⬆️ build(deps): consolidate the dependency wave and fix CodeQL ref parity

.github/workflows/codeql.yaml

@@ -44,7 +44,7 @@ jobs:
         with:
           go-version: stable # matches verify.yaml (go.mod minimum, CI on latest stable)
 
-      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -53,6 +53,6 @@ jobs:
         name: Build for CodeQL
         run: go build -mod=readonly ./...
 
-      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/release.yaml

@@ -105,7 +105,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
-      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+      - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
 
       - name: Build release assets
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
@@ -149,7 +149,7 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish GitHub Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           tag_name: ${{ steps.version.outputs.tag }}
           name: assent ${{ steps.version.outputs.version }}

.github/workflows/scorecard.yaml

@@ -37,7 +37,7 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
           category: scorecard

CHANGELOG.md

@@ -84,6 +84,9 @@ repository still gets a decision, never by following the link; no release carrie
 - build(deps): bump github/codeql-action/init from 4.37.7 to 4.37.8
 - build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.8
 - build(deps): bump github/codeql-action/upload-sarif
+- :arrow_up: build(deps): bump all three github/codeql-action refs to v4.37.9
+- :arrow_up: build(deps): bump sbom-action to v0.24.2 and action-gh-release to v3.0.3
+- :arrow_up: build(deps): bump fast-uri from 3.1.5 to 3.1.7 in schemas-validator
 
 ### Documentation
 - :memo: docs(changelog): stamp the v0.3.0 section after tagging