chore(deps): update github actions

.github/actions/setup/action.yml

@@ -27,14 +27,14 @@ runs:
         node-version: "24"
     - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
       with:
-        python-version: "3.13"
+        python-version: "3.14"
     # uv provides uvx for pinned Semgrep CE and the pinned
     # foreman CLI (see taskfiles/foreman.yml).
     - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
     - uses: arduino/setup-task@c0bc642852239c2689f73f4ea6459c29405f3c52 # v3.0.0
       with:
         # renovate: datasource=github-releases depName=go-task/task extractVersion=^v(?<version>.+)$
-        version: 3.51.1
+        version: 3.52.0
         repo-token: ${{ github.token }}
     - name: Install lint tools (file, shellcheck, shfmt, actionlint, yamllint, yq)
       if: inputs.lint-tools == 'true'
@@ -46,7 +46,7 @@ runs:
         # probes for a package manager rather than assuming apt-get.
         ./scripts/ensure-file.sh
         # renovate: datasource=github-releases depName=koalaman/shellcheck extractVersion=^v(?<version>.+)$
-        SHELLCHECK_VERSION=0.10.0
+        SHELLCHECK_VERSION=0.11.0
         curl -fsSL --retry 3 -o /tmp/shellcheck.tar.xz \
           "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
         tar -xJf /tmp/shellcheck.tar.xz -C /tmp
@@ -68,7 +68,7 @@ runs:
           | tar -xz -C /tmp actionlint
         sudo mv /tmp/actionlint /usr/local/bin/
         # renovate: datasource=github-releases depName=mikefarah/yq extractVersion=^v?(?<version>.+)$
-        YQ_VERSION=4.44.3
+        YQ_VERSION=4.53.3
         # Raw-binary download: fail closed on a checksum mismatch (a version
         # bump must update the pinned hash).
         YQ_SHA256=a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7
@@ -94,5 +94,5 @@ runs:
       shell: bash
       run: |
         # renovate: datasource=npm depName=snyk
-        SNYK_VERSION=1.1305.2
+        SNYK_VERSION=1.1306.3
         npm install --global "snyk@${SNYK_VERSION}"

.github/workflows/build.yml

@@ -43,7 +43,7 @@ jobs:
           # yq comes from the setup action above (lint-tools: "true") — do not
           # re-install it here.
           # renovate: datasource=pypi depName=copier
-          COPIER_VERSION=9.16.0
+          COPIER_VERSION=9.17.1
           python -m pip install "copier==${COPIER_VERSION}"
       - name: Lint
         run: task check

.github/workflows/devcontainer-build.yml

@@ -50,12 +50,12 @@ jobs:
         with:
           # renovate: datasource=node-version depName=node
           node-version: "24"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
         with:
           buildkitd-config-inline: |
             [worker.oci]
               networkMode = "host"
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/release-content-guard.yml

@@ -42,7 +42,7 @@ jobs:
       - uses: arduino/setup-task@c0bc642852239c2689f73f4ea6459c29405f3c52 # v3.0.0
         with:
           # renovate: datasource=github-releases depName=go-task/task extractVersion=^v(?<version>.+)$
-          version: 3.51.1
+          version: 3.52.0
           repo-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Require a releasing title for release-worthy content changes
         # PR title/body are untrusted input — pass them through the environment

.github/workflows/tracking-guard.yml

@@ -74,7 +74,7 @@ jobs:
       - uses: arduino/setup-task@c0bc642852239c2689f73f4ea6459c29405f3c52 # v3.0.0
         with:
           # renovate: datasource=github-releases depName=go-task/task extractVersion=^v(?<version>.+)$
-          version: 3.51.1
+          version: 3.52.0
           repo-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Collect the PR's commit messages
         # Commit messages are a third path to main: they land verbatim under