chore(deps): bump the github-actions group with 4 updates

.github/workflows/ci.yml

@@ -74,7 +74,7 @@ jobs:
         with:
           targets: wasm32-unknown-unknown
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 

.github/workflows/release-native.yml

@@ -207,7 +207,7 @@ jobs:
           subject-path: dist/*.whl
 
       - name: Attach artifacts to GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             dist/*.whl
@@ -218,7 +218,7 @@ jobs:
 
       # Hand the raw distributables to the aggregated publish job.
       - name: Upload wheel artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: python-dist-${{ matrix.wheel }}
           path: dist/*.whl
@@ -330,7 +330,7 @@ jobs:
           subject-path: dist/*.whl
 
       - name: Attach artifacts to GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             dist/*.whl
@@ -341,7 +341,7 @@ jobs:
           fail_on_unmatched_files: false
 
       - name: Upload wheel artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: python-dist-manylinux-${{ matrix.arch }}
           path: |
@@ -359,7 +359,7 @@ jobs:
     environment: release
     steps:
       - name: Download all python dists
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: python-dist-*
           path: dist
@@ -489,7 +489,7 @@ jobs:
           subject-path: ${{ steps.pkg.outputs.zip }}
 
       - name: Attach artifacts to GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             ${{ steps.pkg.outputs.zip }}
@@ -588,7 +588,7 @@ jobs:
           cp "target/${{ matrix.target }}/release/${{ matrix.lib }}" "jni/${{ matrix.jni }}/"
 
       - name: Upload desktop lib
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: jvm-jni-${{ matrix.jni }}
           path: jni/${{ matrix.jni }}/*
@@ -649,7 +649,7 @@ jobs:
       # resources/<platform>/<lib> that JNA loads at runtime. Merging flat would
       # collide the two macOS dylibs (arm64 + x86_64) and lose the platform dirs.
       - name: Download desktop JVM libs
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: jvm-jni-*
           path: jvm-libs
@@ -713,7 +713,7 @@ jobs:
             dist-maven/*.jar
 
       - name: Attach artifacts to GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             dist-maven/*.aar

.github/workflows/release.yml

@@ -172,7 +172,7 @@ jobs:
       # currently broken (it leaves npm unable to resolve its bundled `sigstore`
       # module — "Cannot find module 'sigstore'" — during provenance
       # generation). setup-node's bundled npm is a clean, complete install.
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -211,7 +211,7 @@ jobs:
 
       # --- GitHub Release ---
       - name: Attach artifacts to GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             pkg/metamorphic_log.js