chore(deps): bump the actions group across 1 directory with 3 updates (#43)

Bumps the actions group with 3 updates in the / directory:
[actions/upload-artifact](https://github.com/actions/upload-artifact),
[actions-rust-lang/setup-rust-toolchain](https://github.com/actions-rust-lang/setup-rust-toolchain)
and
[trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog).

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the readme with direct upload details by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li>
<li>Readme: bump all the example versions to v7 by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></li>
<li>Include changes in typespec/ts-http-runtime 0.3.5 by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/797">actions/upload-artifact#797</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7...v7.0.1">https://github.com/actions/upload-artifact/compare/v7...v7.0.1</a></p>
<h2>v7.0.0</h2>
<h2>v7 What's new</h2>
<h3>Direct Uploads</h3>
<p>Adds support for uploading single files directly (unzipped). Callers
can set the new <code>archive</code> parameter to <code>false</code> to
skip zipping the file during upload. Right now, we only support single
files. The action will fail if the glob passed resolves to multiple
files. The <code>name</code> parameter is also ignored with this
setting. Instead, the name of the artifact will be the name of the
uploaded file.</p>
<h3>ESM</h3>
<p>To support new versions of the <code>@actions/*</code> packages,
we've upgraded the package to ESM.</p>
<h2>What's Changed</h2>
<ul>
<li>Add proxy integration test by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li>
<li>Upgrade the module to ESM and bump dependencies by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/762">actions/upload-artifact#762</a></li>
<li>Support direct file uploads by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/764">actions/upload-artifact#764</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Link"><code>@​Link</code></a>- made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v6...v7.0.0">https://github.com/actions/upload-artifact/compare/v6...v7.0.0</a></p>
<h2>v6.0.0</h2>
<h2>v6 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/upload-artifact@v6 now runs on Node.js 24 (<code>runs.using:
node24</code>) and requires a minimum Actions Runner version of 2.327.1.
If you are using self-hosted runners, ensure they are updated before
upgrading.</p>
</blockquote>
<h3>Node.js 24</h3>
<p>This release updates the runtime to Node.js 24. v5 had preliminary
support for Node.js 24, however this action was by default still running
on Node.js 20. Now this action by default will run on Node.js 24.</p>
<h2>What's Changed</h2>
<ul>
<li>Upload Artifact Node 24 support by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/719">actions/upload-artifact#719</a></li>
<li>fix: update <code>@​actions/artifact</code> for Node.js 24 punycode
deprecation by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/744">actions/upload-artifact#744</a></li>
<li>prepare release v6.0.0 for Node.js 24 support by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/745">actions/upload-artifact#745</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0">https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0</a></p>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"><code>043fb46</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/797">#797</a>
from actions/yacaovsnc/update-dependency</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94"><code>634250c</code></a>
Include changes in typespec/ts-http-runtime 0.3.5</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8"><code>e454baa</code></a>
Readme: bump all the example versions to v7 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/796">#796</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e"><code>74fad66</code></a>
Update the readme with direct upload details (<a
href="https://redirect.github.com/actions/upload-artifact/issues/795">#795</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f"><code>bbbca2d</code></a>
Support direct file uploads (<a
href="https://redirect.github.com/actions/upload-artifact/issues/764">#764</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296"><code>589182c</code></a>
Upgrade the module to ESM and bump dependencies (<a
href="https://redirect.github.com/actions/upload-artifact/issues/762">#762</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5"><code>47309c9</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/754">#754</a>
from actions/Link-/add-proxy-integration-tests</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0"><code>02a8460</code></a>
Add proxy integration test</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f"><code>b7c566a</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/745">#745</a>
from actions/upload-artifact-v6-release</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b"><code>e516bc8</code></a>
