chore(deps): update github actions (#2055)

This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [actions/cache](https://redirect.github.com/actions/cache) | action |
minor | `v6` → `v6.1.0` | |
| [actions/cache](https://redirect.github.com/actions/cache) | action |
minor | `v5.0.5` → `v5.1.0` | |
|
[anthropics/claude-code-action](https://redirect.github.com/anthropics/claude-code-action)
| action | patch | `v1.0.158` → `v1.0.165` | `v1.0.166` |
|
[docker/build-push-action](https://redirect.github.com/docker/build-push-action)
| action | minor | `v7.2.0` → `v7.3.0` | |
| [docker/login-action](https://redirect.github.com/docker/login-action)
| action | minor | `v4.2.0` → `v4.4.0` | |
|
[docker/metadata-action](https://redirect.github.com/docker/metadata-action)
| action | minor | `v6.1.0` → `v6.2.0` | |
|
[docker/setup-buildx-action](https://redirect.github.com/docker/setup-buildx-action)
| action | minor | `v4.1.0` → `v4.2.0` | |
|
[docker/setup-qemu-action](https://redirect.github.com/docker/setup-qemu-action)
| action | minor | `v4.1.0` → `v4.2.0` | |
| [dorny/paths-filter](https://redirect.github.com/dorny/paths-filter) |
action | patch | `v4.0.1` → `v4.0.2` | |
|
[taiki-e/install-action](https://redirect.github.com/taiki-e/install-action)
| action | minor | `v2.81.10` → `v2.82.8` | `v2.82.10` (+1) |
| voidzero-dev/pkg-pr-registry-bridge | action | digest | `711e22a` →
`65c8157` | |
| voidzero-dev/setup-vp | action | digest | `13e7afb` → `250f29c` |  |
|
[voidzero-dev/setup-vp](https://redirect.github.com/voidzero-dev/setup-vp)
| action | minor | `v1.13.0` → `v1.14.0` | `v1.15.0` |

---

### Release Notes

<details>
<summary>actions/cache (actions/cache)</summary>

###
[`v6.1.0`](https://redirect.github.com/actions/cache/releases/tag/v6.1.0)

[Compare
Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.1.0)

##### What's Changed

- Bump
[@&#8203;actions/cache](https://redirect.github.com/actions/cache) to
v6.1.0 - handle read-only cache access by
[@&#8203;jasongin](https://redirect.github.com/jasongin) in
[#&#8203;1768](https://redirect.github.com/actions/cache/pull/1768)

**Full Changelog**:
<actions/cache@v6...v6.1.0>

</details>

<details>
<summary>anthropics/claude-code-action
(anthropics/claude-code-action)</summary>

###
[`v1.0.165`](https://redirect.github.com/anthropics/claude-code-action/releases/tag/v1.0.165)

[Compare
Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.164...v1.0.165)

**Full Changelog**:
<anthropics/claude-code-action@v1...v1.0.165>

###
[`v1.0.164`](https://redirect.github.com/anthropics/claude-code-action/releases/tag/v1.0.164)

[Compare
Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.163...v1.0.164)

**Full Changelog**:
<anthropics/claude-code-action@v1...v1.0.164>

###
[`v1.0.163`](https://redirect.github.com/anthropics/claude-code-action/releases/tag/v1.0.163)

[Compare
Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.162...v1.0.163)

**Full Changelog**:
<anthropics/claude-code-action@v1...v1.0.163>

###
[`v1.0.162`](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.161...v1.0.162)

[Compare
Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.161...v1.0.162)

###
[`v1.0.161`](https://redirect.github.com/anthropics/claude-code-action/releases/tag/v1.0.161)

[Compare
Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.160...v1.0.161)

**Full Changelog**:
<anthropics/claude-code-action@v1...v1.0.161>

###
[`v1.0.160`](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.159...v1.0.160)

[Compare
Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.159...v1.0.160)

###
[`v1.0.159`](https://redirect.github.com/anthropics/claude-code-action/releases/tag/v1.0.159)

[Compare
Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.158...v1.0.159)

