From baaada1fdd46d7b85700fa5a0dc88ac560789fea Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 16 Oct 2026 20:52:28 +0000
Subject: [PATCH 1/2] deps(actions): Bump the actions group across 3
 directories with 8 updates

Bumps the actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |
| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.240` | `1.0.248` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |
| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |

Bumps the actions group with 1 update in the /.github/actions/setup-julia directory: [julia-actions/cache](https://github.com/julia-actions/cache).
Bumps the actions group with 1 update in the /.github/actions/setup-node directory: [actions/setup-node](https://github.com/actions/setup-node).


Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1)

Updates `github/codeql-action/init` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)

Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)

Updates `anthropics/claude-code-action` from 1.0.240 to 1.0.248
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/ed670b4cf9de2a5a570d130d2f6197b9e543cd64...1d6de8cb0c237e7c15e9e1bdf973826ebae490cc)

Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1)

Updates `julia-actions/cache` from 3.3.0 to 3.5.0
- [Release notes](https://github.com/julia-actions/cache/releases)
- [Commits](https://github.com/julia-actions/cache/compare/a7bed9df697e5d7309d68afe7542a87621a8b6c8...9353db09a0f2bbbdec6f41791918c75d37391b36)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.248
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: julia-actions/cache
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/actions/setup-julia/action.yml |  2 +-
 .github/actions/setup-node/action.yml  |  2 +-
 .github/workflows/ci-changelog.yml     |  2 +-
 .github/workflows/ci-image.yml         |  2 +-
 .github/workflows/ci-lint.yml          |  2 +-
 .github/workflows/ci-migrations.yml    |  2 +-
 .github/workflows/ci-tests.yml         |  6 +++---
 .github/workflows/codeql.yml           |  4 ++--
 .github/workflows/daily-regen.yml      |  4 ++--
 .github/workflows/impl-generate.yml    |  6 +++---
 .github/workflows/impl-repair.yml      |  6 +++---
 .github/workflows/impl-review.yml      |  4 ++--
 .github/workflows/report-validate.yml  |  2 +-
 .github/workflows/review-retest.yml    | 18 +++++++++---------
 .github/workflows/spec-create.yml      |  4 ++--
 .github/workflows/sync-postgres.yml    |  2 +-
 .github/workflows/util-claude.yml      |  4 ++--
 17 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/.github/actions/setup-julia/action.yml b/.github/actions/setup-julia/action.yml
index 32fecfd4674..087d6a6e9d0 100644
--- a/.github/actions/setup-julia/action.yml
+++ b/.github/actions/setup-julia/action.yml
@@ -36,7 +36,7 @@ runs:
     # Speed up subsequent runs — Julia precompilation is slow on cold start.
     # `julia-actions/cache` keys on Project.toml + Manifest.toml.
     - name: Cache Julia depot
-      uses: julia-actions/cache@a7bed9df697e5d7309d68afe7542a87621a8b6c8  # v3.3.0
+      uses: julia-actions/cache@9353db09a0f2bbbdec6f41791918c75d37391b36  # v3.5.0
 
     - name: Install Julia packages
       # `Pkg.instantiate()` restores the exact versions pinned in
diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml
index bf2cb7a723d..8818ba0cad9 100644
--- a/.github/actions/setup-node/action.yml
+++ b/.github/actions/setup-node/action.yml
@@ -16,7 +16,7 @@ runs:
   using: "composite"
   steps:
     - name: Install Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v6
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v6
       with:
         node-version: ${{ inputs.node-version }}
         # Restore npm's download cache keyed on the committed lockfile so cold
diff --git a/.github/workflows/ci-changelog.yml b/.github/workflows/ci-changelog.yml
index 13228d41100..c5d77a7beee 100644
--- a/.github/workflows/ci-changelog.yml
+++ b/.github/workflows/ci-changelog.yml
@@ -73,7 +73,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
       # `--no-project`: the tool is standard library only, so the gate answers
       # in seconds without syncing pandas, scipy and scikit-learn.
diff --git a/.github/workflows/ci-image.yml b/.github/workflows/ci-image.yml
index f7c66214f5c..19adcd4fcfd 100644
--- a/.github/workflows/ci-image.yml
+++ b/.github/workflows/ci-image.yml
@@ -708,7 +708,7 @@ jobs:
       # Also after a failed assert, so the PNGs show what went wrong.
       - name: Upload the multi-script render
         if: ${{ !cancelled() && steps.check.outputs.should_build == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: renderer-i18n-render
           path: |
diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml
index 125ab0c80d9..221ea308f19 100644
--- a/.github/workflows/ci-lint.yml
+++ b/.github/workflows/ci-lint.yml
@@ -68,7 +68,7 @@ jobs:
 
