chore(deps): combined Dependabot updates

.github/workflows/codeql.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: python
           # security-extended (NOT security-and-quality): the full security ruleset
@@ -48,6 +48,6 @@ jobs:
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           category: "/language:python"

.github/workflows/mutation.yml

@@ -75,7 +75,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: pip install -r ci/poetry-pin.txt --require-hashes

.github/workflows/scorecard.yml

@@ -41,7 +41,7 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF to GitHub code scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           sarif_file: scorecard-results.sarif
           wait-for-processing: true

ci/cyclonedx-pin.txt

@@ -38,9 +38,9 @@ fqdn==1.5.1 \
     --hash=sha256:105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f \
     --hash=sha256:3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014
     # via jsonschema
-idna==3.18 \
-    --hash=sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2 \
-    --hash=sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848
+idna==3.19 \
+    --hash=sha256:5e0811a4383b21dc5838069f801c4fb62113b7447663d2530d2bd6e77b49bf15 \
+    --hash=sha256:815e7be7a7806d54abb586dc943addc79e8b2ee16915059658cbeff4b1b43bf4
     # via jsonschema
 isoduration==20.11.0 \
     --hash=sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9 \

ci/poetry-pin.in

@@ -5,4 +5,4 @@ poetry==2.4.1
 #   <50.0.0  PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle
 #            (GHSA-g6cj-pr64-35w5). Not a path pyrxd itself uses, but this pin
 #            is what CI installs, so it must not resolve to a flagged version.
-cryptography>=50.0.0
+cryptography>=50.0.1

pyproject.toml

@@ -35,7 +35,7 @@ dependencies = [
     "aiohttp>=3.14.3",
     "base58>=2.1.1,<3.0.0",
     "cbor2>=6.1.4,<7.0",
-    "click>=8.4.2,<9.0",
+    "click>=8.5.0,<9.0",
     "coincurve>=21.0.0,<22.0.0",
     # Required for X25519 ECDH + HKDF-SHA256 used by Glyph TIMELOCK / ENCRYPTED
     # (pyrxd.crypto.kem). OpenSSL-backed, well-audited, typically already a
@@ -341,13 +341,13 @@ dev = [
     "mypy>=2.3.1,<3.0.0",
     "pip-audit>=2.10.1,<3.0.0",
     "pytest-asyncio>=1.4.0",
-    "ruff>=0.16.4,<0.17.0",
+    "ruff>=0.16.5,<0.17.0",
     "taskipy>=1.14.1,<2.0.0",
     # Transitive security floor (dev-only): pip-audit -> cachecontrol pulls msgpack, which had an
     # out-of-bounds-read / crash on Unpacker reuse after a caught error in <= 1.2.0
     # (GHSA-6v7p-g79w-8964). cachecontrol allows < 2.0.0, so pin the patched floor. Dev-scope only —
     # msgpack is not a pyrxd runtime dependency and never ships in the published package.
-    "msgpack>=1.2.1",
+    "msgpack>=1.2.2",
     # Transitive security floor (dev-only): cosmic-ray pulls gitpython, which has drawn repeated
     # clusters of HIGH advisories — env-var exfiltration via Repo.clone_from() (GHSA-rwj8-pgh3-r573,
     # patched 3.1.52), command injection via Repo.archive()/git.ls_remote() and short/long-option gate
@@ -359,7 +359,7 @@ dev = [
     # IndexFile.from_tree (GHSA-9rj7-rf2p-w77r, GHSA-4gmw-gg2m-w46p), all patched 3.1.58. cosmic-ray
     # sets no upper cap, so floor at the highest patched version. Dev-scope only — gitpython is not a
     # pyrxd runtime dependency and never ships in the published package.
-    "gitpython>=3.1.59",
+    "gitpython>=3.1.60",
 ]
 test = [
     "bandit[toml]>=1.9.4,<2.0.0",