chore(deps): update the dependencies

.github/codeql/codeql-config.yml

@@ -0,0 +1,8 @@
+# What code scanning looks at: the code that ships. Tests hold fixed passwords,
+# keys and tokens on purpose, which only make noise as findings.
+name: Forgust
+queries:
+  - uses: security-extended
+paths-ignore:
+  - crates/*/tests
+  - web/e2e

.github/dependabot.yml

@@ -0,0 +1,111 @@
+version: 2
+
+# One pull request per ecosystem each week, majors included. A breaking update
+# turns its pull request red: it then gets a branch with the code changes.
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # pinned to the commit of its `1.99` branch, which picks the Rust version:
+    # moved by hand with the toolchain
+    ignore:
+      - dependency-name: "dtolnay/rust-toolchain"
+    cooldown:
+      default-days: 3
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    allow:
+      - dependency-type: "all"
+    cooldown:
+      default-days: 3
+      semver-major-days: 7
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      rust:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "npm"
+    directory: "/web"
+    schedule:
+      interval: "weekly"
+    allow:
+      - dependency-type: "all"
+    cooldown:
+      default-days: 3
+      semver-major-days: 7
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      web:
+        patterns:
+          - "*"
+
+  # npm run gen:api's own install: openapi-typescript uses TypeScript's
+  # JavaScript API, which TypeScript 7 dropped, so it keeps TypeScript 6
+  - package-ecosystem: "npm"
+    directory: "/web/tools/gen-api"
+    schedule:
+      interval: "weekly"
+    ignore:
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 3
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      gen-api:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "docker-compose"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # a new Postgres major cannot open the old data directory: moved by hand,
+    # with upgrade steps for existing installs
+    ignore:
+      - dependency-name: "postgres"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 3
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      docker-compose:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # the Rust image moves with the toolchain CI pins (dtolnay/rust-toolchain)
+    ignore:
+      - dependency-name: "rust"
+    cooldown:
+      default-days: 3
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      docker:
+        patterns:
+          - "*"

.github/release-notes.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Release notes from the Conventional Commit subjects between two refs, grouped by
+# type, newest first. Squash merges make every pull request one such commit.
+#   .github/release-notes.sh v0.1.0 v0.2.0    # since v0.1.0
+#   .github/release-notes.sh "" HEAD          # from the start
+set -euo pipefail
+from=${1:-}
+to=${2:-HEAD}
+range=${from:+$from..}$to
+
+order=(feat fix perf docs deps internal other)
+declare -A title=([feat]=Features [fix]="Bug Fixes" [perf]=Performance [docs]=Documentation
+  [deps]=Dependencies [internal]=Internal [other]="Other Changes")
+declare -A lines=()
+
+while IFS=$'\t' read -r sha subject; do
+  if [[ $subject =~ ^([a-z]+)(\(([^\)]*)\))?(!)?:\ (.+)$ ]]; then
+    type=${BASH_REMATCH[1]} scope=${BASH_REMATCH[3]} bang=${BASH_REMATCH[4]} text=${BASH_REMATCH[5]}
+  else
+    type=other scope="" bang="" text=$subject
+  fi
+  # the version bump itself is not news
+  [[ $type == chore && $text =~ ^release\  ]] && continue
+  case $type in
+    feat | fix | perf | docs) group=$type ;;
+    chore) [[ $scope == deps* ]] && group=deps || group=internal ;; # deps, deps-dev
+    refactor | test | ci | build | style) group=internal ;;
+    *) group=other ;;
+  esac
+  [[ -n $bang ]] && text="**breaking:** $text"
+  lines[$group]+="* $text ($sha)"$'\n'
+done < <(git log --no-merges --format=$'%h\t%s' "$range")
+
+for g in "${order[@]}"; do
+  [[ -n ${lines[$g]:-} ]] || continue
+  printf '### %s\n%s\n' "${title[$g]}" "${lines[$g]}"
+done

.github/workflows/bench.yml

@@ -13,19 +13,22 @@ name: Bench
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   bench:
     runs-on: [self-hosted, bench]
     env:
       BASELINE: bench/baselines/bench-host.json
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: cargo build --release -p forgust-server -p forgust-bench
       - name: Run (regression gate vs stored baseline)
         run: bench/run.sh
         env:
           NIGHTLY: ${{ github.event_name == 'schedule' }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bench-results
           path: bench/results/

