chore(deps): consolidate open dependency updates

.github/workflows/cflite_build.yml

@@ -33,7 +33,7 @@ jobs:
           - address
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/cflite_pr.yml

@@ -38,7 +38,7 @@ jobs:
           - address
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/dependency-review.yml

@@ -23,7 +23,7 @@ jobs:
       pull-requests: write # Required to publish the dependency review summary comment.
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/docs-pages.yml

@@ -55,7 +55,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          version: 0.12.2
+          version: 0.12.7
 
       - name: Build documentation
         run: uv run --locked --only-group docs mkdocs build --strict --clean --site-dir site
@@ -86,7 +86,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          version: 0.12.2
+          version: 0.12.7
 
       - name: Configure GitHub Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

.github/workflows/iac-policy.yml

@@ -57,7 +57,7 @@ jobs:
       pull-requests: write # Required to publish summaries back to pull requests.
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -74,7 +74,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          version: 0.12.2
+          version: 0.12.7
 
       - name: Run offline IaC contract tests
         working-directory: tests
@@ -291,7 +291,7 @@ jobs:
       pull-requests: write # Required to publish summaries back to pull requests.
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -351,7 +351,7 @@ jobs:
       security-events: write # Required to upload Checkov SARIF to code scanning.
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -384,6 +384,6 @@ jobs:
       - name: Upload Checkov SARIF
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

.github/workflows/infrascan-security-audit.yml

@@ -26,7 +26,7 @@ jobs:
       contents: read # Required to checkout repository content for scanning.
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/lambda-tests.yml

@@ -67,7 +67,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          version: 0.12.2
+          version: 0.12.7
 
       - name: Run unit tests
         working-directory: tests

.github/workflows/ministack-smoke.yml

@@ -67,7 +67,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          version: 0.12.2
+          version: 0.12.7
 
       - name: Start MiniStack
         working-directory: tests/smoke

.github/workflows/ossf-scorecard.yml

@@ -30,7 +30,7 @@ jobs:
       security-events: write # Required to upload Scorecard SARIF results to code scanning.
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -54,6 +54,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

.github/workflows/pre-commit.yml

@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     container:
-      image: ghcr.io/cisco-open/forge-pre-commit:main@sha256:8af6a7caa0662c2b0721e8e3732bf1eae2e2805dd6f938e29f68bb8c4992a2b5
+      image: ghcr.io/cisco-open/forge-pre-commit:main@sha256:62c444fc72d9bfb8031ebe415653fdce2b9e1e3b6895b2e612a70c064cc2de73
 
     if: github.event.pull_request.user.login != 'dependabot[bot]'
     steps:

.github/workflows/quality-gates.yml

@@ -92,7 +92,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          version: 0.12.2
+          version: 0.12.7
 
       - name: Run automation gate tests
         working-directory: tests
@@ -140,7 +140,7 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          version: 0.12.2
+          version: 0.12.7
 
       - name: Run deterministic mutation tests
         working-directory: tests

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
     environment: release
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/semantic-check.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/zizmor.yml

@@ -34,6 +34,6 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
         with:
           persona: pedantic

.pre-commit-config.yaml

@@ -83,7 +83,7 @@ repos:
   # Commit Message Hooks
   # ---------------------
   - repo: https://github.com/commitizen-tools/commitizen
-    rev: d910b66e2686a3ef6c3f438dec0f63ba3cf8d7ee  # frozen: v4.18.0
+    rev: 3d7386012109c403d56375314125c20e102e75c0  # frozen: v4.18.0
     hooks:
       - id: commitizen
         name: Git · Validate commit message
@@ -144,8 +144,8 @@ repos:
   # ---------------------
   # Makefile Hooks
   # ---------------------
-  - repo: https://github.com/mrtazz/checkmake.git
-    rev: 59931d556f8f5cf4fbacf2c8390a8122ef7a881d  # frozen: v0.3.2
+  - repo: https://github.com/checkmake/checkmake
+    rev: 446732014beed209cff787b0c397a3d9f905424e  # frozen: v0.3.0
     hooks:
       - id: checkmake
         name: Makefile · Lint Makefile
@@ -161,13 +161,13 @@ repos:
         name: Python · autopep8
 
