Merge branch 'main' into claude/warm-watching-hollerith

Author: rhuanbarreto

.github/workflows/code-pull-request.yml

@@ -150,7 +150,7 @@ jobs:
       # --- Maven ---
       - name: Setup Java
         if: matrix.shim == 'maven'
-        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: "11"
@@ -171,9 +171,9 @@ jobs:
       # --- RubyGem ---
       - name: Setup Ruby
         if: matrix.shim == 'rubygem'
-        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
+        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
         with:
-          ruby-version: "4.0.5"
+          ruby-version: "4.0.6"
       - name: Test RubyGem shim
         if: matrix.shim == 'rubygem'
         working-directory: shims/rubygem
@@ -212,7 +212,7 @@ jobs:
         # `permissions:` above, so SARIF upload would fail — fall back to
         # console-only output and don't let that (or the pre-existing
         # findings backlog) fail the gate for external contributors.
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
         continue-on-error: ${{ github.event.pull_request.head.repo.fork == true }}
         with:
           config: zizmor.yml

.github/workflows/codeql.yml

@@ -44,11 +44,11 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           languages: ${{ matrix.language }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/publish-shims.yml

@@ -62,7 +62,7 @@ jobs:
         with:
           ref: ${{ inputs.tag }}
           persist-credentials: false
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           python-version: "3.12"
           # No cache in a publish workflow — a poisoned cache entry could end up
@@ -138,7 +138,7 @@ jobs:
         with:
           ref: ${{ inputs.tag }}
           persist-credentials: false
-      - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: "temurin"
           java-version: "11"
@@ -168,9 +168,9 @@ jobs:
         with:
           ref: ${{ inputs.tag }}
           persist-credentials: false
-      - uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
+      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
         with:
-          ruby-version: "4.0.5"
+          ruby-version: "4.0.6"
           # No bundler cache in a publish workflow — a poisoned cache entry could
           # end up inside the published gem (zizmor: cache-poisoning).
           bundler-cache: false

.github/workflows/release.yml

@@ -64,7 +64,7 @@ jobs:
         run: bun install --frozen-lockfile
       - name: Context check
         id: check
-        uses: TrigenSoftware/simple-release-action@e7293dad843693d8692d443c3f21b78338048f13 # v1.1.8
+        uses: TrigenSoftware/simple-release-action@a796225481a62b5b46b37d4481ef7fb114a6d399 # v1.1.9
         with:
           workflow: check
           github-token: ${{ steps.generate_token.outputs.token }}
@@ -133,7 +133,7 @@ jobs:
           HOOK
           chmod +x .git/hooks/prepare-commit-msg
       - name: Create or update pull request
-        uses: TrigenSoftware/simple-release-action@e7293dad843693d8692d443c3f21b78338048f13 # v1.1.8
+        uses: TrigenSoftware/simple-release-action@a796225481a62b5b46b37d4481ef7fb114a6d399 # v1.1.9
         with:
           workflow: pull-request
           github-token: ${{ steps.generate_token.outputs.token }}
@@ -184,7 +184,7 @@ jobs:
         id: validate
         run: bun run validate
       - name: Release
-        uses: TrigenSoftware/simple-release-action@e7293dad843693d8692d443c3f21b78338048f13 # v1.1.8
+        uses: TrigenSoftware/simple-release-action@a796225481a62b5b46b37d4481ef7fb114a6d399 # v1.1.9
         with:
           workflow: release
           github-token: ${{ steps.generate_token.outputs.token }}

.github/workflows/scorecard.yml

@@ -40,6 +40,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           sarif_file: results.sarif

.prototools

@@ -1,7 +1,7 @@
 bun = "1.3.14"
 node = "24"
-npm = "11.17.0"
-gh = "2.95.0"
+npm = "11.18.0"
+gh = "2.96.0"
 
 [settings]
 auto-install = true