docs: correct description of Node.js 24 support in README</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/upload-artifact/compare/v4.6.2...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions-rust-lang/setup-rust-toolchain` from 1.16.0 to 1.16.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions-rust-lang/setup-rust-toolchain/releases">actions-rust-lang/setup-rust-toolchain's
releases</a>.</em></p>
<blockquote>
<h2>v1.16.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Rename local variables to avoid conflicts with global variables by
<a href="https://github.com/jonasbb"><code>@​jonasbb</code></a> in <a
href="https://redirect.github.com/actions-rust-lang/setup-rust-toolchain/pull/92">actions-rust-lang/setup-rust-toolchain#92</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions-rust-lang/setup-rust-toolchain/compare/v1.16.0...v1.16.1">https://github.com/actions-rust-lang/setup-rust-toolchain/compare/v1.16.0...v1.16.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions-rust-lang/setup-rust-toolchain/blob/main/CHANGELOG.md">actions-rust-lang/setup-rust-toolchain's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this
file.</p>
<p>The format is based on <a
href="https://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>,
and this project adheres to <a
href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p>
<h2>[Unreleased]</h2>
<h2>[1.16.1] - 2026-05-08</h2>
<ul>
<li>Renamed internally used variable to avoid clashes with globally
existing variables.
This fixes the interference of the TOOLCHAIN variable as reported in <a
href="https://redirect.github.com/actions-rust-lang/setup-rust-toolchain/issues/91">#91</a>.</li>
</ul>
<h2>[1.16.0] - 2026-04-13</h2>
<ul>
<li>Add new parameter <code>cache-save-if</code> that is propagated to
<code>Swatinem/rust-cache</code> as <code>save-if</code> (<a
href="https://redirect.github.com/actions-rust-lang/setup-rust-toolchain/issues/90">#90</a>
by <a
href="https://github.com/ChanTsune"><code>@​ChanTsune</code></a>)</li>
</ul>
<h2>[1.15.4] - 2026-03-15</h2>
<ul>
<li>Bump Swatinem/rust-cache from 2.8.2 to 2.9.1 (<a
href="https://redirect.github.com/actions-rust-lang/setup-rust-toolchain/issues/87">#87</a>
by <a
href="https://github.com/hyperfinitism"><code>@​hyperfinitism</code></a>)
This gets rid of the warnings about Node.js 20.</li>
</ul>
<h2>[1.15.3] - 2026-03-01</h2>
<ul>
<li>Bump Swatinem/rust-cache from 2.8.1 to 2.8.2</li>
</ul>
<h2>[1.15.2] - 2025-10-04</h2>
<ul>
<li>Fix: Run the version detection steps in the selected
<code>rust-src-dir</code> directory.
This should enable the version selection even without a default
toolchain installed.
Fixes <a
href="https://redirect.github.com/actions-rust-lang/setup-rust-toolchain/issues/74">#74</a>.</li>
</ul>
<h2>[1.15.1] - 2025-09-23</h2>
<ul>
<li>Update <code>Swatinem/rust-cache</code> to v2.8.1</li>
</ul>
<h2>[1.15.0] - 2025-09-14</h2>
<ul>
<li>Add support for non-root source directory.
Accept source code and <code>rust-toolchain.toml</code> file in
subdirectories of the repository.
Adds a new parameter <code>rust-src-dir</code> that controls the lookup
for toolchain files and sets a default value for the
<code>cache-workspace</code> input. (<a
href="https://redirect.github.com/actions-rust-lang/setup-rust-toolchain/issues/69">#69</a>
by <a href="https://github.com/Kubaryt"><code>@​Kubaryt</code></a>)</li>
</ul>
<h2>[1.14.1] - 2025-08-28</h2>
<ul>
<li>Pin <code>Swatinem/rust-cache</code> action to a full commit SHA (<a
href="https://redirect.github.com/actions-rust-lang/setup-rust-toolchain/issues/68">#68</a>
by <a
href="https://github.com/JohnTitor"><code>@​JohnTitor</code></a>)</li>
</ul>
<h2>[1.14.0] - 2025-08-23</h2>
<ul>
<li>Add new parameters <code>cache-all-crates</code> and
<code>cache-workspace-crates</code> that are propagated to
<code>Swatinem/rust-cache</code> as <code>cache-all-crates</code> and
<code>cache-workspace-crates</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions-rust-lang/setup-rust-toolchain/commit/46268bd060767258de96ed93c1251119784f2ab6"><code>46268bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions-rust-lang/setup-rust-toolchain/issues/92">#92</a>
from actions-rust-lang/rename-local-variables</li>
<li><a
href="https://github.com/actions-rust-lang/setup-rust-toolchain/commit/826365c0755e87af42e9970334574c853503b60c"><code>826365c</code></a>
Update changelog</li>
<li><a
href="https://github.com/actions-rust-lang/setup-rust-toolchain/commit/4f937ac0ba337db0b2c2394bdb358f5865caa038"><code>4f937ac</code></a>
Rename local variables to avoid conflicts with global variables</li>
<li>See full diff in <a
href="https://github.com/actions-rust-lang/setup-rust-toolchain/compare/2b1f5e9b395427c92ee4e3331786ca3c37afe2d7...46268bd060767258de96ed93c1251119784f2ab6">compare
view</a></li>
</ul>
</details>
<br />