   - repo: https://github.com/PyCQA/isort
-    rev: a333737ed43df02b18e6c95477ea1b285b3de15a  # frozen: 8.0.1
+    rev: 131f4adcd5582bfc53928ab0d740eceb8b506b6c  # frozen: 9.0.1
     hooks:
       - id: isort
         name: Python · Import sorter
 
   - repo: https://github.com/PyCQA/autoflake
-    rev: 2d3853a9f31d97783fb2e181d41cd82a6babd666  # frozen: v2.3.3
+    rev: 6d9dd2716540ab776f29c7b896cd3052ef4619b2  # frozen: v2.4.0
     hooks:
       - id: autoflake
         name: Python · Remove unused imports
@@ -198,7 +198,7 @@ repos:
   # JSON Schema Hooks
   # ---------------------
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 12e63946db2c5cfcc9030fac21c3883ba88c6ed8  # frozen: 0.38.0
+    rev: c4654a7e007c9619a5eb63c39a456572a0fa1851  # frozen: 0.38.0
     hooks:
       - id: check-github-workflows
         name: JSON Schema · GitHub workflows
@@ -260,7 +260,7 @@ repos:
   # Security Hooks
   # ---------------------
   - repo: https://github.com/gitleaks/gitleaks
-    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e  # frozen: v8.30.1
+    rev: 2ca41cc1372d1e939a6a879f18cdc19fc1cac1ce  # frozen: v8.30.0
     hooks:
       - id: gitleaks
         name: Security · Gitleaks
@@ -301,7 +301,7 @@ repos:
   # ---------------------
   # Ansible Hooks
   # ---------------------
-  - repo: https://github.com/ansible-community/ansible-lint.git
+  - repo: https://github.com/ansible/ansible-lint
     rev: 665d9e07a1943254d2910faffc106adaf7ea7294  # frozen: v26.8.0
     hooks:
       - id: ansible-lint

docs/operations/repo-blueprints/containers/containers/action-runner/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:24.04@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea
+FROM ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
       ca-certificates \

docs/operations/repo-blueprints/containers/containers/pre-commit/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.14-slim@sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc
+FROM python:3.14-slim@sha256:cae66f2ef0ec51a9891263eeee7f987dacf0a9879e8aa9353d5606e0530619a5
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \

docs/operations/repo-blueprints/renovate-config/.github/workflows/renovate.yml

@@ -45,7 +45,7 @@ jobs:
           role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }}
 
       - name: Run Renovate
-        uses: renovatebot/github-action@316d7cd859606d6039a2182b7d69199e9b036835 # v46.2.1
+        uses: renovatebot/github-action@39b914146caeff8cd512e61c8992f1d5913af85c # v46.2.5
         with:
           configurationFile: config/default.json
           env-regex: '^(AWS_|LOG_FILE|LOG_FILE_FORMAT|LOG_FILE_LEVEL)'

docs/operations/repo-blueprints/runner-base-image/requirements.yml

@@ -1,8 +1,8 @@
 ---
 collections:
   - name: ansible.windows
-    version: 3.7.0
+    version: 3.8.0
   - name: community.general
-    version: 13.2.0
+    version: 13.3.0
   - name: community.windows
     version: 3.3.0

modules/infra/eks/eks.tf

@@ -19,7 +19,7 @@ module "ebs_csi_irsa_role" {
 module "eks" {
   #checkov:skip=CKV_TF_1:Module source uses Renovate-managed version tags; commit SHA pinning is an accepted policy tradeoff.
   source  = "terraform-aws-modules/eks/aws"
-  version = "21.24.1"
+  version = "21.25.0"
 
   name               = var.cluster_name
   kubernetes_version = var.cluster_version

modules/infra/eks/karpenter.tf

@@ -1,6 +1,6 @@
 module "karpenter" {
   source  = "terraform-aws-modules/eks/aws//modules/karpenter"
-  version = "21.24.1"
+  version = "21.25.0"
 
