Merge branch 'main' into feature/better-test-integration

rjaegers · web-flow · commit dae9dd46cff0 · 2025-03-07T08:58:03.000+01:00
diff --git a/.devcontainer/cpp/Dockerfile b/.devcontainer/cpp/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:24.04@sha256:80dd3c3b9c6cecb9f1667e9290b3bc61b78c2678c02cbdae5f0fea92cc6734ab
+FROM ubuntu:24.04@sha256:72297848456d5d37d1262630108ab308d3e9ec7ed1c3286a32fe09856619a782
 
 ARG BATS_VERSION=1.11.0
 ARG CCACHE_VERSION=4.10.1
diff --git a/.devcontainer/cpp/apt-requirements-base.json b/.devcontainer/cpp/apt-requirements-base.json
@@ -7,7 +7,7 @@
   "gnupg2": "2.4.4-2ubuntu17",
   "ninja-build": "1.11.1-2",
   "python3-pip": "24.0+dfsg-1ubuntu1.1",
-  "udev": "255.4-1ubuntu8.4",
+  "udev": "255.4-1ubuntu8.5",
   "unzip": "6.0-28ubuntu4.1",
   "wget": "1.21.4-1ubuntu4.1",
   "xsltproc": "1.1.39-0exp1build1",
diff --git a/.devcontainer/cpp/devcontainer-metadata-vscode.json b/.devcontainer/cpp/devcontainer-metadata-vscode.json
@@ -9,10 +9,10 @@
         "marus25.cortex-debug@1.12.1",
         "matepek.vscode-catch2-test-adapter@4.12.2",
         "mhutchie.git-graph@1.30.0",
-        "ms-vscode.cmake-tools@1.19.52",
-        "ms-vscode.cpptools@1.22.11",
+        "ms-vscode.cmake-tools@1.20.52",
+        "ms-vscode.cpptools@1.23.6",
         "ms-vsliveshare.vsliveshare@1.0.5948",
-        "sonarsource.sonarlint-vscode@4.15.0"
+        "sonarsource.sonarlint-vscode@4.16.0"
       ],
       "settings": {
         "C_Cpp.intelliSenseEngine": "disabled",
diff --git a/.devcontainer/cpp/requirements.in b/.devcontainer/cpp/requirements.in
@@ -1,3 +1,3 @@
-cmake==3.31.4
-conan==2.11.0
+cmake==3.31.6
+conan==2.13.0
 gcovr==8.3
diff --git a/.devcontainer/cpp/requirements.txt b/.devcontainer/cpp/requirements.txt
@@ -115,27 +115,27 @@ charset-normalizer==3.4.0 \
     --hash=sha256:fe9f97feb71aa9896b81973a7bbada8c49501dc73e58a10fcef6663af95e5079 \
     --hash=sha256:ffc519621dce0c767e96b9c53f09c5d215578e10b02c285809f76509a3931482
     # via requests
-cmake==3.31.4 \
-    --hash=sha256:20be7cdb41903edf85e8a498c4beff8d6854acbb087abfb07c362c738bdf0018 \
-    --hash=sha256:225d9a643b0b60ffce0399ff0cabd7a4820e0dbcb794e97d3aacfcf7c0589ae6 \
-    --hash=sha256:23781e17563693a68b0cef85749746894b8a61488e56e96fc6649b73652e8236 \
-    --hash=sha256:25c5094394f0cee21130b5678e5b4552f72470e266df6d6fb1d5c505100f0eaa \
-    --hash=sha256:2a37be93534df04513f0845492d71bc80899c3f87b77e3b01c95aff1a7fc9bde \
-    --hash=sha256:466c9295af440bb4a47cc5e1af10576cf2227620528afd0fd0b3effa1d513b49 \
-    --hash=sha256:838a388b559137f3654d8cf30f62bbdec10f8d1c3624f0d289614d33cdf4fba1 \
-    --hash=sha256:89143a5e2a5916061f2cfc5012e9fe6281aaf7c0dae7930bdc68d105d22ddc39 \
-    --hash=sha256:926d91cae2ba7d2f3df857d0fc066bdac4f3904bf5c95e99b60435e85aabedb4 \
-    --hash=sha256:929a8d8d289d69e43784661748ddd08933ce1ec5db8f9bcfce6ee817a48f8787 \
-    --hash=sha256:9479a9255197c49e135df039d8484c69aa63158a06ae9c2d0eb939da2f0f7dff \
-    --hash=sha256:a6a3b0b9557f41c955a6b25c94205f2ca9c3a46edca809ad87507c5ef6bc4274 \
