build(deps): bump the minor-patch-dependencies group with 4 updates

[dependabot]

Bumps the minor-patch-dependencies group with 4 updates: msys2/setup-msys2, pypa/cibuildwheel, scientific-python/upload-nightly-action and zizmorcore/zizmor-action.

Updates msys2/setup-msys2 from 2.32.0 to 2.33.0

Release notes

Sourced from msys2/setup-msys2's releases.

v2.33.0

• Update base distribution to 20260927. [#657]
• Due to dependency cleanups "perl" and some related libraries are no longer installed by default.
• Add a deprecation warning for MINGW32/MINGW64. See the new suppress-deprecation-warnings option for how to silence them. [#644]
• pacboy caching fixes [#650]
• Update dependencies

Changelog

Sourced from msys2/setup-msys2's changelog.

Changelog

2.33.0

• Update base distribution to 20260927. [#657]
• Due to dependency cleanups "perl" and some related libraries are no longer installed by default.
• Add a deprecation warning for MINGW32/MINGW64. See the new suppress-deprecation-warnings option for how to silence them. [#644]
• pacboy caching fixes [#650]
• Update dependencies

2.32.0

• Update base distribution to 20260611. [#624]
• Port from ncc to rolldown for bundling
• Include an SBOM of the bundle
• Update dependencies

2.31.1

• input: allow empty input for "install" and "pacboy", meaning not packages will be installed [#589]
• input: deprecate the special "RUNNER_TEMP" value for "location" in favor of an empty string
• Update dependencies

2.31.0

• Update base distribution to 20260322. [#597]
• Update dependencies
• Move to node24 from node20

2.30.0

• Update base distribution to 20251213. [#565]
• Remove folder-hash dependency [#555]
• Update dependencies

2.29.0

• Allow installation to C:\msys64 if it doesn't exist already. Like with the new windows-11-arm image, for example. [#542]
• Update base distribution to 20250830. [#548]
• Update dependencies

2.28.0

• Update base distribution to 20250622. [#518]
• Update dependencies

2.27.0

... (truncated)

Commits

• ec48f7c v2.33.0 d34ca6fb9f66412423e0ade249ca8a35b3715726
• See full diff in compare view

Updates pypa/cibuildwheel from 4.2.0 to 4.2.1

Release notes

Sourced from pypa/cibuildwheel's releases.

v4.2.1

• 🐛 Respects the NuGet package sources configured on the machine when installing CPython on Windows, instead of always falling back to nuget.org (#2966)
• 🐛 Fixes a NameError on Pyodide when an already-compatible wheel was reused, which made the test step fail (#2968)
• 🛠 Updates the Android Python versions, and the Android testbed's Gradle version, making it compatible with Java 25 (#2962)
• 🛠 Updates dependencies including CPython 3.15.0rc2 (#2965, #2970, #2976, #2981, #2985)

Changelog

Sourced from pypa/cibuildwheel's changelog.

---

title: Changelog ref: changelog

Changelog

v4.2.1

5 September 2026

• 🐛 Respects the NuGet package sources configured on the machine when installing CPython on Windows, instead of always falling back to nuget.org (#2966)
• 🐛 Fixes a NameError on Pyodide when an already-compatible wheel was reused, which made the test step fail (#2968)
• 🛠 Updates the Android Python versions, and the Android testbed's Gradle version, making it compatible with Java 25 (#2962)
• 🛠 Updates dependencies including CPython 3.15.0rc2 (#2965, #2970, #2976, #2981, #2985)

v4.2.0

4 August 2026

• 🌟 CPython 3.15 wheels are now built by default - without the "cpython-prerelease" enable set. It's time to build and upload these wheels to PyPI! This release includes CPython 3.15.0rc1, which is guaranteed to be ABI compatible with the final release. (#2944)
• ✨ Adds Pyodide 3.15 support with the cp315-pyodide_wasm32 build identifier, using Pyodide 315.0.0a2. These are also stable wrt. the final release. (#2958)
• 🐛 Retries a failed download six times with exponential backoff, so short network outages no longer stop a build. A 4xx response is still reported at once. (#2953)
• 🐛 Accepts default as a build-frontend value on Pyodide, and accepts pyodide-build in the top-level table and in overrides (#2951)
• 🛠 Holds pip back on GraalPy, where newer pip breaks the build (#2955)
• 🛠 Updates Pyodide to 314.0.4 (#2949, #2952)
• 🛠 Updates dependencies and container pins (#2952, #2960)
• 💼 Updates CI action pins (#2948, #2954)
• 🧪 Uses pp311 for the abi3 test, and deletes test_overridden_pip_constraint, which is not necessary since #2583 (#2956, #2957)