#### What's Changed

- fix: bound app token revocation cleanup by
[@&#8203;tarunag10](https://redirect.github.com/tarunag10) in
[#&#8203;1437](https://redirect.github.com/anthropics/claude-code-action/pull/1437)

#### New Contributors

- [@&#8203;tarunag10](https://redirect.github.com/tarunag10) made their
first contribution in
[#&#8203;1437](https://redirect.github.com/anthropics/claude-code-action/pull/1437)

**Full Changelog**:
<anthropics/claude-code-action@v1...v1.0.159>

</details>

<details>
<summary>docker/build-push-action (docker/build-push-action)</summary>

###
[`v7.3.0`](https://redirect.github.com/docker/build-push-action/compare/v7.2.0...v7.3.0)

[Compare
Source](https://redirect.github.com/docker/build-push-action/compare/v7.2.0...v7.3.0)

</details>

<details>
<summary>docker/login-action (docker/login-action)</summary>

###
[`v4.4.0`](https://redirect.github.com/docker/login-action/compare/v4.3.0...v4.4.0)

[Compare
Source](https://redirect.github.com/docker/login-action/compare/v4.3.0...v4.4.0)

###
[`v4.3.0`](https://redirect.github.com/docker/login-action/releases/tag/v4.3.0)

[Compare
Source](https://redirect.github.com/docker/login-action/compare/v4.2.0...v4.3.0)

- Preserve names in esbuild bundle by
[@&#8203;crazy-max](https://redirect.github.com/crazy-max) in
[#&#8203;1022](https://redirect.github.com/docker/login-action/pull/1022)
- Bump
[@&#8203;aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr)
and
[@&#8203;aws-sdk/client-ecr-public](https://redirect.github.com/aws-sdk/client-ecr-public)
to 3.1076.0
[#&#8203;999](https://redirect.github.com/docker/login-action/pull/999)
[#&#8203;1030](https://redirect.github.com/docker/login-action/pull/1030)
- Bump
[@&#8203;docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit)
from 0.90.0 to 0.92.0 in
[#&#8203;1004](https://redirect.github.com/docker/login-action/pull/1004)
[#&#8203;1027](https://redirect.github.com/docker/login-action/pull/1027)
- Bump
[@&#8203;sigstore/core](https://redirect.github.com/sigstore/core) from
3.1.0 to 3.2.1 in
[#&#8203;1023](https://redirect.github.com/docker/login-action/pull/1023)
- Bump
[@&#8203;sigstore/verify](https://redirect.github.com/sigstore/verify)
from 3.1.0 to 3.1.1 in
[#&#8203;1029](https://redirect.github.com/docker/login-action/pull/1029)
- Bump http-proxy-agent and https-proxy-agent to 9.1.0 in
[#&#8203;1017](https://redirect.github.com/docker/login-action/pull/1017)
- Bump js-yaml from 4.1.1 to 5.2.0 in
[#&#8203;1028](https://redirect.github.com/docker/login-action/pull/1028)
- Bump sigstore from 4.1.0 to 4.1.1 in
[#&#8203;1031](https://redirect.github.com/docker/login-action/pull/1031)
- Bump tmp from 0.2.5 to 0.2.7 in
[#&#8203;1002](https://redirect.github.com/docker/login-action/pull/1002)
- Bump undici from 6.24.1 to 6.27.0 in
[#&#8203;1020](https://redirect.github.com/docker/login-action/pull/1020)
- Bump vite from 7.3.3 to 7.3.6 in
[#&#8203;1019](https://redirect.github.com/docker/login-action/pull/1019)

**Full Changelog**:
<docker/login-action@v4.2.0...v4.3.0>

</details>

<details>
<summary>docker/metadata-action (docker/metadata-action)</summary>

###
[`v6.2.0`](https://redirect.github.com/docker/metadata-action/compare/v6.1.0...v6.2.0)

[Compare
Source](https://redirect.github.com/docker/metadata-action/compare/v6.1.0...v6.2.0)