-    --hash=sha256:a6ac2242e0b16ad7d94c9f8572d6f232e6169747be50e5cdf497f206c4819ce1 \
-    --hash=sha256:b463efdf5b92f3b290235aa9f8da092b3dac19b7636c563fd156022dab580649 \
-    --hash=sha256:c9f5f8289c5e7bd2ed654cbac164021fa7723064fee0443a2f0068bc08413d81 \
-    --hash=sha256:d378c9e58eac906bddafd673c7571262dcd5a9946bb1e8f9e3902572a8fa95ca \
-    --hash=sha256:f6af3b83a1b1fc1d990d18b6a566ee9c95c0393f986c6df15f2505dda8ad1bcc \
-    --hash=sha256:f96127bf663168accd29d5a50ee68ea80f26bcd37f96c7a14ef2378781f19936 \
-    --hash=sha256:fc048b4b70facd16699a43c737f6782b4eff56e8e6093090db5979532d9db0f6
-    # via -r cpp/requirements.in
+cmake==3.31.6 \
+    --hash=sha256:024a79ca3d2c355f75875b6cc92d907afd710d1a4ffde2f20a7da712a2f4b1c3 \
+    --hash=sha256:112b36427e59bd26145b705a49d5f70b16433a655ce807cb8fdd81dd4d0e60c2 \
+    --hash=sha256:13f2e636dc27834fe096f53301d6efb913b4b501fdc0ed03f386c0a7e7ec1a21 \
+    --hash=sha256:1c8b05df0602365da91ee6a3336fe57525b137706c4ab5675498f662ae1dbcec \
+    --hash=sha256:2297e9591307d9c61e557efe737bcf4d7c13a30f1f860732f684a204fee24dca \
+    --hash=sha256:42d9883b8958da285d53d5f69d40d9650c2d1bcf922d82b3ebdceb2b3a7d4521 \
+    --hash=sha256:4326f6c6f39867a60e2822fea8e6aedbcac09c9f59ad3f0f3386a890a2c8d89d \
+    --hash=sha256:547efc1d0e27a194da819a0392fe645a9b8f1485bc2c3f34ae4f1e682cfd3153 \
+    --hash=sha256:689441fc74fbb03673c67e20d4636614a231634d5e803387cd213d2cdf9675fc \
+    --hash=sha256:6cb97adae7e5390ce68f8b7f38e1be1c72bf19e9f6727f31f8fa1c095b39be88 \
+    --hash=sha256:6f77db820af725bb92fab60c4c9d67f64442ac0ea9b933aca4cd4586219cbd1f \
+    --hash=sha256:8b67bf9613dfb59c12ce643c6be582c49c981e6eee28c4c244aeb3248b33f05e \
+    --hash=sha256:8edddfbf367fa1bcf4b9f3064470bc0e1022f70609c0cf69c863961897826205 \
+    --hash=sha256:9eed74a1f2a29a7cd92a9f071a35d64645b19802beb393ec250d6e7c09441314 \
+    --hash=sha256:9f170e3c6933dba64f333cb456823bbb1d0ac126f94aa4a577e40855d2b1ca49 \
+    --hash=sha256:bbaed969cef3c427f4f17591feb28db4ae595e3a4bbd45cb35522cee14df6a32 \
+    --hash=sha256:ce5fc0299ecafe489b2614daa6176c3c2baacea6bc3b359bac9aa25b46ed43e9 \
+    --hash=sha256:cefb910be81e1b4fdc3b89ef61819c3e848b3906ed56ac36d090f37cfa05666b \
+    --hash=sha256:da9d4fd9abd571fd016ddb27da0428b10277010b23bb21e3678f8b9e96e1686e
+    # via -r requirements.in
 colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
@@ -144,9 +144,9 @@ colorlog==6.8.2 \
     --hash=sha256:3e3e079a41feb5a1b64f978b5ea4f46040a94f11f0e8bbb8261e3dbbeca64d44 \
     --hash=sha256:4dcbb62368e2800cb3c5abd348da7e53f6c362dda502ec27c560b2e58a66bd33
     # via gcovr
-conan==2.11.0 \
-    --hash=sha256:87f78a295716d1a37dfabc26f5d1b6a0ed49594618ea339420bb89627ececeda
-    # via -r cpp/requirements.in
+conan==2.13.0 \
+    --hash=sha256:0ad929984e5842fe6bb686361ae1a6240e28b24a6df09aab2c87aaa46ff71f33
+    # via -r requirements.in
 distro==1.8.0 \
     --hash=sha256:02e111d1dc6a50abb8eed6bf31c3e48ed8b0830d1ea2a1b78c61765c2513fdd8 \
     --hash=sha256:99522ca3e365cac527b44bde033f64c6945d90eb9f769703caaec52b09bbd3ff
