[larsoner]

Bump to h5io 0.2.6 which just came out because <= 0.2.5 is a security risk, and thus takes priority over our SPEC0 standard.

I also enabled private vulnerability reporting in https://github.com/mne-tools/mne-python/settings/security_analysis so people can report that way instead of emailing if they want.

[drammock]

@larsoner CIs will fail until 0.2.6 hits conda-forge; move h5io from dependencies into pypi-dependencies table in the pixi.toml file if you don't want to wait for that

[larsoner]

Okay that should happen in an hour or two, will restart CIs then

[lumberbot-app]

Owee, I'm MrMeeseeks, Look at me.

There seem to be a conflict, please backport manually. Here are approximate instructions:
They assume that the base project is the Git remote upstream and your fork is origin.

1. Update backport branch.

git fetch upstream maint/1.13:maint/1.13
# or `git pull upstream maint/1.13` if you are on maint/1.13

2. Create PR branch.

git switch -c auto-backport-of-pr-14499-on-maint/1.13 maint/1.13

3. Cherry pick the first parent branch of this PR on top of the older branch:

git cherry-pick -x -m1 d7548ee6f8abd1df6a3fbf432079cd10a38102c3

4. You will likely have some merge/cherry-pick conflict here, fix them and commit:

git commit -am 'Backport PR #14499: Update h5io version for CVE'

5. Push to a named branch:

git push --set-upstream origin auto-backport-of-pr-14499-on-maint/1.13

6. Create a PR against branch maint/1.13, I would have named this PR:

Backport PR #14499 on branch maint/1.13 (Update h5io version for CVE)

And apply the correct labels and milestones.

Congratulations — you did some good work! Hopefully your backport PR will be tested by the continuous integration and merged soon!

Remember to remove the Still Needs Manual Backport label once the PR gets merged.

If these instructions are inaccurate, feel free to suggest an improvement.