chore(deps): update all dependencies

.github/actions/setup-docker/action.yaml

@@ -28,34 +28,34 @@ runs:
   using: "composite"
   steps:
     - name: "Restore docker caches"
-      uses: "actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae" # v5.0.5
+      uses: "actions/cache@caa296126883cff596d87d8935842f9db880ef25" # v5.1.0
       with:
         path: ".cache/docker"
         key: "${{ inputs.cache-key }}-docker-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('mise.lock', 'Cargo.lock', 'pyproject.toml', 'pnpm-lock.yaml', 'uv.lock') }}"
         restore-keys: |
           ${{ inputs.cache-key }}-docker-${{ runner.os }}-${{ runner.arch }}-
     - name: "Login to GitHub Container Registry"
-      uses: "docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee" # v4.2.0
+      uses: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" # v4.6.0
       with:
         registry: "ghcr.io"
         username: "${{ github.actor }}"
         password: "${{ inputs.github-token }}"
     - name: "Login to Docker Hub"
       if: "${{ inputs.dockerhub-username != '' && inputs.dockerhub-token != '' }}"
-      uses: "docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee" # v4.2.0
+      uses: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" # v4.6.0
       with:
         username: "${{ inputs.dockerhub-username }}"
         password: "${{ inputs.dockerhub-token }}"
     - name: "Setup Buildx"
-      uses: "docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5" # v4.1.0
+      uses: "docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c" # v4.2.0
     - name: "Get current UID/GID"
       id: "ids"
       shell: "bash"
       run: |
         echo "uid=$(id -u)" >> "$GITHUB_OUTPUT"
         echo "gid=$(id -g)" >> "$GITHUB_OUTPUT"
     - name: "Build Docker image"
-      uses: "docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf" # v7.2.0
+      uses: "docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a" # v7.3.0
       with:
         context: "."
         file: "Dockerfile"

.github/actions/setup-native/action.yaml

@@ -14,7 +14,7 @@ runs:
   using: "composite"
   steps:
     - name: "Restore native caches"
-      uses: "actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae" # v5.0.5
+      uses: "actions/cache@caa296126883cff596d87d8935842f9db880ef25" # v5.1.0
       with:
         path: ".cache/native"
         key: "${{ inputs.cache-key }}-native-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock', 'pyproject.toml', 'pnpm-lock.yaml', 'uv.lock') }}"
@@ -28,7 +28,7 @@ runs:
       if: "runner.os == 'Windows'"
       uses: "ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756" # v1.13.0
     - name: "Run mise install"
-      uses: "jdx/mise-action@1648a7812b9aeae629881980618f079932869151" # v4.0.1
+      uses: "jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518" # v4.2.5
       with:
         version: "${{ inputs.mise-version }}"
         cache_key_prefix: "${{ inputs.cache-key }}-mise"

.github/actions/setup/action.yaml

@@ -34,7 +34,7 @@ runs:
   using: "composite"
   steps:
     - name: "Restore shared caches"
-      uses: "actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae" # v5.0.5
+      uses: "actions/cache@caa296126883cff596d87d8935842f9db880ef25" # v5.1.0
       with:
         path: ".cache/shared"
         key: "${{ inputs.cache-key }}-shared-${{ runner.os }}-${{ runner.arch }}"

.github/actions/upload-reports/action.yaml

@@ -11,7 +11,7 @@ runs:
   using: "composite"
   steps:
     - name: "Install latest Node.js"
-      uses: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" # v6.4.0
+      uses: "actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38" # v6.5.0
       with:
         node-version: "latest"
         check-latest: true
@@ -40,14 +40,14 @@ runs:
         EOF
     - name: "Upload coverage reports to Codecov"
       if: "steps.expand.outputs.coverage != ''"
-      uses: "codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354" # v6.0.1
+      uses: "codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f" # v6.0.2
       with:
         use_oidc: true
         report_type: "coverage"
         files: "${{ steps.expand.outputs.coverage }}"
     - name: "Upload test results to Codecov"
       if: "steps.expand.outputs.reports != ''"
-      uses: "codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354" # v6.0.1
+      uses: "codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f" # v6.0.2
       with:
         use_oidc: true
         report_type: "test_results"

