ci: bump pypa/cibuildwheel from 4.3.0 to 4.3.5 - #50

Sourced from pypa/cibuildwheel's releases.

v4.3.5

• 🐛 Stops passing the target build environment to the host virtualenv call, regression in v4.3.4 (#3023)
• 🛠 Updates dependencies and constraints (pyodide-build 0.39.3, CPython 3.15.2, etc) (#3024, #3027)
• 💼 Updates CI actions (#3025)

v4.3.4

• 🔐 Warns when a uv build frontend is selected and the host uv is older than 0.13.4, which still trusts the compromised eMudhra CA roots (#3021)
• 🔐 Uses cibuildwheel's CA bundle for pip on Python 3.9, where pip uses its bundled certifi, which still trusts the compromised eMudhra roots (#3017)
• 🔐 Uses cibuildwheel's CA bundle for pip on GraalPy, where truststore is not supported (#3019)
• 🔐 Uses cibuildwheel's CA bundle in Android, iOS, and Pyodide cross venvs, where pip uses the host's OpenSSL CA file (#3020)
• 🐛 Seeds build's isolated environment with the pinned pip on macOS and Windows, fixing GraalPy 25.0 builds (#3018)
• 💼 Stops Azure cache growth from restoreKeys (#3022)

v4.3.3

• 🔐 Updates manylinux images and pip to fix vulnerability to eMudhra.

v4.3.2

• 🔐 Updates our dependency pins to certifi==2026.10.19, following the eMudhra Intermediate CA Compromise. Linux builds may still be vulnerable through manylinux images - a patch release will soon follow if so.

v4.3.1

• 🛠 Updates CPython 3.15 to the final 3.15.0 release (#3009)

Sourced from pypa/cibuildwheel's changelog.

v4.3.5

27 October 2026

• 🐛 Stops passing the target build environment to the host virtualenv call, regression in v4.3.4 (#3023)
• 🛠 Updates dependencies and constraints (pyodide-build 0.39.3, CPython 3.15.2, etc) (#3024, #3027)
• 💼 Updates CI actions (#3025)

v4.3.4

22 October 2026

• 🔐 Warns when a uv build frontend is selected and the host uv is older than 0.13.4, which still trusts the compromised eMudhra CA roots (#3021)
• 🔐 Uses cibuildwheel's CA bundle for pip on Python 3.9, where pip uses its bundled certifi, which still trusts the compromised eMudhra roots (#3017)
• 🔐 Uses cibuildwheel's CA bundle for pip on GraalPy, where truststore is not supported (#3019)
• 🔐 Uses cibuildwheel's CA bundle in Android, iOS, and Pyodide cross venvs, where pip uses the host's OpenSSL CA file (#3020)
• 🐛 Seeds build's isolated environment with the pinned pip on macOS and Windows, fixing GraalPy 25.0 builds (#3018)
• 💼 Stops Azure cache growth from restoreKeys (#3022)

v4.3.3

21 October 2026

• 🔐 Updates manylinux images and pip to fix vulnerability to eMudhra.

v4.3.2

20 October 2026

• 🔐 Updates our dependency pins to certifi==2026.10.19, following the eMudhra Intermediate CA Compromise. Linux builds may still be vulnerable through manylinux images - a patch release will soon follow if so.

v4.3.1

10 October 2026

• 🛠 Updates CPython 3.15 to the final 3.15.0 release (#3009)

• f9b966c Bump version: v4.3.5
• 7e3caea Update constraints (#3027)
• dff3913 chore(deps): bump the actions group with 2 updates (#3025)
• 2956993 fix: do not pass target environment to the host virtualenv call (#3023)
• 5d621c9 [Bot] Update dependencies (#3024)
• b9e566a Bump version: v4.3.4
• 0d511ac fix: use cibuildwheel's CA bundle in cross venvs (#3020)
• d6c9b11 feat: warn when uv is too old to have the eMudhra CA fix (#3021)
• 4463120 fix: seed build's isolated env with the pinned pip (#3018)
• 6d4911a fix: use cibuildwheel's CA bundle for pip on GraalPy (#3019)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)