chore(deps): consolidated Dependabot batch 2026-06-29

.github/workflows/auto-release.yml

@@ -31,7 +31,7 @@ jobs:
     outputs:
       new_tag: ${{ steps.rel.outputs.new_tag }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/build.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: docker/setup-buildx-action@v3
 
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: docker/setup-buildx-action@v3
 

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
       run:
         working-directory: middleware
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v4
         with:
@@ -87,7 +87,7 @@ jobs:
       run:
         working-directory: web-ui
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v4
         with:
@@ -143,7 +143,7 @@ jobs:
         middleware/src/profileSnapshots/migrations
         middleware/src/profileStorage/migrations
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Enable pgvector extension
         run: |
@@ -193,7 +193,7 @@ jobs:
       run:
         working-directory: ${{ matrix.workspace }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v4
         with:

.github/workflows/desktop-apps.yml

@@ -89,7 +89,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout the released tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.release.tag_name || inputs.tag }}
 
@@ -363,7 +363,7 @@ jobs:
       # stapled installers — not a pre-notarization copy.
       - name: Upload installers as run artifacts
         if: ${{ always() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: omadia-installers-${{ matrix.os }}
           if-no-files-found: ignore

.github/workflows/publish-images.yml

@@ -55,10 +55,10 @@ jobs:
             build_args: |
               MIDDLEWARE_URL=http://middleware:8080
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
-      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-qemu-action@v4
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:

.github/workflows/release.yml

@@ -46,7 +46,7 @@ jobs:
       run:
         working-directory: middleware
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: '22'

Dockerfile

@@ -9,7 +9,7 @@
 # botbuilder (@azure/msal-node family) have post-install hooks that break on
 # Alpine's musl libc without extra build tools. Slim keeps the image small
 # while staying on glibc.
-FROM node:22.22.3-slim AS builder
+FROM node:22.23.1-slim AS builder
 ARG TARGETARCH
 WORKDIR /app
 
@@ -38,7 +38,7 @@ COPY middleware/scripts ./scripts
 RUN npm run build
 
 # --- runtime ----------------------------------------------------------------
-FROM node:22.22.3-slim AS runtime
+FROM node:22.23.1-slim AS runtime
 ARG TARGETARCH
 WORKDIR /app