build(pins): actually bump llvm-mingw to 20260922 in windows.Dockerfile

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.5] - 2026-10-05
+
 ### Changed
 - **llvm-mingw `20260908` -> `20260922`** (`docker/windows.Dockerfile`), the pin [0046]'s weekly checker reported behind. sha256 recomputed from the real tarball; still unpacks to a single top-level directory (`tar tJf`).
 - **emsdk `6.0.9`/`f04ea239` -> `6.0.11`/`f6264d4a`** (`docker/webassembly.Dockerfile`), the pin [0046]'s weekly checker reported behind. sha256 recomputed from the real tarball; layout re-checked with `tar tJf` (still a top-level `install/` with `bin/`).
@@ -1712,7 +1714,8 @@ ballistics-lab/micropython-native-ci, but both tags exist here too, so every
 link resolves inside this repository -- the version line continues rather
 than restarting (see the 0.3.0a1 entry). -->
 
-[Unreleased]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.4...HEAD
+[Unreleased]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.5...HEAD
+[0.7.5]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.4...v0.7.5
 [0.7.4]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.3...v0.7.4
 [0.7.3]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.2...v0.7.3
 [0.7.2]: https://github.com/ballistics-lab/cibuildmp/compare/v0.7.1...v0.7.2

README.md

@@ -125,7 +125,7 @@ On CI, use the action instead of installing the CLI yourself — it already
 runs on a bare runner with the runner's own Docker daemon reachable:
 
 ```yaml
-- uses: ballistics-lab/cibuildmp@v0.7.4
+- uses: ballistics-lab/cibuildmp@v0.7.5
   with:
     build: "mpy6.3-* v1.29.0-manylinux_2_28_x86_64"
 ```
@@ -144,7 +144,7 @@ newest:
     path: ~/.cache/cibuildmp
     key: cibuildmp-${{ runner.os }}
     restore-keys: cibuildmp-${{ runner.os }}
-- uses: ballistics-lab/cibuildmp@v0.7.4
+- uses: ballistics-lab/cibuildmp@v0.7.5
   with:
     build: "mpy6.3-* v1.29.0-manylinux_2_28_x86_64"
 ```
@@ -203,7 +203,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ballistics-lab/cibuildmp@v0.7.4
+      - uses: ballistics-lab/cibuildmp@v0.7.5
         with:
           build: "mpy6.3-v1.29.0-*"
       - uses: actions/upload-artifact@v4

docker/windows.Dockerfile

@@ -92,22 +92,22 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     g++-mingw-w64-i686 \
     && rm -rf /var/lib/apt/lists/*
 
-# llvm-mingw 20260908, linux-x64. **Nothing else to keep this in step
+# llvm-mingw 20260922, linux-x64. **Nothing else to keep this in step
 # with** -- this line used to say "pinned to resources/usermod.toml's own
 # [llvm-mingw] table", which contradicted the "pin of record" paragraph
 # above it: [0092] deleted that file, and usermod/llvmmingw.py with its
 # `sole_directory()` call went with [0050]/[0042]. The version, URL and
 # sha256 right here are the whole pin.
 #
 # The tarball still unpacks to a single
-# `llvm-mingw-20260908-ucrt-ubuntu-22.04-x86_64/` directory -- re-checked
+# `llvm-mingw-20260922-ucrt-ubuntu-22.04-x86_64/` directory -- re-checked
 # with `tar tJf` at this version, not carried over from the last one, and
 # so were the four `<arch>-w64-mingw32-` bin/ prefixes build_windows.py
 # drives. --strip-components=1 flattens that away so the install prefix is
 # a stable /opt/llvm-mingw regardless of the version in the name.
 RUN curl -fsSL -o /tmp/llvm-mingw.tar.xz \
-      https://github.com/mstorsjo/llvm-mingw/releases/download/20260908/llvm-mingw-20260908-ucrt-ubuntu-22.04-x86_64.tar.xz && \
-    echo "2258c745e3155870c80793f3e8c80b28fbde11b9ff73c4c78783635b3440b092  /tmp/llvm-mingw.tar.xz" | sha256sum -c - && \
+      https://github.com/mstorsjo/llvm-mingw/releases/download/20260922/llvm-mingw-20260922-ucrt-ubuntu-22.04-x86_64.tar.xz && \
+    echo "bb7bb7654b33d5aa8712acb837c963b2e0c56352560c76105270a3268c665c21  /tmp/llvm-mingw.tar.xz" | sha256sum -c - && \
     mkdir -p /opt/llvm-mingw && \
     tar -xJf /tmp/llvm-mingw.tar.xz -C /opt/llvm-mingw --strip-components=1 && \
     rm /tmp/llvm-mingw.tar.xz

docs/ACTIONS.md

@@ -300,11 +300,11 @@ jobs:
         with:
           submodules: recursive
 
-      - uses: ballistics-lab/cibuildmp/.github/actions/fetch-micropython@v0.7.4
+      - uses: ballistics-lab/cibuildmp/.github/actions/fetch-micropython@v0.7.5
         with:
           mpy_tag: v1.29.0
 
-      - uses: ballistics-lab/cibuildmp/.github/actions/build-natmod@v0.7.4
+      - uses: ballistics-lab/cibuildmp/.github/actions/build-natmod@v0.7.5
         with:
           arch: ${{ matrix.arch }}
           # natmod_dir: natmod              # default; a7p passes micropython/natmod

src/cibuildmp/resources/pinned_docker_images.toml

@@ -211,7 +211,7 @@ manylinux_2_41_mipsel = "ghcr.io/ballistics-lab/manylinux_2_41_mipsel@sha256:cda
 # `dockerrun.py`, since it is a property of the image rather than of any
 # build target) is what lets them run on an arm64 host at all -- emulated,
 # instead of failing with `exec format error`.
-windows = "ghcr.io/ballistics-lab/windows@sha256:ffd88f1a33dd79ba338b0ecaecfdb60f755c3e7192958232cbe9c712a8ea20a6"
+windows = "ghcr.io/ballistics-lab/windows@sha256:5b999b70457633a6a5639e8e42068d5ee4b58c8ea59d56734a83bc30364678f7"
 webassembly = "ghcr.io/ballistics-lab/webassembly@sha256:452dd18eb34a70be198ec7bc962c9585b1838280181a618baeb332459a27e373"
 
 # ── the five toolchain-group images (record 0058, thinned by 0096) ─────