feat(deps): consolidate 16 open dependency pull requests, install gh, disable debuginfod

.devcontainer/base/apt-requirements.json

@@ -1,8 +1,9 @@
 {
   "bash-completion": "1:2.16.0-8build1",
   "ca-certificates": "20260601~26.04.1",
+  "gh": "2.46.0-4",
   "git": "1:2.53.0-1ubuntu1",
-  "gnupg2": "2.4.8-4ubuntu3",
+  "gnupg2": "2.4.8-4ubuntu3.1",
   "gnuplot-qt": "6.0.2+dfsg1-2ubuntu2",
   "libgl1-mesa-dev": "26.0.8-1ubuntu0.3",
   "libxcb-cursor0": "0.1.6-1",

.devcontainer/cpp/Dockerfile

@@ -134,7 +134,7 @@ RUN --mount=type=bind,source=.devcontainer/cpp/apt-requirements-base.json,target
     UBUNTU_CODENAME=$(grep '^UBUNTU_CODENAME=' /etc/os-release | cut -d= -f2)
     #echo "deb [signed-by=/usr/share/keyrings/llvm-snapshot-keyring.gpg] http://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-${CLANG_VERSION} main" | tee /etc/apt/sources.list.d/llvm-snapshot.list > /dev/null
     echo "deb [signed-by=/usr/share/keyrings/mull-project-mull-stable-archive-keyring.gpg] https://dl.cloudsmith.io/public/mull-project/mull-stable/deb/ubuntu ${UBUNTU_CODENAME} main" | tee /etc/apt/sources.list.d/mull-project-mull-stable.list > /dev/null
-    echo -e 'Package: *\nPin: origin "apt.llvm.org"\nPin-Priority: 1000' > /etc/apt/preferences
+    printf 'Package: *\nPin: origin "apt.llvm.org"\nPin-Priority: 1000\n' > /etc/apt/preferences
     apt-get update && jq -r 'to_entries | .[] | .key + "=" + .value' /tmp/apt-requirements-clang.json | \
         xargs apt-get install -y --no-install-recommends
 
@@ -178,4 +178,4 @@ RUN --mount=type=cache,target=/var/log,sharing=locked \
 RUN --mount=type=cache,target=/cache,sharing=locked \
  wget --no-hsts -qP /usr/local/lib/python*/dist-packages/cmake/data/share/cmake-*/Modules/ https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_VERSION}/CPM.cmake \
  && conan profile detect \
- && echo -e "\n[conf]\ntools.cmake.cmaketoolchain:generator=Ninja" >> "$(conan profile path default)"
+ && printf '\n[conf]\ntools.cmake.cmaketoolchain:generator=Ninja\n' >> "$(conan profile path default)"

.devcontainer/cpp/devcontainer-lock.json

@@ -1,14 +1,14 @@
 {
   "features": {
-    "ghcr.io/devcontainers/features/desktop-lite:1.2.9": {
-      "version": "1.2.9",
-      "resolved": "ghcr.io/devcontainers/features/desktop-lite@sha256:d8649bc8ca8e50a52fbee29d281739ea05dc1022905b185434d6bbe9afc8f221",
-      "integrity": "sha256:d8649bc8ca8e50a52fbee29d281739ea05dc1022905b185434d6bbe9afc8f221"
+    "ghcr.io/devcontainers/features/desktop-lite:1.2.10": {
+      "version": "1.2.10",
+      "resolved": "ghcr.io/devcontainers/features/desktop-lite@sha256:3cfd1ed97b027614f3a56d53183d20ebf29e9c36ac58a3d669edf39890e3aec3",
+      "integrity": "sha256:3cfd1ed97b027614f3a56d53183d20ebf29e9c36ac58a3d669edf39890e3aec3"
     },
-    "ghcr.io/devcontainers/features/github-cli:1.1.0": {
-      "version": "1.1.0",
-      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671",
-      "integrity": "sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671"
+    "ghcr.io/devcontainers/features/github-cli:1.1.2": {
+      "version": "1.1.2",
+      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:7c409bf6316ffd85f04fd92fba85a744282639e603417dd4796409866bdb6805",
+      "integrity": "sha256:7c409bf6316ffd85f04fd92fba85a744282639e603417dd4796409866bdb6805"
     },
     "ghcr.io/devcontainers/features/node:2.0.0": {
       "version": "2.0.0",

