2026.10.1.2

What's Changed

Changes and improvements

• feat(deps): install upcoming oidc extra by @nijel in #4820
• fix: validate PostgreSQL version before shell arithmetic by @nijel in #4829
• fix: avoid signing published image digests twice by @nijel in #4830
• fix: verify reusable workflow signing identity by @nijel in #4831
• chore: sync with WeblateOrg/meta by @nijel in #4832
• ci: move local hook tests into container CI by @nijel in #4833
• hardening: validate startup worker settings by @nijel in #4835

Dependency updates

• chore(deps): update github/codeql-action action to v4.39.0 by @renovate[bot] in #4819
• chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.17.1 by @renovate[bot] in #4822
• chore(deps): update dependency astral-sh/uv to v0.13.1 by @renovate[bot] in #4821
• chore(deps): update pre-commit hook adamchainz/djade-pre-commit to v1.10.0 by @renovate[bot] in #4824
• chore(deps): update dependency mongodb/kingfisher to v2.13.0 by @renovate[bot] in #4823
• chore(deps): update pre-commit hook zizmorcore/zizmor-pre-commit to v1.31.1 by @renovate[bot] in #4826
• chore(deps): update pre-commit hook rvben/rumdl-pre-commit to v0.3.0 by @renovate[bot] in #4825
• chore(deps): update weblate/base docker tag to v2026.43.0 by @renovate[bot] in #4827
• chore(deps): update weblate/dev docker tag to v2026.43.0 by @renovate[bot] in #4828
• chore(deps): update weblate/base docker tag to v2026.43.1 by @renovate[bot] in #4834
• chore(deps): update weblate/dev docker tag to v2026.43.1 by @renovate[bot] in #4836

Full Changelog: 2026.10.1.1...2026.10.1.2