Update pyqasm requirement from <1.1.0,>=1.0.4 to >=1.0.4,<1.3.0

[dependabot]

Updates the requirements on pyqasm to permit the latest version.

Release notes

Sourced from pyqasm's releases.

PyQASM 1.2.0

Release 1.2.0 (August 27, 2026)

Summary

Fixed

• Fixed pyqasm validate wrapping its diagnostics at the console width, which split a file path longer than the width across lines mid-token and left it neither copyable nor clickable. The error console now uses soft_wrap, keeping one diagnostic per line.
• Fixed an indirect cycle between gate definitions exhausting the Python stack: gate a q { b q; } with gate b q { a q; } raised a bare RecursionError naming nothing, while the direct case was already reported cleanly. The guard compared the body's gate name against one name, so it saw only a cycle of length one. It now tests membership of the whole expansion chain, and names the path: Recursive definitions not allowed for gate 'a' (a -> b -> a). A gate reached twice down separate paths is a diamond, not a cycle, and still expands. (#369)
• Fixed a nested external custom gate counting the depth of the decomposition it skipped, the shape the #352 fix did not reach: unroll(external_gates=["outer"]) on a gate whose body calls another custom gate emitted one statement but reported depth() == 13. The suppression flag was assigned and cleared without save-restore, so the inner gate clobbered the outer gate's state in both directions. It is now saved and restored, and the depth is recorded once, from the outermost external gate. (#367)

Other

• Added an OpenSSF Scorecard workflow. It grades the repository's supply-chain practices and publishes the score to the public Scorecard API, so a third party computes the number rather than us. (#412)
• Switched PyPI publishing from a long-lived PYPI_API_TOKEN repository secret to trusted publishing. The publish job now mints a short-lived OIDC credential scoped to that one workflow, and the action attaches PEP 740 attestations recording the repository, workflow and commit SHA behind each uploaded file. Attestations apply to releases published after this merges, not retroactively. (#411)
• Fixed the pre-release build stamping a version that pyqasm.__version__ and the package metadata spelled differently. pre_build.sh wrote 1.1.0-a.0 into pyproject.toml, setuptools normalized that to 1.1.0a0 for the metadata, and _version.py kept the raw string, so pip show pyqasm and pyqasm.__version__ disagreed and test_sdist.sh failed its version check. The stamped version is now normalized to PEP 440 before it is written. (#414)
• Fixed the pre-release workflow publishing its source distribution under the released version instead of the pre-release one. build_sdist.sh ran git reset --hard and git clean -xdf, which discarded the pyproject.toml version that the preceding step had just stamped, so a run that built 1.1.0a0 wheels built a 1.1.0 sdist and PyPI rejected it as a duplicate. pre_build.sh already resets the tree, so the second reset is gone. It also no longer destroys uncommitted work when the script is run locally. (#413)
• Added a SECURITY.md with a private vulnerability disclosure path. There was no documented way to report one, leaving a public issue or a guessed email address as the only options. Reports now go through this repository's GitHub security advisory form. (#383)

Full Changelog: qBraid/pyqasm@v1.1.0...v1.2.0

Commits

• 79f4f72 Bump minor version to 1.2.0 (#420)
• 09175f7 ci: add OpenSSF Scorecard workflow (#412)
• 087b797 ci: publish to PyPI via trusted publishing instead of an API token (#411)
• 5313d03 ci: normalize the stamped pre-release version to PEP 440 (#414)
• aa87d96 ci: keep the pre-release version in the sdist build (#413)
• 9d278a0 Keep pyqasm validate diagnostics on one line (#405)
• a69bfcd Add SECURITY.md with a private vulnerability disclosure path (#383)
• d5b40bb Remove statements from args docstring on QasmModule (#381)
• 3664615 Fix while_loop hint, update pragma hint (#371)
• 426181e fix: nested external gate depth, and gate definition cycles of any length (#375)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)