.devcontainer/cpp/devcontainer-metadata.json

@@ -1,4 +1,7 @@
 {
+  "containerEnv": {
+    "DEBUGINFOD_URLS": ""
+  },
   "remoteEnv": {
     "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}"
   },
@@ -11,7 +14,7 @@
         "ms-vscode.cmake-tools@1.23.52",
         "ms-vscode.cpptools@1.33.8",
         "ms-vsliveshare.vsliveshare@1.1.122",
-        "sonarsource.sonarlint-vscode@5.8.1"
+        "sonarsource.sonarlint-vscode@5.9.1"
       ],
       "settings": {
         "C_Cpp.intelliSenseEngine": "disabled",

.devcontainer/cpp/devcontainer.json

@@ -10,13 +10,16 @@
   "forwardPorts": [
     6080
   ],
+  "containerEnv": {
+    "DEBUGINFOD_URLS": ""
+  },
   "remoteEnv": {
     "CONTAINER_FLAVOR": "cpp",
     "NODE_EXTRA_CA_CERTS": "/etc/ssl/certs/ca-certificates.crt"
   },
   "features": {
-    "ghcr.io/devcontainers/features/desktop-lite:1.2.9": {},
-    "ghcr.io/devcontainers/features/github-cli:1.1.0": {},
+    "ghcr.io/devcontainers/features/desktop-lite:1.2.10": {},
+    "ghcr.io/devcontainers/features/github-cli:1.1.2": {},
     "ghcr.io/devcontainers/features/node:2.0.0": {}
   },
   "postCreateCommand": "npm install && npx playwright install --with-deps",
@@ -37,15 +40,15 @@
         "alexkrechik.cucumberautocomplete@3.1.0",
         "github.copilot@1.388.0",
         "github.vscode-github-actions@0.32.3",
-        "github.vscode-pull-request-github@0.162.0",
+        "github.vscode-pull-request-github@0.164.0",
         "jetmartin.bats@0.1.10",
         "kherring.bats-test-runner@0.1.3",
         "mhutchie.git-graph@1.30.0",
         "ms-azuretools.vscode-docker@2.0.0",
         "ms-playwright.playwright@1.1.19",
         "ms-vscode.cmake-tools@1.23.52",
-        "ms-vscode.cpptools@1.32.2",
-        "sonarsource.sonarlint-vscode@5.6.0",
+        "ms-vscode.cpptools@1.33.8",
+        "sonarsource.sonarlint-vscode@5.9.1",
         "usernamehw.errorlens@3.28.0"
       ]
     }

.devcontainer/cpp/requirements.in

@@ -1,3 +1,3 @@
-cmake==4.3.4
-conan==2.30.0
+cmake==4.4.2
+conan==2.31.2
 gcovr==8.6