.github/workflows/ci.yml

@@ -29,11 +29,11 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.99
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
       - name: Format
         run: cargo fmt --all --check
       - name: Clippy
@@ -81,16 +81,16 @@ jobs:
       FORGUST_TEST_PG_RESTORE: /usr/lib/postgresql/17/bin/pg_restore
       FORGUST_TEST_PG_URL: postgres://forgust:forgust@127.0.0.1:5432
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: System packages (git-lfs, the Postgres 17 client for the backup test)
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends git-lfs openssh-client postgresql-common
           sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y
           sudo apt-get install -y --no-install-recommends postgresql-client-17
           git --version && git lfs version && /usr/lib/postgresql/17/bin/pg_dump --version
-      - uses: dtolnay/rust-toolchain@1.99
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: test
           save-if: ${{ matrix.shard == 1 }}
@@ -128,9 +128,9 @@ jobs:
       DATABASE_URL: postgres://forgust:forgust@127.0.0.1:5432/forgust
       FORGUST_TEST_RUNNER: gitlab/gitlab-runner:${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.99
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
       - name: Images
         run: |
           pull() { for i in 1 2 3 4; do docker pull -q "$1" && return; sleep 15; done; return 1; }
@@ -159,9 +159,9 @@ jobs:
       FORGUST_TEST_SKOPEO: quay.io/skopeo/stable:v1.22.3
       GLAB_VERSION: "1.128.0"
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.99
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
       - name: glab, Renovate and skopeo
         run: |
           curl -sSfL "https://gitlab.com/gitlab-org/cli/-/releases/v${GLAB_VERSION}/downloads/glab_${GLAB_VERSION}_linux_amd64.tar.gz" \
@@ -189,8 +189,8 @@ jobs:
     env:
       CARGO_DENY: "0.20.2"
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.99
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99
       - name: cargo-deny
         run: |
           curl -sSfL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY}/cargo-deny-${CARGO_DENY}-x86_64-unknown-linux-musl.tar.gz" \
@@ -204,10 +204,10 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 22
+          node-version: 26
           cache: npm
           cache-dependency-path: web/package-lock.json
       - run: npm ci
@@ -221,7 +221,7 @@ jobs:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build the image
         run: docker build -t "forgust:ci-${GITHUB_RUN_NUMBER}" .
       - name: The image starts
@@ -248,12 +248,12 @@ jobs:
       FORGUST_SERVER__DATA_DIR: /tmp/forgust-e2e
       FORGUST_SERVER__STATIC_DIR: web/dist
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.99
-      - uses: Swatinem/rust-cache@v2
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 22
+          node-version: 26
           cache: npm
           cache-dependency-path: web/package-lock.json
       - name: Build
@@ -278,7 +278,7 @@ jobs:
       - name: Server log
         if: failure()
         run: tail -200 /tmp/forgust-e2e.log
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: failure()
         continue-on-error: true
         with:

.github/workflows/codeql.yml

@@ -0,0 +1,43 @@
+name: CodeQL
+
+# Code scanning for the server (Rust), the web UI (TypeScript) and these
+# workflows; findings show in the repository's Security tab.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    # nothing to scan in prose or screenshots; main and the weekly run see everything
+    paths-ignore: ["**/*.md", ".github/images/**"]
+  schedule:
+    - cron: "41 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analyze:
+    name: analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [rust, javascript-typescript, actions]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          category: /language:${{ matrix.language }}

.github/workflows/conformance.yml

@@ -22,7 +22,7 @@ jobs:
     env:
       GITLAB_CT: forgust-conformance-${{ github.run_id }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Start GitLab CE
         run: |
           docker run -d --name "$GITLAB_CT" -p 8929:8929 --shm-size 256m \

.github/workflows/pr-title.yml

@@ -0,0 +1,33 @@
+name: Pull request title
+
+# Squash merges use the pull request's title as the commit message on main, and
+# the release notes are grouped by its type: it must be a Conventional Commit.
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  conventional:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@2252a14e810aa9b85c2d560bd7070c802206ecf6 # v6.1.2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            perf
+            refactor
+            docs
+            test
+            ci
+            chore
+            revert
+          subjectPattern: ^(?![A-Z]).+$
+          subjectPatternError: |
+            The summary "{subject}" starts with a capital letter: write it in lower case,
+            for example "fix: keep reviewed requests apart in your work".