Update github-actions

.github/renovate.json

@@ -178,6 +178,12 @@
       "minimumReleaseAge": null,
       "schedule": ["at any time"]
     },
+    {
+      "description": "neondatabase/create-branch-action dropped the `v` prefix at 6.3.1, and its stray `v6.4.0` tag is on a commit 12 commits behind 6.3.1 with no release, so semver ranks a downgrade as the newest version",
+      "matchManagers": ["github-actions"],
+      "matchPackageNames": ["neondatabase/create-branch-action"],
+      "allowedVersions": "!/^v6\\.4\\.0$/"
+    },
     {
       "description": "canopy pins the pristine @xterm/addon-webgl AND @xterm/xterm to the exact commit the SDF fork's sdf branch is based on (the addon's beta counter is offset from core's; canopy/README.md records the current correspondence). They are the UpstreamVsFork regression baseline and move in lockstep with the hand-cut @diffplug/xterm-addon-webgl-sdf tarball, which Renovate cannot see, so bumping either one is a manual edit made when the fork rebases — never a Renovate bump (see canopy/README.md and docs/specs/webgl-text.md). File-scoped: lib and standalone still track upstream betas via the xterm group above. Must stay last; later rules win",
       "matchManagers": ["npm"],

.github/workflows/ci.yml

@@ -402,7 +402,7 @@ jobs:
       # Windows and macOS runners bill at a multiple of Linux, so the dependency
       # compile is cached rather than paid on every PR.
       - name: Rust cache
-        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: standalone/src-tauri
 

.github/workflows/security-audit.yaml

@@ -207,7 +207,7 @@ jobs:
 
       - name: Audit against the security specs
         if: steps.plan.outputs.skip != 'true'
-        uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254
+        uses: anthropics/claude-code-action@8041f1d17e0e7d2f2cfe35002962e9f26237c0bb # v1.0.263
         env:
           # `claude-code-action` resets `GH_TOKEN` to its own internal
           # workflow token, so setting `GH_TOKEN` at this scope is
@@ -739,7 +739,7 @@ jobs:
       # The audit job's agent step, less `ci-and-secrets`: the same pinned
       # action, prompts, tools, and model split.
       - name: Audit the seeded checkout
-        uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254
+        uses: anthropics/claude-code-action@8041f1d17e0e7d2f2cfe35002962e9f26237c0bb # v1.0.263
         env:
           BASH_DEFAULT_TIMEOUT_MS: "600000"
         with:

.github/workflows/workflow-audit.yaml

@@ -77,7 +77,7 @@ jobs:
         run: git fetch origin '+refs/heads/*:refs/remotes/origin/*'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
 
       - name: Audit workflow file changes
         env: