build: adopt current shared dependencies and Actions

.github/workflows/ci.yml

@@ -19,23 +19,23 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
         with:
-          version: 2026.9.1
+          version: 2026.10.1
       - name: Install native test tools
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends gjs gnome-shell libglib2.0-bin librsvg2-common gir1.2-soup-3.0 gir1.2-secret-1 dbus-daemon
       - run: npm ci --ignore-scripts
       - run: ./node_modules/.bin/playwright install --with-deps chromium firefox
       - run: just ci
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: extension-bundle
           path: '*.shell-extension.zip'
           if-no-files-found: error
           retention-days: 90
-      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         with:
           path: docs

.github/workflows/pages.yml

@@ -19,7 +19,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
-      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+      - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
         id: deploy
         with:
           artifact_name: github-pages

.github/workflows/release.yml

@@ -22,9 +22,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
         with:
-          version: 2026.9.1
+          version: 2026.10.1
           cache: false
       - name: Verify tag and tested commit
         id: verify
@@ -50,14 +50,14 @@ jobs:
       contents: write # Create the release and attach its tested ZIP.
       actions: read # Inspect workflow runs and download their tested artifacts.
     steps:
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
         with:
-          version: 2026.9.1
+          version: 2026.10.1
           cache: false
           mise_toml: |
             [tools]
-            gh = "2.99.0"
-      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+            gh = "2.102.0"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: extension-bundle
           run-id: ${{ needs.verify.outputs.run }}

.github/workflows/security.yml

@@ -22,11 +22,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: javascript-typescript,python
           queries: security-extended
-      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
   scanners:
     name: scanners
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
@@ -37,8 +37,8 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
         with:
-          version: 2026.9.1
+          version: 2026.10.1
       - run: npm ci --ignore-scripts
       - run: just security

.github/workflows/sonar.yml

@@ -22,9 +22,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
         with:
-          version: 2026.9.1
+          version: 2026.10.1
       - name: Require Sonar configuration
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/template.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
         with:
-          version: 2026.9.1
+          version: 2026.10.1
       - run: just template-check template-status

mise.toml

@@ -1,18 +1,18 @@
 # Exact tool versions shared by every Quick extension.
 [tools]
 node = "24.21.0"
-python = "3.14.7"
-uv = "0.12.9"
+python = "3.14.8"
+uv = "0.12.22"
 "pipx:coverage" = "7.16.2"
 just = "1.58.0"
-ruff = "0.16.9"
+ruff = "0.16.10"
 actionlint = "1.7.12"
 gitleaks = "8.30.1"
 osv-scanner = "2.6.0"
 shellcheck = "0.11.0"
-trivy = "0.74.0"
+trivy = "0.75.0"
 zizmor = "1.30.1"
-gh = "2.99.0"
+gh = "2.102.0"
 sonar-scanner-cli = "8.1.0.6389"
 
 [env]

package.json

@@ -8,12 +8,12 @@
     "@axe-core/playwright": "4.13.0",
     "@eslint/js": "10.0.1",
     "@playwright/test": "1.63.0",
-    "@vitest/coverage-v8": "5.0.2",
-    "eslint": "10.11.0",
-    "eslint-plugin-security": "4.0.1",
-    "globals": "17.12.0",
+    "@vitest/coverage-v8": "5.0.3",
+    "eslint": "10.12.0",
+    "eslint-plugin-security": "4.2.0",
+    "globals": "17.13.0",
     "prettier": "3.9.9",
-    "vitest": "5.0.2"
+    "vitest": "5.0.3"
   },
   "engines": {
     "node": ">=24"

quick-template.lock.json

@@ -1,5 +1,5 @@
 {
   "$schema": "quick-template.schema.json",
   "repository": "Ghost-Assembly/quick-template",
-  "revision": "40e31d2739e0c94162c707adb6851cc207ce6d2c"
+  "revision": "174a20f771bc1b25d19b5547820fa3647c752a1a"
 }