chore(deps): update all non-major dependencies

Author: renovate[bot]

.devcontainer/Dockerfile

@@ -35,7 +35,7 @@ ARG RUFF_VERSION=0.16.4
 # binary lands on PATH for CI, pre-commit, and the `astral-sh.ty` editor
 # extension. UV_TOOL_{BIN_DIR,DIR} are shared across all uv tool installs.
 # renovate: datasource=pypi depName=ty
-ARG TY_VERSION=0.0.73
+ARG TY_VERSION=0.0.74
 # pre-commit: the hook runner. Installed via `uv tool install` (not pip) so
 # we have a single Python package manager in the devcontainer; the binary
 # lands at /usr/local/bin/pre-commit, so post-create.sh and any contributor

.github/workflows/ci.yml

@@ -245,7 +245,7 @@ jobs:
       - name: ty check
         env:
           # renovate: datasource=pypi depName=ty
-          TY_VERSION: "0.0.73"
+          TY_VERSION: "0.0.74"
         run: uvx "ty@${TY_VERSION}" check
 
   # Build and test runs once per supported target platform, on a runner whose host matches

.github/workflows/security.yml

@@ -102,13 +102,13 @@ jobs:
             go.work.sum
             **/go.sum
 
-      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: ${{ matrix.language }}
           # No separate autobuild step: that action documents itself as superseded by this input.
           build-mode: ${{ matrix.build-mode }}
 
-      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           # The string default setup uploaded under; it is what separates one language's
           # results from another's within a tool.
@@ -244,7 +244,7 @@ jobs:
           format: sarif
           output: trivy.sarif
 
-      - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         if: always()
         with:
           sarif_file: trivy.sarif

MODULE.bazel

@@ -64,7 +64,7 @@ go_deps.from_file(go_work = "//:go.work")
 use_repo(go_deps, "com_github_vbauerster_mpb_v8")
 
 # ── Python ────────────────────────────────────────────────────────────────────────────────────────
-bazel_dep(name = "rules_python", version = "2.3.1")
+bazel_dep(name = "rules_python", version = "2.3.2")
 
 python = use_extension("@rules_python//python/extensions:python.bzl", "python")
 python.toolchain(