fix(deps): update all non-major dependencies

Author: renovate[bot]

.devcontainer/Dockerfile

@@ -18,7 +18,7 @@ ARG BUILDIFIER_VERSION=v8.5.1
 # later layers can layer `uv tool install ruff ty pre-commit` on top of it.
 # Pinned tag bumped by Renovate's docker manager (matches the pattern used in
 # ~/.dotfiles/.devcontainer/Dockerfile).
-COPY --from=ghcr.io/astral-sh/uv:0.12.3 /uv /uvx /usr/local/bin/
+COPY --from=ghcr.io/astral-sh/uv:0.12.4 /uv /uvx /usr/local/bin/
 
 # ruff: format + lint. Installed via `uv tool install` so the binary lives in
 # /usr/local/bin and `ruff` is on PATH for the pre-commit hooks and the VS Code
@@ -27,18 +27,18 @@ COPY --from=ghcr.io/astral-sh/uv:0.12.3 /uv /uvx /usr/local/bin/
 # /root (mode 700) and the vscode user could not follow the bin/ symlink.
 # Renovate's regex manager tracks RUFF_VERSION via the comment above the ARG.
 # renovate: datasource=pypi depName=ruff
-ARG RUFF_VERSION=0.16.2
+ARG RUFF_VERSION=0.16.3
 # ty: static type checker. Same `uv tool install` pattern as ruff so the
 # binary lands on PATH for CI, pre-commit, and the `astral-sh.ty` editor
 # extension. UV_TOOL_{BIN_DIR,DIR} are shared across all uv tool installs.
 # renovate: datasource=pypi depName=ty
-ARG TY_VERSION=0.0.69
+ARG TY_VERSION=0.0.71
 # pre-commit: the hook runner. Installed via `uv tool install` (not pip) so
 # we have a single Python package manager in the devcontainer; the binary
 # lands at /usr/local/bin/pre-commit, so post-create.sh and any contributor
 # shell can invoke it directly without a $HOME/.local/bin PATH dance.
 # renovate: datasource=pypi depName=pre-commit
-ARG PRE_COMMIT_VERSION=4.6.1
+ARG PRE_COMMIT_VERSION=4.6.2
 # UV_TOOL_DIR holds the per-tool venvs; UV_PYTHON_INSTALL_DIR is where uv
 # downloads its managed Python interpreters (both the pre-commit tool venv's
 # interpreter and the interactive `python3` installed below). Both must be

.devcontainer/devcontainer.json

@@ -22,7 +22,7 @@
       "upgradePackages": false
     },
     "ghcr.io/devcontainers/features/go:1.3.4": {
-      "version": "1.26.5"
+      "version": "1.26.6"
     },
     // Python is NOT a devcontainer feature: that feature compiles CPython from source
     // (~2 min/build). The Dockerfile installs a prebuilt uv-managed interpreter instead

.github/workflows/ci.yml

@@ -157,7 +157,7 @@ jobs:
       - uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
         with:
           # renovate: datasource=pypi depName=ruff
-          version: "0.16.2"
+          version: "0.16.3"
           args: format --check
       - run: ruff check
 
@@ -208,7 +208,7 @@ jobs:
       - name: ty check
         env:
           # renovate: datasource=pypi depName=ty
-          TY_VERSION: "0.0.69"
+          TY_VERSION: "0.0.71"
         run: uvx "ty@${TY_VERSION}" check
 
   # Build and test runs once per supported target platform, on a runner whose host matches

.github/workflows/security.yml

@@ -48,7 +48,7 @@ jobs:
     name: Semgrep
     runs-on: ubuntu-latest
     container:
-      image: semgrep/semgrep:1.172.0@sha256:65dcd4408adda7c183a6b4550cb1e9b19f7f627a6fbb7e0559bd466bedc44d7b
+      image: semgrep/semgrep:1.173.0@sha256:67319956da3dcb58baf5b322899c15458e3963e7018a86aeeb5cd224e69cb77a
     permissions:
       contents: read
     steps:
@@ -170,7 +170,7 @@ jobs:
           format: sarif
           output: trivy.sarif
 
-      - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+      - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         if: always()
         with:
           sarif_file: trivy.sarif

MODULE.bazel

@@ -42,17 +42,17 @@ go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
 go_sdk.download(
     goarch = "amd64",
     goos = "linux",
-    version = "1.26.5",
+    version = "1.26.6",
 )
 go_sdk.download(
     goarch = "arm64",
     goos = "linux",
-    version = "1.26.5",
+    version = "1.26.6",
 )
 go_sdk.download(
     goarch = "arm64",
     goos = "darwin",
-    version = "1.26.5",
+    version = "1.26.6",
 )
 
 # Discover external Go deps from the workspace's go.work + per-module go.mod files.
@@ -64,7 +64,7 @@ go_deps.from_file(go_work = "//:go.work")
 use_repo(go_deps, "com_github_vbauerster_mpb_v8")
 
 # ── Python ────────────────────────────────────────────────────────────────────────────────────────
-bazel_dep(name = "rules_python", version = "2.2.0")
+bazel_dep(name = "rules_python", version = "2.3.0")
 
 python = use_extension("@rules_python//python/extensions:python.bzl", "python")
 python.toolchain(

go.work

@@ -1,3 +1,3 @@
-go 1.26.5
+go 1.26.6
 
 use ./tools/network_infrastructure_maintenance