chore(deps): update pypa/gh-action-pypi-publish action to v1.8.8

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
pypa/gh-action-pypi-publish	action	patch	v1.8.5 -> v1.8.8

---

Release Notes

pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)

v1.8.8

Compare Source

💅 Cosmetic output improvements

• In https://github.com/pypa/gh-action-pypi-publish/pull/167, @​woodruffw introduced a nudge-warning encouraging people to start using secretless publishing to PyPI, as suggested by @​sethmlarson in https://github.com/pypa/gh-action-pypi-publish/issues/164, collaborating with @​di.

  💡 Tip: The OIDC-based trusted publishing integration details can be found in the action README at https://github.com/marketplace/actions/pypi-publish#trusted-publishing and on the PyPI docs page at https://docs.pypi.org/trusted-publishers/. It's gone GA on April 20, 2023, during PyCon: https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/. And the Trail Of Bits blog post has some deeper explanation here: https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/.

🛠️ Internal dependencies

• @​pquentin bumped the runtime dependency pins to the recent versions @&#https://github.com/pypa/gh-action-pypi-publish/pull/168ll/168.

💪 New Contributors

• @​pquentin made their first contribution in https://github.com/pypa/gh-action-pypi-publish/pull/168

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.8.7...v1.8.8

v1.8.7

Compare Source

💅 Cosmetic output impovements

• @​woodruffw fixed OIDC the multiline annotations by escaping LF through urlencoding it in https://github.com/pypa/gh-action-pypi-publish/pull/156.
• @​jaap3 noticed and promptly removed extraneous } from a non-OIDC log annotation in https://github.com/pypa/gh-action-pypi-publish/pull/161.
• @​hugovk made pip ignore that it runs under the root user and suppress its warning output in https://github.com/pypa/gh-action-pypi-publish/pull/159.

🛠️ Internal dependencies

• Cryptography was bumped from 39.0.1 to 41.0.0 @&#https://github.com/pypa/gh-action-pypi-publish/pull/160ll/160
• Requests was bumped from 2.28.1 to 2.31.0 @&#https://github.com/pypa/gh-action-pypi-publish/pull/157ll/157

💪 New Contributors

• @​jaap3 made their first contribution in https://github.com/pypa/gh-action-pypi-publish/pull/161

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.8.6...v1.8.7

v1.8.6

Compare Source

What's Updated

• @​woodruffw dropped the references to a “private beta” from the project docs and runtime in https://github.com/pypa/gh-action-pypi-publish/pull/147. He also clarified that the API tokens are still more secure than passwords in https://github.com/pypa/gh-action-pypi-publish/pull/150.
• @​asherf noticed that the action metadata incorrectly marked the password field as required and contributed a correction in https://github.com/pypa/gh-action-pypi-publish/pull/151
• @​webknjaz moved the Trusted Publishing example to the top of the README in hopes that new users would default to using it via pypa/gh-action-pypi-publish@f47b347

New Contributors

• @​asherf made their first contribution in https://github.com/pypa/gh-action-pypi-publish/pull/151

Full Diff: pypa/gh-action-pypi-publish@v1.8.5...v1.8.6

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.