Update CI dependencies

Author: renovate[bot]

.github/publish.yaml

@@ -1,4 +1,4 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/camptocamp/tag-publish/1.1.1/tag_publish/schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/camptocamp/tag-publish/1.2.0/tag_publish/schema.json
 
 pypi:
   versions_type:

.github/workflows/main.yaml

@@ -31,24 +31,24 @@ jobs:
       success: ${{ steps.success.outputs.success }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.13'
       - run: python3 -m pip install $(grep pre-commit== requirements.txt)
 
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
           restore-keys: "pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}\npre-commit-"
       - run: pre-commit run --all-files --color=always
       - run: git diff --exit-code --patch > /tmp/pre-commit.patch; git diff --color; git reset --hard || true
         if: failure()
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Apply pre-commit fix.patch
           path: /tmp/pre-commit.patch
@@ -68,11 +68,11 @@ jobs:
       success: ${{ steps.success.outputs.success }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.13'
       - run: python3 -m pip install --requirement=.github/requirements.txt
@@ -100,7 +100,7 @@ jobs:
 
       - run: git diff --exit-code --patch > /tmp/dpkg-versions.patch || true
         if: failure()
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Update dpkg versions list.patch
           path: /tmp/dpkg-versions.patch

.github/workflows/pull-request-automation.yaml

@@ -17,12 +17,12 @@ jobs:
         env:
           GITHUB: ${{ toJson(github) }}
       - name: Print context
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |-
             console.log(context);
       - name: Auto reviews GHCI updates
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |-
             github.rest.pulls.createReview({
@@ -37,7 +37,7 @@ jobs:
             || github.event.pull_request.user.login == 'geo-ghci-int[bot]'
             || github.event.pull_request.user.login == 'geo-ghci[bot]')
       - name: Auto reviews Renovate updates
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |-
             github.rest.pulls.createReview({

.pre-commit-config.yaml

@@ -52,7 +52,7 @@ repos:
           - tag_publish/schema.json
           - config.md
   - repo: https://github.com/sbrunner/hooks
-    rev: 1.6.1
+    rev: 1.8.0
     hooks:
       - id: copyright
       - id: poetry2-lock
@@ -61,8 +61,8 @@ repos:
       - id: canonicalize
       - id: prospector-to-ruff
         additional_dependencies:
-          - prospector-profile-duplicated==1.11.0 # pypi
-          - prospector-profile-utils==1.26.5 # pypi
+          - prospector-profile-duplicated==1.12.0 # pypi
+          - prospector-profile-utils==1.27.0 # pypi
         args:
           - --test=utils:tests
   - repo: https://github.com/codespell-project/codespell
@@ -99,7 +99,7 @@ repos:
     hooks:
       - id: ripsecrets
   - repo: https://github.com/prospector-dev/prospector
-    rev: v1.17.3
+    rev: v1.19.1
     hooks:
       - id: prospector
         args:
@@ -108,9 +108,9 @@ repos:
           - --output-format=pylint
           - --profile=.prospector.yaml
         additional_dependencies:
-          - prospector-profile-duplicated==1.11.0 # pypi
-          - prospector-profile-utils==1.26.5 # pypi
-          - pylint[spelling]==3.3.9 # pypi
+          - prospector-profile-duplicated==1.12.0 # pypi
+          - prospector-profile-utils==1.27.0 # pypi
+          - pylint[spelling]==4.0.6 # pypi
           - mypy==2.3.0 # pypi
           - ruff==0.15.21 # pypi
         exclude: |-
@@ -129,7 +129,7 @@ repos:
           - --profile=utils:tests
           - --profile=utils:pre-commit
         additional_dependencies:
-          - prospector-profile-utils==1.26.5 # pypi
+          - prospector-profile-utils==1.27.0 # pypi
           - mypy==2.3.0 # pypi
           - ruff==0.15.21 # pypi
   - repo: https://github.com/astral-sh/ruff-pre-commit

poetry.lock

@@ -80,7 +80,7 @@ multi-repo-automation = "1.7.0"
 githubkit = "0.14.3"
 
 [tool.poetry.group.dev.dependencies]
-prospector = { version = "1.17.3", extras = ["with_bandit", "with_mypy", "with_pyroma", "with_ruff"] }
+prospector = { version = "1.19.1", extras = ["with_bandit", "with_mypy", "with_pyroma", "with_ruff"] }
 prospector-profile-duplicated = "1.12.0"
 prospector-profile-utils = "1.27.0"
 types-requests = "2.33.0.20260712"