build(deps): update Python, frontend, docs, base image and Actions pins

.github/workflows/dependabot-lockfile-fix.yml

@@ -47,7 +47,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
 

.github/workflows/deploy-docs.yml

@@ -26,7 +26,7 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           # Matches the node npm-lock-sync validates against, so the tree that
           # deploys is the tree that gate approved.
@@ -58,4 +58,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/docs-build.yml

@@ -28,7 +28,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm

.github/workflows/docs-checks.yml

@@ -30,7 +30,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
       # No npm ci: both steps are plain Node with no dependencies, and skipping

.github/workflows/frontend-ci.yml

@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -71,7 +71,7 @@ jobs:
       # gated on having had a token to upload with.
       - name: Upload frontend coverage to Codecov
         if: ${{ !cancelled() }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: ./src/dispatch/static/dispatch/coverage/lcov.info
           flags: frontend

.github/workflows/lockfile-sync.yml

@@ -40,7 +40,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
 

.github/workflows/python-ci.yml

@@ -89,7 +89,7 @@ jobs:
           uv pip install --system --constraint requirements-lock.txt \
             pytest==9.1.1 pytest-mock pytest-xdist pytest-cov factory-boy faker \
             easydict devtools schemathesis coverage
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -137,7 +137,7 @@ jobs:
       # uploading nothing until this was turned on.
       - name: Upload coverage to Codecov
         if: ${{ !cancelled() }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: ./coverage.xml
           flags: backend

constraints.txt

@@ -3,4 +3,4 @@
 # Held so the vendored jaraco.context and wheel stay past CVE-2026-23949 /
 # CVE-2026-24049. 83 removes pkg_resources; verified in the runtime image that
 # nothing in the lock needs it, so the old "hold at 81 for pkg_resources" is dead.
-setuptools==84.0.0
+setuptools==84.2.1

docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.14.7-slim-trixie as sdist
+FROM python:3.14.9-slim-trixie as sdist
 
 LABEL maintainer="oss@dispatch.io"
 LABEL org.opencontainers.image.title="Dispatch PyPI Wheel"
@@ -77,7 +77,7 @@ RUN YARN_CACHE_FOLDER="$(mktemp -d)" \
   && mv /usr/src/dispatch/dist /dist
 
 # This is the image to be run
-FROM python:3.14.7-slim-trixie
+FROM python:3.14.9-slim-trixie
 
 LABEL maintainer="oss@dispatch.io"
 LABEL org.opencontainers.image.title="Dispatch"