ci(deps): bump the actions-minor-and-patch group across 1 directory with 6 updates

.github/workflows/bun-scanner.yml

@@ -57,7 +57,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
       - name: Test the production staging decision and summary with a stub registry

.github/workflows/demo.yml

@@ -153,7 +153,7 @@ jobs:
           ls -l docs/demo.gif
 
       - name: Upload the recording as an artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: demo
           path: docs/demo.gif
@@ -173,7 +173,7 @@ jobs:
         with:
           persist-credentials: true
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: demo
           path: docs

.github/workflows/npm-publish.yml

@@ -108,7 +108,7 @@ jobs:
           # The same release the bun-scanner test workflow pins.
           bun-version: "1.4.2"
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           # npm 12 asks for ^24.15.0 on the 24 line; setup-node resolves the
           # newest 24.x, which has been past that since 2026.

.github/workflows/pnpm-hook.yml

@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
       - name: Install the pinned pnpm test runner outside the integration

.github/workflows/release.yml

@@ -88,7 +88,7 @@ jobs:
           cosign-release: v3.1.3
 
       - name: Install syft
-        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           # Newest syft release on 2026-09-09. The action adds it to PATH.
           syft-version: v1.51.1
@@ -98,7 +98,7 @@ jobs:
         run: echo "epoch=$(git log -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"
 
       - name: Build, sign and publish with goreleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           distribution: goreleaser
           version: v2.18.1

.github/workflows/selftest.yml

@@ -129,7 +129,7 @@ jobs:
           steps.sarif.outputs.found == 'true' &&
           (github.event_name == 'workflow_dispatch' ||
            github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: trustdiff.sarif
           # Keeps trustdiff's findings apart from other analyses of the same commit.

action.yml

@@ -444,7 +444,7 @@ runs:
         steps.run.outputs.report != '' &&
         (github.event_name != 'pull_request' ||
          github.event.pull_request.head.repo.full_name == github.repository)
-      uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
       with:
         sarif_file: ${{ steps.run.outputs.report }}
         # Keeps trustdiff's findings apart from other analyses of the same commit.