chore(ci): bump checkout v7, setup-node v7, setup-python v7; normalize maturin-action pin (PF-040)

.github/dependabot.yml

@@ -45,6 +45,12 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "js-yaml"
         update-types: ["version-update:semver-major"]
+      # typescript 7.x is blocked on a build-system migration, not a version bump: the CJS half of
+      # the dual build (packages/{bundler-utils,webpack-loader,rspack-loader}/tsconfig.cjs.json)
+      # uses moduleResolution=node10, which TS 7 removed (TS5108). Tracked in #364; remove this
+      # entry when it lands. `ignore` filters VERSION updates only — SECURITY updates still arrive.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: "/"

.github/workflows/ci.yml

@@ -22,13 +22,13 @@ jobs:
     name: Rust — fmt, clippy, test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c  # stable
         with:
           components: rustfmt, clippy
       # mds-python (pyo3, abi3-py311) is compiled by `clippy --all-targets` and
       # `test --workspace`; a 3.11+ interpreter makes the pyo3 build deterministic.
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - uses: Swatinem/rust-cache@v2
@@ -48,15 +48,15 @@ jobs:
     name: MSRV (Rust 1.88)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # rust-version = 1.88 is declared workspace-wide; verify the published
       # crates still compile on it. napi/wasm bindings are checked on stable
       # in their own jobs since their toolchain needs can differ.
       - uses: dtolnay/rust-toolchain@2eae45db285e407f22119950686d47e1101e071b  # 1.88
       # mds-python is added to the MSRV gate: its pyo3/abi3 build must compile on
       # the workspace floor (Rust 1.88 ≥ pyo3 0.28 MSRV 1.83). setup-python gives
       # the pyo3 build script a 3.11+ interpreter.
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - uses: Swatinem/rust-cache@v2
@@ -66,7 +66,7 @@ jobs:
     name: WASM — build & test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Pinned to 1.96.0 (released 2026-05-28, >30-day soak per project convention).
       # RATIONALE: unpinned `stable` lets compiler drift silently change the wasm-opt
       # output size independently of any source change, making the 850 KB guard measure
@@ -167,15 +167,15 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # DELIBERATE: @stable is intentionally not pinned to a SHA here. This is the
       # only job that builds the native addon (ubuntu/macOS/Windows) against the
       # stable compiler — providing the sole CI coverage of the compiler that actually
       # ships in releases. Pinning to a fixed version (like the wasm job's 1.96.0)
       # would silently remove coverage of the released compiler channel.
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -209,7 +209,7 @@ jobs:
       # no pre-installed maturin needed.  MDS_PYTHON_BIN is set to the exact
       # executable that owns the installed module so findPythonForMarkdownScript()
       # picks it up cross-platform (bin/ on Unix, Scripts/ on Windows).
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - name: Install Python binding (CF-SM2 parity surface)
@@ -234,10 +234,10 @@ jobs:
         python-version: ["3.11", "3.13"]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c  # stable
       - uses: Swatinem/rust-cache@v2
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install test tooling
@@ -275,7 +275,7 @@ jobs:
     name: examples/ gitignore coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c  # stable
       - uses: Swatinem/rust-cache@v2
       - name: Build mds CLI
@@ -327,10 +327,10 @@ jobs:
     name: Python — wheel install smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c  # stable
       - uses: Swatinem/rust-cache@v2
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - name: Install build tooling
@@ -369,8 +369,8 @@ jobs:
     name: Source hygiene
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - name: Scan tracked source for hazardous codepoints
@@ -405,7 +405,7 @@ jobs:
     name: Watch startup race (probe)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c  # stable
       - uses: Swatinem/rust-cache@v2
       # Scoped to -p mds-cli --test cli_watch: `startup-race-probe` injects a sleep

