chore(ci): bump the github-actions group with 5 updates

.github/workflows/apidocs-drift.yml

@@ -90,7 +90,7 @@ jobs:
         with:
           version: 10.33.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: "22"
           cache: pnpm

.github/workflows/ci.yml

@@ -185,7 +185,7 @@ jobs:
       # override even for `cargo install`), which broke this job. A prebuilt
       # binary is immune to future tool-dependency MSRV bumps.
       - name: Install cargo-audit
-        uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2
+        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           tool: cargo-audit
 
@@ -199,7 +199,7 @@ jobs:
           version: 10.33.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: "22"
 
@@ -218,7 +218,7 @@ jobs:
           command: check licenses sources
 
       - name: Install cargo-vet
-        uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2
+        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           # 0.10.2+ parses trusted-publisher entries in imports.lock (wasmtime
           # crates publish via GitHub trusted publishing); 0.10.0 rejects them.
@@ -262,7 +262,7 @@ jobs:
       - name: Install uutils coreutils multicall for differential tests
         id: install_uutils
         continue-on-error: true
-        uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2
+        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           tool: coreutils
       - name: Verify uutils on PATH

.github/workflows/coreutils-args-drift.yml

@@ -227,7 +227,7 @@ jobs:
 
       - name: Upload drift patch
         if: steps.diff.outputs.drifted == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coreutils-drift-patch
           path: ${{ runner.temp }}/coreutils-drift.patch
@@ -251,7 +251,7 @@ jobs:
           persist-credentials: false
 
       - name: Download drift patch
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: coreutils-drift-patch
           path: ${{ runner.temp }}/coreutils-drift

.github/workflows/coverage.yml

@@ -39,7 +39,7 @@ jobs:
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
       - name: Install cargo-tarpaulin
-        uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2
+        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           tool: cargo-tarpaulin
 
@@ -69,7 +69,7 @@ jobs:
             --engine llvm
 
       - name: Upload coverage artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: rust-coverage-report
           path: coverage/
@@ -94,15 +94,15 @@ jobs:
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2
+        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           tool: cargo-llvm-cov
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
 
       - name: Generate Python-driven Rust coverage
         run: |
@@ -122,7 +122,7 @@ jobs:
             --ignore-filename-regex "$LLVM_COV_IGNORE_FILENAME_REGEX"
 
       - name: Upload Python coverage artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: python-rust-coverage-report
           path: coverage/python-rust-coverage.json
@@ -145,7 +145,7 @@ jobs:
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2
+        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           tool: cargo-llvm-cov
 
@@ -155,7 +155,7 @@ jobs:
           version: 10.33.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: "22"
           cache: pnpm
@@ -183,7 +183,7 @@ jobs:
             --ignore-filename-regex "$LLVM_COV_IGNORE_FILENAME_REGEX"
 
       - name: Upload Node coverage artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: node-rust-coverage-report
           path: coverage/node-rust-coverage.json
@@ -198,7 +198,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: "*-coverage-report"
           merge-multiple: true

.github/workflows/debian-oracle.yml

@@ -53,7 +53,7 @@ jobs:
 
       - name: Upload failing cases
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: debian-oracle-fails
           path: |

.github/workflows/fuzz.yml

@@ -68,7 +68,7 @@ jobs:
 
       - name: Upload crash artifacts
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: fuzz-crashes-${{ matrix.target }}
           path: |

.github/workflows/js.yml

@@ -52,7 +52,7 @@ jobs:
           version: 10.33.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: "22"
           cache: pnpm
@@ -122,7 +122,7 @@ jobs:
 
       - name: Setup Node.js
         if: matrix.runtime == 'node'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: ${{ matrix.version }}
           cache: pnpm
@@ -132,7 +132,7 @@ jobs:
 
       - name: Setup Node.js (for napi build)
         if: matrix.runtime != 'node'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: "22"
           cache: pnpm

.github/workflows/nightly.yml

@@ -62,7 +62,7 @@ jobs:
       # dependencies resolve unlocked, and an MSRV bump in one of them past our
       # pinned toolchain broke this step once already in CI.
       - name: Install cargo-audit
-        uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2
+        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           tool: cargo-audit
 
@@ -74,7 +74,7 @@ jobs:
           version: 10.33.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: "22"
 
@@ -107,7 +107,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload geiger report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: geiger-report
           path: geiger-report.txt

.github/workflows/publish-js.yml

@@ -91,7 +91,7 @@ jobs:
           version: 10.33.0
 
       - name: Setup node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: 24
           cache: pnpm
@@ -124,7 +124,7 @@ jobs:
         working-directory: crates/bashkit-js
 
       - name: Upload native binding
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: js-bindings-${{ matrix.settings.target }}
           path: |
@@ -135,7 +135,7 @@ jobs:
       # Upload generated JS stubs from one build (they're identical across targets)
       - if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
         name: Upload JS stubs
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: js-stubs
           path: |
@@ -195,7 +195,7 @@ jobs:
           version: 10.33.0
 
       - name: Setup node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: ${{ matrix.node }}
           cache: pnpm
@@ -207,13 +207,13 @@ jobs:
         working-directory: crates/bashkit-js
 
       - name: Download native binding
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: js-bindings-${{ matrix.settings.target }}
           path: crates/bashkit-js
 
       - name: Download JS stubs
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: js-stubs
           path: crates/bashkit-js
@@ -318,7 +318,7 @@ jobs:
           version: 10.33.0
 
       - name: Setup node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: ${{ matrix.node }}
           cache: pnpm
@@ -347,13 +347,13 @@ jobs:
         working-directory: crates/bashkit-js
 
       - name: Download native binding
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: js-bindings-${{ matrix.target }}
           path: crates/bashkit-js
 
       - name: Download JS stubs
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: js-stubs
           path: crates/bashkit-js
@@ -443,7 +443,7 @@ jobs:
   #       with:
   #         version: 10.33.0
   #     - name: Setup node
-  #       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+  #       uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
   #       with:
   #         node-version: 24
   #         cache: pnpm
@@ -452,12 +452,12 @@ jobs:
   #       run: pnpm install --frozen-lockfile --cpu wasm32
   #       working-directory: crates/bashkit-js
   #     - name: Download native binding
-  #       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+  #       uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
   #       with:
   #         name: js-bindings-wasm32-wasip1-threads
   #         path: crates/bashkit-js
   #     - name: Download JS stubs
-  #       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+  #       uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
   #       with:
   #         name: js-stubs
   #         path: crates/bashkit-js
@@ -502,7 +502,7 @@ jobs:
           version: 10.33.0
 
       - name: Setup node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: 24
           cache: pnpm
@@ -514,14 +514,14 @@ jobs:
         working-directory: crates/bashkit-js
 
       - name: Download all native bindings
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: js-bindings-*
           merge-multiple: true
           path: crates/bashkit-js
 
       - name: Download JS stubs
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: js-stubs
           path: crates/bashkit-js