@@ -158,14 +158,14 @@ fasteners==0.19 \
 gcovr==8.3 \
     --hash=sha256:d613a90aeea967b4972fbff69587bf8995ee3cd80df2556983b73141f30642d2 \
     --hash=sha256:faa371f9c4a7f78c9800da655107d4f99f04b718d1c0d9f48cafdcbef0049079
-    # via -r cpp/requirements.in
+    # via -r requirements.in
 idna==3.10 \
     --hash=sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9 \
     --hash=sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3
     # via requests
-jinja2==3.1.5 \
-    --hash=sha256:8fefff8dc3034e27bb80d67c671eb8a9bc424c0ef4c0826edbff304cceff43bb \
-    --hash=sha256:aba0f4dc9ed8013c424088f68a5c226f7d6097ed89b246d7749c2ec4175c6adb
+jinja2==3.1.6 \
+    --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
+    --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
     # via
     #   conan
     #   gcovr
diff --git a/.devcontainer/rust/Dockerfile b/.devcontainer/rust/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:24.04@sha256:80dd3c3b9c6cecb9f1667e9290b3bc61b78c2678c02cbdae5f0fea92cc6734ab
+FROM ubuntu:24.04@sha256:72297848456d5d37d1262630108ab308d3e9ec7ed1c3286a32fe09856619a782
 
 ARG BATS_VERSION=1.11.0
 ARG CARGO_BINSTALL_VERSION=1.10.22
diff --git a/.devcontainer/rust/apt-requirements-base.json b/.devcontainer/rust/apt-requirements-base.json
@@ -4,9 +4,9 @@
   "g++-14": "14.2.0-4ubuntu2~24.04",
   "git": "1:2.43.0-1ubuntu7.2",
   "gnupg2": "2.4.4-2ubuntu17",
-  "libc6-dev": "2.39-0ubuntu8.3",
+  "libc6-dev": "2.39-0ubuntu8.4",
   "rustup": "1.26.0-5build1",
-  "udev": "255.4-1ubuntu8.4",
+  "udev": "255.4-1ubuntu8.5",
   "wget": "1.21.4-1ubuntu4.1",
   "xz-utils": "5.6.1+really5.4.5-1build0.1"
 }
diff --git a/.devcontainer/rust/devcontainer-metadata-vscode.json b/.devcontainer/rust/devcontainer-metadata-vscode.json
@@ -7,9 +7,9 @@
       "extensions": [
         "mhutchie.git-graph@1.30.0",
         "ms-vsliveshare.vsliveshare@1.0.5948",
-        "rust-lang.rust-analyzer@0.3.2273",
+        "rust-lang.rust-analyzer@0.3.2319",
         "tamasfe.even-better-toml@0.21.2",
-        "usernamehw.errorlens@3.22.0"
+        "usernamehw.errorlens@3.23.0"
       ]
     }
   }
diff --git a/.github/workflows/acceptance-test.yml b/.github/workflows/acceptance-test.yml
@@ -19,7 +19,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+      - uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
         with:
           egress-policy: audit
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -68,7 +68,7 @@ jobs:
           GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}
           GITHUB_PASSWORD: ${{ secrets.TEST_GITHUB_PASSWORD }}
           GITHUB_TOTP_SECRET: ${{ secrets.TEST_GITHUB_TOTP_SECRET }}
-      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         if: always()
         with:
           name: playwright-artifacts
diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
@@ -20,7 +20,8 @@ env:
 
 jobs:
   build-push:
-    runs-on: ubuntu-latest
+    # The ARM64 build segfaults with Ubuntu 24.04, so use 22.04 (for now)
+    runs-on: ubuntu-22.04
     permissions:
