chore(deps): apply Dependabot bumps for actions and Python requirements

.github/actions/drift-check/action.yml

@@ -96,7 +96,7 @@ runs:
         path: .drift-checker
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ inputs.python-version }}
 

.github/actions/release-doc-sync/action.yml

@@ -118,7 +118,7 @@ runs:
         path: .release-doc-sync
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ inputs.python-version }}
 

.github/workflows/README.md

@@ -28,7 +28,7 @@ First-party GitHub actions (`actions/`, `github/`) may use a major-version tag:
 
 ```yaml
 - uses: actions/checkout@v7
-- uses: actions/setup-python@v6
+- uses: actions/setup-python@v7
 ```
 
 Rationale: tags are mutable and can be retargeted to a malicious commit. SHAs are immutable. GitHub-owned actions are exempt because GitHub's own security model protects them.

.github/workflows/stale.yml

@@ -15,7 +15,7 @@ jobs:
     name: Close stale issues
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           days-before-stale: 60
           days-before-close: 14
@@ -36,7 +36,7 @@ jobs:
     name: Close stale PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           days-before-stale: 30
           days-before-close: 14

.github/workflows/sync.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

.github/workflows/validate.yml

@@ -44,7 +44,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -229,7 +229,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -363,7 +363,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

CLAUDE.md

@@ -179,6 +179,6 @@ Open `docs/index.html` in a browser. The script falls back to embedded registry
 
 | Dependency | Purpose | Where |
 |------------|---------|-------|
-| Jinja2 >=3.1,<4.0 | Scaffold template rendering | `requirements.txt` |
+| Jinja2 >=3.1.6,<4.0 | Scaffold template rendering | `requirements.txt` |
 
 The docs site has zero runtime dependencies. The sync script is pure stdlib.

requirements-test.txt

@@ -1,8 +1,8 @@
-pytest>=8.0,<9.0
+pytest>=9.1.1,<10.0
 # PyYAML is required by the YAML-validating tests (test_release_doc_sync.py,
 # test_composite_action_shape.py). Without it those tests pytest.importorskip
 # and silently skip in CI, hiding real coverage.
-PyYAML>=6.0,<7.0
+PyYAML>=6.0.3,<7.0
 # Jinja2 is required by the born-green scaffold integration test, which renders
 # a repo of each type and runs the drift checker against the output.
-Jinja2>=3.1,<4.0
+Jinja2>=3.1.6,<4.0

requirements.txt

@@ -1 +1 @@
-Jinja2>=3.1,<4.0
+Jinja2>=3.1.6,<4.0

scaffold/generator.py

@@ -54,11 +54,11 @@
 ACTION_PINS = {
     "actions/checkout": "v7",
     "actions/setup-node": "v6",
-    "actions/setup-python": "v6",
+    "actions/setup-python": "v7",
     "actions/configure-pages": "v6",
     "actions/upload-pages-artifact": "v5",
     "actions/deploy-pages": "v5",
-    "actions/stale": "v10",
+    "actions/stale": "v11",
 }
 NODE_MATRIX = (22, 24)
 NODE_ENGINES = ">=22.0.0"

scaffold/templates/pages.yml.j2

@@ -38,7 +38,7 @@ jobs:
           sparse-checkout: site-template
           path: _template
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

scaffold/templates/stale.yml.j2

@@ -13,7 +13,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           stale-issue-message: "This issue has been automatically marked as stale due to inactivity. It will be closed in 7 days if no further activity occurs."
           stale-pr-message: "This PR has been automatically marked as stale due to inactivity. It will be closed in 7 days if no further activity occurs."

scaffold/templates/validate.yml.j2

@@ -150,7 +150,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

site-template/requirements.txt

@@ -1 +1 @@
-Jinja2>=3.1,<4.0
+Jinja2>=3.1.6,<4.0