dependabot · Oct 13, 2026
diff --git a/.github/workflows/aamp-snapshot-check.yml b/.github/workflows/aamp-snapshot-check.yml
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
 

diff --git a/.github/workflows/apps-web-check.yml b/.github/workflows/apps-web-check.yml
@@ -54,7 +54,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.changes.outputs.web == 'true'
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: "24"
           cache: "npm"

diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml
@@ -76,7 +76,7 @@ jobs:
         ref: ${{ github.event.workflow_run.head_branch || github.ref }}
 
     - name: Use Node.js
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@v7.1.0
       with:
         node-version: '24'
         cache: 'npm'

diff --git a/.github/workflows/build-check.yml b/.github/workflows/build-check.yml
@@ -24,7 +24,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "24"
           cache: "npm"
@@ -102,7 +102,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "24"
           cache: "npm"
@@ -139,7 +139,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "24"
           cache: "npm"
@@ -207,7 +207,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "24"
           cache: "npm"

diff --git a/.github/workflows/changeset-check.yml b/.github/workflows/changeset-check.yml
@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
 
@@ -45,7 +45,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
 

diff --git a/.github/workflows/check-image-alt-text.yml b/.github/workflows/check-image-alt-text.yml
@@ -19,7 +19,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
 

diff --git a/.github/workflows/check-seo-metadata.yml b/.github/workflows/check-seo-metadata.yml
@@ -19,7 +19,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
 

diff --git a/.github/workflows/check-testable-snippets.yml b/.github/workflows/check-testable-snippets.yml
@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 0  # Need full history for diff
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
 
@@ -46,7 +46,7 @@ jobs:
 
       - name: Upload docs example coverage artifact
         if: always()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: docs-example-coverage
           path: |

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -493,7 +493,7 @@ jobs:
           fi
 
       - name: Setup Node.js for artifact build
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "24"
           cache: "npm"
@@ -553,7 +553,7 @@ jobs:
 
       - name: Upload Fly forensics
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: fly-forensics-${{ github.run_id }}
           path: /tmp/forensics/

diff --git a/.github/workflows/external-smoke.yml b/.github/workflows/external-smoke.yml
@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
           cache: npm

diff --git a/.github/workflows/ipr-agreement.yml b/.github/workflows/ipr-agreement.yml
@@ -63,7 +63,7 @@ jobs:
           persist-credentials: true
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
 

diff --git a/.github/workflows/ipr-check-callable.yml b/.github/workflows/ipr-check-callable.yml
@@ -90,7 +90,7 @@ jobs:
           persist-credentials: true
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
 

diff --git a/.github/workflows/migration-smoke-test.yml b/.github/workflows/migration-smoke-test.yml
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "24"
           cache: "npm"
@@ -973,7 +973,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "24"
           cache: "npm"

diff --git a/.github/workflows/publish-schema-pr-bundle.yml b/.github/workflows/publish-schema-pr-bundle.yml
@@ -21,7 +21,7 @@ jobs:
     env:
       PR_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
     steps:
-      - uses: actions/download-artifact@v8.0.1
+      - uses: actions/download-artifact@v8.0.2
         with:
           name: schema-pr-bundle-${{ github.event.workflow_run.head_sha }}
           path: bundle

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -86,7 +86,7 @@ jobs:
         run: node scripts/check-release-state.cjs current
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -200,7 +200,7 @@ jobs:
         run: node scripts/check-release-state.cjs current
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -370,7 +370,7 @@ jobs:
 
       - name: Retain Changesets reconciliation evidence
         if: always() && steps.release-artifacts.outputs.has_release_artifacts == 'false'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: changesets-transaction-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/release-hooks/state.json

diff --git a/.github/workflows/runtime-default-image.yml b/.github/workflows/runtime-default-image.yml
@@ -91,7 +91,7 @@ jobs:
 
