Bump the ci-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the ci-dependencies group with 3 updates in the / directory: actions/dependency-review-action, pypa/cibuildwheel and actions/download-artifact.

Updates actions/dependency-review-action from 4.6.0 to 4.7.1

Release notes

Sourced from actions/dependency-review-action's releases.

v4.7.1

• Packages added to allow-dependencies-licenses will be allowed even if the package in question has no license information #889
• License expressions (e.g. Ruby OR GPL-2.0) in the allow list are automatically discarded so that they don't invalidate the whole allow list, which should just be license identifier (e.g. Ruby)

v4.7.0

• Handle complex license expressions (e.g. MIT AND GPL-2.0) in allow lists (fixes #809 and probably others)
• Replace OTHER in package licenses with LicenseRef-clearlydefined-OTHER so that parsing passes

Commits

• da24556 Merge pull request #933 from actions/dangoor/471-release
• 9af0caf Bump version number for 4.7.1
• d8f2df2 Merge pull request #932 from actions/907-disallow-expression
• 6e9307a Discard allow list entries that are not SPDX IDs
• 8805179 Merge pull request #930 from actions/889-allow-no-license
• 014300b Update build
• 34486f3 Check namespaces when excluding license checks
• 9b155d6 Update build
• f199659 Allowing dependencies works with no licenses
• 38ecb5b Merge pull request #929 from actions/dangoor/4.7-release
• Additional commits viewable in compare view

Updates pypa/cibuildwheel from 2.23.2 to 2.23.3

Release notes

Sourced from pypa/cibuildwheel's releases.

v2.23.3

• 🛠 Dependency updates, including Python 3.13.3 (#2371)

Changelog

Sourced from pypa/cibuildwheel's changelog.

---

title: Changelog

Changelog

v3.0.0

Not yet released, but available for testing.

Note - when using a beta version, be sure to check the latest docs, rather than the stable version, which is still on v2.X.

If you've used previous versions of the beta:

• ⚠️ Previous betas of v3.0 changed the working directory for tests. This has been rolled back to the v2.x behaviour, so you might need to change configs if you adapted to the beta 1 or 2 behaviour. See [issue #2406](pypa/cibuildwheel#2406) for more information.
• ⚠️ GraalPy shipped with the identifier gp242-* in previous betas, this has been changed to gp311_242-* to be consistent with other interpreters, and to fix a bug with GraalPy and project requires-python detection. If you were using GraalPy, you might need to update your config to use the new identifier.

v3.0.0b4

29 May 2025

• 🛠 Dependency updates, including Python 3.14.0b2 (#2371)
• 🛠 Remove the addition of PYTHONSAFEPATH to test-environment. (#2429)
• 📚 README table now matches docs and auto-updates. (#2427, #2428)

v3.0.0b3

28 May 2025

• 🛠 Reverts the test working dir (when test-sources isn't set) to a temporary dir, rather than the project. (#2420)
• 📚 Docs now primarily use the pyproject.toml name of options, rather than the environment variable name. (#2389)

v3.0.0b2

25 May 2025

• ✨ Adds the CIBW_TEST_ENVIRONMENT option, which allows you to set environment variables for the test command. cibuildwheel now sets PYTHONSAFEPATH=1 in test environments by default, to avoid picking up package imports from the local directory - we want to test the installed wheel, not the source tree! You can change that, or any other environment variable in the test environment using this option. (#2388)
• ✨ Improves support for Pyodide builds and adds the CIBW_PYODIDE_VERSION option, which allows you to specify the version of Pyodide to use for builds. (#2002)

v3.0.0b1

19 May 2025

• 🌟 Adds the ability to build wheels for iOS! Set the platform option to ios on a Mac with the iOS toolchain to try it out!
• 🌟 Adds support for the GraalPy interpreter! Enable for your project using the enable option. (#1538)
• ✨ Adds CPython 3.14 support, under the enable option cpython-prerelease. This version of cibuildwheel uses 3.14.0b1.

... (truncated)

Commits

• faf86a6 Bump version: v2.23.3
• 4241f37 [2.x] Update dependencies (#2371)
• See full diff in compare view

Updates actions/download-artifact from 4.2.1 to 4.3.0

Release notes

Sourced from actions/download-artifact's releases.

v4.3.0

What's Changed

• feat: implement new artifact-ids input by @​GrantBirki in actions/download-artifact#401
• Fix workflow example for downloading by artifact ID by @​joshmgross in actions/download-artifact#402
• Prep for v4.3.0 release by @​robherley in actions/download-artifact#404

New Contributors

• @​GrantBirki made their first contribution in actions/download-artifact#401

Full Changelog: actions/download-artifact@v4.2.1...v4.3.0

Commits

• d3f86a1 Merge pull request #404 from actions/robherley/v4.3.0
• fc02353 prep for v4.3.0 release
• 7745437 Merge pull request #402 from actions/joshmgross/download-by-id-example
• 84fc7a0 Remove path filters from Check dist workflow
• 67f2bc3 Fix workflow example for downloading by artifact ID
• 8ea3c2c Merge pull request #401 from actions/download-by-id
• d219c63 add supporting unit tests for artifact downloads with ids
• 54124fb revert getArtifact() changes - for now we have to list and filter by artifa...
• b83057b bundle
• 171183c use the same artifactClient.getArtifact structure as seen above in `isSingl...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions