stvoutsin · May 20, 2026 · Apr 2, 2026 · Apr 2, 2026 · Apr 2, 2026 · Mar 31, 2026
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -56,6 +56,7 @@ docs/time                   @taldcroft
 docs/visualization          @astrofrog      @larrybradley
 docs/wcs                    @mcara
 
+scripts/*                   @neutrinoceros
 pyproject.toml              @neutrinoceros
 setup.py                    @neutrinoceros
 MANIFEST.in                 @neutrinoceros

diff --git a/.github/labeler.yml b/.github/labeler.yml
@@ -1,3 +1,8 @@
+dependencies:
+- any:
+  - head-branch:
+    - '^update-astropy-iers-data-pin-\d+$'
+
 Docs:
 - changed-files:
   - any-glob-to-any-file:

diff --git a/.github/workflows/check_milestone.yml b/.github/workflows/check_milestone.yml
@@ -16,7 +16,7 @@ jobs:
   milestone_checker:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+    - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
       if: github.repository == 'astropy/astropy'
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}

diff --git a/.github/workflows/ci_benchmark.yml b/.github/workflows/ci_benchmark.yml
@@ -54,7 +54,7 @@ jobs:
           ccache -z
 
       - name: "Restore ccache"
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306  # v5.0.3
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
         with:
           path: .ccache
           key: ccache-${{ secrets.CACHE_VERSION }}-${{ steps.prepare-ccache.outputs.key }}-${{ steps.prepare-ccache.outputs.timestamp }}
@@ -93,7 +93,7 @@ jobs:
         run: ccache -s
         if: always()
 
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         if: always()
         with:
           name: asv-benchmark-results

diff --git a/.github/workflows/ci_workflows.yml b/.github/workflows/ci_workflows.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check base branch
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
       if: github.event_name == 'pull_request' && github.repository == 'astropy/astropy'
       with:
         script: |
@@ -54,11 +54,11 @@ jobs:
       contents: none
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c  # v6.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         name: Install Python
         with:
           python-version: "3.14"
@@ -69,7 +69,7 @@ jobs:
 
   tests:
     needs: [initial_checks]
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@99401c364fa51c9c507d3cd6d272049278ac0b2c  # v2.4.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@2835f0cacddf3f8de198db9afdb5354a5cebe0ef  # v2.6.3
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     with:
@@ -137,7 +137,7 @@ jobs:
 
   allowed_failures:
     needs: [initial_checks]
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@99401c364fa51c9c507d3cd6d272049278ac0b2c  # v2.4.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@2835f0cacddf3f8de198db9afdb5354a5cebe0ef  # v2.6.3
     with:
       setenv: |
         ARCH_ON_CI: "normal"
@@ -150,13 +150,13 @@ jobs:
           - language-pack-de
           - tzdata
       envs: |
-        - name: (Allowed Failure) Python 3.13 with remote data and dev version of key dependencies
-          linux: py313-test-devdeps
+        - name: (Allowed Failure) Python 3.14 with remote data and dev version of key dependencies
+          linux: py314-test-devdeps
           posargs: --remote-data=any --verbose
 
   stub_tests:
     needs: [initial_checks]
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@99401c364fa51c9c507d3cd6d272049278ac0b2c  # v2.4.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@2835f0cacddf3f8de198db9afdb5354a5cebe0ef  # v2.6.3
     with:
       setenv: |
         ARCH_ON_CI: "normal"
@@ -175,7 +175,7 @@ jobs:
     # This ensures that a couple of wheel targets work fine in pull requests and pushes
     permissions:
       contents: none
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish.yml@99401c364fa51c9c507d3cd6d272049278ac0b2c  # v2.4.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish.yml@2835f0cacddf3f8de198db9afdb5354a5cebe0ef  # v2.6.3
     with:
       upload_to_pypi: false
       upload_to_anaconda: false

