Validation only: coordinated dependency updates

.changeset/coordinated-dependency-updates.md

@@ -0,0 +1,5 @@
+---
+"sql-fs-api": patch
+---
+
+Update jose to 6.2.12 for JWT, JWS, JWE, and remote JWKS validation fixes.

.github/workflows/ci.yml

@@ -17,9 +17,9 @@ jobs:
     name: Lint & Typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
       - uses: actions/setup-node@v4
         with:
@@ -42,9 +42,9 @@ jobs:
     name: Unit Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
       - uses: actions/setup-node@v4
         with:
@@ -62,9 +62,9 @@ jobs:
       run:
         working-directory: clients/typescript
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
       - uses: actions/setup-node@v4
         with:
@@ -82,9 +82,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [lint-typecheck, unit-tests]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
       - uses: actions/setup-node@v4
         with:
@@ -96,7 +96,7 @@ jobs:
       - run: pnpm build
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
@@ -108,21 +108,21 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v4
         with:
           node-version-file: .node-version
           cache: pnpm
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: pip install uv==0.9.18
       - run: pnpm setup:dev
       - run: pnpm verify:architecture
       - name: Upload verification evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: integration-evidence
           path: scripts/verify/.run/

.github/workflows/dependency-validation.yml

@@ -0,0 +1,37 @@
+name: Dependency merge validation
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-proof:
+    if: github.head_ref == 'chore/dependency-proof-20261014'
+    name: Full dependency proof
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .node-version
+          cache: pnpm
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - run: pip install uv==0.9.18
+      - run: pnpm setup:dev
+      - run: pnpm check
+      - run: pnpm security:audit
+      - run: pnpm verify:architecture
+      - name: Upload verification evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: dependency-proof
+          path: scripts/verify/.run/
+          include-hidden-files: true
+          retention-days: 7

.github/workflows/python-sdk-ci.yml

@@ -21,9 +21,9 @@ jobs:
     name: Lint & Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -40,9 +40,9 @@ jobs:
     name: Type Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.9"
 
@@ -59,9 +59,9 @@ jobs:
       matrix:
         python-version: ["3.9", "3.11", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/python-sdk-release.yml

@@ -28,7 +28,7 @@ jobs:
       contents: write   # git push tag + GitHub Release creation
       id-token: write   # OIDC token for PyPI trusted publisher
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -125,7 +125,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       # ── 4. Build sdist + wheel ─────────────────────────────────────────────
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         if: steps.detect.outputs.RELEASE == 'true'
         with:
           python-version: "3.12"
@@ -138,7 +138,7 @@ jobs:
 
       - name: Upload build artifacts
         if: steps.detect.outputs.RELEASE == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: python-sdk-dist-${{ steps.detect.outputs.VERSION }}
           path: clients/python/dist/
@@ -166,7 +166,7 @@ jobs:
 
       - name: Create GitHub Release
         if: steps.detect.outputs.RELEASE == 'true'
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: python-sdk-v${{ steps.detect.outputs.VERSION }}
           name: Python SDK v${{ steps.detect.outputs.VERSION }}

.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
     name: Build, push & maybe release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -151,7 +151,7 @@ jobs:
 
       - name: Create GitHub Release
         if: steps.detect.outputs.RELEASE == 'true'
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: v${{ steps.detect.outputs.VERSION }}
           name: Release v${{ steps.detect.outputs.VERSION }}

.github/workflows/security.yml

@@ -16,15 +16,15 @@ jobs:
     name: Dependency audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v4
         with:
           node-version-file: .node-version
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm security:audit
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: pip install uv==0.9.18
@@ -40,7 +40,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript,python

.github/workflows/ts-sdk-release.yml

@@ -27,7 +27,7 @@ jobs:
     name: Test & typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -36,7 +36,7 @@ jobs:
           node-version: "22"
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
 
       - name: Install dependencies
         run: pnpm install --ignore-workspace --frozen-lockfile
@@ -59,7 +59,7 @@ jobs:
       RELEASE: ${{ steps.detect.outputs.RELEASE }}
       VERSION: ${{ steps.detect.outputs.VERSION }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -113,7 +113,7 @@ jobs:
     permissions:
       contents: write # git push tag + GitHub Release creation
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -124,7 +124,7 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
 
       - name: Verify version consistency
         run: |
@@ -174,7 +174,7 @@ jobs:
         run: pnpm build
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ts-sdk-dist-${{ needs.detect.outputs.VERSION }}
           path: clients/typescript/dist/
@@ -195,7 +195,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ts-sdk-v${{ needs.detect.outputs.VERSION }}
           name: TypeScript SDK v${{ needs.detect.outputs.VERSION }}