       - name: Retain footprint and smoke receipts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: default-runtime-footprint-${{ github.run_id }}
           path: ${{ runner.temp }}/default-runtime-footprint

diff --git a/.github/workflows/sdk-response-conformance.yml b/.github/workflows/sdk-response-conformance.yml
@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: '24'
           cache: npm
@@ -49,7 +49,7 @@ jobs:
           node scripts/sdk-response-conformance/summary.cjs .context/sdk-response-conformance/report.json >> "$GITHUB_STEP_SUMMARY"
       - name: Retain wire observations and validation details
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sdk-response-evidence
           path: .context/sdk-response-conformance/

diff --git a/.github/workflows/training-agent-storyboards.yml b/.github/workflows/training-agent-storyboards.yml
@@ -170,7 +170,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -342,7 +342,7 @@ jobs:
 
       - name: Upload storyboards log on failure
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: storyboards-log-${{ matrix.surface }}-${{ matrix.tenant }}
           path: /tmp/storyboards.log
@@ -557,7 +557,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -594,7 +594,7 @@ jobs:
 
       - name: Upload /sales orchestrator artifacts
         if: always()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: storyboards-current-sales-orchestrator-${{ matrix.orchestrator }}
           path: |
@@ -612,7 +612,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Download /sales orchestrator artifacts
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           pattern: storyboards-current-sales-orchestrator-*
           path: /tmp/storyboards-sales-orchestrators
@@ -703,7 +703,7 @@ jobs:
 
       - name: Upload aggregate /sales log on failure
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: storyboards-log-current-sales
           path: /tmp/storyboards.log

diff --git a/.github/workflows/validate-agent-context.yml b/.github/workflows/validate-agent-context.yml
@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 2
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
       - name: Run validator

diff --git a/.github/workflows/validate-agent-roles-sync.yml b/.github/workflows/validate-agent-roles-sync.yml
@@ -17,7 +17,7 @@ jobs:
     timeout-minutes: 2
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
       - name: Regenerate from source

diff --git a/.github/workflows/validate-schema-bundle.yml b/.github/workflows/validate-schema-bundle.yml
@@ -29,7 +29,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
           cache: npm
@@ -86,7 +86,7 @@ jobs:
           cmp "${RUNNER_TEMP}/first.tgz.provenance.json" dist/protocol/latest.tgz.provenance.json
 
       - name: Upload protocol PR bundle
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: schema-pr-bundle-${{ github.event.pull_request.head.sha }}
           path: |
@@ -102,7 +102,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/download-artifact@v8.0.1
+      - uses: actions/download-artifact@v8.0.2
         with:
           name: schema-pr-bundle-${{ github.event.pull_request.head.sha }}
           path: bundle
@@ -113,7 +113,7 @@ jobs:
           path: sdk
           fetch-depth: 1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
           cache: npm
@@ -169,7 +169,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/download-artifact@v8.0.1
+      - uses: actions/download-artifact@v8.0.2
         with:
           name: schema-pr-bundle-${{ github.event.pull_request.head.sha }}
           path: bundle

diff --git a/.github/workflows/verify-matched-v4-runtime-attestation.yml b/.github/workflows/verify-matched-v4-runtime-attestation.yml
@@ -34,7 +34,7 @@ jobs:
           test "$DISPATCH_SHA" = "$current_main_sha"
           test "$(git rev-parse HEAD)" = "$current_main_sha"
           echo "approved_main_sha=$current_main_sha" >> "$GITHUB_OUTPUT"
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "24"
           cache: npm
@@ -56,7 +56,7 @@ jobs:
             "${{ steps.verify.outputs.approved_main_sha }}" "$bundle_sha256" \
             > /tmp/matched-v4-runtime-attestation.json
       - name: Transfer build output to the protected attestation job
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: matched-v4-runtime-build-${{ steps.verify.outputs.approved_main_sha }}
           path: |
@@ -78,7 +78,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download the untrusted build output without executing it
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: matched-v4-runtime-build-${{ needs.verify-origin-main.outputs.approved_main_sha }}
           path: /tmp/matched-v4-runtime
@@ -219,7 +219,7 @@ jobs:
               raise ValueError("deployment-environment value mismatch")
           PY
       - name: Retain verification inputs for the later protected runner
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: matched-v4-runtime-attestation-${{ github.sha }}
           path: |