Bump exasol/python-toolbox from 8 to 10

[dependabot]

Bumps exasol/python-toolbox from 8 to 10.

Release notes

Sourced from exasol/python-toolbox's releases.

10.0.0 - 2026-06-23

Summary

In this major release, several modifications were made to the PTB's workflow templates and actions:

• the default DB-version was updated to come from BaseConfig instead of the hardcoded 7.1.9, so ITDE-related test flows use the configured Exasol baseline and unit-test help no longer advertises --db-version.

• the github_template_dict.custom_workflows entry now auto-detects secret names from custom workflow files and passes them into PTB-controlled workflow templates. For example:

  on:
    workflow_call:
      secrets:
        PYPI_TOKEN:
          required: true
        SONAR_TOKEN:
          required: true

• the Python environment GitHub action now accepts extras as a comma-separated list, which makes it easier to pass multiple optional dependency groups in one value. Additionally, it supports all-extras, so that all extras are installed without further specification needed.

• the new workflow:audit Nox session runs zizmor against GitHub Actions and reusable workflows, so security checks are part of the normal checks.yml pipeline instead of being a separate manual step. It also keeps the audit configuration in the project root via .zizmor.yml; see the zizmor configuration guide and the troubleshooting guide for findings for details on tuning or suppressing findings locally.

Security Issues

This release fixes vulnerabilities by updating dependencies:

Dependency	Vulnerability	Affected	Fixed in
cryptography	GHSA-537c-gmf6-5ccf	48.0.0	48.0.1
msgpack	GHSA-6v7p-g79w-8964	1.1.2	1.2.1

Feature

• #874: Added the security label to dependency update PR creation
• #699: Added all-extras support to the Python environment GitHub action
• #875: Added name attribute to generated workflow jobs using -extension.yml workflows

... (truncated)

Commits

• 54d437a Prepare release 10.4.0 (#932)
• 3959fa8 Fix formatting of list items in user guide (#931)
• d39df96 Add SPDX SBOM generation to build-and-publish workflow (#905)
• a259a63 Prepare release 10.3.0 (#928)
• 827ac61 Feature/922 make permissions configurable for custom workflows (#923)
• 3e14c0e Remove lint:dependencies usage from report.yml and add deprecation notice...
• 48b5172 Bugfix/920 ensure no duplicate secrets (#921)
• 095e09e Bugfix/898 improve code related to bug in dependency update (#915)
• 1196fc1 #909: Let CD extension workflow depend on successful PyPi release (#912)
• 454fa52 Update SECURITY.md (#908)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Superseded by #321.