build: integrate compatible dependency and workflow updates

.github/dependabot.yml

@@ -4,11 +4,26 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    groups:
+      rust-compatible:
+        patterns: ["*"]
+        update-types: [minor, patch]
   - package-ecosystem: npm
     directory: /apps/desktop
     schedule:
       interval: weekly
+    groups:
+      desktop-compatible:
+        patterns: ["*"]
+        update-types: [minor, patch]
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+    # This ref defines the promised compiler floor, not an action runtime version.
+    ignore:
+      - dependency-name: dtolnay/rust-toolchain
+        update-types: [version-update:semver-major, version-update:semver-minor, version-update:semver-patch]

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Check release metadata
         run: python scripts/check_release_metadata.py
@@ -83,7 +83,7 @@ jobs:
     name: Rust 1.90 MSRV
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Linux system dependencies
         run: |

.github/workflows/codeforge-regression.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -30,7 +30,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
 
       - name: Cache CodeForge v0.2.1 build inputs
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -56,7 +56,7 @@ jobs:
 
       - name: Upload CodeForge SARIF
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: codeforge-sarif
           path: codeforge.sarif

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
     name: Release preflight
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -71,7 +71,7 @@ jobs:
             cli_path: target/release/codeforge
             tauri_args: "--bundles appimage,deb"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Linux system dependencies
         if: runner.os == 'Linux'
@@ -141,7 +141,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/download-artifact@v8
         with:
           path: artifacts

.github/workflows/security.yml

@@ -14,7 +14,7 @@ jobs:
   cargo-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Install cargo-audit
@@ -25,7 +25,7 @@ jobs:
   frontend-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v6
         with:
           version: 12
@@ -42,10 +42,10 @@ jobs:
   secret-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: "1.23"
       - name: Install gitleaks

apps/desktop/package.json

@@ -12,19 +12,19 @@
   },
   "dependencies": {
     "@monaco-editor/react": "^4.7.0",
-    "@tanstack/react-virtual": "^3.13.12",
+    "@tanstack/react-virtual": "^3.14.21",
     "@tauri-apps/api": "^2.8.0",
-    "@tauri-apps/plugin-dialog": "^2.4.0",
-    "lucide-react": "^1.48.0",
+    "@tauri-apps/plugin-dialog": "^2.8.3",
+    "lucide-react": "^1.59.0",
     "monaco-editor": "^0.57.0",
     "react": "^19.1.1",
     "react-dom": "^19.1.1",
     "zustand": "^5.0.8"
   },
   "devDependencies": {
     "@eslint/js": "^9.35.0",
-    "@tauri-apps/cli": "^2.8.4",
-    "@types/node": "^24.3.0",
+    "@tauri-apps/cli": "^2.12.3",
+    "@types/node": "^26.6.5",
     "@types/react": "^19.1.12",
     "@types/react-dom": "^19.1.9",
     "@vitejs/plugin-react": "^5.0.2",