build(deps): bump all dependencies (2026-10-31)

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up mise
-        uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
         with:
           install: true
           cache: true
@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up mise
-        uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
         with:
           install: true
           cache: true
@@ -100,11 +100,11 @@ jobs:
         with:
           persist-credentials: false
       - name: Audit GitHub Actions workflows (zizmor)
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           # Pinned to the same version `.mise.toml` installs, so the local
           # `mise run audit` and this job cannot silently diverge. The action
           # validates this string against a list baked into its own release:
           # 1.29.0 requires zizmor-action >= v0.6.2, which is the SHA above.
-          version: "1.30.1"
+          version: "1.31.1"
           advanced-security: false

.github/workflows/deploy.yml

@@ -23,7 +23,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up mise
-        uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
         with:
           install: true
           cache: true

.github/workflows/links.yml

@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up mise
-        uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
         with:
           install: true
           cache: true

.mise.toml

@@ -9,15 +9,15 @@ lockfile = true
 # auto-download on any machine or CI runner. Bumps are deliberate commits.
 [tools]
 actionlint = "1.7.12"
-bun = "1.4.2"
+bun = "1.4.4"
 gitleaks = "8.30.1"
 lychee = "0.24.2"
-prek = "0.5.2"
+prek = "0.5.7"
 # Load-bearing, not cosmetic: actionlint exits 0 without ever inspecting a
 # `run:` block if shellcheck is not on PATH, so dropping this pin would silently
 # turn half of `mise run audit` into a no-op.
 shellcheck = "0.11.0"
-zizmor = "1.30.1"
+zizmor = "1.31.1"
 
 [tasks.docs-install]
 description = "Install the site dependencies (bun)"

docs/package.json

@@ -10,14 +10,14 @@
     "astro": "astro"
   },
   "dependencies": {
-    "@astrojs/markdown-remark": "7.3.1",
-    "@astrojs/starlight": "0.42.5",
-    "astro": "7.3.5",
+    "@astrojs/markdown-remark": "7.3.4",
+    "@astrojs/starlight": "0.42.7",
+    "astro": "7.4.2",
     "sharp": "0.35.5"
   },
   "devDependencies": {
-    "@astrojs/check": "0.9.10",
-    "playwright": "1.63.0",
+    "@astrojs/check": "0.9.12",
+    "playwright": "1.64.1",
     "typescript": "6.0.3"
   }
 }

prek.toml

@@ -35,7 +35,7 @@ hooks = [
 # Markdown linting
 [[repos]]
 repo = "https://github.com/DavidAnson/markdownlint-cli2"
-rev = "v0.22.0"
+rev = "v0.24.0"
 hooks = [{ id = "markdownlint-cli2", exclude = '\.mdx$' }]
 
 # Broken link checking (uses locally installed lychee)
@@ -82,7 +82,7 @@ hooks = [
 # Commit message linting
 [[repos]]
 repo = "https://github.com/alessandrojcm/commitlint-pre-commit-hook"
-rev = "v9.24.0"
+rev = "v9.27.0"
 hooks = [
   {
     id = "commitlint",