Bump exasol/python-toolbox from 8 to 10

[dependabot]

Bumps exasol/python-toolbox from 8 to 10.

Release notes

Sourced from exasol/python-toolbox's releases.

10.0.0 - 2026-06-23

Summary

In this major release, several modifications were made to the PTB's workflow templates and actions:

• the default DB-version was updated to come from BaseConfig instead of the hardcoded 7.1.9, so ITDE-related test flows use the configured Exasol baseline and unit-test help no longer advertises --db-version.

• the github_template_dict.custom_workflows entry now auto-detects secret names from custom workflow files and passes them into PTB-controlled workflow templates. For example:

  on:
    workflow_call:
      secrets:
        PYPI_TOKEN:
          required: true
        SONAR_TOKEN:
          required: true

• the Python environment GitHub action now accepts extras as a comma-separated list, which makes it easier to pass multiple optional dependency groups in one value. Additionally, it supports all-extras, so that all extras are installed without further specification needed.

• the new workflow:audit Nox session runs zizmor against GitHub Actions and reusable workflows, so security checks are part of the normal checks.yml pipeline instead of being a separate manual step. It also keeps the audit configuration in the project root via .zizmor.yml; see the zizmor configuration guide and the troubleshooting guide for findings for details on tuning or suppressing findings locally.

Security Issues

This release fixes vulnerabilities by updating dependencies:

Dependency	Vulnerability	Affected	Fixed in
cryptography	GHSA-537c-gmf6-5ccf	48.0.0	48.0.1
msgpack	GHSA-6v7p-g79w-8964	1.1.2	1.2.1

Feature

• #874: Added the security label to dependency update PR creation
• #699: Added all-extras support to the Python environment GitHub action
• #875: Added name attribute to generated workflow jobs using -extension.yml workflows

... (truncated)

Commits

• 54d437a Prepare release 10.4.0 (#932)
• 3959fa8 Fix formatting of list items in user guide (#931)
• d39df96 Add SPDX SBOM generation to build-and-publish workflow (#905)
• a259a63 Prepare release 10.3.0 (#928)
• 827ac61 Feature/922 make permissions configurable for custom workflows (#923)
• 3e14c0e Remove lint:dependencies usage from report.yml and add deprecation notice...
• 48b5172 Bugfix/920 ensure no duplicate secrets (#921)
• 095e09e Bugfix/898 improve code related to bug in dependency update (#915)
• 1196fc1 #909: Let CD extension workflow depend on successful PyPi release (#912)
• 454fa52 Update SECURITY.md (#908)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)