.devcontainer/cpp/requirements.txt

@@ -139,26 +139,26 @@ charset-normalizer==3.4.7 \
     --hash=sha256:fbccdc05410c9ee21bbf16a35f4c1d16123dcdeb8a1d38f33654fa21d0234f79 \
     --hash=sha256:fea24543955a6a729c45a73fe90e08c743f0b3334bbf3201e6c4bc1b0c7fa464
     # via requests
-cmake==4.3.4 \
-    --hash=sha256:03ba364755daf56c279df01da15a0cabdb8cfe87adae991d01e91ac08ab44a31 \
-    --hash=sha256:189a38a194b669e2d2c8419240abb28c68293bb4779cb4505106fe97b06b77f5 \
-    --hash=sha256:1a5ed4d38ab184422ff393afa1893eadfc732c42cdc4b8364f93fdd00e39fe09 \
-    --hash=sha256:1ab14fad08f03e85a1fc837f18e12f72acb215c44eff91231dbe7f871cb5112e \
-    --hash=sha256:1b57929957ec779a55f00607e68e76f69e22701f42b0ac96502cf212e3953783 \
-    --hash=sha256:232523e606c2089fc15bdc1e8f759268ca0dd03b9ccd31f30980dc723ace1d7e \
-    --hash=sha256:250deb91d4a25427b67624b6b1ec2b52a995995797549d552bda1025e5b6d8da \
-    --hash=sha256:269884c73a0710f07b006efbf5ba8ba2211e744302c79d02c9178333e0c91463 \
-    --hash=sha256:2751beafd188d4eca8cfcef06ad3812728d10aa2686df82dfe85e071957f28a4 \
-    --hash=sha256:3abe3d85f94804053eb192d735ea4d86d9ff2ee41f709a47d686d5bbf5037f10 \
-    --hash=sha256:3c052ee4414a431bd8d4e01b3e7b6ddedfa2007430303aa5e442a4579e4db39e \
-    --hash=sha256:5afc11495431a23d446b82fdb5f2aeeb8bde3a967c1f4fff278bdf4383422e54 \
-    --hash=sha256:61a34a746853b3740c6ad494e51faf4d457b9ef82099e19974148808c31cc2eb \
-    --hash=sha256:6372aa6565e3b38afbd634a7d4171ff1f0e4cd5a4bd92c948797cf721012e7b5 \
-    --hash=sha256:757959349d216712bc311e7cd87f345f9143a90168294678f7017afe4dcae4e5 \
-    --hash=sha256:c97e84a62cf71aaa4f012da5aea411b432b1361d78e6421f987679869aa0fa7a \
-    --hash=sha256:ce0a77faf0a5c480616a29b778fe07dd19bba2d15b0b3d0e97798f12d1db7eff \
-    --hash=sha256:ec21974344e7073dea495a961645316dc51bc7d38a8d8f29b0e19e4930d11f65 \
-    --hash=sha256:fd2a9894a9aa798674a273d1e230b5ba9d1ab855d437ad86bf52f1cef29271b7
+cmake==4.4.2 \
+    --hash=sha256:00195668e40e5dd0d51244e31d15fabb79b97c5e154f9f78b4240f152198c2eb \
+    --hash=sha256:00a0a207efc83019b55f617b93b2592c2616aebd9c4eeab83ec076dc2a9b84a4 \
+    --hash=sha256:0220135cceb78530e79e2b5cd0392672e4c524178db768a5f940ea24520e1359 \
+    --hash=sha256:109af09f308fd53ddc44bbc23536b6ecb72db53f0218f611efccd9871b19f39f \
+    --hash=sha256:1358f355578d19397f87955d4204f737bb399ba36cce59be5853976912836b32 \
+    --hash=sha256:269f84ede6543c5d65249dd685db6125a962e5928b7eafd0ed3acdd2b600aa9e \
+    --hash=sha256:27b024e903ef985b37183d754a5c61230b56b41fe0971cd44b71b80c787ec594 \
+    --hash=sha256:41e2a04663685304222ba03fb5bed8db52480854aa873cbae1478eedf3a8ec1a \
+    --hash=sha256:4eb0e17af8344d3063ce0c1a38a156eb7bbe3447f984ad12629a40f5c967fedd \
+    --hash=sha256:6af2e0585239627f85f49a8f90761ce4560c671daae1d5e8d2b5f059dc7d22de \
+    --hash=sha256:7a0279d3006c961ba1d62fe4383919ebcb7b770fb3357f6ae1309ca89210183b \
+    --hash=sha256:93b06166210e478783e3078612144700d44e0492fe7efd6fcd00e4061bc709a6 \
+    --hash=sha256:a3580e0c30755c36b48edbbf471aaeb5d07858de0281e58a4a598dfa52a0f05d \
+    --hash=sha256:b0a9bb2fa889773c3ff719130064de28edd36fd3e916b46e576243a6f16f033f \
+    --hash=sha256:c28388fe95298486169c45c0ec8bdf067aabcb59273b98a4cdae8be5cd9c74f3 \
+    --hash=sha256:e58296c6e0c04dec37fc28cbf56ca7150646c948dddab2b0d6f8a0a466e7f1ca \
+    --hash=sha256:e5b51faffe02ca78ed4f6b9afbe6dee8d25ab36e9a9365f510e890a16db76013 \
+    --hash=sha256:ea5c206308f8eefc0be7cbeeee93b8b192b6af7338741b6d12fe387234bb7920 \
+    --hash=sha256:fc9d9f95dc9a542db99ca96cba1c275adeeb497ff2e134c780a9677b8578bd05
     # via -r cpp/requirements.in
 colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
@@ -168,9 +168,9 @@ colorlog==6.10.1 \
     --hash=sha256:2d7e8348291948af66122cff006c9f8da6255d224e7cf8e37d8de2df3bad8c9c \
     --hash=sha256:eb4ae5cb65fe7fec7773c2306061a8e63e02efc2c72eba9d27b0fa23c94f1321
     # via gcovr
-conan==2.30.0 \
-    --hash=sha256:67a2e9a6fdc338c9bb464a247057a9c259cff3b6cd53d38cd5a3a7ee7c3e4bb6 \
-    --hash=sha256:8cee363744b164fc043d0b9bef8db856bd6b27a3c971d9c494441d2aa92794fa
+conan==2.31.2 \
+    --hash=sha256:87a8ae0b492c4fd4291d4146bf80522a00d6157637bed7ec055787e1a51f75d6 \
+    --hash=sha256:d820e9f5ac44eca1567874f6a7c83586c16a3df5ebca006d9c0c6933fbb375b1
     # via -r cpp/requirements.in
 distro==1.9.0 \
     --hash=sha256:2fa77c6fd8940f116ee1d6b94a2f90b13b5ea8d019b98bc8bafdcabcdd9bdbed \

