deps(main): consolidate dependency updates and security fixes

.github/actions/shared/build-image/action.yml

@@ -53,7 +53,7 @@ runs:
           network=host
 
     - name: Cache Docker layers
-      uses: actions/cache@v5
+      uses: actions/cache@v6.1.0
       with:
         path: /tmp/.buildx-cache
         key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-buildx-${{ github.sha }}

.github/actions/shared/deploy-provider/action.yml

@@ -121,7 +121,7 @@ runs:
 
     - name: Download image artifact (if specified)
       if: inputs.image-artifact != '' && inputs.use-registry != 'true'
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@v8.0.2
       with:
         name: ${{ inputs.image-artifact }}
 

.github/actions/v3/setup-rust/action.yml

@@ -51,7 +51,7 @@ runs:
     - name: Cache Cargo dependencies
       id: cache
       if: inputs.cache == 'true'
-      uses: actions/cache@v5
+      uses: actions/cache@v6.1.0
       with:
         path: |
           ~/.cargo/bin/

.github/workflows/_ci-bash.yml

@@ -25,7 +25,7 @@ jobs:
     name: ShellCheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - name: Run shellcheck
         run: |
           set -euo pipefail
@@ -40,7 +40,7 @@ jobs:
     name: bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - name: Install bats
         run: sudo apt-get update && sudo apt-get install -y bats
       - name: Run bats

.github/workflows/_ci-docker.yml

@@ -28,7 +28,7 @@ jobs:
     name: docker build (validation)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Build (no push)

.github/workflows/_ci-npm.yml

@@ -23,11 +23,11 @@ jobs:
     name: pnpm install + test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-node@v4
         with: { node-version: "${{ inputs.node_version }}" }
       - uses: pnpm/action-setup@v6
-        with: { version: 9 }
+        with: { version: 12.14.0 }
       - name: Install dependencies
         working-directory: ${{ inputs.package_dir }}
         run: pnpm install --frozen-lockfile=false

.github/workflows/_ci-rust.yml

@@ -45,7 +45,7 @@ jobs:
     name: Workspace guard
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - name: Verify Cargo.toml exists at workspace_dir
         run: test -f "${{ inputs.workspace_dir }}/Cargo.toml" || { echo "::error::No Cargo.toml at ${{ inputs.workspace_dir }}"; exit 1; }
 
@@ -54,7 +54,7 @@ jobs:
     name: cargo fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ inputs.toolchain }}
@@ -67,7 +67,7 @@ jobs:
     name: cargo clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ inputs.toolchain }}
@@ -91,7 +91,7 @@ jobs:
     name: cargo test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ inputs.toolchain }}
@@ -114,7 +114,7 @@ jobs:
     name: cargo build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - name: Install musl tools (if requested)
         if: ${{ inputs.install_musl_tools }}
         run: sudo apt-get update && sudo apt-get install -y musl-tools

.github/workflows/_release-cargo-dist.yml

@@ -42,7 +42,7 @@ jobs:
           - { os: macos-latest,   target: aarch64-apple-darwin,      platform: macos-aarch64 }
           - { os: windows-latest, target: x86_64-pc-windows-msvc,    platform: windows-x86_64 }
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -54,7 +54,7 @@ jobs:
         run: cargo install cross --git https://github.com/cross-rs/cross
 
       - name: Cache cargo registry + target
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cargo/bin/

.github/workflows/build-base-image.yml

@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.1
 
       - name: Set build arguments
         id: args

.github/workflows/check-links.yml

@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.1
 
       - name: Restore lychee cache
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           path: .lycheecache
           key: cache-lychee-${{ github.sha }}
@@ -68,10 +68,10 @@ jobs:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.1
 
       - name: Restore lychee cache
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           path: .lycheecache
           key: cache-lychee-external-${{ github.sha }}

.github/workflows/ci-v1.yml

@@ -24,7 +24,7 @@ jobs:
     name: Markdown lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - name: Lint v1/CHANGELOG.md and root markdown
         uses: DavidAnson/markdownlint-cli2-action@v23
         with:

.github/workflows/ci-v2.yml

@@ -87,7 +87,7 @@ jobs:
       image-digest: ${{ steps.build.outputs.digest }}
       image-ref: ${{ steps.meta.outputs.tags }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -154,7 +154,7 @@ jobs:
     outputs:
       providers: ${{ steps.matrix.outputs.providers }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Generate matrices
         id: matrix
@@ -194,7 +194,7 @@ jobs:
       packages: read
       security-events: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Login to GHCR
         uses: docker/login-action@v4

.github/workflows/ci-v3.yml

@@ -61,13 +61,13 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: v3 -> target
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@v1.19.1
+        uses: cargo-bins/cargo-binstall@v1.26.0
       - name: Install cargo-machete
         run: cargo binstall cargo-machete --no-confirm
       - name: Scan for unused dependencies
@@ -97,7 +97,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [rust]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -110,7 +110,7 @@ jobs:
           workspaces: v3 -> target
 
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@v1.19.1
+        uses: cargo-bins/cargo-binstall@v1.26.0
 
       - name: Install cargo-llvm-cov
         run: cargo binstall cargo-llvm-cov --no-confirm --force
@@ -168,15 +168,15 @@ jobs:
           fi
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7.1.1
         with:
           files: v3/coverage/lcov.info
           flags: workspace
           name: sindri-v3-workspace
           fail_ci_if_error: false
 
       - name: Upload providers coverage to Codecov
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7.1.1
         with:
           files: v3/coverage/providers-lcov.info
           flags: providers
@@ -213,10 +213,10 @@ jobs:
       image-tag: ${{ steps.build.outputs.tag }}
       image-digest: ${{ steps.build.outputs.digest }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Download sindri binary
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: sindri-v3-binaries-${{ github.sha }}
           path: ./bin
@@ -313,7 +313,7 @@ jobs:
       packages: read
       security-events: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Login to GHCR
         uses: docker/login-action@v4
@@ -399,13 +399,13 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'push' || github.event.inputs.run-audit == 'true'
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@v1.19.1
+        uses: cargo-bins/cargo-binstall@v1.26.0
 
       - name: Install cargo-audit
         run: cargo binstall cargo-audit --no-confirm
@@ -450,7 +450,7 @@ jobs:
     name: Documentation Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -483,7 +483,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.inputs.test-extensions == 'true' || github.event_name != 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Check if v3 extensions exist
         id: check
@@ -523,10 +523,10 @@ jobs:
     needs: [rust]
     continue-on-error: true  # Don't fail CI if k8s tests fail
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Download sindri binary
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: sindri-v3-binaries-${{ github.sha }}
           path: ./bin
@@ -568,10 +568,10 @@ jobs:
     needs: [rust]
     continue-on-error: true  # Don't fail CI if k8s tests fail
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Download sindri binary
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: sindri-v3-binaries-${{ github.sha }}
           path: ./bin
@@ -622,10 +622,10 @@ jobs:
       matrix:
         provider: [kind, k3d]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Download sindri binary
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: sindri-v3-binaries-${{ github.sha }}
           path: ./bin
@@ -700,7 +700,7 @@ jobs:
       matrix:
         provider: [runpod, northflank]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -737,7 +737,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [rust]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -762,10 +762,10 @@ jobs:
     needs: [rust]
     continue-on-error: true  # Config validation is informational, don't block PRs
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Download sindri binary
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: sindri-v3-binaries-${{ github.sha }}
           path: ./bin