Consolidate Dependabot updates and patch sharp security alert

.config/dotnet-tools.json

@@ -3,11 +3,11 @@
   "isRoot": true,
   "tools": {
     "cyclonedx": {
-      "version": "6.2.0",
+      "version": "6.3.0",
       "commands": [
         "dotnet-CycloneDX"
       ],
       "rollForward": false
     }
   }
-}
+}

.github/workflows/azure-live-qualification.yml

@@ -25,7 +25,7 @@ jobs:
           dotnet-version: 10.0.x
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22.x
 

.github/workflows/ci.yml

@@ -115,7 +115,7 @@ jobs:
 
       - name: Set up Node
         if: ${{ needs.changes.outputs.javascript == 'true' }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22.x
           cache: npm

.github/workflows/codeql.yml

@@ -95,14 +95,14 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ steps.selection.outputs.enabled == 'true' }}
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build_mode }}
 
       - name: Analyze
         if: ${{ steps.selection.outputs.enabled == 'true' }}
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: /language:${{ matrix.language }}
           output: artifacts/codeql/${{ matrix.language }}

.github/workflows/container-security.yml

@@ -81,14 +81,14 @@ jobs:
 
       - name: Upload server findings to code scanning
         if: ${{ always() && hashFiles('artifacts/container-security/vyral-server.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: artifacts/container-security/vyral-server.sarif
           category: /container:vyral-server
 
       - name: Upload worker findings to code scanning
         if: ${{ always() && hashFiles('artifacts/container-security/execution-smoke-worker.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: artifacts/container-security/execution-smoke-worker.sarif
           category: /container:execution-smoke-worker

.github/workflows/publish-first-cohort.yml

@@ -134,7 +134,7 @@ jobs:
           dotnet-version: 10.0.x
 
       - name: Download the authorized distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: package-release-v0.3.4
           path: dist
@@ -174,7 +174,7 @@ jobs:
       id-token: write
     steps:
       - name: Download the authorized distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: package-release-v0.3.4
           path: dist

.github/workflows/python-runtime-qualification.yml

@@ -100,7 +100,7 @@ jobs:
             runtimes/python/pyproject.toml
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22.x
           cache: npm
@@ -229,7 +229,7 @@ jobs:
           python-version: "3.12"
 
       - name: Download platform receipts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: python-runtime-*-${{ github.sha }}
           path: artifacts/platform-receipts

.github/workflows/release-integrity.yml

@@ -43,7 +43,7 @@ jobs:
 
       - name: Set up Node
         if: ${{ github.event_name != 'pull_request' }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22.x
 

runtimes/python/pyproject.toml

@@ -42,7 +42,7 @@ extropic-torx = [
 ]
 dev = [
   "build>=1.2,<2",
-  "coverage==7.16.1",
+  "coverage==7.16.2",
   "jsonschema>=4.23,<5",
   "mypy>=1.18,<3"
 ]