fix(deps): update all non-major dependencies

.github/workflows/ci.yml

@@ -74,7 +74,7 @@ jobs:
         env:
           PI_DEPS: ${{ github.workspace }}/src/bundled/pi/deps
         run: ./bin/node scripts/ci-test-report.mjs kind=vitest report=test-results/protection/vitest.json evidence=test-results/protection/timing.json title="Protected Pi" -- ./bin/pnpm exec vitest run src/bundled/pi/protection.live.test.ts --reporter=default --reporter=json --outputFile=test-results/protection/vitest.json
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: agent-protection
           save-if: ${{ github.event_name == 'push' }}
@@ -118,7 +118,7 @@ jobs:
           sudo sed -i '\|^http://azure\.archive\.ubuntu\.com/ubuntu/|d' /etc/apt/apt-mirrors.txt
           sudo apt-get update
           sudo apt-get install --no-install-recommends -y dbus-daemon libwebkit2gtk-4.1-dev build-essential libssl-dev librsvg2-dev libayatana-appindicator3-dev patchelf
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: native
           save-if: ${{ github.event_name == 'push' }}
@@ -174,7 +174,7 @@ jobs:
           rustup toolchain install $version --profile minimal --component clippy
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           "RUSTUP_TOOLCHAIN=$version" >> $env:GITHUB_ENV
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: windows-native
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -248,7 +248,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: browser-fixture
           save-if: ${{ github.event_name == 'push' }}
@@ -326,7 +326,7 @@ jobs:
         with:
           browsers: "true"
           browser-engine: ${{ matrix.engine }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.browser_fixture.outputs.artifact-id }}
           merge-multiple: true
@@ -467,7 +467,7 @@ jobs:
         with:
           browsers: "true"
           browser-engine: ${{ matrix.engine }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.browser_fixture.outputs.artifact-id }}
           merge-multiple: true

.github/workflows/desktop-build.yml

@@ -98,7 +98,7 @@ jobs:
           rustup toolchain install "$version" --profile minimal --target "$TARGET"
           echo "RUSTUP_TOOLCHAIN=$version" >> "$GITHUB_ENV"
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: macos-prerelease-${{ matrix.arch }}
           cache-all-crates: true
@@ -202,7 +202,7 @@ jobs:
           test -s "$archive" && test -s "$archive.sig" || { echo '::error::Updater signing failed'; exit 1; }
           (cd release-assets && shasum -a 256 ./*.dmg ./*.tar.gz > SHA256SUMS)
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: signed-macos-${{ matrix.arch }}
           path: release-assets/
@@ -217,23 +217,23 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: signed-macos-aarch64
           path: build-assets/macos-aarch64
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: signed-macos-x64
           path: build-assets/macos-x64
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: windows-x64-candidate
           path: build-assets/windows
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: linux-x64-candidates
           path: build-assets/linux
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: windows-linux-updater-signatures
           path: build-assets/signatures
@@ -350,7 +350,7 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ steps.pins.outputs.node }}
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
           version: ${{ steps.pins.outputs.pnpm }}
       - run: pnpm install --frozen-lockfile
@@ -390,7 +390,7 @@ jobs:
           printf '%s\n' "$GITHUB_SHA" > release-assets/SOURCE_COMMIT
           cd release-assets
           sha256sum ./*.exe > SHA256SUMS
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: windows-x64-candidate
           path: release-assets/
@@ -490,7 +490,7 @@ jobs:
           printf '%s\n' "$GITHUB_SHA" > release-assets/SOURCE_COMMIT
           cd release-assets
           sha256sum ./*.deb ./*.AppImage > SHA256SUMS
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: linux-x64-candidates
           path: release-assets/
@@ -511,11 +511,11 @@ jobs:
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: windows-x64-candidate
           path: build-assets/windows
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: linux-x64-candidates
           path: build-assets/linux
@@ -534,7 +534,7 @@ jobs:
             test -s "$installer.sig" || { echo '::error::Updater signing failed'; exit 1; }
             mv "$installer.sig" signatures/
           done
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: windows-linux-updater-signatures
           path: signatures/

.github/workflows/desktop-release-tag.yml

@@ -44,7 +44,7 @@ jobs:
 