     - name: Install uv
       if: steps.check.outputs.should_lint == 'true'
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
     - name: Install dependencies
       if: steps.check.outputs.should_lint == 'true'
diff --git a/.github/workflows/ci-migrations.yml b/.github/workflows/ci-migrations.yml
index 6b359839fd2..82ed4f7d37e 100644
--- a/.github/workflows/ci-migrations.yml
+++ b/.github/workflows/ci-migrations.yml
@@ -157,7 +157,7 @@ jobs:
 
       - name: Install uv
         if: steps.check.outputs.should_check == 'true'
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
       # alembic, SQLAlchemy and asyncpg are core dependencies; no extra is
       # needed, the same install sync-postgres.yml runs before it migrates prod.
diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index 2befd1efd98..24f3a0e3442 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -116,7 +116,7 @@ jobs:
 
     - name: Install uv
       if: steps.check.outputs.should_test == 'true'
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
     - name: Install dependencies
       if: steps.check.outputs.should_test == 'true'
@@ -178,7 +178,7 @@ jobs:
 
     - name: Upload coverage to GitHub Artifacts
       if: steps.check.outputs.should_test == 'true' && github.actor != 'dependabot[bot]' && always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
       with:
         name: coverage-report
         path: coverage.xml
@@ -243,7 +243,7 @@ jobs:
 
     - name: Set up Node.js
       if: steps.check.outputs.should_test == 'true'
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v6
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v6
       with:
         node-version: '24'
         cache: 'yarn'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 01282213e5e..bf52f7a0e0d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -54,7 +54,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
         with:
           languages: ${{ matrix.language }}
           build-mode: none
@@ -66,6 +66,6 @@ jobs:
               - plots/**
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/daily-regen.yml b/.github/workflows/daily-regen.yml
index 88f3793b658..3982bd0066e 100644
--- a/.github/workflows/daily-regen.yml
+++ b/.github/workflows/daily-regen.yml
@@ -299,7 +299,7 @@ jobs:
         # block the main regeneration pipeline. Skip cleanly and continue.
         continue-on-error: true
         timeout-minutes: 15
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: '--model sonnet --settings ${{ github.workspace }}/.claude/settings.json'
@@ -315,7 +315,7 @@ jobs:
         # rather than aborting the dispatch.
         continue-on-error: true
         timeout-minutes: 15
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: '--model sonnet --settings ${{ github.workspace }}/.claude/settings.json'
diff --git a/.github/workflows/impl-generate.yml b/.github/workflows/impl-generate.yml
index 7f81d5325b3..173d1429c9e 100644
--- a/.github/workflows/impl-generate.yml
+++ b/.github/workflows/impl-generate.yml
@@ -275,7 +275,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
       - name: Install system dependencies
         run: |
@@ -452,7 +452,7 @@ jobs:
         id: claude
         continue-on-error: true
         timeout-minutes: 60
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ steps.inputs.outputs.model }} --settings ${{ github.workspace }}/.claude/settings.json"
@@ -472,7 +472,7 @@ jobs:
         if: steps.claude.outcome == 'failure'
         id: claude_retry
         timeout-minutes: 60
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ steps.inputs.outputs.model }} --settings ${{ github.workspace }}/.claude/settings.json"
diff --git a/.github/workflows/impl-repair.yml b/.github/workflows/impl-repair.yml
index aa1d5998d96..3f09b60f319 100644
--- a/.github/workflows/impl-repair.yml
+++ b/.github/workflows/impl-repair.yml
@@ -172,7 +172,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
       - name: Install Python plotting dependencies
         if: steps.lang.outputs.language == 'python'
@@ -228,7 +228,7 @@ jobs:
         id: claude
         continue-on-error: true
         timeout-minutes: 45
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ steps.model.outputs.model }} --settings ${{ github.workspace }}/.claude/settings.json"
@@ -248,7 +248,7 @@ jobs:
         if: steps.claude.outcome == 'failure'
         id: claude_retry
         timeout-minutes: 45
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ steps.model.outputs.model }} --settings ${{ github.workspace }}/.claude/settings.json"
diff --git a/.github/workflows/impl-review.yml b/.github/workflows/impl-review.yml
index 8c492c42249..f507b8e74de 100644
--- a/.github/workflows/impl-review.yml
+++ b/.github/workflows/impl-review.yml
@@ -681,7 +681,7 @@ jobs:
         id: review
         continue-on-error: true
         timeout-minutes: 30
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         env:
           LIBRARY: ${{ steps.pr.outputs.library }}
           SPEC_ID: ${{ steps.pr.outputs.specification_id }}
@@ -1098,7 +1098,7 @@ jobs:
         if: steps.pair.outputs.dir != ''
         continue-on-error: true
         timeout-minutes: 5
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: regen-pair-${{ steps.pr.outputs.pr_number }}-${{ github.run_attempt }}
           path: ${{ steps.pair.outputs.dir }}
diff --git a/.github/workflows/report-validate.yml b/.github/workflows/report-validate.yml
index b182d34cf76..997e035c145 100644
--- a/.github/workflows/report-validate.yml
+++ b/.github/workflows/report-validate.yml
@@ -58,7 +58,7 @@ jobs:
         id: validate
         continue-on-error: true
         timeout-minutes: 10
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         env:
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
diff --git a/.github/workflows/review-retest.yml b/.github/workflows/review-retest.yml
index 8bee58b5496..2c41f360b5e 100644
--- a/.github/workflows/review-retest.yml
+++ b/.github/workflows/review-retest.yml
@@ -139,7 +139,7 @@ jobs:
 
