chore(deps): bump the github-actions group with 11 updates

.github/workflows/benchmark-compare.yml

@@ -109,7 +109,7 @@ jobs:
 
       - name: Set up Rust
         if: ${{ inputs.language == 'rust' }}
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.rust_toolchain }}
 

.github/workflows/benchmark.yml

@@ -111,7 +111,7 @@ jobs:
 
       - name: Set up Rust
         if: ${{ inputs.language == 'rust' }}
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.rust_toolchain }}
 

.github/workflows/ci.yml

@@ -68,7 +68,7 @@ jobs:
           python-version: "3.13"
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # Stated, not inherited -- and it does change something. The pinned
@@ -124,7 +124,7 @@ jobs:
           python-version: "3.13"
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # Stated, not inherited -- and it does change something. The pinned
@@ -299,7 +299,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           enable-cache: false
@@ -396,7 +396,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           enable-cache: false

.github/workflows/coverage-gate.yml

@@ -103,7 +103,7 @@ jobs:
 
       - name: Upload to Codecov
         if: ${{ inputs.use_codecov }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
+        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4  # v7.1.0
         with:
           token: ${{ secrets.codecov_token }}
           files: ${{ inputs.files }}

.github/workflows/docs-quality.yml

@@ -75,7 +75,7 @@ jobs:
 
       - name: Spell check (typos)
         if: ${{ inputs.typos }}
-        uses: crate-ci/typos@4d9c206a77c041268485162b8e2579ad7a5cb9a3  # v1.50.0
+        uses: crate-ci/typos@d43b6c087ac471e2ea7b8af622ff15f05c0c365b  # v1.50.1
         with:
           files: ${{ inputs.typos_files }}
 

.github/workflows/fuzzing.yml

@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.rust_toolchain }}
 

.github/workflows/iac-scan.yml

@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkov
-        uses: bridgecrewio/checkov-action@f967808197a8d784d3e72919f38c3ff0cda7884e  # v12.3122.0
+        uses: bridgecrewio/checkov-action@a8664e3a0549367977f0cda990a34311835c87c0  # v12.3123.0
         with:
           directory: ${{ inputs.directory }}
           framework: ${{ inputs.framework }}

.github/workflows/java-ci.yml

@@ -64,7 +64,7 @@ jobs:
 
       - name: Set up Java
         if: ${{ !inputs.use_preinstalled_toolchain }}
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
         with:
           java-version: ${{ inputs.java_version }}
           distribution: ${{ inputs.distribution }}

.github/workflows/kotlin-android-ci.yml

@@ -74,7 +74,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
         with:
           java-version: ${{ inputs.java_version }}
           distribution: ${{ inputs.java_distribution }}

.github/workflows/maintenance.yml

@@ -82,7 +82,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # The sweep decides what maintenance debt exists; it must not

.github/workflows/mutation-testing.yml

@@ -80,7 +80,7 @@ jobs:
 
       - name: Set up Rust
         if: ${{ inputs.language == 'rust' }}
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.rust_toolchain }}
 

.github/workflows/nddev-security-bundle.yml

@@ -116,7 +116,7 @@ jobs:
             "$source_root/scripts/run_private_security_bundle.sh" >> "$GITHUB_ENV"
 
       - name: Set up pinned uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           enable-cache: false
@@ -169,7 +169,7 @@ jobs:
 
       - name: Upload zizmor SARIF
         if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }}
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif
           category: zizmor

.github/workflows/private-static.yml

@@ -110,7 +110,7 @@ jobs:
 
       - name: Set up uv
         if: ${{ inputs.setup_uv }}
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: ${{ inputs.uv_version }}
           # uv provisions our pinned tooling here, not the caller's

.github/workflows/public-codeql.yml

@@ -115,21 +115,21 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ inputs.config_file == '' }}
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           languages: ${{ matrix.language }}
           queries: ${{ inputs.queries }}
 
       - name: Initialize CodeQL with config
         if: ${{ inputs.config_file != '' }}
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ inputs.config_file }}
 
       - name: Autobuild
         if: ${{ inputs.autobuild && inputs.build_command == '' }}
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
 
       - name: Custom build
         if: ${{ inputs.build_command != '' }}
@@ -139,13 +139,13 @@ jobs:
 
       - name: Analyze
         if: ${{ inputs.output_directory == '' }}
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           category: "/language:${{ matrix.language }}"
 
       - name: Analyze with output directory
         if: ${{ inputs.output_directory != '' }}
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           category: "/language:${{ matrix.language }}"
           output: ${{ inputs.output_directory }}

.github/workflows/public-scorecard.yml

@@ -165,7 +165,7 @@ jobs:
       - name: Upload SARIF to code scanning
         id: upload-sarif
         if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }}
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           sarif_file: results.sarif
           category: ${{ inputs.sarif_category }}

.github/workflows/python-ci.yml

@@ -108,7 +108,7 @@ jobs:
 
       - name: Set up uv and Python
         if: ${{ inputs.package_manager == 'uv' && !inputs.use_preinstalled_toolchain }}
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: ${{ inputs.uv_version }}
           enable-cache: true

.github/workflows/qt-ci.yml

@@ -98,7 +98,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.

.github/workflows/release.yml

@@ -77,7 +77,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # setup-uv caches by default. On a publishing workflow that turns the

.github/workflows/runtime-fixtures-languages.yml

@@ -500,7 +500,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
@@ -544,7 +544,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
@@ -586,7 +586,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up JDK
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
         with:
           java-version: '21'
           distribution: temurin
@@ -601,7 +601,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
@@ -660,7 +660,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.

.github/workflows/rust-ci.yml

@@ -84,7 +84,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
           components: ${{ inputs.components }}
@@ -131,7 +131,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
 
@@ -163,7 +163,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
           components: rustfmt
@@ -196,7 +196,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
           components: clippy
@@ -229,7 +229,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up MSRV toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.msrv_toolchain }}
 

.github/workflows/rust-supply-chain.yml

@@ -97,11 +97,11 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
       - name: Install cargo-audit
-        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf  # v2.87.2
+        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
         with:
           tool: cargo-audit@${{ inputs.cargo_audit_version }}
       - name: Run cargo-audit
@@ -120,11 +120,11 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
       - name: Install cargo-machete
-        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf  # v2.87.2
+        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
         with:
           tool: cargo-machete@${{ inputs.cargo_machete_version }}
       - name: Run cargo-machete

.github/workflows/semgrep-ci.yml

@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # uv provisions our pinned analyser here, not the caller's

.github/workflows/sql-ci.yml

@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # uv provisions our pinned tooling here, not the caller's

.github/workflows/zizmor-no-sarif.yml

@@ -56,7 +56,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # Consumer-facing gate. uv provisions our pinned analyser here,

.github/workflows/zizmor-sarif.yml

@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # This workflow backs the `zizmor` job, which is in `ci-gate.needs`.
@@ -82,7 +82,7 @@ jobs:
             "${ZIZMOR_TARGET}" > zizmor.sarif
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           sarif_file: zizmor.sarif
           category: zizmor