chore(deps): update all dependencies

Author: renovate[bot]

.github/workflows/finalize.yml

@@ -47,7 +47,7 @@ jobs:
 
       # Download coverage artifacts from the test job (same workflow run)
       - name: Download artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: logs.zip
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -56,7 +56,7 @@ jobs:
       # For PRs: Extract PR number from artifact file
       - name: Fetch PR Number artifact
         if: inputs.workflow-event == 'pull_request'
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: pr_number
           path: .
@@ -124,7 +124,7 @@ jobs:
           echo "Running SonarCloud analysis..."
 
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@v6
+        uses: SonarSource/sonarqube-scan-action@v7
         env:
           SONAR_TOKEN: ${{ secrets.CICD_ORG_SONAR_TOKEN_CICD_BOT }}
         with:

.github/workflows/tox.yml

@@ -133,7 +133,7 @@ jobs:
           submodules: true
 
       - name: Set pre-commit cache
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         if: ${{ matrix.name == 'lint' }}
         with:
           path: |
@@ -222,7 +222,7 @@ jobs:
       - name: Upload coverage data to codecov.io
         id: upload-coverage
         if: ${{ !cancelled() && hashFiles('**/coverage.xml') != '' }}
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           name: ${{ matrix.name }}
           fail_ci_if_error: true
@@ -237,7 +237,7 @@ jobs:
       - name: Upload test results to codecov.io
         id: upload-test-results
         if: ${{ !cancelled() && hashFiles('junit.xml') != '' }}
-        uses: codecov/test-results-action@47f89e9acb64b76debcd5ea40642d25a4adced9f # v1
+        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1
         with:
           fail_ci_if_error: true
           name: ${{ matrix.name }}
@@ -277,14 +277,14 @@ jobs:
 
       - name: Upload PR number artifact
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: pr_number
           path: pr_number.txt
 
       - name: Merge logs into a single archive
         # Should do nothing if job is retried
-        uses: actions/upload-artifact/merge@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact/merge@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: logs.zip
           pattern: logs-*.zip

.pre-commit-config.yaml

@@ -12,7 +12,7 @@ repos:
     hooks:
       - id: check-useless-excludes
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.9.16
+    rev: 0.9.18
     hooks:
       - id: uv-sync
       - id: uv-lock
@@ -21,7 +21,7 @@ repos:
         args: ["--upgrade"]
         stages: [manual]
   - repo: https://github.com/biomejs/pre-commit
-    rev: "v2.3.8"
+    rev: "v2.3.10"
     hooks:
       - id: biome-check
         name: biome
@@ -44,14 +44,14 @@ repos:
       - id: debug-statements
         language_version: python3
   - repo: https://github.com/tombi-toml/tombi-pre-commit
-    rev: v0.7.3
+    rev: v0.7.8
     hooks:
       - id: tombi-format
         alias: toml
       - id: tombi-lint
         alias: toml
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.8
+    rev: v0.14.9
     hooks:
       - id: ruff-format
         alias: ruff
@@ -66,7 +66,7 @@ repos:
         types: [file, yaml]
         entry: yamllint --strict
   - repo: https://github.com/ansible/ansible-lint
-    rev: v25.12.0
+    rev: v25.12.1
     hooks:
       - id: ansible-lint
         args: [--fix]