ci: update CI dependencies and bump versions for various actions

.github/workflows/bootstrap.yml

@@ -41,7 +41,7 @@ jobs:
           echo "distribution=$DISTRIBUTION" >> $GITHUB_OUTPUT
 
       - name: Install yq
-        uses: mikefarah/yq@v4.52.2
+        uses: mikefarah/yq@v4.52.5
 
       - name: Load bootstrap config
         id: load_config

.github/workflows/cd.yml

@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Download build artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: python-package-distributions-${{ github.event.workflow_run.head_sha }}
           path: dist/
@@ -98,7 +98,7 @@ jobs:
 #
 #    steps:
 #      - name: Download build artifacts
-#        uses: actions/download-artifact@v7
+#        uses: actions/download-artifact@v8
 #        with:
 #          name: python-package-distributions-${{ github.event.workflow_run.head_sha }}
 #          path: dist/
@@ -123,7 +123,7 @@ jobs:
 #        uses: actions/checkout@v6
 #
 #      - name: Download build artifacts
-#        uses: actions/download-artifact@v7
+#        uses: actions/download-artifact@v8
 #        with:
 #          name: python-package-distributions-${{ github.event.workflow_run.head_sha }}
 #          path: dist/

.github/workflows/ci.yml

@@ -79,7 +79,7 @@ jobs:
 
       - name: Upload coverage report as artifact
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.python-version == env.PYTHON_VERSION }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-report-${{ matrix.python-version }}-${{ matrix.os }}-${{ github.run_id }}
           path: |
@@ -88,7 +88,7 @@ jobs:
 
       - name: Upload coverage reports to Codecov
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.python-version == env.PYTHON_VERSION }}
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
@@ -119,7 +119,7 @@ jobs:
           uv build
 
       - name: Upload distribution as artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: python-package-distributions-${{ github.sha }}
           path: dist/
@@ -150,7 +150,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Download build artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: python-package-distributions-${{ github.sha }}
           path: dist/

.github/workflows/pr-checks.yml

@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check PR has description
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const pr = context.payload.pull_request;
@@ -152,15 +152,15 @@ jobs:
 
       - name: Upload coverage report as artifact
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-report-${{ env.PYTHON_VERSION }}-${{ github.run_id }}
           path: |
             .log/coverage/htmlcov
             .log/coverage/coverage.xml
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           override_pr: ${{ github.event.pull_request.number }}
@@ -225,7 +225,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Apply labels based on PR title
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const prTitle = context.payload.pull_request.title.toLowerCase();

.github/workflows/security.yml

@@ -58,7 +58,7 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
       - name: Upload SARIF as build artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: snyk-results
           path: |
@@ -102,7 +102,7 @@ jobs:
 
       - name: Upload Bandit results
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: bandit-report
           path: bandit-report.json

pyproject.toml

@@ -14,17 +14,17 @@ classifiers = [
 ]
 
 dependencies = [
-    "pydantic-settings>=2.12.0",
+    "pydantic-settings>=2.13.1",
     "structlog>=25.5.0",
 ]
 
 [dependency-groups]
-test = ["pytest>=9.0.0", "pytest-cov>=7.0.0"]
+test = ["pytest>=9.0.0", "pytest-cov>=7.1.0"]
 quality = ["prek>=0.3.1", "bandit[toml]>=1.7.6", "ruff>=0.14.7", "mypy>=1.19.0"]
 dev = [
     {include-group = "test"},
     {include-group = "quality"},
-    "python-dotenv>=1.2.1",
+    "python-dotenv>=1.2.2",
 ]
 
 [project.urls]