v4.1.1

24 July 2026

• ✨ Adds pyodide-build as a separate build-frontend, now the default frontend for Pyodide, with verbosity flags handling. Any other frontend is ignored with a warning on Pyodide. (#2609, #2945)
• 🔐 Uses digests instead of tags for pinned container images, strengthening supply-chain security. The human-readable tags remain as comments in pinned_docker_images.cfg. (#2915)
• 🐛 Fixes platform-specific test-runtime environment variables (e.g. CIBW_TEST_RUNTIME_ANDROID) not being honored (#2941)
• 🐛 Fixes quoting of test-requires and audit-requires so PEP 508 specifiers containing spaces work (#2913)
• 🐛 Makes archs parsing case-insensitive and platform-aware, so e.g. arm64 works on Windows (#2920)
• 🐛 Uses an absolute path for the {project} placeholder in config-settings (#2934)
• 🐛 Validates the pyodide-version option against the build identifier with a clear error (#2925)
• 🐛 Fixes PyPy installs on macOS after PyPy switched its downloads from .tar.bz2 to .tar.gz (#2939)
• 🐛 Makes a matching python3-config available in the build and test venvs on macOS (#2922)
• 🛠 Updates dependencies and container pins (#2917, #2935, #2939)
• 🛠 Updates Android tests to current Python versions and the new test repository URL (#2933)
• 🛠 Drops the orjson dependency, no longer used by mypy 2+ (#2923)
• 📚 Builds the docs with properdocs, a MkDocs fork (#2946)
• 📚 Adds the missing cp314-pyodide_wasm32 entry to the build identifier table (#2947)
• 📚 Removes outdated notes about the pip wheel build frontend and ClearLinux (#2926)
• 💼 Adds a "CI: PyPy EoL" PR label to run PyPy EoL tests on PRs (#2930)

... (truncated)

Commits

• e090b81 Bump version: v4.2.1
• 59501f4 Respect configured NuGet package sources (#2966)
• 885ead0 [Bot] Update dependencies (#2985)
• 3d9e8c5 docs: refresh CircleCI and CPython platform links (#2977)
• 7d5ec95 [Bot] Update dependencies (#2981)
• a007eed [Bot] Update dependencies (#2976)
• fdda545 chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the actions grou...
• 8832cf6 chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 in the ...
• a35209b [Bot] Update dependencies (#2970)
• 148ea70 chore: faster and stricter mypy (#2968)
• Additional commits viewable in compare view

Updates scientific-python/upload-nightly-action from 0.6.4 to 0.6.5

Release notes

Sourced from scientific-python/upload-nightly-action's releases.

0.6.5

What's Changed

• Add details about the consequences of not regularly uploading wheels by @​betatim in scientific-python/upload-nightly-action#173
• Add issue-opener when wheels are almost dead by @​larsoner in scientific-python/upload-nightly-action#175
• MNT: Update to pixi lock spec v7 and project version v0.6.5 by @​matthewfeickert in scientific-python/upload-nightly-action#183

New Contributors

• @​larsoner made their first contribution in scientific-python/upload-nightly-action#175

Full Changelog: scientific-python/upload-nightly-action@0.6.4...0.6.5

Commits

• 16fa02e MNT: Update to pixi lock spec v7 and project version v0.6.5 (#183)
• fd44fde chore: Move requirements file under tools/ (#182)
• 1dbb7f3 Build(deps): Bump pygithub from 2.9.1 to 2.10.0 in the python group (#180)
• 2ca17bd Build(deps): Bump prefix-dev/setup-pixi in the actions group (#179)
• 1a97ddf Build(deps): Bump the actions group with 3 updates (#177)
• c88d30e Add issue-opener when wheels are almost dead (#175)
• d770301 Build(deps): Bump the actions group with 4 updates (#174)
• 33e7342 Add details about the consequences of not regularly uploading wheels (#173)
• 64f2a45 Build(deps): Bump the actions group with 3 updates (#170)
• 9aaae99 Build(deps): Bump the actions group with 4 updates (#168)
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.6.2 to 0.6.4

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.4

Sponsorship is appreciated!

zizmor 1.30.1 is now the default version.

Release notes: zizmorcore/zizmor-action#1301

v0.6.3

zizmor 1.30.0 is now the default version.

Release notes: zizmorcore/zizmor-action#1300

Commits

• cc914d7 Sync zizmor versions (#166)
• bae72b7 chore(deps): bump the github-actions group with 2 updates (#165)
• 27604f9 chore(deps): bump the github-actions group with 2 updates (#164)
• c41d665 README: bump pins (#163)
• 70fb788 Sync zizmor versions (#162)
• 7999d8c chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 in ...
• 2ae1ce9 chore(deps): bump github/codeql-action/upload-sarif (#160)
• 951a5ee Skip prerelease versions in sync-zizmor-versions workflow (#158)
• 79f0191 chore(deps): bump github/codeql-action/upload-sarif (#156)
• 26a3ae6 sync-zizmor-versions: retry up to 5 times (#155)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.