[silvexis]

Security fix

Bumps vulnerable dependencies flagged in the 2026-11-02 vulnerability intel run (GitHub-reviewed advisories, published 2026-10-30).

Package	Fixed version	Advisories	Severity	Fixed release published
pypa/gh-action-pypi-publish	v1.14.3	GHSA-5xjx-3w67-w9x9	critical	GitHub release, 2026-10-20

What changed

• .github/workflows/publish.yml: pypa/gh-action-pypi-publish@release/v1 → @7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 (the commit the v1.14.3 tag points to).

Scope

CI only: the PyPI publish job (Trusted Publishing). No package code change.

Dependency freshness hold

The fixed release is already older than 7 days, so the hold (cz-standards govern-dependency-freshness) doesn't block it. Because this is a high/critical security fix, the hold would be waived by severity anyway.

Testing / CI

• The moving release/v1 branch points at v1.14.3 today, but a branch ref can change. Pinning to the commit SHA locks in the fixed release and matches the SHA-pin convention used elsewhere.
• CI runs on this PR. I haven't waited for results.

Risk

Low. Not tested by PR CI, since publishing runs only on release. Separate from this fix: the same workflow still uses actions/upload-artifact@v3 / download-artifact@v3, which GitHub has deprecated, so the publish job may fail for that reason. Out of scope here.

---

AI-assisted change (labelled ai-generated per cz-standards ai-usage). Needs human review from code owners before merge; not approved or merged by automation.

[greptile-apps]

Confidence Score: 5/5

[Low impact] The PR appears safe to merge; no actionable issue was found in the changed action reference.

Summary

Pins pypa/gh-action-pypi-publish to a full commit SHA, labeled v1.14.3, instead of the moving release/v1 branch.

• The PyPI publishing job uses the fixed v1.14.3 action commit.

_{Reviews (1) · Last reviewed commit: "security: pin pypa/gh-action-pypi-publis..." · Reviewed by Greptile}