From 9ab1b786372e812f19fe3b6c29f3bf506313dcc9 Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate@users.noreply.lochnair.net>
Date: Sat, 29 Aug 2026 14:36:38 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .gitea/workflows/docker-publish.yml | 10 +++++-----
 .github/workflows/osv-scanner.yml   |  4 ++--
 .github/workflows/rust-clippy.yml   |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index 40d507e..810f362 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Determine image tags
         id: meta
@@ -42,10 +42,10 @@ jobs:
       # (native builds, no emulation), but buildx still needs a driver that
       # can assemble a multi-platform manifest list.
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Log in to Gitea Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.GITEA_REGISTRY }}
           # The automatic per-job token comes back unauthorized for package
@@ -55,7 +55,7 @@ jobs:
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.GHCR_REGISTRY }}
           username: ${{ secrets.GHCR_USERNAME }}
@@ -76,7 +76,7 @@ jobs:
       # below), never a separate build, so the hash matches everywhere.
       - name: Build and push to Gitea
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 58f2186..f3fd1c9 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -31,7 +31,7 @@ permissions:
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@8deb546fdb875b9996d27d4950be7312dac076a1" # v2.5.0
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@6e4298ebc4db23e847df9b2e2de2939d6f066c67" # v2.5.1
     with:
       # Example of specifying custom arguments
       scan-args: |-
@@ -40,7 +40,7 @@ jobs:
         ./
   scan-pr:
     if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@8deb546fdb875b9996d27d4950be7312dac076a1" # v2.5.0
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@6e4298ebc4db23e847df9b2e2de2939d6f066c67" # v2.5.1
     with:
       # Example of specifying custom arguments
       scan-args: |-
diff --git a/.github/workflows/rust-clippy.yml b/.github/workflows/rust-clippy.yml
index 439cb5e..a62fa1d 100644
--- a/.github/workflows/rust-clippy.yml
+++ b/.github/workflows/rust-clippy.yml
@@ -60,7 +60,7 @@ jobs:
           exit 0
 
       - name: Upload Clippy SARIF
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         if: always()
         with:
           sarif_file: rust-clippy-results.sarif
-- 
2.54.0