.github/workflows/release.yml

@@ -36,10 +36,10 @@ jobs:
       actions: read  # CI workflow runs + their jobs, for the CI-history step
       id-token: write # OIDC for PyPI trusted publisher probe (F5, security-08)
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: 22, registry-url: "https://registry.npmjs.org" }
       - name: "Verify publish credentials before irreversible steps (security-08)"
         env:
@@ -300,10 +300,10 @@ jobs:
             build: napi build --platform --release --target x86_64-pc-windows-msvc --no-js
     runs-on: ${{ matrix.settings.host }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: 22, cache: npm }
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -369,10 +369,10 @@ jobs:
     if: ${{ !cancelled() && needs.build-napi.result == 'success' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: 22, cache: npm }
       - run: npm ci
       - name: Download all .node artifacts
@@ -461,7 +461,7 @@ jobs:
             sdist: true
     runs-on: ${{ matrix.host }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
       # Rust toolchain needed for macOS/Windows wheel builds. Linux legs run
@@ -481,7 +481,7 @@ jobs:
       # --- build wheel ---
       - name: Build wheel
         if: ${{ !matrix.sdist }}
-        uses: PyO3/maturin-action@3e2bdf6ba6453a61e649744019b8a2d906c7eb38  # v1.51.0
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b  # v1.51.0
         with:
           command: build
           args: --release --locked --compatibility pypi -m crates/mds-python/Cargo.toml --out dist
@@ -491,7 +491,7 @@ jobs:
       # --- build sdist ---
       - name: Build sdist
         if: ${{ matrix.sdist }}
-        uses: PyO3/maturin-action@3e2bdf6ba6453a61e649744019b8a2d906c7eb38  # v1.51.0
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b  # v1.51.0
         with:
           command: sdist
           args: -m crates/mds-python/Cargo.toml --out dist
@@ -672,7 +672,7 @@ jobs:
     if: ${{ !cancelled() && needs.version-gate.result == 'success' && needs.stage-and-verify-napi.result == 'success' && needs.build-python.result == 'success' && startsWith(github.ref, 'refs/tags/v') }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
       - uses: dtolnay/rust-toolchain@stable
@@ -755,10 +755,10 @@ jobs:
       NPM_CONFIG_ACCESS: "public"
       NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -934,7 +934,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
       - name: Create release

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Cargo dependency sweep: napi 3.9.0 → 3.12.2, napi-derive 3.5.6 → 3.6.3, napi-build 2.3.2 → 2.4.1 (napi-sys 3.3.0, napi-derive-backend 6.1.2), pyo3 0.29.0 → 0.29.2, clap 4.6.1 → 4.6.6, similar 3.1.1 → 3.2.0, wasm-bindgen 0.2.121 → 0.2.126 (js-sys 0.3.103, wasm-bindgen-futures 0.4.76, wasm-bindgen-test 0.3.76), serde 1.0.228 → 1.0.229, serde_json 1.0.150 → 1.0.151, thiserror 2.0.18 → 2.0.20, libc 0.2.186 → 0.2.189. Supersedes Dependabot #354 #360 #359 #358 #280 #251 #249 #246 #243.
 - npm dependency sweep: relaxed the three phantom floor pins to caret ranges — fast-uri 3.1.5 → ^3.1.6 (oldest release patching GHSA-5jgf-p345-68v8, GHSA-fph4-wmhf-6fwf, GHSA-f65p-4m7j-42xc, GHSA-jqff-g426-hqxp), nanoid 3.3.18 → ^3.3.18, js-yaml 4.3.1 → ^4.3.1 (#336); @napi-rs/cli ^3.0.0 → ^3.8.6 (lock 3.7.0 → 3.8.6); vite lock 8.1.5 → 8.2.2; Dependabot `ignore` rules for semver-major bumps of the three phantom pins. Supersedes Dependabot #315 #332 #346 #362 #355 #357 #279.
+- GitHub Actions sweep: actions/checkout v6 → v7 (16 call sites: 9 ci.yml + 7 release.yml), actions/setup-node v6 → v7 (6 sites), actions/setup-python v5 → v7 (5 sites, ci.yml only; action runtime node20 → node24), PyO3/maturin-action pin normalized from the v1.51.0 annotated-tag object (`3e2bdf6`) to the commit it points to (`e83996d1`), same version (PF-040); Dependabot `ignore` for typescript semver-major version updates pending the TS 7 migration (#364). Supersedes Dependabot #111, #189, #241, #356; replaces #169.
 
 ## [0.4.2] — 2026-09-03