Merge branch 'stable'

diff --cc .github/workflows/publish.yaml
index 4463e6580a5bd7f818e523983272b38a3435cf36,8840bf6ef8ddaaa6f91b631a139a32b3e95e89e1..eb5c6a5a55bca0f0ca3aab785a8e217f224cea46
--- 1/.github/workflows/publish.yaml
--- 2/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@@ -5,37 -6,22 +5,22 @@@ on
  jobs:
    build:
      runs-on: ubuntu-latest
-     outputs:
-       hash: ${{ steps.hash.outputs.hash }}
      steps:
        - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 -      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
 +      - uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6.1.0
          with:
 -          python-version: '3.x'
 -          cache: pip
 -          cache-dependency-path: requirements*/*.txt
 -      - run: pip install -r requirements/build.txt
 -      # Use the commit date instead of the current date during the build.
 +          enable-cache: true
 +          prune-cache: false
 +      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
 +        with:
 +          python-version-file: pyproject.toml
        - run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
 -      - run: python -m build
 -      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
 +      - run: uv build
-       - name: generate hash
-         id: hash
-         run: cd dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
 +      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
          with:
            path: ./dist
-   provenance:
-     needs: [build]
-     permissions:
-       actions: read
-       id-token: write
-       contents: write
-     # Can't pin with hash due to how this workflow works.
-     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
-     with:
-       base64-subjects: ${{ needs.build.outputs.hash }}
    create-release:
-     needs: [provenance]
+     needs: [build]
      runs-on: ubuntu-latest
      permissions:
        contents: write
@@@ -49,7 -34,9 +33,7 @@@
          env:
            GH_TOKEN: ${{ github.token }}
    publish-pypi:
-     needs: [provenance]
+     needs: [build]
 -    # Wait for approval before attempting to upload to PyPI. This allows reviewing the
 -    # files in the draft release.
      environment:
        name: publish
        url: https://pypi.org/project/Jinja2/${{ github.ref_name }}