)

• config: Validate commit author in config internally, closes [#1476](https://github.com/python-semantic-release/python-semantic-release/issues/1476)_ (PR#1477, 10afa8e)

⚙️ Build System

• deps: Adjust importlib use to maintain 3.8 support (59fea4f_)

• deps: Bump rich requirement from v14.0+ to v15.0+ (PR#1464, abd942d)

• deps: Bump tomlkit requirement to ~=0.15.0 (PR#1463, 429588d)

.. _#1476: python-semantic-release/python-semantic-release#1476 .. _10afa8e: 10afa8e .. _429588d: 429588d .. _59fea4f: 59fea4f .. _9a56ace: 9a56ace .. _abd942d: abd942d .. _PR#1463: python-semantic-release/python-semantic-release#1463 .. _PR#1464: python-semantic-release/python-semantic-release#1464 .. _PR#1477: python-semantic-release/python-semantic-release#1477

.. _changelog-v10.6.1:

v10.6.1 (2026-07-06)

🪲 Bug Fixes

• changelog: Fix handling of whitespace commit bodies in changelog template filter (PR#1457, d95e46e)

• cmd-version: Fix non-styled error msg when strict & no new version, closes [#1423](https://github.com/python-semantic-release/python-semantic-release/issues/1423)_

... (truncated)

Commits

• 9a026e9 chore: release v10.6.2
• 10afa8e fix(config): validate commit author in config internally (#1477)
• 414e8fb ci(validate): improve Windows e2e test reliability
• 9a56ace fix(cmd-changelog): fix reading of TOML when file was created on Windows
• 7df3d73 test(util): add additional clarity for e2e test failure
• c74aa3b refactor(deps): adjust dependency paradigm to maximize compatibility (#1466)
• abd942d build(deps): bump rich requirement from v14.0+ to v15.0+ (#1464)
• de32322 refactor(cmd-changelog): adjust import to chosing appropriate importlib when ...
• df34b89 test: refactor for chosing correct importlib when needed
• 59fea4f build(deps): adjust importlib use to maintain 3.8 support
• Additional commits viewable in compare view

Updates python-semantic-release/publish-action from 10.6.1 to 10.6.2

Release notes

Sourced from python-semantic-release/publish-action's releases.

v10.6.2 (2026-08-29)

Build System

• deps: Bump python-semantic-release from v10.6.1 to v10.6.2 (#108, 6d89e2d)

---

Detailed Changes: v10.6.1...v10.6.2

Commits

• 6d89e2d build(deps): bump python-semantic-release from v10.6.1 to v10.6.2 (#108)
• de054f7 ci(deps): bump python-semantic-release@v10.6.1 action to v10.6.2 (#109)
• d758488 ci(deps): bump actions/stale@v10.4.0 to v11.0.0 (#109)
• ecc6d18 ci(dependabot): add cooldown exclusions for python-semantic-release (#107)
• c420bca ci(deps): bump actions/stale@v10.3.0 to v10.4.0 (#106)
• c331a90 ci(deps): bump actions/checkout@v7.0.0 to v7.0.1 (#106)
• See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

• @​davidbrochart made their first contribution in #415
• @​takluyver made their first contribution in #416

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits

• dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
• 8b2f234 Bump pypi-attestations and sigstore
• 78b72db Merge pull request #416 from takluyver/twine-v7
• 92f4d2a Update twine to v7
• See full diff in compare view

Updates actions/stale from 10.4.0 to 11.0.0

Release notes

Sourced from actions/stale's releases.

v11.0.0

What's Changed

Enhancement

• Migrate to ESM and update dependencies by @​chiranjib-swain in actions/stale#1350

Dependency Update

• Override brace-expansion to 5.0.8 to address 24 high-severity dependency vulnerabilities by @​dependabot in actions/stale#1351

Full Changelog: actions/stale@v10...v11.0.0

Commits

• 4391f3d Fix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8 (...
• eaf9131 refactor: update imports to use ES module syntax and improve test structure (...
• See full diff in compare view

Updates mikepenz/action-junit-report from 6.4.2 to 6.5.0

Release notes

Sourced from mikepenz/action-junit-report's releases.

v6.5.0

🚀 Features

• ci: add OpenSSF Scorecard, top-level permissions, fix script injection
  • PR: #1609

🐛 Fixes

• fix: accept comma separated exclude_sources again
  • PR: #1611

📦 Dependencies

• chore(deps): lock file maintenance
  • PR: #1572
• chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to 4823a29
  • PR: #1569
• chore(deps): update node devdependency non-major updates
  • PR: #1570
• chore(deps): update dependency undici to v8
  • PR: #1571
• chore(deps): lock file maintenance
  • PR: #1577
• chore(deps): update dependency serialize-javascript to v7.0.6
  • PR: #1573
• chore(deps): update node devdependency non-major updates
  • PR: #1574
• chore(deps): update dependency js-yaml to v5
  • PR: #1576
• chore(deps): update actions/checkout action to v7
  • PR: #1575
• chore(deps): lock file maintenance
  • PR: #1581
• chore(deps): update dependency vite to v8.1.0
  • PR: #1579
• chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to 2449e39
  • PR: #1578
• chore(deps): update node devdependency non-major updates
  • PR: #1580
• chore(deps): lock file maintenance
  • PR: #1587
• chore(deps): update dependency brace-expansion to v5.0.7
  • PR: #1582
• chore(deps): update node devdependency non-major updates
  • PR: #1585
• chore(deps): update dependency undici to v8.7.0
  • PR: #1586
• chore(deps): update dependency serialize-javascript to v7.0.7
  • PR: #1583
• chore(deps): update dependency vite to v8.1.3

... (truncated)

Commits

• a9170d5 chore(deps): update mikepenz/action-gh-release action to v3.1.0 (#1619)
• efeb9fc Merge pull request #1617 from mikepenz/renovate/node-devdependency-non-major-...
• b96a237 Merge pull request #1616 from mikepenz/renovate/js-yaml-5.x
• e80da3b chore: rebuild dist for renovate
• 1ede41f chore: sync js-yaml version between devDependencies and overrides
• d0a2dbb chore: sync js-yaml version between devDependencies and overrides
• e66f752 chore(deps): update node devdependency non-major updates
• 07503e7 chore(deps): update dependency js-yaml to v5.3.0
• 6efe830 chore(deps): update mikepenz/release-changelog-builder-action action to v6.2....
• d9dc257 Merge pull request #1614 from mikepenz/renovate/nanoid-6.x
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions