NPA-5043: Resolve Dependabot Issues (#268)

# Pull Request

## 🧾 Ticket Link

<!-- Add the Jira ticket link here -->

https://nhsd-jira.digital.nhs.uk/browse/NPA-XXXX

---

## 📄 Description/Summary of Changes

<!-- Describe the changes made in this PR. Include the
purpose/scope/impact of the changes -->

Merged in the following PRs:
-
https://github.com/NHSDigital/validated-relationships-service-api/pull/263/files
-
https://github.com/NHSDigital/validated-relationships-service-api/pull/222/files
-
https://github.com/NHSDigital/validated-relationships-service-api/pull/211/files

---

## 🧪 Developer Testing Carried Out

<!-- Describe what tests (automated/unit/manual etc.) have been done for
the ticket. Include: -->
<!-- - Any tests added/updated -->
<!-- - Evidence that each acceptance criterion from the Jira ticket is
met -->

- Ran API tests in QA against this branch
[here](https://github.com/NHSDigital/proxy-validated-relationships-service/actions/runs/19665221186)

---

## 🧪 Reviewer Testing Required

<!-- Describe how to test the changes that have been made in the ticket.
Include: -->
<!-- - Testing environment details (e.g. sandbox/local setup) -->
<!-- - Steps to verify the changes -->

- [ ] <!-- Add bullet points for testing instructions -->
- [ ] <!-- Add bullet points for testing instructions -->
- [ ] <!-- Add bullet points for testing instructions -->

---

## ✅ Developer Checklist

<!-- Complete before submitting the PR -->

- [ ] PR title follows the format: `NPA-XXXX: <short-description>`
- [ ] Branch name follows the convention:
`<type>/NPA-XXXX/<short-description>`
- [ ] Commit messages follow the template: `NPA-XXXX:
<short-description>`
- [ ] All acceptance criteria from the Jira ticket are addressed
- [ ] Automated tests (unit/integration/API/infrastructure etc. tests)
are added or updated
- [ ] Assignees and appropriate labels (e.g. `terraform`,
`documentation`) are added

---

## 👀 Reviewer Checklist

<!-- To be completed by the reviewer -->

- [ ] Changes meet the acceptance criteria of the Jira ticket
- [ ] Code is able to be merged (no conflicts and adheres to coding
standards)
- [ ] Sufficient test evidence is provided (manual and/or automated)
- [ ] Infrastructure/operational/build changes are validated (if
applicable)

---

## 🚀 Post-merge

<!-- Actions to complete after merging -->

After merging and deploying changes to the sandbox, Postman collection
or spec examples please run the Run Postman
collection workflow.

This will run the tests within the collection to check that the sandbox
is working as expected once deployed.

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: ellie-bound1-NHSD

.github/workflows/codeql-analysis.yml

@@ -16,11 +16,11 @@ jobs:
             security-events: write
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
             - name: Initialize CodeQL
-              uses: github/codeql-action/init@v3
+              uses: github/codeql-action/init@v4
               with:
                   languages: python
                   queries: security-extended
             - name: Perform CodeQL Analysis
-              uses: github/codeql-action/analyze@v3
+              uses: github/codeql-action/analyze@v4

.github/workflows/continuous-integration.yml

@@ -8,12 +8,12 @@ jobs:
         if: github.ref == 'refs/heads/master'
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
               with:
                   fetch-depth: 0 # This causes all history to be fetched, which is required for calculate-version to function
 
             - name: Install Python 3.8
-              uses: actions/setup-python@v5
+              uses: actions/setup-python@v6
               with:
                   python-version: 3.8
 

.github/workflows/dependency-review.yml

@@ -8,7 +8,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout Repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
             - name: Dependency Review
               uses: actions/dependency-review-action@v4
               with:

.github/workflows/openapi-validate.yml

@@ -44,13 +44,13 @@ jobs:
                     ]
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
               with:
                   fetch-depth: 0
                   persist-credentials: false
 
             - name: Set up Python
-              uses: actions/setup-python@v5
+              uses: actions/setup-python@v6
               with:
                   python-version: 3.9
 

.github/workflows/prettier-checks.yml

@@ -10,12 +10,12 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
               with:
                   fetch-depth: 0
                   persist-credentials: false
             - name: Setup Node
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v6
               with:
                   node-version: 22
 

.github/workflows/run-postman-collection.yml

@@ -8,9 +8,9 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Check out the repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
             - name: Set up Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v6
               with:
                   node-version: "22"
             - name: Install Newman

.github/workflows/sandbox-checks.yaml

@@ -5,10 +5,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Install poetry
         run: pipx install poetry
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.8"
           cache: "poetry"