</details>

<details>
<summary>docker/setup-buildx-action
(docker/setup-buildx-action)</summary>

###
[`v4.2.0`](https://redirect.github.com/docker/setup-buildx-action/releases/tag/v4.2.0)

[Compare
Source](https://redirect.github.com/docker/setup-buildx-action/compare/v4.1.0...v4.2.0)

- Preserve names in esbuild bundle by
[@&#8203;crazy-max](https://redirect.github.com/crazy-max) in
[#&#8203;572](https://redirect.github.com/docker/setup-buildx-action/pull/572)
- Bump [@&#8203;actions/core](https://redirect.github.com/actions/core)
from 3.0.0 to 3.0.1 in
[#&#8203;551](https://redirect.github.com/docker/setup-buildx-action/pull/551)
- Bump
[@&#8203;docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit)
from 0.90.0 to 0.92.0 in
[#&#8203;557](https://redirect.github.com/docker/setup-buildx-action/pull/557)
[#&#8203;580](https://redirect.github.com/docker/setup-buildx-action/pull/580)
- Bump
[@&#8203;sigstore/core](https://redirect.github.com/sigstore/core) from
3.1.0 to 3.2.1 in
[#&#8203;573](https://redirect.github.com/docker/setup-buildx-action/pull/573)
- Bump
[@&#8203;sigstore/verify](https://redirect.github.com/sigstore/verify)
from 3.1.0 to 3.1.1 in
[#&#8203;576](https://redirect.github.com/docker/setup-buildx-action/pull/576)
- Bump js-yaml from 4.1.1 to 5.2.0 in
[#&#8203;562](https://redirect.github.com/docker/setup-buildx-action/pull/562)
- Bump sigstore from 4.1.0 to 4.1.1 in
[#&#8203;577](https://redirect.github.com/docker/setup-buildx-action/pull/577)
- Bump tmp from 0.2.5 to 0.2.7 in
[#&#8203;556](https://redirect.github.com/docker/setup-buildx-action/pull/556)
- Bump undici from 6.25.0 to 6.27.0 in
[#&#8203;570](https://redirect.github.com/docker/setup-buildx-action/pull/570)
- Bump vite from 7.3.2 to 7.3.6 in
[#&#8203;569](https://redirect.github.com/docker/setup-buildx-action/pull/569)

**Full Changelog**:
<docker/setup-buildx-action@v4.1.0...v4.2.0>

</details>

<details>
<summary>docker/setup-qemu-action (docker/setup-qemu-action)</summary>

###
[`v4.2.0`](https://redirect.github.com/docker/setup-qemu-action/compare/v4.1.0...v4.2.0)

[Compare
Source](https://redirect.github.com/docker/setup-qemu-action/compare/v4.1.0...v4.2.0)

</details>

<details>
<summary>dorny/paths-filter (dorny/paths-filter)</summary>

###
[`v4.0.2`](https://redirect.github.com/dorny/paths-filter/blob/HEAD/CHANGELOG.md#v402)

[Compare
Source](https://redirect.github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2)

- [Work around git dubious ownership errors in container
jobs](https://redirect.github.com/dorny/paths-filter/pull/317)
- [Use rev-parse instead of branch --show-current for older git
compat](https://redirect.github.com/dorny/paths-filter/pull/303)
- [Fix warning
message](https://redirect.github.com/dorny/paths-filter/pull/282)

</details>

<details>
<summary>taiki-e/install-action (taiki-e/install-action)</summary>

###
[`v2.82.8`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.82.8):
2.82.8

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.82.7...v2.82.8)

- Update `vacuum@latest` to 0.29.8.

- Update `uv@latest` to 0.11.26.

- Update `typos@latest` to 1.48.0.

- Update `trivy@latest` to 0.72.0.

- Update `tombi@latest` to 1.1.7.

- Update `prek@latest` to 0.4.6.

- Update `mise@latest` to 2026.7.0.

- Update `just@latest` to 1.55.1.

- Update `biome@latest` to 2.5.2.

