chore(deps): update all dependencies

.agents/skills/td-supply-chain-audit/scripts/check_package.py

@@ -42,7 +42,7 @@ def get_pypi_release_dates(package_name: str) -> dict[str, str]:
     """
     try:
         url = f"https://pypi.org/pypi/{package_name}/json"
-        req = urllib.request.Request(  # noqa: S310
+        req = urllib.request.Request(
             url,
             headers={"User-Agent": "supply-chain-audit/1.0"},
         )
@@ -74,7 +74,7 @@ def get_npm_release_dates(package_name: str) -> dict[str, str]:
     """
     try:
         url = f"https://registry.npmjs.org/{package_name}"
-        req = urllib.request.Request(  # noqa: S310
+        req = urllib.request.Request(
             url,
             headers={"User-Agent": "supply-chain-audit/1.0"},
         )

.agents/skills/td-supply-chain-audit/scripts/collect.py

@@ -937,7 +937,7 @@ def enrich_dep_release_info(dep: dict) -> None:
     try:
         if ecosystem == "pypi":
             url = f"https://pypi.org/pypi/{pkg}/{version}/json"
-            req = urllib.request.Request(  # noqa: S310
+            req = urllib.request.Request(
                 url,
                 headers={"User-Agent": "supply-chain-audit/1.0"},
             )
@@ -1566,7 +1566,7 @@ def _fetch_openssf_scorecard(repo: str) -> dict:
     api_url = f"https://api.securityscorecards.dev/projects/github.com/{repo}"
     result = _empty_scorecard_score(api_url)
     try:
-        req = urllib.request.Request(  # noqa: S310
+        req = urllib.request.Request(
             api_url,
             headers={"User-Agent": "supply-chain-audit/1.0", "Accept": "application/json"},
         )
@@ -1725,7 +1725,7 @@ def _download_scorecard_cli(dest: Path) -> str | None:
     print(f"  Bootstrapping Scorecard CLI {SCORECARD_CLI_VERSION} ({goos}/{goarch})...")
 
     try:
-        req = urllib.request.Request(  # noqa: S310
+        req = urllib.request.Request(
             url,
             headers={"User-Agent": "supply-chain-audit/1.0"},
         )

.github/workflows/ack.yml

@@ -31,15 +31,15 @@ jobs:
       pull-requests: write # pr approval and merge
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Dump GitHub context
         run: |
           cat <<'EOF_GITHUB_CONTEXT'
           ${{ toJson(github) }}
           EOF_GITHUB_CONTEXT
 
-      - uses: release-drafter/release-drafter/autolabeler@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7
+      - uses: release-drafter/release-drafter/autolabeler@eada3c96a64734dd381cfbda23511034e328ddb0 # v7
 
       - name: Verify PR label action
         if: github.event_name != 'merge_group'
@@ -63,7 +63,7 @@ jobs:
 
       - name: Update release notes if this is already merged
         if: github.event.pull_request.merged == true
-        uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/bootstrap_skills.yml

@@ -26,7 +26,7 @@ jobs:
           - ansible/vscode-ansible
     steps:
       - name: Checkout target repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: ${{ matrix.repo }}
           token: ${{ secrets.BOT_PAT }}

.github/workflows/finalize.yml

@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
           show-progress: false

.github/workflows/forum_post.py

@@ -86,7 +86,7 @@ def _get_release_notes(self) -> tuple[str, str]:
         release_url = (
             f"https://api.github.com/repos/{self.project}/releases/tags/{self.release}"
         )
-        with urllib.request.urlopen(release_url) as url:  # noqa: S310
+        with urllib.request.urlopen(release_url) as url:
             data = json.load(url)
 
         release_notes = data["body"]
@@ -98,7 +98,7 @@ def _get_category_id(self) -> str:
         categories_url = (
             "https://forum.ansible.com/categories.json?include_subcategories=true"
         )
-        categories_request = Request(categories_url)  # noqa: S310
+        categories_request = Request(categories_url)
         categories_request.add_header("Api-Key", self.forum_api_key)
         categories_request.add_header("Api-Username", self.forum_user)
         with urllib.request.urlopen(url=categories_request) as url:  # noqa: S310
@@ -138,7 +138,7 @@ def post(self) -> None:
         data = json.dumps(payload).encode("utf-8")
 
         url = "https://forum.ansible.com/posts.json"
-        request = Request(url)  # noqa: S310
+        request = Request(url)
         request.method = "POST"
         request.add_header("Api-Key", self.forum_api_key)
         request.add_header("Api-Username", self.forum_user)

.github/workflows/guardian-daily.yml

@@ -34,12 +34,12 @@ jobs:
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Ensure report directories
         run: mkdir -p "${SKILL_ROOT}/reports" "${SITE_DIR}"