       - name: Fetch the run to resume
         if: inputs.resume_from != ''
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: retest-report
           run-id: ${{ inputs.resume_from }}
@@ -190,7 +190,7 @@ jobs:
 
       - name: Upload bundles
         if: steps.plan.outputs.sessions != '0'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: retest-bundles
           path: ${{ runner.temp }}/bundles
@@ -256,7 +256,7 @@ jobs:
           echo "::notice::rules ${RULES_SHA} over harness ${GITHUB_SHA}"
 
       - name: Download bundles
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: retest-bundles
           path: ${{ runner.temp }}/bundles
@@ -290,7 +290,7 @@ jobs:
         if: steps.cell.outcome == 'success'
         continue-on-error: true
         timeout-minutes: 25
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         env:
           LIBRARY: ${{ matrix.cell.library }}
           SPEC_ID: ${{ matrix.cell.spec_id }}
@@ -346,7 +346,7 @@ jobs:
 
       - name: Upload the cell
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: cell-${{ matrix.cell.id }}
           path: ${{ runner.temp }}/cell
@@ -371,7 +371,7 @@ jobs:
 
       - name: Download cells
         continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           pattern: cell-*
           path: ${{ runner.temp }}/cells
@@ -379,7 +379,7 @@ jobs:
       - name: Download the baseline arm
         if: inputs.compare_to != ''
         continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: retest-report
           run-id: ${{ inputs.compare_to }}
@@ -389,7 +389,7 @@ jobs:
       - name: Download the resumed run
         if: inputs.resume_from != ''
         continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: retest-report
           run-id: ${{ inputs.resume_from }}
@@ -427,7 +427,7 @@ jobs:
           cat "$RUNNER_TEMP/report/retest-report.md" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload the report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: retest-report
           path: ${{ runner.temp }}/report
diff --git a/.github/workflows/spec-create.yml b/.github/workflows/spec-create.yml
index 570f9415412..0c8973fabfd 100644
--- a/.github/workflows/spec-create.yml
+++ b/.github/workflows/spec-create.yml
@@ -92,7 +92,7 @@ jobs:
         id: process
         continue-on-error: true
         timeout-minutes: 30
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         env:
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
@@ -252,7 +252,7 @@ jobs:
         if: steps.check.outputs.should_run == 'true' && steps.process.outcome == 'failure'
         id: process_retry
         timeout-minutes: 30
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         env:
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
diff --git a/.github/workflows/sync-postgres.yml b/.github/workflows/sync-postgres.yml
index 65c06a26eaa..c4f73ef41d5 100644
--- a/.github/workflows/sync-postgres.yml
+++ b/.github/workflows/sync-postgres.yml
@@ -39,7 +39,7 @@ jobs:
         python-version: '3.13'
 
     - name: Install uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
     - name: Install dependencies
       run: |
diff --git a/.github/workflows/util-claude.yml b/.github/workflows/util-claude.yml
index 5d08d1d4e6f..76dd1ca46bd 100644
--- a/.github/workflows/util-claude.yml
+++ b/.github/workflows/util-claude.yml
@@ -41,7 +41,7 @@ jobs:
       - name: Run Claude Code
         id: claude
         continue-on-error: true
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model opus --settings ${{ github.workspace }}/.claude/settings.json"
@@ -53,7 +53,7 @@ jobs:
       - name: Retry Claude (on failure)
         if: steps.claude.outcome == 'failure'
         id: claude_retry
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model opus --settings ${{ github.workspace }}/.claude/settings.json"

From 6c4fa86b20d9656477e477e66b58e22fbe0fac36 Mon Sep 17 00:00:00 2001
From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com>
Date: Fri, 16 Oct 2026 23:21:32 +0200
Subject: [PATCH 2/2] ci: bump the review-retest ACTION_SHA with the
 claude-code-action pin

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdMSqLR5ww4ji74EUSmk9M
---
 .github/workflows/review-retest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/review-retest.yml b/.github/workflows/review-retest.yml
index 2c41f360b5e..d92cb00611f 100644
--- a/.github/workflows/review-retest.yml
+++ b/.github/workflows/review-retest.yml
@@ -95,7 +95,7 @@ env:
   # Keep in sync with the claude-code-action pin in the review job (a test
   # checks it). Cells record it, and plan reuses a resumed cell only when it
   # matches.
-  ACTION_SHA: ed670b4cf9de2a5a570d130d2f6197b9e543cd64
+  ACTION_SHA: 1d6de8cb0c237e7c15e9e1bdf973826ebae490cc
 
 concurrency:
   group: review-retest