###
[`v2.82.7`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.82.7):
2.82.7

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.82.6...v2.82.7)

- Update `tombi@latest` to 1.1.6.

- Update `kingfisher@latest` to 1.105.0.

- Update `gungraun-runner@latest` to 0.19.3.

- Update `editorconfig-checker@latest` to 3.8.0.

- Update `dprint@latest` to 0.55.1.

- Update `cargo-tarpaulin@latest` to 0.36.0.

###
[`v2.82.6`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.82.6):
2.82.6

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.82.5...v2.82.6)

- Update `vacuum@latest` to 0.29.7.

- Update `uv@latest` to 0.11.25.

- Update `syft@latest` to 1.46.0.

- Update `dprint@latest` to 0.55.0.

- Update `cargo-auditable@latest` to 0.7.5.

###
[`v2.82.5`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.82.5):
2.82.5

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.82.4...v2.82.5)

- Update `wasmtime@latest` to 46.0.1.

- Update `wasm-bindgen@latest` to 0.2.126.

- Update `vacuum@latest` to 0.29.6.

- Update `mise@latest` to 2026.6.14.

- Update `cargo-rdme@latest` to 2.1.0.

###
[`v2.82.4`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.82.4):
2.82.4

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.82.3...v2.82.4)

- Update `uv@latest` to 0.11.24.

- Update `mise@latest` to 2026.6.13.

- Update `just@latest` to 1.54.0.

- Update `biome@latest` to 2.5.1.

###
[`v2.82.3`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.82.3):
2.82.3

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.82.2...v2.82.3)

- Update `zizmor@latest` to 1.26.1.

- Update `wasmtime@latest` to 46.0.0.

- Update `tombi@latest` to 1.1.5.

- Update `mise@latest` to 2026.6.12.

- Update `kingfisher@latest` to 1.104.0.

- Update `cargo-tarpaulin@latest` to 0.35.5.

- Update `cargo-nextest@latest` to 0.9.138.

- Update `cargo-crap@latest` to 0.3.0.

- Update `cargo-binstall@latest` to 1.20.1.

- Update `cargo-rdme@latest` to 2.0.1.

###
[`v2.82.2`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.82.2):
2.82.2

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.82.1...v2.82.2)

- Update `xh@latest` to 0.26.1.

- Update `uv@latest` to 0.11.23.

- Update `trivy@latest` to 0.71.2.

- Update `sccache@latest` to 0.16.0.

###
[`v2.82.1`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.82.1):
2.82.1

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.82.0...v2.82.1)

- Update `vacuum@latest` to 0.29.4.

- Update `uv@latest` to 0.11.22.

- Update `osv-scanner@latest` to 2.4.0.

- Update `mise@latest` to 2026.6.11.

- Update `martin@latest` to 1.11.0.

- Update `just@latest` to 1.53.0.

- Update `cargo-zigbuild@latest` to 0.23.0.

###
[`v2.82.0`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.82.0):
2.82.0

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.81.11...v2.82.0)

- Support `cargo-vet`.
([#&#8203;1908](https://redirect.github.com/taiki-e/install-action/pull/1908),
thanks [@&#8203;jakewimmer](https://redirect.github.com/jakewimmer))

- Support `cargo-crap`.
([#&#8203;1905](https://redirect.github.com/taiki-e/install-action/pull/1905),
thanks
[@&#8203;BartoszCiesla](https://redirect.github.com/BartoszCiesla))

- Support `cargo-leptos`.
([#&#8203;1903](https://redirect.github.com/taiki-e/install-action/pull/1903),
thanks [@&#8203;404Simon](https://redirect.github.com/404Simon))

- Update `kingfisher@latest` to 1.103.0.

- Update `cargo-xwin@latest` to 0.23.0.

- Update `wasmtime@latest` to 45.0.2.

- Update `cargo-deny@latest` to 0.19.9.

- Update `prek@latest` to 0.4.5.

- Update `trivy@latest` to 0.71.1.

- Update `mise@latest` to 2026.6.10.