.devcontainer/rust/devcontainer-metadata.json

@@ -7,7 +7,7 @@
       "extensions": [
         "mhutchie.git-graph@1.30.0",
         "ms-vsliveshare.vsliveshare@1.1.122",
-        "rust-lang.rust-analyzer@0.3.2989",
+        "rust-lang.rust-analyzer@0.3.3033",
         "tamasfe.even-better-toml@0.21.2",
         "usernamehw.errorlens@3.28.0"
       ]

.devcontainer/rust/devcontainer.json

@@ -20,13 +20,13 @@
       "extensions": [
         "github.copilot@1.388.0",
         "github.vscode-github-actions@0.32.3",
-        "github.vscode-pull-request-github@0.162.0",
+        "github.vscode-pull-request-github@0.164.0",
         "jetmartin.bats@0.1.10",
         "kherring.bats-test-runner@0.1.3",
         "mhutchie.git-graph@1.30.0",
         "ms-azuretools.vscode-docker@2.0.0",
-        "rust-lang.rust-analyzer@0.3.2989",
-        "sonarsource.sonarlint-vscode@5.6.0",
+        "rust-lang.rust-analyzer@0.3.3033",
+        "sonarsource.sonarlint-vscode@5.9.1",
         "tamasfe.even-better-toml@0.21.2",
         "usernamehw.errorlens@3.28.0"
       ]

.github/workflows/continuous-integration.yml

@@ -62,7 +62,7 @@ jobs:
     # Only run when build-push-test succeeded (i.e. test artifacts exist).
     if: ${{ !cancelled() && needs.build-push-test.result == 'success' }}
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo: true
           egress-policy: audit

.github/workflows/image-cleanup.yml

@@ -19,7 +19,7 @@ jobs:
     permissions:
       packages: write # is needed by dataaxiom/ghcr-cleanup-action to delete untagged and orphaned images
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo: true
           allowed-endpoints: >

.github/workflows/issue-cleanup.yml

@@ -15,11 +15,11 @@ jobs:
       issues: write # is needed by actions/stale to close/comment on issues
       pull-requests: write # is needed by actions/stale to close/comment on PRs
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo-and-containers: true
           egress-policy: audit
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           stale-issue-label: "stale"
           stale-pr-label: "stale"

