chore(tools): scheduled pin refresh to 2026-09-21 upstream releases

.github/workflows/benchmark-compare.yml

@@ -126,7 +126,7 @@ jobs:
         run: bash -euo pipefail -c "$BENCH_COMMAND"
 
       - name: Compare and alert
-        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba  # v1.22.1
+        uses: benchmark-action/github-action-benchmark@4322e5726e6334590d251fc4f92bec0efafc45dc  # v1.22.2
         with:
           tool: ${{ inputs.tool }}
           output-file-path: ${{ inputs.output_file_path }}

.github/workflows/benchmark.yml

@@ -128,7 +128,7 @@ jobs:
         run: bash -euo pipefail -c "$BENCH_COMMAND"
 
       - name: Compare and alert
-        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba  # v1.22.1
+        uses: benchmark-action/github-action-benchmark@4322e5726e6334590d251fc4f92bec0efafc45dc  # v1.22.2
         with:
           tool: ${{ inputs.tool }}
           output-file-path: ${{ inputs.output_file_path }}

.github/workflows/ci.yml

@@ -68,7 +68,7 @@ jobs:
           python-version: "3.13"
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # Stated, not inherited -- and it does change something. The pinned
@@ -124,7 +124,7 @@ jobs:
           python-version: "3.13"
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # Stated, not inherited -- and it does change something. The pinned
@@ -299,7 +299,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           enable-cache: false
@@ -396,7 +396,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           enable-cache: false

.github/workflows/coverage-gate.yml

@@ -103,7 +103,7 @@ jobs:
 
       - name: Upload to Codecov
         if: ${{ inputs.use_codecov }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           token: ${{ secrets.codecov_token }}
           files: ${{ inputs.files }}

.github/workflows/docker-build.yml

@@ -147,11 +147,11 @@ jobs:
           password: ${{ github.token }}
 
       - name: Set up BuildKit
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
 
       - name: Build and push
         id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}

.github/workflows/docs-quality.yml

@@ -75,7 +75,7 @@ jobs:
 
       - name: Spell check (typos)
         if: ${{ inputs.typos }}
-        uses: crate-ci/typos@4d9c206a77c041268485162b8e2579ad7a5cb9a3  # v1.50.0
+        uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53  # v1.50.2
         with:
           files: ${{ inputs.typos_files }}
 

.github/workflows/iac-scan.yml

@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkov
-        uses: bridgecrewio/checkov-action@f967808197a8d784d3e72919f38c3ff0cda7884e  # v12.3122.0
+        uses: bridgecrewio/checkov-action@444c9db6fa75e2d9c19ebf1fde7322089be9009e  # v12.3125.0
         with:
           directory: ${{ inputs.directory }}
           framework: ${{ inputs.framework }}

.github/workflows/java-ci.yml

@@ -64,7 +64,7 @@ jobs:
 
       - name: Set up Java
         if: ${{ !inputs.use_preinstalled_toolchain }}
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
         with:
           java-version: ${{ inputs.java_version }}
           distribution: ${{ inputs.distribution }}

.github/workflows/kotlin-android-ci.yml

@@ -74,7 +74,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
         with:
           java-version: ${{ inputs.java_version }}
           distribution: ${{ inputs.java_distribution }}
@@ -87,7 +87,7 @@ jobs:
 
       - name: Set up Android SDK
         if: ${{ inputs.setup_android }}
-        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699  # v4.0.1
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd  # v4.0.4
         with:
           packages: ${{ inputs.android_packages }}
 

.github/workflows/maintenance.yml

@@ -82,7 +82,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # The sweep decides what maintenance debt exists; it must not

.github/workflows/nddev-security-bundle.yml

@@ -116,7 +116,7 @@ jobs:
             "$source_root/scripts/run_private_security_bundle.sh" >> "$GITHUB_ENV"
 
       - name: Set up pinned uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           enable-cache: false
@@ -169,7 +169,7 @@ jobs:
 
