chore: update dependencies and Rust tooling

.changeset/calm-hawks-check.md

@@ -0,0 +1,5 @@
+---
+"@stll/stdnum": patch
+---
+
+Publish refreshed package builds after updating dependencies and Rust quality tooling.

.changeset/config.json

@@ -1,10 +1,11 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
   "changelog": [
     "@changesets/changelog-github",
     { "repo": "stella/stdnum" }
   ],
   "commit": false,
+  "format": "oxfmt",
   "fixed": [
     [
       "@stll/stdnum",

.github/workflows/ci.yml

@@ -1,5 +1,10 @@
 name: CI
 
+env:
+  HAWK_RUST_TOOLCHAIN: "1.97.1"
+  HAWK_VERSION: "0.1.12"
+  HAWK_X86_64_UNKNOWN_LINUX_GNU_SHA256: "f9cafbbc5777b2b00c362619b8b62af942d2900a121acae2e73210a8ebffd857"
+
 on:
   push:
     branches: [main]
@@ -168,6 +173,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - run: bun install --frozen-lockfile
@@ -185,13 +192,31 @@ jobs:
           cargo install cargo-dylint --version 6.0.1 --locked
           cargo install dylint-link --version 6.0.1 --locked
 
+      - name: Install pinned Hawk
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected_hawk_script="cargo +${HAWK_RUST_TOOLCHAIN} hawk check --target-dir target/hawk -D warnings -A hawk::dead_public -A hawk::unnecessary_public"
+          jq -e --arg expected "$expected_hawk_script" \
+            '.scripts["rust:hawk"] == $expected' package.json >/dev/null
+          archive="$RUNNER_TEMP/cargo-hawk.tar.gz"
+          install_dir="$RUNNER_TEMP/cargo-hawk"
+          curl --proto '=https' --tlsv1.2 --retry 3 -fsSL \
+            -o "$archive" \
+            "https://github.com/astral-sh/hawk/releases/download/${HAWK_VERSION}/cargo-hawk-x86_64-unknown-linux-gnu.tar.gz"
+          echo "${HAWK_X86_64_UNKNOWN_LINUX_GNU_SHA256}  ${archive}" | sha256sum --check
+          mkdir -p "$install_dir"
+          tar -xzf "$archive" -C "$install_dir" --strip-components=1
+          echo "$install_dir" >> "$GITHUB_PATH"
+          rustup toolchain install "$HAWK_RUST_TOOLCHAIN" --profile minimal
+
       - name: Install pinned Rust CI tools (checksum-verified)
         # Prebuilt nextest (the `cargo ci-test` runner), cargo-deny (the
         # supply-chain gate, `cargo ci-deny`), and cargo-insta (the
         # snapshot-hygiene gate, `cargo ci-snapshot`); avoids a from-source
         # compile on every CI run. taiki-e/install-action verifies release
         # checksums, unlike a raw `curl | tar`.
-        uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2.83.4
+        uses: taiki-e/install-action@67729d5c413db75907f0ad1e39bb04b9c868ff60 # v2.85.7
         with:
           tool: nextest@0.9.140,cargo-deny@0.20.2,cargo-insta@1.48.0
 
@@ -210,6 +235,9 @@ jobs:
       - name: Rust checks (fmt, clippy, dylint, test)
         run: bun run rust:check
 
+      - name: Hawk visibility lint
+        run: bun run rust:hawk
+
       - name: Cargo deny (supply chain)
         # Full-tree license/advisory/source/duplicate checks; complements the
         # PR-scoped dependency-review action. See deny.toml.

.github/workflows/mutants.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Install pinned Rust tools (checksum-verified)
         # nextest is the test runner used by cargo-mutants. taiki-e/install-action
         # verifies release checksums, unlike a raw `curl | tar`.
-        uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2.83.4
+        uses: taiki-e/install-action@67729d5c413db75907f0ad1e39bb04b9c868ff60 # v2.85.7
         with:
           tool: nextest@0.9.140,cargo-mutants@27.1.0
 

.github/workflows/release.yml

@@ -422,7 +422,7 @@ jobs:
             exit 1
           fi
 
-      - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: dist
 

.github/workflows/scorecard.yml

@@ -23,13 +23,13 @@ jobs:
           persist-credentials: false
 
       - name: Run OpenSSF Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
 
       - name: Upload SARIF to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           sarif_file: results.sarif