.github/workflows/issue-creation-tool-versions.yml

@@ -16,7 +16,7 @@ jobs:
       contents: read # is needed to checkout the repository
       issues: write # is needed by gh cli to create/close/pin/unpin issues
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo-and-containers: true
           egress-policy: audit

.github/workflows/linting-formatting.yml

@@ -26,25 +26,25 @@ jobs:
       pull-requests: write # is needed by oxsecurity/megalinter and reviewdog/action-suggester to post PR comments
       security-events: write # is needed by oxsecurity/megalinter for uploading sarif files
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo: true
           egress-policy: audit
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+      - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
         with:
           persona: pedantic
       # flavors/dotnet is the smallest flavor of MegaLinter that contains the linters
       # we are interested in.
-      - uses: oxsecurity/megalinter/flavors/dotnet@0e3ce9b9c8c10effb9b269509cc47ca17cae31c7 # v9.5.0
+      - uses: oxsecurity/megalinter/flavors/dotnet@15e5b45552097e318c93de385779ce3b1084052c # v10.0.0
         env:
           APPLY_FIXES: all
           VALIDATE_ALL_CODEBASE: true
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         if: success() || failure()
         with:
           sarif_file: megalinter-reports/megalinter-report.sarif

.github/workflows/ossf-scorecard.yml

@@ -20,19 +20,19 @@ jobs:
       security-events: write # is needed by github/codeql-action/upload-sarif to upload sarif files
       id-token: write # is needed by ossf/scorecard-action to authenticate with OIDC
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo: true
           egress-policy: audit
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
           repo_token: ${{ secrets.SCORECARD_TOKEN }}
           publish_results: true
-      - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: results.sarif

.github/workflows/pr-conventional-title.yml

@@ -17,7 +17,7 @@ jobs:
     permissions:
       pull-requests: write # is needed by marocchino/sticky-pull-request-comment to post comments on PRs
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo-and-containers: true
           allowed-endpoints: >
@@ -32,7 +32,7 @@ jobs:
             doesn't start with an uppercase character.
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+      - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: ${{ !cancelled() && steps.pr-title.outputs.error_message != null }}
         with:
           header: pr-title-lint-error
@@ -44,7 +44,7 @@ jobs:
             :warning: Details
 
             ${{ steps.pr-title.outputs.error_message }}
-      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+      - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: steps.pr-title.outputs.error_message == null
         with:
           header: pr-title-lint-error

.github/workflows/pr-image-cleanup.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       packages: write # is needed by dataaxiom/ghcr-cleanup-action to delete images
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo: true
           egress-policy: audit
@@ -29,7 +29,7 @@ jobs:
     permissions:
       actions: write # is needed to delete workflow run caches
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo-and-containers: true
           egress-policy: audit

.github/workflows/pr-report.yml

@@ -18,7 +18,7 @@ jobs:
       actions: read # is needed by philips-software/pull-request-report-action to fetch workflow run information
     runs-on: ubuntu-latest
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo-and-containers: true
           egress-policy: audit

.github/workflows/release-build.yml

@@ -40,7 +40,7 @@ jobs:
       # currently provide a more fine-grained permission for release modification.
       contents: write # is needed to modify a release
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo-and-containers: true
           egress-policy: audit
@@ -75,7 +75,7 @@ jobs:
       REF_NAME: ${{ github.ref_name }}
       REGISTRY: ghcr.io
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo: true
           egress-policy: audit
@@ -134,7 +134,7 @@ jobs:
       contents: write # is needed to modify a release
     needs: [generate-documents]
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo: true
           egress-policy: audit
@@ -156,7 +156,7 @@ jobs:
     permissions:
       pull-requests: write # is needed by rdlf0/comment-released-prs-action to post comments on PRs
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo-and-containers: true
           egress-policy: audit

.github/workflows/release-please.yml

@@ -18,7 +18,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           disable-sudo-and-containers: true
           egress-policy: audit