fix: green gate: repin moved actions, update vulnerable crates

.github/workflows/ci.yml

@@ -71,7 +71,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
           components: rustfmt
@@ -96,7 +96,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
           components: clippy
@@ -127,14 +127,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
       - name: Free runner disk space
         run: |
           sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc \
             /usr/local/.ghcup /usr/local/share/powershell 2>/dev/null || true
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
         if: github.workflow == 'CI' && !inputs.clean
         with:
           key: ${{ runner.os }}-${{ runner.arch }}-test-${{ matrix.lane.name }}
@@ -170,7 +170,7 @@ jobs:
           version="$(awk '/^name = "termlens"$/{found=1; next} found && /^version = /{gsub(/[",]/, "", $3); print $3; exit}' Cargo.lock)"
           [ -n "$version" ] || { echo "::error::no termlens version in Cargo.lock"; exit 1; }
           echo "version=$version" >> "$GITHUB_OUTPUT"
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+      - uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30
         if: matrix.lane.name == 'default'
         with:
           tool: termlens-cli@${{ steps.termlens.outputs.version }}
@@ -199,7 +199,7 @@ jobs:
           name: termlens-report-linux-${{ matrix.lane.name }}
       - name: Upload Cargo build timings
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: timings-linux-${{ matrix.lane.name }}
           path: target/cargo-timings/*.html
@@ -218,11 +218,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
           components: clippy
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
         if: github.workflow == 'CI' && !inputs.clean
         with:
           key: ${{ runner.os }}-${{ runner.arch }}-metal
@@ -245,7 +245,7 @@ jobs:
           name: termlens-report-metal
       - name: Upload Cargo build timings
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: timings-metal
           path: target/cargo-timings/*.html
@@ -269,7 +269,7 @@ jobs:
           msrv="$(sed -n 's/^rust-version *= *"\(.*\)"/\1/p' Cargo.toml)"
           echo "MSRV: ${msrv}"
           echo "msrv=${msrv}" >> "$GITHUB_OUTPUT"
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: ${{ steps.msrv.outputs.msrv }}
       - run: cargo check --workspace --all-targets --locked
@@ -283,7 +283,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
       - run: make doc
@@ -317,7 +317,7 @@ jobs:
       # What crates.io will show for every crate: README, repository,
       # keywords, categories, docs.rs link. Inherited fields must be opted
       # into per manifest; 0.1.0 shipped without them.
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
       - run: ./.github/scripts/check-crate-metadata.sh

.github/workflows/install.yml

@@ -73,7 +73,7 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "msrv=$msrv" >> "$GITHUB_OUTPUT"
           echo "installing $version (declared MSRV: ${msrv:-none})"
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           # Falls back to stable if the registry reports no rust-version: an
           # empty toolchain string would otherwise install nothing and fail

.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
         with:
           persist-credentials: false
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
       - name: Compare the tag against the workspace version
@@ -107,7 +107,7 @@ jobs:
         with:
           persist-credentials: false
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
       - name: Verify the tree the tag points at
@@ -120,7 +120,7 @@ jobs:
       # answers the exchange with 400 "No Trusted Publishing config found" —
       # that is expected on the first release, so the step may fail and the
       # publish loop falls back to the registry token below.
-      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+      - uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
         id: auth
         continue-on-error: true
       - name: Publish every crate, in dependency order

.github/workflows/stress.yml

@@ -32,10 +32,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
         with:
           key: ${{ runner.os }}-${{ runner.arch }}-stress-release
           cache-bin: false
@@ -55,7 +55,7 @@ jobs:
           name: termlens-report-stress-${{ matrix.os }}
       - name: Upload Cargo build timings
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: timings-stress-${{ matrix.os }}
           path: target/cargo-timings/*.html

CHANGELOG.md

@@ -8,6 +8,21 @@ versions (0.x) may contain breaking changes; they are always listed under a
 
 ## [Unreleased]
 
+### Security
+
+- **Vulnerable crates in the locked graph updated** (the lockfile is what
+  `cargo install --locked` and the release binaries build from): rustls
+  0.23.46 (RUSTSEC-2026-0346 to -0349: TLS secrets in `Debug` output, up to
+  1 GiB allocated by Brotli certificate decompression before
+  authentication, an ECH data leak and a key-exchange downgrade),
+  rustls-webpki 0.103.16 (RUSTSEC-2026-0382), tokio 1.54.1
+  (RUSTSEC-2026-0386), the patched zstd 0.13.4 / zstd-safe 7.4 / zstd-sys
+  2.1.2 line (RUSTSEC-2026-0391, -0398, -0403, -0410), ctutils 0.4.8
+  (RUSTSEC-2026-0385), pulldown-cmark 0.13.6 (a build dependency;
+  RUSTSEC-2026-0414, -0433), and the AWS SDK crates Ballista bundles, whose
+  current releases no longer pull the unmaintained `pin-utils`
+  (RUSTSEC-2026-0441).
+
 ## [0.2.0] - 2026-09-21
 
 The observability release. A GPU deployment that silently ran everything on