.github/workflows/guardian-on-demand.yml

@@ -33,12 +33,12 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Ensure report directories
         run: mkdir -p "${SKILL_ROOT}/reports"

.github/workflows/guardian-weekly.yml

@@ -35,12 +35,12 @@ jobs:
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Ensure report directories
         run: mkdir -p "${SKILL_ROOT}/reports" "${SITE_DIR}"

.github/workflows/push.yml

@@ -18,7 +18,7 @@ jobs:
       contents: write # release-drafter updates draft releases
       pull-requests: read
     steps:
-      - uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7
+      - uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/push_network.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: write # release-drafter updates draft releases
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: ${{ inputs.repo }}
           fetch-depth: 0
@@ -51,7 +51,7 @@ jobs:
 
       - name: Run release drafter
         id: release_drafter
-        uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/release.yml

@@ -37,7 +37,7 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Check out src from Git
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0 # needed by setuptools-scm
 

.github/workflows/release_ah.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-24.04
     environment: ${{ inputs.environment }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Build the collection
         run: |

.github/workflows/release_collection.yml

@@ -27,15 +27,15 @@ permissions:
 jobs:
   release_automation_hub:
     # Pin by SHA for OpenSSF Scorecard Pinned-Dependencies (cross-repo callers need owner/repo@ref).
-    uses: ansible/team-devtools/.github/workflows/release_ah.yml@6446fb695ce7a3d181a85cb24ff9349bdcec8e08 # main
+    uses: ansible/team-devtools/.github/workflows/release_ah.yml@52cd2a024bb3d3a22bba5d9169798bb9b13848a4 # main
     with:
       environment: release
     secrets:
       ah_token: ${{ secrets.ah_token }}
 
   release_galaxy:
     # Keep in sync with release_automation_hub pin when release_galaxy.yml changes.
-    uses: ansible/team-devtools/.github/workflows/release_galaxy.yml@6446fb695ce7a3d181a85cb24ff9349bdcec8e08 # main
+    uses: ansible/team-devtools/.github/workflows/release_galaxy.yml@52cd2a024bb3d3a22bba5d9169798bb9b13848a4 # main
     needs: [release_automation_hub]
     with:
       environment: release

.github/workflows/release_galaxy.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-24.04
     environment: ${{ inputs.environment }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Build the collection
         run: |

.github/workflows/scorecard.yml

@@ -37,12 +37,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -73,6 +73,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard (optional).
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b7351df727350dca84cb9d725d57dcf5bc82ba26 # v3.37.1
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           sarif_file: results.sarif

.github/workflows/sync_skills.yml

@@ -28,7 +28,7 @@ jobs:
           - ansible/vscode-ansible
     steps:
       - name: Checkout target repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: ${{ matrix.repo }}
           token: ${{ secrets.BOT_PAT }}

.github/workflows/test.yml

@@ -43,7 +43,7 @@ jobs:
           echo "github.event.action: ${{ github.event.action }}"
           echo "github.event.inputs: ${{ github.event.inputs }}"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
           ref: ${{ github.head_ref }}

.github/workflows/tox.yml

@@ -103,7 +103,7 @@ jobs:
     outputs:
       matrix: ${{ steps.generate_matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0 # needed by setuptools-scm
           submodules: true
@@ -157,7 +157,7 @@ jobs:
       matrix: ${{ fromJson(needs.prepare.outputs.matrix) }}
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0 # needed by setuptools-scm
           submodules: true
@@ -190,13 +190,13 @@ jobs:
 
       - name: Set up Node.js (custom)
         if: ${{ inputs.node-version-file != '' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version-file: ${{ inputs.node-version-file }}
 
       - name: Set up Node.js
         if: ${{ inputs.node-version-file == '' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: "24"
 
@@ -313,7 +313,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install the latest version of uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2

.pre-commit-config.yaml

@@ -14,7 +14,7 @@ repos:
       - id: check-useless-excludes
         priority: 0
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.11.28
+    rev: 0.11.32
     hooks:
       - id: uv-sync
         priority: 0
@@ -25,15 +25,15 @@ repos:
         args: ["--upgrade"]
         stages: [manual]
   - repo: https://github.com/biomejs/pre-commit
-    rev: "v2.5.3"
+    rev: "v2.5.5"
     hooks:
       - id: biome-check
         priority: 1
         name: biome
         alias: biome
         args: [--unsafe]
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: v2.4.3
     hooks:
       - id: codespell
         priority: 0
@@ -53,7 +53,7 @@ repos:
       - id: check-merge-conflict
         priority: 0
   - repo: https://github.com/tombi-toml/tombi-pre-commit
-    rev: v1.2.0
+    rev: v1.2.4
     hooks:
       - id: tombi-format
         alias: toml