   namespace    = "karpenter"
   cluster_name = var.cluster_name

modules/infra/eks/nodes.tf

@@ -10,7 +10,7 @@ data "aws_ami" "eks_default" {
 module "self_managed_node_group" {
   #checkov:skip=CKV_TF_1:Module source uses Renovate-managed version tags; commit SHA pinning is an accepted policy tradeoff.
   source  = "terraform-aws-modules/eks/aws//modules/self-managed-node-group"
-  version = "21.24.1"
+  version = "21.25.0"
 
   name                = var.cluster_name
   cluster_name        = var.cluster_name

modules/integrations/splunk_opencost_eks/main.tf

@@ -2,7 +2,7 @@ resource "helm_release" "managed_prometheus" {
   name             = "prometheus"
   repository       = "https://prometheus-community.github.io/helm-charts"
   chart            = "prometheus"
-  version          = "29.21.0"
+  version          = "29.27.0"
   namespace        = "prometheus-system"
   create_namespace = true
 
@@ -53,7 +53,7 @@ resource "helm_release" "opencost" {
   name             = "opencost"
   repository       = "https://opencost.github.io/opencost-helm-chart"
   chart            = "opencost"
-  version          = "2.5.29"
+  version          = "2.5.30"
   namespace        = "opencost"
   create_namespace = true
 

modules/integrations/splunk_otel_eks/otel.tf

@@ -19,7 +19,7 @@ resource "helm_release" "splunk_otel_collector" {
   name             = "splunk-otel-collector"
   repository       = "https://signalfx.github.io/splunk-otel-collector-chart"
   chart            = "splunk-otel-collector"
-  version          = "0.157.0"
+  version          = "0.159.0"
   namespace        = "splunk-otel-collector"
   create_namespace = true
 

modules/platform/ec2_deployment/main.tf

@@ -5,7 +5,7 @@ locals {
   terraform_aws_github_runner_tags = merge(
     var.tenant_configs.tags,
     {
-      terraform-aws-github-runner-ref = "v7.10.1"
+      terraform-aws-github-runner-ref = "v7.11.0"
     }
   )
   webhook_api_gateway_access_log_format = jsonencode({
@@ -67,7 +67,7 @@ data "aws_subnet" "runner_subnet" {
 }
 
 data "external" "download_lambdas" {
-  program = ["bash", "${path.module}/scripts/download_lambdas.sh", "/tmp/${var.runner_configs.prefix}/", "v7.10.1", "github-aws-runners/terraform-aws-github-runner"]
+  program = ["bash", "${path.module}/scripts/download_lambdas.sh", "/tmp/${var.runner_configs.prefix}/", "v7.11.0", "github-aws-runners/terraform-aws-github-runner"]
 }
 
 # ---------------------------------------------------------------------------
@@ -126,7 +126,7 @@ resource "aws_iam_policy" "runner_hooks_ssm_read" {
 
 module "runners" {
   #checkov:skip=CKV_TF_1:Module source uses Renovate-managed version tags; commit SHA pinning is an accepted policy tradeoff.
-  source = "git::https://github.com/github-aws-runners/terraform-aws-github-runner.git//modules/multi-runner?ref=v7.10.1"
+  source = "git::https://github.com/github-aws-runners/terraform-aws-github-runner.git//modules/multi-runner?ref=v7.11.0"
 
   aws_region = var.aws_region
 

modules/platform/ec2_deployment/tests/source_inventory.tftest.hcl

@@ -11,7 +11,7 @@ run "platform_ec2_deployment_contract" {
       "module \"ec2_update_runner_ssm_ami\"",
       "module \"ec2_update_runner_tags\"",
       "module \"runners\"",
-      "source = \"git::https://github.com/github-aws-runners/terraform-aws-github-runner.git//modules/multi-runner?ref=v7.10.1\"",
+      "source = \"git::https://github.com/github-aws-runners/terraform-aws-github-runner.git//modules/multi-runner?ref=v7.11.0\"",
       "multi_runner_config = local.multi_runner_config_v1",
       "resource \"aws_cloudwatch_log_group\" \"webhook_api_gateway_access\"",
       "resource \"aws_kms_key\" \"github\"",