From 7fdb98486a7645fa4b3724e004a0c5b5d6f58b08 Mon Sep 17 00:00:00 2001
From: Tim Hoffmann <2836374+timhoffm@users.noreply.github.com>
Date: Sat, 22 Aug 2026 07:27:17 +0200
Subject: [PATCH 1/6] Merge pull request #32210 from
 matplotlib/dependabot/github_actions/actions-6dd3908678

Bump the actions group across 1 directory with 6 updates

(cherry picked from commit af04c715433b88657cdaef0ce90ebfec87683322)

# Conflicts:
#	.github/workflows/linting.yml
---
 .github/workflows/cibuildwheel.yml    | 6 +++---
 .github/workflows/codeql-analysis.yml | 4 ++--
 .github/workflows/linting.yml         | 8 ++++++--
 .github/workflows/stale-tidy.yml      | 2 +-
 .github/workflows/stale.yml           | 2 +-
 .github/workflows/wasm.yml            | 2 +-
 .github/workflows/zizmor.yml          | 2 +-
 7 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/cibuildwheel.yml b/.github/workflows/cibuildwheel.yml
index f4614d2d6ce7..abe675bc3e07 100644
--- a/.github/workflows/cibuildwheel.yml
+++ b/.github/workflows/cibuildwheel.yml
@@ -125,7 +125,7 @@ jobs:
         run: Remove-Item -Recurse C:\Strawberry
 
       - name: Build wheels for CPython 3.14
-        uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c  # v4.1.1
+        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
         with:
           package-dir: dist/${{ needs.build_sdist.outputs.SDIST_NAME }}
         env:
@@ -133,7 +133,7 @@ jobs:
           CIBW_ARCHS: ${{ matrix.cibw_archs }}
 
       - name: Build wheels for CPython 3.13
-        uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c  # v4.1.1
+        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
         with:
           package-dir: dist/${{ needs.build_sdist.outputs.SDIST_NAME }}
         env:
@@ -141,7 +141,7 @@ jobs:
           CIBW_ARCHS: ${{ matrix.cibw_archs }}
 
       - name: Build wheels for CPython 3.12
-        uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c  # v4.1.1
+        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
         with:
           package-dir: dist/${{ needs.build_sdist.outputs.SDIST_NAME }}
         env:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d07566f963f7..dc0c1e8c8217 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
         with:
           languages: ${{ matrix.language }}
 
@@ -45,4 +45,4 @@ jobs:
           pip install --user -v .
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
index f93b5b2a2c91..6656783a9cce 100644
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -15,9 +15,13 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: j178/prek-action@5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16  # v2.0.6
+      - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece  # v3.0.0
         with:
-          extra-args: --hook-stage manual --all-files
+          extra-args: --hook-stage manual --all-files --skip oxipng
+      # Only run oxipng on the last diff, because we haven't updated all images.
+      - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece  # v3.0.0
+        with:
+          extra-args: --hook-stage manual --from-ref origin/${{ github.base_ref }} oxipng
 
   ruff:
     name: ruff
diff --git a/.github/workflows/stale-tidy.yml b/.github/workflows/stale-tidy.yml
index c4e8ab51398f..2a017da26e4a 100644
--- a/.github/workflows/stale-tidy.yml
+++ b/.github/workflows/stale-tidy.yml
@@ -13,7 +13,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629  # v10.4.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93  # v11.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           operations-per-run: 300
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 87e293636564..61603aeeb296 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -14,7 +14,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629  # v10.4.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93  # v11.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           operations-per-run: 20
diff --git a/.github/workflows/wasm.yml b/.github/workflows/wasm.yml
index 14c1684dd345..d6bfe7bf8845 100644
--- a/.github/workflows/wasm.yml
+++ b/.github/workflows/wasm.yml
@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
 
       - name: Build wheels for wasm
-        uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c  # v4.1.1
+        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
         env:
           CIBW_PLATFORM: "pyodide"
           CIBW_TEST_COMMAND: "true"
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index e66b441b8e43..62d4c1d0e9da 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -27,4 +27,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5  # v0.6.1
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054  # v0.6.2

From f3f3a8b319a1b74766077fff7188dc049467bb1e Mon Sep 17 00:00:00 2001
From: Tim Hoffmann <2836374+timhoffm@users.noreply.github.com>
Date: Sat, 29 Aug 2026 07:44:28 +0200
Subject: [PATCH 2/6] Merge pull request #32255 from
 matplotlib/dependabot/github_actions/actions-b632086d0b