       - name: Create release tagger token
         id: release-tagger
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.BUZZ_RELEASE_TAGGER_CLIENT_ID }}
           private-key: ${{ secrets.BUZZ_RELEASE_TAGGER_PRIVATE_KEY }}

.github/workflows/mesh-cross-node.yml

@@ -34,7 +34,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install --no-install-recommends -y libwebkit2gtk-4.1-dev build-essential libssl-dev librsvg2-dev libayatana-appindicator3-dev
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: mesh-cross-node
           save-if: ${{ github.event_name == 'push' }}

crates/agent-controller/Cargo.toml

@@ -13,14 +13,14 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 regex = "1"
 sha2 = "0.10"
-hmac = "0.12"
-base64 = "0.22"
-nostr = { version = "=0.45.5", default-features = false, features = ["std", "nip44", "os-rng"] }
-getrandom = "0.3"
+hmac = "0.13"
+base64 = "0.23"
+nostr = { version = "=0.45.7", default-features = false, features = ["std", "nip44", "os-rng"] }
+getrandom = "0.4"
 buzz-credential-store = { path = "../credential-store" }
 url = "2"
-secp256k1 = { version = "0.31", default-features = false, features = ["std"] }
-bech32 = "0.11"
+secp256k1 = { version = "0.33", default-features = false, features = ["std"] }
+bech32 = "0.12"
 zeroize = "1.9"
 
 [target.'cfg(unix)'.dependencies]

crates/buzz-ifc/Cargo.toml

@@ -9,6 +9,6 @@ description = "Buzz execution domains and broker-side information-flow checks"
 
 [dependencies]
 ifc-core = { path = "../ifc-core" }
-nostr = { version = "=0.45.5", default-features = false, features = ["std"] }
+nostr = { version = "=0.45.7", default-features = false, features = ["std"] }
 thiserror = "2"
 uuid = "1"

crates/nsec-backup/Cargo.toml

@@ -6,7 +6,7 @@ license = "Apache-2.0"
 description = "Native HTTP client for Buzz nsec backups"
 
 [dependencies]
-base64 = "0.22"
+base64 = "0.23"
 reqwest = { version = "0.13", default-features = false, features = ["rustls"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

crates/pairing/Cargo.toml

@@ -6,7 +6,7 @@ license = "Apache-2.0"
 description = "Buzz NIP-AB device pairing protocol"
 
 [dependencies]
-nostr = { version = "0.44", features = ["nip44"] }
+nostr = { version = "0.45", features = ["nip44"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 thiserror = "2"

crates/plugin-manager/Cargo.toml

@@ -21,8 +21,8 @@ flate2 = "1"
 crc32fast = "1"
 
 [dependencies]
-bech32 = "0.11"
-base64 = "0.22"
+bech32 = "0.12"
+base64 = "0.23"
 buzz-credential-store = { path = "../credential-store" }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
 serde = { version = "1", features = ["derive"] }
@@ -32,7 +32,7 @@ dirs = "6"
 tempfile = "3"
 url = "2"
 cap-std = "4"
-nostr = { version = "=0.45.5", default-features = false, features = ["std", "os-rng"] }
+nostr = { version = "=0.45.7", default-features = false, features = ["std", "os-rng"] }
 # Unused in code: its build metadata (`DEP_TAURI_DEV`) tells build.rs whether
 # this is a `tauri dev` run. The app's own tauri dependency sets its features.
 # Only the app turns on `app`, so standalone builds need no GTK.

