2.3.18

2.3.18

Summary

• remove conversion-test from the CodeQL workflow
• switch PyPI publishing to Trusted Publishing and harden GHCR login handling
• add a 7-day uv dependency cooldown with PyTorch index packages exempted
• bump the package version to 2.3.18

Verification

• validated workflow YAML parsing after workflow changes
• regenerated uv.lock with the cooldown policy in place
• confirmed the PyPI workflow no longer references PYPI_API_TOKEN

What's Changed

• Harden release workflows and bump to 2.3.18 by @PINTO0309 in #923

Full Changelog: 2.3.17...2.3.18