       attestations: write
       # dependency-submission needs contents write permission.
@@ -33,20 +34,20 @@ jobs:
       matrix:
         flavor: ["cpp", "rust"]
     steps:
-      - uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+      - uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
         with:
           egress-policy: audit
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
-      - uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
       - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         if: github.event_name != 'merge_group'
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         if: matrix.flavor == 'cpp'
         id: buildkit-cache
         with:
@@ -62,7 +63,7 @@ jobs:
               "root-ccache": "/root/.ccache"
             }
           skip-extraction: ${{ steps.buildkit-cache.outputs.cache-hit }}
-      - uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
+      - uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         id: metadata
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
@@ -82,7 +83,7 @@ jobs:
         id: devcontainer-metadata
       - run: echo "git-commit-epoch=$(git log -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"
         id: devcontainer-epoch
-      - uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
+      - uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         id: build-and-push
         env:
           SOURCE_DATE_EPOCH: ${{ steps.devcontainer-epoch.outputs.git-commit-epoch }}
@@ -118,7 +119,7 @@ jobs:
         with:
           comment-summary-in-pr: on-failure
           fail-on-severity: critical
-      - uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
+      - uses: actions/attest-build-provenance@bd77c077858b8d561b7a36cbe48ef4cc642ca39d # v2.2.2
         if: github.event_name != 'merge_group'
         with:
           subject-name: ${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -25,14 +25,14 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
-      - uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
-      - uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+      - uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           file: .devcontainer/${{ matrix.flavor }}/Dockerfile
           load: true
           tags: ${{ github.repository }}-${{ matrix.flavor }}:test
           cache-from: type=gha,scope=${{ github.repository }}-${{ matrix.flavor }}
-      - uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      - uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         if: matrix.flavor == 'cpp'
         with:
           path: test/.xwin-cache
@@ -43,7 +43,7 @@ jobs:
         run: |
           set -Eeuo pipefail
           docker run --rm --mount type=bind,src=/var/run/docker.sock,dst=/var/run/docker.sock --mount type=bind,src="${{ github.workspace }}/test/${{ matrix.flavor }}",dst=/ws -w /ws ${{ github.repository }}-${{ matrix.flavor }}:test bats --formatter junit integration-tests.bats | tee test-report-${{ matrix.flavor }}.xml
-      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         if: always()
         with:
           name: test-results-${{ matrix.flavor }}
@@ -56,7 +56,7 @@ jobs:
     needs: build-test
     if: always()
     steps:
-      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
         with:
           merge-multiple: true
           pattern: test-results-*
diff --git a/.github/workflows/linting-formatting.yml b/.github/workflows/linting-formatting.yml
@@ -26,16 +26,16 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: oxsecurity/megalinter@f90c800040e4f84800700b27b2394d3eecc1fdad # v8.4.0
+      - uses: oxsecurity/megalinter@ec124f7998718d79379a3c5b39f5359952baf21d # v8.4.2
         env:
           APPLY_FIXES: all
           VALIDATE_ALL_CODEBASE: true
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: github/codeql-action/upload-sarif@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+      - uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
         if: success() || failure()
         with:
           sarif_file: megalinter-reports/megalinter-report.sarif
-      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         if: success() || failure()
         with:
           name: Linter Report
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
@@ -21,12 +21,12 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
-      - uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+      - uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
         with:
           results_file: results.sarif
           results_format: sarif
           repo_token: ${{ secrets.SCORECARD_TOKEN }}
           publish_results: true
-      - uses: github/codeql-action/upload-sarif@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+      - uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/package-published.yml b/.github/workflows/package-published.yml