diff --git a/.github/workflows/open_actions.yml b/.github/workflows/open_actions.yml
@@ -4,6 +4,9 @@ on:
   issues:
     types:
     - opened
+  # pull_request_target is only dangerous if combined with an explicit checkout
+  # of the opener's code, which it isn't here. See
+  # https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
   pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
     - opened
@@ -23,7 +26,7 @@ jobs:
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
     - name: 'Reviewer Checklist'
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
       if: github.event_name == 'pull_request_target'
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -26,7 +26,7 @@ jobs:
     # or if triggered manually via the workflow dispatch, or for a tag.
     permissions:
       contents: none
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish.yml@a138926f6e4f9667d1306c24f24f5bdcaa01fbab # v2.5.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish.yml@2835f0cacddf3f8de198db9afdb5354a5cebe0ef # v2.6.3
     if: |
       github.repository == 'astropy/astropy' && (
         startsWith(github.ref, 'refs/tags/v') ||
@@ -85,10 +85,10 @@ jobs:
       id-token: write
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           merge-multiple: true
           pattern: dist-*
           path: dist
       - name: Upload to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
diff --git a/.github/workflows/sphinx_rc_workflows.yml b/.github/workflows/sphinx_rc_workflows.yml
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   tests:
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@99401c364fa51c9c507d3cd6d272049278ac0b2c  # v2.4.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@2835f0cacddf3f8de198db9afdb5354a5cebe0ef  # v2.6.3
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     with:

diff --git a/.github/workflows/update_astropy_iers_data_pin.yml b/.github/workflows/update_astropy_iers_data_pin.yml
@@ -26,7 +26,7 @@ jobs:
         persist-credentials: true # needed for git push
         fetch-depth: 0
     - name: Set up uv
-      uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
 
     # we take advantage of uv add's ability to set a lower bound on a new dependency
     # by first removing it (simulating astropy-iers-data being "new") and re-adding it.

diff --git a/.github/workflows/update_credits.md b/.github/workflows/update_credits.md
@@ -0,0 +1,13 @@
+This is an automated update of the credits for the core package.
+
+Checklist:
+
+* [ ] Apply backport labels to any active backport branches
+* [ ] Check the resulting docs/credits.rst, and update the .mailmap file for any duplicates or missing names
+* [ ] If you update .mailmap, re-run:
+
+```
+python scripts/update-credits.py
+```
+
+and commit and push the changes to this branch.
diff --git a/.github/workflows/update_credits.yml b/.github/workflows/update_credits.yml
@@ -0,0 +1,64 @@
+# Regularly update the credits.rst file, to reduce maintenance burden at the time
+# of release. This will allow issues with the .mailmap issues to be spotted early.
+
+name: Auto-update credits
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'  # Weekly
+  pull_request:
+    paths:
+      - '.github/workflows/update_credits.yml'
+      - '.github/workflows/update_credits.md'
+      - 'scripts/update-credits.py'
+      - 'docs/credits.rst'
+      - '.mailmap'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+
+  update-credits:
+    permissions:
+      contents: write  # to create a branch
+      pull-requests: write  # to create a PR
+    name: Auto-update credits
+    runs-on: ubuntu-latest
+    if: github.repository == 'astropy/astropy' || github.event_name == 'pull_request'
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      with:
+        persist-credentials: true  # needed for git push
+        fetch-depth: 0
+    - name: Set up Python
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+      with:
+        python-version: 3.x
+    - name: Run update script
+      run: pipx run scripts/update-credits.py
+    - name: Show diff
+      run: git diff docs/credits.rst
+    - name: Commit changes
+      if: github.event_name != 'pull_request'
+      run: |
+        git config user.name github-actions
+        git config user.email [email protected]
+        BRANCH_NAME=update-credits-$(date +"%s")
+        git switch -c "$BRANCH_NAME"
+        git add docs/credits.rst
+        if ! git diff --cached --exit-code; then
+          git commit -m "Update docs/credits.rst with new contributors"
+        fi
+        git push --set-upstream origin "$BRANCH_NAME"
+    - name: Create Pull Request
+      if: github.event_name != 'pull_request'
+      run: |
+        gh pr create \
+          --title "Update credits to add new contributors" \
+          --label no-changelog-entry-needed --label Docs \
+          --body-file .github/workflows/update_credits.md
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}