fix(deps): update non-major dependencies

.github/workflows/ci.yml

@@ -118,7 +118,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: 'fs'
           scan-ref: '.'

.github/workflows/kingfisher.yml

@@ -37,11 +37,11 @@
       contents: read
       security-events: write # upload SARIF to Code Scanning
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # full history — Kingfisher defaults to --git-history full
 
-      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           # Must match the exact key in mise.toml, not a bare short name —
           # "kingfisher" alone resolves against mise's central tool registry
@@ -58,6 +58,6 @@
 
       - name: Upload SARIF to GitHub Security
         if: always()
-        uses: github/codeql-action/upload-sarif@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3
+        uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3
         with:
           sarif_file: kingfisher-results.sarif

.github/workflows/plumber.yml

@@ -47,10 +47,10 @@
       issues: write # maintain the High/Medium/Low backlog issue
       pull-requests: write # post the compliance comment on PRs
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: plumber
-        uses: getplumber/plumber@7970e5df1e7d217de41b2880832b63a6f2152b97 # v0.4.8
+        uses: getplumber/plumber@6452d3d9c12dfa4aecaecde6bc6c528eea3b21a5 # v0.4.55
         # soft-fail: the action never fails on its own A-E score. continue-on-error:
         # a transient runtime error must not block either — the Critical gate below
         # is the only blocking signal. SARIF upload to Code Scanning is left on

.github/workflows/pr-agent.yml

@@ -57,7 +57,7 @@ jobs:
       - name: PR Agent action step
         if: steps.key.outputs.present == 'true'
         continue-on-error: true
-        uses: docker://pragent/pr-agent@sha256:ea2ea90f072fd97708755e59827a317272f66097a1ef349eca23d39160bb0baf
+        uses: docker://pragent/pr-agent@sha256:e6463e802562daa47db51950de84100a5679472844926d77d53911e529398ee5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Model IDs on every provider are point-in-time; expect to bump these

Cargo.toml

@@ -10,4 +10,4 @@ which = "8"
 anyhow = "1"
 owo-colors = "3"
 dirs = "6"
-dialoguer = "0.10"
+dialoguer = "0.12"