       - name: Upload zizmor SARIF
         if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }}
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
         with:
           sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif
           category: zizmor

.github/workflows/osv-scan.yml

@@ -19,11 +19,11 @@ on:
         default: '--recursive .'
       osv_scanner_version:
         type: string
-        default: '2.5.0'
+        default: '2.6.0'
       osv_scanner_sha256:
         description: 'SHA256 of osv-scanner_linux_amd64 from the release SHA256SUMS.'
         type: string
-        default: 'edcfc41d257db36148f065055655fe3fcfc434b0b423ea67468a84c207524e0c'
+        default: 'ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108'
       timeout_minutes:
         type: number
         default: 15

.github/workflows/private-security-bundle-free.yml

@@ -183,8 +183,8 @@ jobs:
       - name: Restore OSV-Scanner binary
         uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@96215b32fbc751716b5c0b758a7a7ca202246574  # 0.1.23
         with:
-          url: https://github.com/google/osv-scanner/releases/download/v2.5.0/osv-scanner_linux_amd64
-          sha256: edcfc41d257db36148f065055655fe3fcfc434b0b423ea67468a84c207524e0c
+          url: https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_amd64
+          sha256: ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108
           output: ${{ runner.temp }}/private-security-tools/osv-scanner
           max-bytes: '268435456'
 

.github/workflows/private-static.yml

@@ -110,7 +110,7 @@ jobs:
 
       - name: Set up uv
         if: ${{ inputs.setup_uv }}
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: ${{ inputs.uv_version }}
           # uv provisions our pinned tooling here, not the caller's

.github/workflows/public-codeql.yml

@@ -115,21 +115,21 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ inputs.config_file == '' }}
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
         with:
           languages: ${{ matrix.language }}
           queries: ${{ inputs.queries }}
 
       - name: Initialize CodeQL with config
         if: ${{ inputs.config_file != '' }}
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ inputs.config_file }}
 
       - name: Autobuild
         if: ${{ inputs.autobuild && inputs.build_command == '' }}
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
 
       - name: Custom build
         if: ${{ inputs.build_command != '' }}
@@ -139,13 +139,13 @@ jobs:
 
       - name: Analyze
         if: ${{ inputs.output_directory == '' }}
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
         with:
           category: "/language:${{ matrix.language }}"
 
       - name: Analyze with output directory
         if: ${{ inputs.output_directory != '' }}
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
         with:
           category: "/language:${{ matrix.language }}"
           output: ${{ inputs.output_directory }}

.github/workflows/public-scorecard.yml

@@ -165,7 +165,7 @@ jobs:
       - name: Upload SARIF to code scanning
         id: upload-sarif
         if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }}
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
         with:
           sarif_file: results.sarif
           category: ${{ inputs.sarif_category }}

.github/workflows/python-ci.yml

@@ -108,7 +108,7 @@ jobs:
 
       - name: Set up uv and Python
         if: ${{ inputs.package_manager == 'uv' && !inputs.use_preinstalled_toolchain }}
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: ${{ inputs.uv_version }}
           enable-cache: true

.github/workflows/qt-ci.yml

@@ -98,7 +98,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.

.github/workflows/r-ci.yml

@@ -64,7 +64,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up R
-        uses: r-lib/actions/setup-r@465b7d8e732ca3921382b1674c59bada9cbf3399  # v2.13.0
+        uses: r-lib/actions/setup-r@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05  # v2.14.0
         with:
           r-version: ${{ inputs.r_version }}
           use-public-rspm: ${{ inputs.use_public_rspm }}

