build(deps): cargo update and roll up open dependabot PRs (#1787)

* Cargo update

* build(deps): roll up open dependabot updates

Bump GitHub Actions (taiki-e/install-action, astral-sh/setup-uv,
github/codeql-action init+analyze) and uv.lock packages (virtualenv,
urllib3, tornado, pyjwt, soupsieve). CodeQL init and analyze must be
bumped together; separately they fail with a config version mismatch.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: timsaucer

.github/workflows/build.yml

@@ -69,7 +69,7 @@ jobs:
         with:
           python-version: "3.12"
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7
         with:
           enable-cache: true
 
@@ -95,7 +95,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install taplo
-        uses: taiki-e/install-action@v2.85.5
+        uses: taiki-e/install-action@v2.87.22
         with:
           tool: taplo-cli
 
@@ -117,12 +117,12 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7
         with:
           enable-cache: true
 
       - name: Install cargo-license
-        uses: taiki-e/install-action@v2.85.5
+        uses: taiki-e/install-action@v2.87.22
         with:
           tool: cargo-license
 
@@ -163,7 +163,7 @@ jobs:
         with:
           key: ${{ inputs.build_mode }}-${{ matrix.python-tag }}
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7
         with:
           enable-cache: true
 
@@ -254,7 +254,7 @@ jobs:
         with:
           key: ${{ inputs.build_mode }}-${{ matrix.python-tag }}
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7
         with:
           enable-cache: true
 
@@ -324,7 +324,7 @@ jobs:
           python-version: ${{ matrix.python-tag }}
           freethreaded: true
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7
         with:
           enable-cache: true
 
@@ -407,7 +407,7 @@ jobs:
           python-version: ${{ matrix.python-tag }}
           freethreaded: true
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7
         with:
           enable-cache: true
 
@@ -536,7 +536,7 @@ jobs:
           python-version: "3.10"
 
       - name: Install dependencies
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7
         with:
           enable-cache: true
 

.github/workflows/codeql.yml

@@ -44,11 +44,11 @@ jobs:
         persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
       with:
         languages: actions
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
       with:
         category: "/language:actions"

.github/workflows/test.yml

@@ -62,7 +62,7 @@ jobs:
           key: cargo-cache-stable-${{ hashFiles('Cargo.lock') }}
 
       - name: Install dependencies
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7
         with:
           enable-cache: true