Merge pull request #638 from EMMC-ASBL/dependabot/github_actions/master/actions/download-artifact-6

Bump actions/download-artifact from 5 to 6

Group GH Action updates from dependabot.

Temporarily use pip<25.3 for the pip-audit CI job.
This is due to a compatbility issue between the latest pip-tools
and pip 25.3+.

Author: CasperWA

.github/dependabot.yml

@@ -36,3 +36,7 @@ updates:
   labels:
     - CI/CD
     - skip-changelog
+  groups:
+    github-actions:
+      patterns:
+        - "*"

.github/workflows/cd_release.yml

@@ -54,7 +54,7 @@ jobs:
 
     steps:
       - name: Download distribution
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: dist  # The artifact will always be called 'dist'
           path: dist

.github/workflows/ci_tests.yml

@@ -75,6 +75,9 @@ jobs:
         pip install -U setuptools wheel
         pip install -U -r .github/utils/requirements_audit.txt
 
+        # TEMPORARY: Install pip<25.3 to avoid issues with pip-compile and pip 25.3+
+        pip install "pip<25.3"
+
     - name: Create requirements.txt for pip-audit
       run: pip-compile --output-file="${{ runner.temp }}/requirements.txt" --all-extras --verbose --color "${{ github.workspace }}/pyproject.toml"