###
[`v2.81.11`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.81.11):
2.81.11

[Compare
Source](https://redirect.github.com/taiki-e/install-action/compare/v2.81.10...v2.81.11)

- Update `wasm-tools@latest` to 1.252.0.

- Update `wasm-bindgen@latest` to 0.2.125.

- Update `uv@latest` to 0.11.21.

- Update `protoc@latest` to 3.35.1.

- Update `mise@latest` to 2026.6.9.

- Update `jaq@latest` to 3.1.0.

- Update `cargo-insta@latest` to 1.48.0.

- Update `biome@latest` to 2.5.0.

</details>

<details>
<summary>voidzero-dev/setup-vp (voidzero-dev/setup-vp)</summary>

###
[`v1.14.0`](https://redirect.github.com/voidzero-dev/setup-vp/releases/tag/v1.14.0)

[Compare
Source](https://redirect.github.com/voidzero-dev/setup-vp/compare/v1.13.0...v1.14.0)

#### What's Changed

- docs: document the version release process by
[@&#8203;fengmk2](https://redirect.github.com/fengmk2) in
[#&#8203;101](https://redirect.github.com/voidzero-dev/setup-vp/pull/101)
- ci: auto-rebuild action bundle on Renovate dependency bumps by
[@&#8203;fengmk2](https://redirect.github.com/fengmk2) in
[#&#8203;103](https://redirect.github.com/voidzero-dev/setup-vp/pull/103)
- feat: resolve Vite+ version from package.json / catalog by
[@&#8203;fengmk2](https://redirect.github.com/fengmk2) in
[#&#8203;102](https://redirect.github.com/voidzero-dev/setup-vp/pull/102)

**Full Changelog**:
<voidzero-dev/setup-vp@v1.13.0...v1.14.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/voidzero-dev/vite-plus).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/actions/build-upstream/action.yml

@@ -49,7 +49,7 @@ runs:
     - name: Restore NAPI binding cache
       id: cache-restore
       if: inputs.skip-native != 'true'
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: |
           packages/cli/binding/*.node
@@ -189,7 +189,7 @@ runs:
 
     - name: Save NAPI binding cache
       if: steps.native.outputs.build == 'true'
-      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: |
           packages/cli/binding/*.node

.github/actions/build-windows-cli/action.yml

@@ -48,7 +48,7 @@ runs:
 
     - name: Restore binaries cache
       id: binaries-cache
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: ${{ steps.binary-paths.outputs.paths }}
         key: ${{ steps.cache-key.outputs.key }}
@@ -97,7 +97,7 @@ runs:
         if-no-files-found: error
         retention-days: 7
 
-    - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       if: steps.binaries-cache.outputs.cache-hit != 'true'
       with:
         path: ${{ steps.binary-paths.outputs.paths }}

.github/actions/setup-xwin/action.yml

@@ -34,15 +34,15 @@ runs:
     - run: rustup target add x86_64-pc-windows-msvc
       shell: bash
 
-    - uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2.81.10
+    - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8
       with:
         tool: ${{ inputs.tools != '' && format('{0},cargo-xwin', inputs.tools) || 'cargo-xwin' }}
 
     # Downloading and unpacking the MSVC CRT/Windows SDK dominates cold wall
     # time (~10 minutes); the unpacked result is immutable for a given manifest
     # version, so cache it (combined restore + post-job save). Bump the key when
     # bumping cargo-xwin.
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: ~/.cache/cargo-xwin
         key: cargo-xwin-msvc-17

.github/workflows/ci.yml

@@ -55,7 +55,7 @@ jobs:
       code-changed: ${{ steps.filter.outputs.code == 'true' || steps.filter.outputs.snapshots == 'true' }}
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: filter
         with:
           predicate-quantifier: every
@@ -80,7 +80,7 @@ jobs:
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
 