Updates `trufflesecurity/trufflehog` from 3.95.2 to 3.95.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/trufflesecurity/trufflehog/releases">trufflesecurity/trufflehog's
releases</a>.</em></p>
<blockquote>
<h2>v3.95.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it
consistent with its Analyzer by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4906">trufflesecurity/trufflehog#4906</a></li>
<li>Rename AnalysisInfo field to SecretParts on detectors.Result by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4911">trufflesecurity/trufflehog#4911</a></li>
<li>Document SecretParts contract in detector-authoring docs by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4912">trufflesecurity/trufflehog#4912</a></li>
<li>Add a static check for detectors that don't set SecretParts by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4913">trufflesecurity/trufflehog#4913</a></li>
<li>Populate SecretParts on all detectors by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4919">trufflesecurity/trufflehog#4919</a></li>
<li>Make checksecretparts required in CI by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4921">trufflesecurity/trufflehog#4921</a></li>
<li>Deduplicate concurrent credential verification requests via
singleflight by <a
href="https://github.com/kashifkhan0771"><code>@​kashifkhan0771</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4314">trufflesecurity/trufflehog#4314</a></li>
<li>log non-critical chunk errors at V(2).Info instead of Error by <a
href="https://github.com/johnelliott"><code>@​johnelliott</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4928">trufflesecurity/trufflehog#4928</a></li>
<li>[INS-320] Cloudinary detector by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4747">trufflesecurity/trufflehog#4747</a></li>
<li>ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth
v3) by <a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4933">trufflesecurity/trufflehog#4933</a></li>
<li>chore: bump golangci-lint-action v7 → v9 (Node 24) by <a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4936">trufflesecurity/trufflehog#4936</a></li>
<li>Add default Content-Type: application/json header for custom
detector verification request by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4947">trufflesecurity/trufflehog#4947</a></li>
<li>Make detector Result.SecretParts initialization stricter by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4948">trufflesecurity/trufflehog#4948</a></li>
<li>Add Pinecone API key detector by <a
href="https://github.com/dylanTruffle"><code>@​dylanTruffle</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4917">trufflesecurity/trufflehog#4917</a></li>
<li>adding customizable successRanges and rotatedRanges to
customDetector by <a
href="https://github.com/jordanTunstill"><code>@​jordanTunstill</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4892">trufflesecurity/trufflehog#4892</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/trufflesecurity/trufflehog/compare/v3.95.2...v3.95.3">https://github.com/trufflesecurity/trufflehog/compare/v3.95.2...v3.95.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/37b77001d0174ebec2fcca2bd83ff83a6d45a3ab"><code>37b7700</code></a>
adding customizable successRanges and rotatedRanges to customDetector
(<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4892">#4892</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/ba0a524d6e51744d9d4e306bc57ac5d6ca5173ea"><code>ba0a524</code></a>
Add Pinecone API key detector (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4917">#4917</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/ab5dd03ee012e5f372e2ba82c4813c2ba1331261"><code>ab5dd03</code></a>
Make detector Result.SecretParts initialization stricter (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4948">#4948</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/90ca685b33dd2ad6fe7d287d935f85088260ec90"><code>90ca685</code></a>
Add default Content-Type: application/json header for custom detector
verific...</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/5f47aad1c2df34f7c6230784ce9a5a659922f479"><code>5f47aad</code></a>
chore: bump golangci-lint-action v7 → v9 (Node 24) (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4936">#4936</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/a4e3016d045b88a1a93acf6f9012af7b8158e9f3"><code>a4e3016</code></a>
ci: bump JS actions to Node 24 majors (checkout v6, setup-go v6, codeql
v4, a...</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/8a12e8e2fb6f3c4a4294a8e63b3659af6c08cfe3"><code>8a12e8e</code></a>
[INS-320] Cloudinary detector (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4747">#4747</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/cf31c26af3131bd053d161a3b2155ed0cc47a050"><code>cf31c26</code></a>
Log non-critical chunk errors at V(2).Info instead of Error (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4928">#4928</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/99dc7bd6c06427bcb32f32fe1641d7fb83583915"><code>99dc7bd</code></a>
Deduplicate concurrent credential verification requests via singleflight
(<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4314">#4314</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/3fc0c2aa6648d54242e4af6fbfde0701796e4fb0"><code>3fc0c2a</code></a>
Make checksecretparts required in CI (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4921">#4921</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/trufflesecurity/trufflehog/compare/17456f8c7d042d8c82c9a8ca9e937231f9f42e26...37b77001d0174ebec2fcca2bd83ff83a6d45a3ab">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/ci-cd.yml

@@ -166,7 +166,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
+        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
         with:
           toolchain: ${{ env.RUST_VERSION }}
           components: rustfmt, clippy

.github/workflows/hypatia-scan.yml

@@ -80,7 +80,7 @@ jobs:
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload findings artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: hypatia-findings
           path: hypatia-findings.json

.github/workflows/quality.yml

@@ -18,7 +18,7 @@ jobs:
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@17456f8c7d042d8c82c9a8ca9e937231f9f42e26 # v3.88.3
+        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3.88.3
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}

.github/workflows/secret-scanner.yml

@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0  # Full history for scanning
 
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@17456f8c7d042d8c82c9a8ca9e937231f9f42e26 # v3
+        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3
         with:
           # The v3 action injects --fail automatically on pull_request events.
           # Passing --fail here triggers "flag 'fail' cannot be repeated".