Bump conda-incubator/setup-miniconda from 3.3.0 to 4.1.0 in /.github/workflows

[dependabot]

Bumps conda-incubator/setup-miniconda from 3.3.0 to 4.1.0.

Release notes

Sourced from conda-incubator/setup-miniconda's releases.

Version 4.1.0

What's Changed

Features and Enhancements

• #567[567]: Add Miniforge support for linux-riscv64

Fixes

• #539539: Look up the tool cache by tool name to fix Miniconda3 cache misses

Tasks and Maintenance

• #507507: Harden GitHub Actions workflows and add zizmor scanning
• #508508: Bump vite to 8.0.14 to resolve security advisories
• #513513: Centralize test action-input fixtures in a shared helper
• #541541, #551551: Bump codecov/codecov-action from 6 to 7
• #544544: Bump vite in the npm_and_yarn group
• #545545, #552552, #561561: Bump actions/checkout from 6.0.2 to 7.0.1
• #546546, #556556, #566[566]: Bump js-yaml from 4.1.1 to 5.2.3
• #547547: Bump semver from 7.7.4 to 7.8.5
• #549549, #558558, #572[572], #575[575]: Bump the npm_and_yarn group (linkify-it, postcss, undici, brace-expansion, @​vitest/mocker, @​vitest/coverage-v8)
• #550550, #557557: Bump marocchino/sticky-pull-request-comment from 3.0.3 to 3.0.5
• #553553: Bump actions/cache from 5.0.5 to 6.1.0
• #554554, #560560, #565[565], #574[574]: Bump zizmorcore/zizmor-action from 0.5.6 to 0.6.3
• #562[562]: Bump actions/setup-node from 6.4.0 to 7.0.0
• #573[573]: Bump actions/deploy-pages from 5.0.0 to 5.0.1

... (truncated)

Changelog

Sourced from conda-incubator/setup-miniconda's changelog.

CHANGELOG

v4.1.0 (2026-09-16)

Features and Enhancements

• #567[567]: Add Miniforge support for linux-riscv64

Fixes

• #539539: Look up the tool cache by tool name to fix Miniconda3 cache misses

Tasks and Maintenance

• #507507: Harden GitHub Actions workflows and add zizmor scanning
• #508508: Bump vite to 8.0.14 to resolve security advisories
• #513513: Centralize test action-input fixtures in a shared helper
• #541541, #551551: Bump codecov/codecov-action from 6 to 7
• #544544: Bump vite in the npm_and_yarn group
• #545545, #552552, #561[561]: Bump actions/checkout from 6.0.2 to 7.0.1
• #546546, #556[556], #566[566]: Bump js-yaml from 4.1.1 to 5.2.3
• #547547: Bump semver from 7.7.4 to 7.8.5
• #549549, #558[558], #572[572], #575[575]: Bump the npm_and_yarn group (linkify-it, postcss, undici, brace-expansion, @​vitest/mocker, @​vitest/coverage-v8)
• #550550, #557[557]: Bump marocchino/sticky-pull-request-comment from 3.0.3 to 3.0.5
• #553553: Bump actions/cache from 5.0.5 to 6.1.0
• #554[554], #560[560], #565[565], #574[574]: Bump zizmorcore/zizmor-action from 0.5.6 to 0.6.3
• #562[562]: Bump actions/setup-node from 6.4.0 to 7.0.0
• #573[573]: Bump actions/deploy-pages from 5.0.0 to 5.0.1

... (truncated)

Commits

• be893c9 Prepare v4.1.0 release (#576)
• c7e9df3 Bump @​vitest/mocker from 4.1.0 to 5.0.1 in the npm_and_yarn group across 1 di...
• c9e4d79 Bump the npm_and_yarn group across 1 directory with 4 updates (#572)
• 0ee587f Add miniforge for linux-riscv64 (#567)
• 8646c59 Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#574)
• cdd7904 Bump actions/deploy-pages from 5.0.0 to 5.0.1 (#573)
• 3770981 Bump js-yaml from 5.2.1 to 5.2.3 (#566)
• 049518b Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.2 (#565)
• 6dac52e Bump actions/setup-node from 6.4.0 to 7.0.0 (#562)
• e81fd62 Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 (#560)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

🟢 Approval recommended

The focused dependency update is consistent across all three workflow usages with no unresolved issues.

0 open findings

What changed in this PR

Updates the Miniconda setup action consistently across CI platforms.

Changes:

• Bumps setup-miniconda from v3.3.0 to v4.1.0.
• Pins all usages to the v4.1.0 commit SHA.

File	Description
.github/​workflows/​windows.yml	Updates the Windows CI action.
.github/​workflows/​macos.yml	Updates the macOS CI action.
.github/​workflows/​linux.yml	Updates the Linux CI action.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.