Bump the actions group with 2 updates

(cherry picked from commit 17552e2153dc2458dea217037c7b0db01b7736ab)
---
 .github/workflows/codeql-analysis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index dc0c1e8c8217..2e10a35da3f1 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           languages: ${{ matrix.language }}
 
@@ -45,4 +45,4 @@ jobs:
           pip install --user -v .
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8

From 222329374441e62a6df9f975061f22428c2e08d4 Mon Sep 17 00:00:00 2001
From: Tim Hoffmann <2836374+timhoffm@users.noreply.github.com>
Date: Sat, 5 Sep 2026 08:50:23 +0200
Subject: [PATCH 3/6] Merge pull request #32294 from
 matplotlib/dependabot/github_actions/actions-f1ba23a83b

Bump the actions group with 2 updates

(cherry picked from commit f3877c54e25baefc2605d6260cb7ef44b5edbb12)
---
 .github/workflows/codeql-analysis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 2e10a35da3f1..430d0aae75c5 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
 
@@ -45,4 +45,4 @@ jobs:
           pip install --user -v .
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9

From 6b519785ad4e6b498e0ee0f3d71ddd43a38e7a84 Mon Sep 17 00:00:00 2001
From: Ricci Adams <git@ricciadams.com>
Date: Sun, 13 Sep 2026 13:10:18 -0700
Subject: [PATCH 4/6] Backport PR #32294: Bump the actions group with 2 updates

---
 .github/workflows/nightlies.yml | 2 +-
 .github/workflows/zizmor.yml    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/nightlies.yml b/.github/workflows/nightlies.yml
index 47d1de50781c..8e8958a961ed 100644
--- a/.github/workflows/nightlies.yml
+++ b/.github/workflows/nightlies.yml
@@ -60,7 +60,7 @@ jobs:
           ls -l dist/
 
       - name: Upload wheels to Anaconda Cloud as nightlies
-        uses: scientific-python/upload-nightly-action@e76cfec8a4611fd02808a801b0ff5a7d7c1b2d99  # 0.6.4
+        uses: scientific-python/upload-nightly-action@16fa02eacee1655195143de09f03676e60ef2bf5  # 0.6.5
         with:
           artifacts_path: dist
           anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 62d4c1d0e9da..853bef83e04a 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -27,4 +27,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054  # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99  # v0.6.3

From 10c9179ca87f4df409712e1f2fa5f77777bf94a9 Mon Sep 17 00:00:00 2001
From: Ricci Adams <git@ricciadams.com>
Date: Sun, 13 Sep 2026 13:23:47 -0700
Subject: [PATCH 5/6] Remove references to oxipng

Two roads diverged in a merge conflict and I took the wrong one.
---
 .github/workflows/linting.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
index 6656783a9cce..a133ff25ca3a 100644
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -17,11 +17,7 @@ jobs:
           persist-credentials: false
       - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece  # v3.0.0
         with:
-          extra-args: --hook-stage manual --all-files --skip oxipng
-      # Only run oxipng on the last diff, because we haven't updated all images.
-      - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece  # v3.0.0
-        with:
-          extra-args: --hook-stage manual --from-ref origin/${{ github.base_ref }} oxipng
+          extra-args: --hook-stage manual --all-files
 
   ruff:
     name: ruff

From febbd83d78d9368ce09055ed848477c421a93fdd Mon Sep 17 00:00:00 2001
From: Elliott Sales de Andrade <quantum.analyst@gmail.com>
Date: Thu, 10 Sep 2026 15:46:54 -0400
Subject: [PATCH 6/6] ci: Skip Python 3.15 for Pyodide builds

It seems Pyodide no longer ships its own wheels for Python 3.15,
presumably because PyPI now supports WASM wheels and it's expected for
upstreams to release them.

Unfortunately, our upstreams (at least contourpy and kiwisolver) don't
yet have those wheels, so our wasm build fails and we haven't been
uploading nightlies for the past few days.
---
 .github/workflows/wasm.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/wasm.yml b/.github/workflows/wasm.yml
index d6bfe7bf8845..4400d36f76ae 100644
--- a/.github/workflows/wasm.yml
+++ b/.github/workflows/wasm.yml
@@ -47,6 +47,7 @@ jobs:
       - name: Build wheels for wasm
         uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
         env:
+          CIBW_SKIP: "cp315-*"
           CIBW_PLATFORM: "pyodide"
           CIBW_TEST_COMMAND: "true"