.github/workflows/regular.yaml

@@ -31,7 +31,7 @@ jobs:
       mise-version: "${{ steps.init-workflow.outputs.mise-version }}"
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803" # v6.1.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -55,7 +55,7 @@ jobs:
     runs-on: "${{ matrix.os }}"
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803" # v6.1.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -97,7 +97,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803" # v6.1.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -120,7 +120,7 @@ jobs:
         with:
           run: "mise run --force ci-build"
       - name: "Run benchmarks"
-        uses: "CodSpeedHQ/action@3194d9a39c4d46684cb44bf7207fc56626aad8fd" # v4.15.1
+        uses: "CodSpeedHQ/action@f22792bfac16f3e14eb9fbea76f4a48e9cc22b93" # v4.19.1
         with:
           mode: "simulation"
           run: "pnpm -C packages/node exec vitest bench --run"
@@ -133,13 +133,13 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout repository"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803" # v6.1.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
           persist-credentials: false
       - name: "Run zizmor"
-        uses: "zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d" # v0.5.6
+        uses: "zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054" # v0.6.2
         with:
           persona: "auditor"
         env:
@@ -153,7 +153,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout repository"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803" # v6.1.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -168,6 +168,6 @@ jobs:
           output: "trivy-results.sarif"
           ignore-unfixed: true
       - name: "Upload Trivy scan results to GitHub Security tab"
-        uses: "github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa" # v4.36.0
+        uses: "github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd" # v4.37.7
         with:
           sarif_file: "trivy-results.sarif"

.github/workflows/release.yaml

@@ -23,7 +23,7 @@ jobs:
       mise-version: "${{ steps.init-workflow.outputs.mise-version }}"
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803" # v6.1.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -63,7 +63,7 @@ jobs:
     runs-on: "${{ matrix.os }}"
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803" # v6.1.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -111,11 +111,11 @@ jobs:
           gh-token: "${{ secrets.GITHUB_TOKEN }}"
           run: "mise run sbom:rust"
       - name: "Attest build provenance"
-        uses: "actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32" # v4.1.0
+        uses: "actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8" # v4.2.2
         with:
           subject-path: "packages/node/dist/*.gz"
       - name: "Attest Rust SBOM"
-        uses: "actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26" # v4.1.0
+        uses: "actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6" # v4.2.2
         with:
           subject-path: "packages/node/dist/*.node.gz"
           sbom-path: "packages/node/dist/node_reqwest.cdx.json"
@@ -140,7 +140,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803" # v6.1.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -172,11 +172,11 @@ jobs:
           gh-token: "${{ secrets.GITHUB_TOKEN }}"
           run: "mise run sbom:js"
       - name: "Attest node build provenance"
-        uses: "actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32" # v4.1.0
+        uses: "actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8" # v4.2.2
         with:
           subject-path: "packages/node/package.tar.gz"
       - name: "Attest JS SBOM"
-        uses: "actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26" # v4.1.0
+        uses: "actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6" # v4.2.2
         with:
           subject-path: "packages/node/package.tar.gz"
           sbom-path: "packages/node/package.cdx.json"
@@ -208,7 +208,7 @@ jobs:
       id-token: "write" # npm provenance via OIDC + npm trusted publishing
     steps:
       - name: "Install Node.js"
-        uses: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" # v6.4.0
+        uses: "actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38" # v6.5.0
         with:
           node-version: "latest"
           check-latest: true
@@ -252,7 +252,7 @@ jobs:
     runs-on: "${{ matrix.os }}"
     steps:
       - name: "Install Node.js"
-        uses: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" # v6.4.0
+        uses: "actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38" # v6.5.0
         with:
           node-version: "latest"
           check-latest: true

.gitmodules

@@ -3,4 +3,4 @@
 	url = https://github.com/nodejs/undici.git
 	# Pinned to undici v8.3.0; bump in lockstep with the version in
 	# pnpm-workspace.yaml `catalog:`.
-	branch = v8.3.0
+	branch = v8.10.0

.mise-version

@@ -1 +1 @@
-v2026.5.15
+v2026.8.6

.python-version

@@ -1 +1 @@
-3.14.5
+3.14.7