@@ -3,7 +3,6 @@ name: Package Published
 
 on:
   registry_package:
-    types: [updated]
 
 permissions:
   contents: read
diff --git a/.github/workflows/prime-cache.yml b/.github/workflows/prime-cache.yml
@@ -14,13 +14,14 @@ concurrency:
 
 jobs:
   prime-docker-cache:
-    runs-on: ubuntu-latest
+    # The ARM64 build segfaults with Ubuntu 24.04, so use 22.04 (for now)
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         flavor: ["cpp", "rust"]
     steps:
-      - uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
-      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         if: matrix.flavor == 'cpp'
         id: buildkit-cache
         with:
@@ -36,7 +37,7 @@ jobs:
               "root-ccache": "/root/.ccache"
             }
           skip-extraction: ${{ steps.buildkit-cache.outputs.cache-hit }}
-      - uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
+      - uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           file: .devcontainer/${{ matrix.flavor }}/Dockerfile
           platforms: linux/amd64,linux/arm64
@@ -49,7 +50,7 @@ jobs:
           set -Eeuo pipefail
           mkdir test
           docker run --rm --mount type=bind,src="$(pwd)/test",dst=/ws -w /ws ghcr.io/${{ github.repository }}-cpp:latest xwin --accept-license splat --preserve-ms-arch-notation
-      - uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      - uses: actions/cache/save@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: test/.xwin-cache
           key: xwin-cache-${{ github.run_id }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
@@ -16,11 +16,11 @@ jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # v1.11.6
         id: token
         with:
           app-id: ${{ vars.FOREST_RELEASER_APP_ID }}
           private-key: ${{ secrets.FOREST_RELEASER_APP_PRIVATE_KEY }}
-      - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
+      - uses: googleapis/release-please-action@d1a8f221d7723166f48a584aebba00ef3f6febec # v4.1.4
         with:
           token: ${{ steps.token.outputs.token }}
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
@@ -29,12 +29,12 @@ jobs:
         id: update-packages
         with:
           input-file: .devcontainer/${{ matrix.flavor }}/apt-requirements-*.json
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # v1.11.6
         id: token
         with:
           app-id: ${{ vars.FOREST_RELEASER_APP_ID }}
           private-key: ${{ secrets.FOREST_RELEASER_APP_PRIVATE_KEY }}
-      - uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
+      - uses: peter-evans/create-pull-request@dd2324fc52d5d43c699a5636bcf19fceaa70c284 # v7.0.7
         with:
           commit-message: "Update ${{ join(fromJson(steps.update-packages.outputs.updated-dependencies), ', ') }}"
           branch: feature/amp-devcontainer-${{ matrix.flavor }}/update-apt-packages
@@ -58,12 +58,12 @@ jobs:
         id: update-extensions
         with:
           input-file: .devcontainer/${{ matrix.flavor }}/devcontainer-metadata-vscode.json
-      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+      - uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # v1.11.6
         id: token
         with:
           app-id: ${{ vars.FOREST_RELEASER_APP_ID }}
           private-key: ${{ secrets.FOREST_RELEASER_APP_PRIVATE_KEY }}
-      - uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
+      - uses: peter-evans/create-pull-request@dd2324fc52d5d43c699a5636bcf19fceaa70c284 # v7.0.7
         with:
           commit-message: "Update ${{ join(fromJson(steps.update-extensions.outputs.updated-dependencies), ', ') }}"
           branch: feature/amp-devcontainer-${{ matrix.flavor }}/update-vscode-extensions
diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           image: ghcr.io/${{ github.repository }}-${{ matrix.flavor }}:latest
           dockerfile: .devcontainer/Dockerfile
-      - uses: github/codeql-action/upload-sarif@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+      - uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
         if: steps.scan.outputs.sarif != ''
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "5.6.0"
+  ".": "5.6.2"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM ubuntu:24.04@sha256:80dd3c3b9c6cecb9f1667e9290b3bc61b78c2678c02cbdae5f0fea92cc6734ab`
	`1`	`+FROM ubuntu:24.04@sha256:72297848456d5d37d1262630108ab308d3e9ec7ed1c3286a32fe09856619a782`
`2`	`2`
`3`	`3`	`ARG BATS_VERSION=1.11.0`
`4`	`4`	`ARG CCACHE_VERSION=4.10.1`
Original file line number	Diff line number	Diff line change
`@@ -7,9 +7,9 @@`
`7`	`7`	`"extensions": [`
`8`	`8`	`"[email protected]",`
`9`	`9`	`"[email protected]",`
`10`		`- "[email protected].2273",`
	`10`	`+ "[email protected].2319",`
`11`	`11`	`"[email protected]",`
`12`		`- "usernamehw.errorlens@3.22.0"`
	`12`	`+ "usernamehw.errorlens@3.23.0"`
`13`	`13`	`]`
`14`	`14`	`}`
`15`	`15`	`}`