chore(deps): roll up safe dependency updates

.github/workflows/ci.yml

@@ -94,7 +94,7 @@ jobs:
       - run: pnpm exec playwright test --config=playwright.clean.config.ts
       - run: MUSTER_DEMO_MODE=true pnpm db:seed
       - run: pnpm exec playwright test tests/muster.spec.ts tests/jessie-hunt.spec.ts --project=chromium
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: playwright-report
@@ -135,7 +135,7 @@ jobs:
             org.opencontainers.image.title=Muster
             org.opencontainers.image.description=Shared workspace for human and agent-driven security operations
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         id: build
         with:
           context: .
@@ -144,16 +144,19 @@ jobs:
           platforms: linux/amd64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          provenance: mode=max
-          sbom: true
+          provenance: ${{ github.event_name == 'push' && 'mode=max' || 'false' }}
+          sbom: ${{ github.event_name == 'push' }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
       - name: Verify container starts
         if: github.event_name == 'pull_request'
-        run: docker image inspect "${REGISTRY}/${IMAGE_NAME}:sha-${GITHUB_SHA::7}"
+        shell: bash
+        run: |
+          image_ref="${REGISTRY}/${IMAGE_NAME,,}:sha-${GITHUB_SHA::7}"
+          docker image inspect "$image_ref"
       - name: Attest published image
         if: github.event_name == 'push'
-        uses: actions/attest@36051bcae73b7c2a8a6945a48cbf80953c6baa35 # v4
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build.outputs.digest }}

.github/workflows/security.yml

@@ -16,18 +16,18 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: github/codeql-action/init@adfda868f108ac4222129de456ea554034a27db7 # v4
+      - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
         with:
           languages: javascript-typescript
-      - uses: github/codeql-action/analyze@adfda868f108ac4222129de456ea554034a27db7 # v4
+      - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
 
   dependencies-and-secrets:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc # v2
+      - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -43,7 +43,7 @@ jobs:
         run: |
           pnpm licenses list --prod --json | tee licenses.json
           ! grep -E '"(AGPL|SSPL)' licenses.json
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dependency-licences
           path: licenses.json
@@ -53,7 +53,7 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           load: true
@@ -78,7 +78,7 @@ jobs:
           printf '{"commit":"%s","workflow":"%s","runId":"%s","image":"muster:security"}\n' \
             "$GITHUB_SHA" "$GITHUB_WORKFLOW" "$GITHUB_RUN_ID" > provenance.json
           sha256sum muster-sbom.cdx.json provenance.json > SHA256SUMS
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: security-artifacts
           path: |

apps/web/package.json

@@ -35,7 +35,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "drizzle-orm": "0.45.2",
-    "ioredis": "5.8.2",
+    "ioredis": "5.11.1",
     "lucide-react": "1.27.0",
     "next": "16.2.12",
     "radix-ui": "^1.4.3",

packages/auth/package.json

@@ -26,7 +26,7 @@
     "@better-auth/passkey": "1.6.25",
     "@muster/database": "workspace:*",
     "better-auth": "1.6.25",
-    "nodemailer": "9.0.1"
+    "nodemailer": "9.0.3"
   },
   "devDependencies": {
     "@types/nodemailer": "^7.0.1",

packages/database/package.json

@@ -36,7 +36,7 @@
     "@muster/contracts": "workspace:*",
     "drizzle-orm": "0.45.2",
     "pg": "^8.16.3",
-    "uuid": "^13.0.0",
+    "uuid": "14.0.1",
     "zod": "4.4.3"
   },
   "devDependencies": {