.github/workflows/release-supply-chain-free.yml

@@ -435,11 +435,11 @@ jobs:
           RELEASE_RUNNER_ARCH: ${{ runner.arch }}
           RELEASE_RUNNER_OS: ${{ runner.os }}
           SYFT_CHECK_FOR_APP_UPDATE: 'false'
-          SYFT_LINUX_ARM64_SHA256: 9fafef4db4f032ce81008d3a1529985d41ceb6ccdf2b388c9ce2f1ed7d32082e
-          SYFT_LINUX_ARM64_SIZE: '25829350'
-          SYFT_LINUX_X64_SHA256: d654f678b709eb53c393d38519d5ed7d2e57205529404018614cfefa0fb2b5ca
-          SYFT_LINUX_X64_SIZE: '28342623'
-          SYFT_VERSION: '1.46.0'
+          SYFT_LINUX_ARM64_SHA256: c46d5e4c28e12aa4c5becfaa343ef1c7f89045b6b895f2c21d471c62db09c706
+          SYFT_LINUX_ARM64_SIZE: '26744986'
+          SYFT_LINUX_X64_SHA256: caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d
+          SYFT_LINUX_X64_SIZE: '29289629'
+          SYFT_VERSION: '1.52.0'
         run: |
           set -euo pipefail
           umask 077

.github/workflows/release-supply-chain.yml

@@ -442,11 +442,11 @@ jobs:
           RELEASE_RUNNER_ARCH: ${{ runner.arch }}
           RELEASE_RUNNER_OS: ${{ runner.os }}
           SYFT_CHECK_FOR_APP_UPDATE: 'false'
-          SYFT_LINUX_ARM64_SHA256: 9fafef4db4f032ce81008d3a1529985d41ceb6ccdf2b388c9ce2f1ed7d32082e
-          SYFT_LINUX_ARM64_SIZE: '25829350'
-          SYFT_LINUX_X64_SHA256: d654f678b709eb53c393d38519d5ed7d2e57205529404018614cfefa0fb2b5ca
-          SYFT_LINUX_X64_SIZE: '28342623'
-          SYFT_VERSION: '1.46.0'
+          SYFT_LINUX_ARM64_SHA256: c46d5e4c28e12aa4c5becfaa343ef1c7f89045b6b895f2c21d471c62db09c706
+          SYFT_LINUX_ARM64_SIZE: '26744986'
+          SYFT_LINUX_X64_SHA256: caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d
+          SYFT_LINUX_X64_SIZE: '29289629'
+          SYFT_VERSION: '1.52.0'
         run: |
           set -euo pipefail
           umask 077

.github/workflows/release.yml

@@ -77,7 +77,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # setup-uv caches by default. On a publishing workflow that turns the

.github/workflows/runtime-fixtures-languages.yml

@@ -500,7 +500,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
@@ -544,7 +544,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
@@ -586,12 +586,12 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up JDK
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
         with:
           java-version: '21'
           distribution: temurin
       - name: Set up Android SDK
-        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699  # v4.0.1
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd  # v4.0.4
         with:
           packages: 'platforms;android-37.0 build-tools;36.0.0'
       - name: Set up isolated Python contract runtime
@@ -601,7 +601,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
@@ -660,7 +660,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.

.github/workflows/rust-supply-chain.yml

@@ -101,7 +101,7 @@ jobs:
         with:
           toolchain: ${{ inputs.toolchain }}
       - name: Install cargo-audit
-        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf  # v2.87.2
+        uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73  # v2.87.17
         with:
           tool: cargo-audit@${{ inputs.cargo_audit_version }}
       - name: Run cargo-audit
@@ -124,7 +124,7 @@ jobs:
         with:
           toolchain: ${{ inputs.toolchain }}
       - name: Install cargo-machete
-        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf  # v2.87.2
+        uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73  # v2.87.17
         with:
           tool: cargo-machete@${{ inputs.cargo_machete_version }}
       - name: Run cargo-machete

.github/workflows/semgrep-ci.yml

@@ -20,7 +20,7 @@ on:
       semgrep_version:
         description: 'Exact semgrep version to pin.'
         type: string
-        default: '1.170.0'
+        default: '1.177.0'
       extra_args:
         type: string
         default: ''
@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # uv provisions our pinned analyser here, not the caller's

.github/workflows/sql-ci.yml

@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # uv provisions our pinned tooling here, not the caller's