-      - uses: voidzero-dev/setup-vp@35171c92dd08b67d5a9d3f2a4327800e58396f2a # v1.13.0
+      - uses: voidzero-dev/setup-vp@13e7afb99c66525824db54e107d667216e795d37 # v1.14.0
         with:
           # The workspace `vite-plus` version can be ahead of the registry, so
           # pin the released build instead of auto-detecting from package.json.
@@ -239,7 +239,7 @@ jobs:
         with:
           name: windows-test-archive
 
-      - uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2.81.10
+      - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8
         with:
           tool: cargo-nextest
 
@@ -1158,7 +1158,7 @@ jobs:
         with:
           name: windows-snapshot-test-archive
 
-      - uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2.81.10
+      - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8
         with:
           tool: cargo-nextest
 

.github/workflows/deploy-docs-preview.yml

@@ -31,15 +31,15 @@ jobs:
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
 
-      - uses: voidzero-dev/setup-vp@13e7afb99c66525824db54e107d667216e795d37 # main
+      - uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # main
         with:
           cache: true
           working-directory: docs
           cache-dependency-path: docs/pnpm-lock.yaml
 
       - name: Restore docs Vite Task cache
         id: vite-task-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: docs/node_modules/.vite/task-cache
           key: vite-task-docs-${{ runner.os }}-${{ runner.arch }}-pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
@@ -53,7 +53,7 @@ jobs:
 
       - name: Save docs Vite Task cache
         if: success() && steps.vite-task-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: docs/node_modules/.vite/task-cache
           key: ${{ steps.vite-task-cache.outputs.cache-primary-key }}

.github/workflows/deploy-docs.yml

@@ -31,15 +31,15 @@ jobs:
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
 
-      - uses: voidzero-dev/setup-vp@13e7afb99c66525824db54e107d667216e795d37 # main
+      - uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # main
         with:
           cache: true
           working-directory: docs
           cache-dependency-path: docs/pnpm-lock.yaml
 
       - name: Restore docs Vite Task cache
         id: vite-task-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: docs/node_modules/.vite/task-cache
           key: vite-task-docs-${{ runner.os }}-${{ runner.arch }}-main-${{ github.sha }}
@@ -52,7 +52,7 @@ jobs:
 
       - name: Save docs Vite Task cache
         if: success() && steps.vite-task-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: docs/node_modules/.vite/task-cache
           key: ${{ steps.vite-task-cache.outputs.cache-primary-key }}

.github/workflows/e2e-test.yml

@@ -33,7 +33,7 @@ jobs:
       related-files-changed: ${{ steps.filter.outputs.related-files }}
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: filter
         with:
           filters: |

.github/workflows/publish-preview.yml

@@ -150,7 +150,7 @@ jobs:
       - name: Register commit build with the registry bridge
         id: bridge
         if: github.event.pull_request.head.repo.full_name == github.repository
-        uses: voidzero-dev/pkg-pr-registry-bridge@711e22a2e1ae55d809fc5fab514c1180a41ac91e # main
+        uses: voidzero-dev/pkg-pr-registry-bridge@65c8157a6f44f075c50d3d3faf3a9bd43d2b230a # main
         with:
           sha: ${{ github.event.pull_request.head.sha }}
           admin-token: ${{ secrets.PKG_PR_BRIDGE_ADMIN_TOKEN }}
@@ -276,10 +276,10 @@ jobs:
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
 
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -291,7 +291,7 @@ jobs:
       # amd64-only: this throwaway preview avoids the slow arm64 QEMU leg; arm64
       # is covered by the release build and the test-install-sh-arm64 job.
       - name: Build and push preview image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: docker
           file: docker/Dockerfile
@@ -323,7 +323,7 @@ jobs:
       PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
       - name: Log in to GHCR
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/release.yml

@@ -233,20 +233,20 @@ jobs:
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
 
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Docker metadata
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.IMAGE }}
           flavor: latest=false
@@ -257,7 +257,7 @@ jobs:
             type=raw,value=latest
 
       - name: Build and push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: docker
           file: docker/Dockerfile

.github/workflows/test-standalone-install.yml

@@ -160,7 +160,7 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         with:
           platforms: arm64
 
@@ -277,7 +277,7 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         with:
           platforms: arm64