package.json

@@ -39,47 +39,47 @@
   },
   "dependencies": {
     "@base-ui/react": "1.9.0",
-    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/cordis": "4.1.0",
     "@dnd-kit/core": "6.3.1",
     "@emoji-mart/data": "1.2.1",
     "@fontsource-variable/inter": "^5.2.8",
     "@fontsource/jetbrains-mono": "^5.3.0",
     "@jsquash/webp": "1.5.0",
-    "@modelcontextprotocol/server": "2.3.1",
-    "@noble/curves": "2.0.1",
-    "@pydantic/genai-prices": "0.1.13",
-    "@tabler/icons": "3.46.0",
-    "@tabler/icons-react": "3.46.0",
+    "@modelcontextprotocol/server": "2.4.0",
+    "@noble/curves": "2.4.0",
+    "@pydantic/genai-prices": "0.2.1",
+    "@tabler/icons": "3.51.0",
+    "@tabler/icons-react": "3.51.0",
     "@tanstack/react-router": "^1.168.10",
     "@tauri-apps/api": "^2.12.3",
     "@tauri-apps/plugin-updater": "2.14.1",
     "@xterm/addon-fit": "0.11.0",
     "@xterm/xterm": "6.0.0",
     "blurhash": "2.0.5",
     "consola": "3.4.2",
-    "d3-scale": "4.0.2",
+    "d3-scale": "4.0.3",
     "diff": "8.0.4",
-    "dockview-react": "8.3.1",
+    "dockview-react": "8.9.0",
     "emoji-mart": "5.6.0",
-    "flexlayout-react": "0.11.0",
-    "mdast-util-from-markdown": "2.0.3",
-    "mdast-util-gfm-strikethrough": "2.0.0",
-    "mdast-util-gfm-table": "2.0.0",
-    "mdast-util-to-markdown": "2.1.2",
+    "flexlayout-react": "0.11.1",
+    "mdast-util-from-markdown": "2.1.0",
+    "mdast-util-gfm-strikethrough": "2.0.1",
+    "mdast-util-gfm-table": "2.0.1",
+    "mdast-util-to-markdown": "2.2.3",
     "micromark-extension-gfm-strikethrough": "2.1.0",
-    "micromark-extension-gfm-table": "2.1.1",
-    "motion": "12.40.0",
-    "nostr-tools": "2.25.2",
-    "pele": "1.6.0",
-    "prosemirror-commands": "1.7.1",
-    "prosemirror-history": "1.5.0",
-    "prosemirror-model": "1.25.8",
-    "prosemirror-schema-list": "1.5.1",
+    "micromark-extension-gfm-table": "2.1.2",
+    "motion": "12.43.0",
+    "nostr-tools": "2.26.0",
+    "pele": "1.13.0",
+    "prosemirror-commands": "1.7.2",
+    "prosemirror-history": "1.5.1",
+    "prosemirror-model": "1.25.13",
+    "prosemirror-schema-list": "1.6.0",
     "prosemirror-state": "1.4.4",
-    "prosemirror-view": "1.42.3",
+    "prosemirror-view": "1.42.9",
     "react": "19.2.8",
-    "react-day-picker": "10.0.1",
-    "react-diff-view": "3.3.2",
+    "react-day-picker": "10.0.2",
+    "react-diff-view": "3.3.3",
     "react-dom": "19.2.8",
     "react-markdown": "10.1.0",
     "remark-breaks": "4.0.0",
@@ -89,8 +89,8 @@
     "yaml": "2.9.1"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.14",
-    "@hypothesi/tauri-mcp-server": "0.13.1",
+    "@biomejs/biome": "2.6.6",
+    "@hypothesi/tauri-mcp-server": "0.13.2",
     "@playwright/test": "1.63.0",
     "@tailwindcss/postcss": "4.3.3",
     "@tauri-apps/cli": "2.12.3",
@@ -100,18 +100,18 @@
     "@testing-library/user-event": "14.6.7",
     "@types/d3-scale": "4.0.9",
     "@types/mdast": "4.0.4",
-    "@types/node": "24.13.6",
+    "@types/node": "24.19.2",
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.7",
-    "@vitejs/plugin-react": "6.1.1",
-    "jsdom": "30.1.0",
-    "postcss": "8.5.28",
-    "rolldown": "1.2.7",
+    "@vitejs/plugin-react": "6.2.1",
+    "jsdom": "30.1.3",
+    "postcss": "8.5.32",
+    "rolldown": "1.3.0",
     "tailwindcss": "4.3.3",
     "typescript": "7.0.2",
-    "undici": "7.29.1",
-    "vite": "8.3.0",
+    "undici": "7.30.2",
+    "vite": "8.3.6",
     "vitest": "5.0.4",
-    "ws": "8.18.3"
+    "ws": "8.22.2"
   }
 }