build(deps): refresh dependencies and update automation

[acgetchell]

• Update Rust, Python, and repository tool pins to compatible releases.
• Refresh setup-uv, CodeQL, and zizmor action revisions while preserving cache pruning.
• Add grouped uv Dependabot updates and publish the ruleset-required CodeRabbit status.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 77eaa3af-62a5-4eca-8345-428e8b7f67f3

📥 Commits

Reviewing files that changed from the base of the PR and between 39d0993 and cc175a0.

⛔ Files ignored due to path filters (2)

• Cargo.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (16)

• .coderabbit.yml
• .github/dependabot.yml
• .github/workflows/audit.yml
• .github/workflows/benchmarks.yml
• .github/workflows/ci.yml
• .github/workflows/codacy.yml
• .github/workflows/codeql.yml
• .github/workflows/generate-baseline.yml
• .github/workflows/papers.yml
• .github/workflows/release-benchmarks.yml
• .github/workflows/rust-clippy.yml
• .github/workflows/semgrep-sarif.yml
• .github/workflows/zizmor.yml
• Cargo.toml
• justfile
• pyproject.toml

---

Walkthrough

The pull request updates repository automation settings, GitHub Actions pins, cache behavior, Dependabot configuration, and Rust/Python development dependency versions.

Changes

Automation and dependency updates

Layer / File(s)	Summary
Repository review and update settings .coderabbit.yml, .github/dependabot.yml	Review progress reporting is disabled. Weekly grouped Dependabot updates for uv dependencies are configured.
Workflow action updates .github/workflows/*	setup-uv, CodeQL, and zizmor action pins are updated. Cache pruning is enabled for selected setup-uv steps.
Development dependency and tool pins Cargo.toml, justfile, pyproject.toml	The clap, rumdl, uv, Ruff, Semgrep, and Ty versions are updated. The Semgrep override comment is updated.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• acgetchell/delaunay#523: Updates shared CodeQL action pins in related workflow files.

Poem

A rabbit checks the pins in line,
While fresh tools hop into design.
Caches prune and workflows gleam,
Dependabot joins the stream.
“All updated!” the bunny sings.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the dependency refresh and automation updates in the changeset.
Description check	✅ Passed	The description directly covers the dependency, workflow, Dependabot, and CodeRabbit configuration changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependency-pins-and-automation

---

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

🟢 Coverage ∅ diff coverage · -0.01% coverage variation

Metric	Results
Coverage variation	✅ -0.01% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (39d0993)	81860	74782	91.35%
Head commit (cc175a0)	81860 (+0)	74775 (-7)	91.34% (-0.01%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#544)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.32%. Comparing base (39d0993) to head (cc175a0).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #544      +/-   ##
==========================================
- Coverage   91.33%   91.32%   -0.01%     
==========================================
  Files          88       88              
  Lines       81649    81649              
==========================================
- Hits        74573    74566       -7     
- Misses       7076     7083       +7     

Flag	Coverage Δ
unittests	91.32% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.