chore(deps): bump the dependencies group with 6 updates

.github/workflows/a11y.yaml

@@ -36,7 +36,7 @@ jobs:
     permissions:
       contents: read # Clone the repository for package.json and the pa11y config
     steps:
-      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
@@ -45,12 +45,12 @@ jobs:
           persist-credentials: false
 
       - name: Download built site
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.artifact }}
           path: public
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm

.github/workflows/auto-labeler.yaml

@@ -18,7 +18,7 @@ jobs:
       contents: read # Read the release-drafter config
       pull-requests: write # Apply labels to the pull request
       issues: write # Create labels referenced in the config but missing from the repo
-    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@038160c3e14227cf7c1a7387217ac1623a969f0c # v2.1.1
+    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@690dbbefe65f0c1d68c5211dd6ff997f533099b5 # v2.2.0
     with:
       config-name: release-drafter.yml
     secrets:

.github/workflows/cloudflare-pages-deploy.yaml

@@ -55,7 +55,7 @@ jobs:
     permissions:
       contents: read # Check out functions/ when deploying Pages Functions
     steps:
-      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
@@ -69,7 +69,7 @@ jobs:
           sparse-checkout: functions
 
       - name: Download built site
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.artifact }}
           path: site

.github/workflows/hugo-ci.yaml

@@ -46,7 +46,7 @@ jobs:
     permissions:
       contents: read # Clone the repository
     steps:
-      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
@@ -59,7 +59,7 @@ jobs:
 
       - name: Setup Node
         if: inputs.prepare-command != ''
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
 
@@ -96,7 +96,7 @@ jobs:
 
       - name: Upload built site
         if: inputs.upload-artifact != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ inputs.upload-artifact }}
           path: public/

.github/workflows/lint.yaml

@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: read # Clone the repository
     steps:
-      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 

.github/workflows/mark-ready.yaml

@@ -28,7 +28,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 

.github/workflows/release.yaml

@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: write # Create releases and push tags
       pull-requests: read # Read PR labels for release-drafter
-    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release-minimal.yaml@038160c3e14227cf7c1a7387217ac1623a969f0c # v2.1.1
+    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release-minimal.yaml@690dbbefe65f0c1d68c5211dd6ff997f533099b5 # v2.2.0
     with:
       release-config-name: release-drafter.yml
       publish: true

.github/workflows/resolve-deploy-run.yaml

@@ -41,7 +41,7 @@ jobs:
       sha: ${{ steps.resolve.outputs.sha }}
       run-id: ${{ steps.resolve.outputs.run-id }}
     steps:
-      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit