build(deps): bump actions and pip packages

.github/workflows/general.yml

@@ -15,8 +15,8 @@ jobs:
           - testing-type: yamllint
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # yamllint disable-line rule:line-length
-      - uses: schubergphilis/mcvs-general-action@f52c4433add29d8eff9036bf37b5b69a2c4cf28b # v0.5.8
+      - uses: schubergphilis/mcvs-general-action@c367827038743325c7f56a9490b5e3df59060986 # v0.7.1
         with:
           testing-type: ${{ matrix.args.testing-type }}

.github/workflows/mcvs-pr-validation.yml

@@ -15,6 +15,6 @@ jobs:
   MCVS-PR-validation-action:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # yamllint disable-line rule:line-length
-      - uses: schubergphilis/mcvs-pr-validation-action@b1c337a896fea52b52a93335713a435d5a07ea72 # v0.2.0
+      - uses: schubergphilis/mcvs-pr-validation-action@6f153c01301ab2f92336781173b7f3a796de5f3e # v0.2.2

.github/workflows/python.yml

@@ -8,7 +8,7 @@ jobs:
   mcvs-python-action:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

CLAUDE.md

@@ -24,22 +24,22 @@ The action is defined in `action.yml` and executes as a series of composite step
 
 - **Composite vs Docker**: Uses `using: composite` to avoid Docker overhead and enable caching
 - **Conditional Execution**: Steps like testing and binary building only run when applicable
-- **Token Authentication**: Requires GitHub token for package registry and Docker registry access
+- **Token Authentication**: Requires GitHub token to attach binaries to releases
 - **Version Pinning**: All tools are pinned to specific versions for reproducibility
 
 ## Version Constraints
 
-**CRITICAL**: The following versions are pinned in `action.yml`:
+**CRITICAL**: Actions are pinned by commit SHA in `action.yml`; pip packages are pinned with hashes in `configs/pip/*/requirements.txt`:
 
-- `yamllint==1.37.1` (action.yml:21)
-- `actions/setup-python@v5.6.0` (action.yml:28)
-- `anchore/scan-action@v6.2.0` (action.yml:34)
-- `flake8==7.2.0` (action.yml:75)
-- `pyinstaller==v6.13.0` (action.yml:102)
-- `svenstaro/upload-release-action@2.9.0` (action.yml:106)
+- `actions/setup-python@v7.0.0` (action.yml:22)
+- `anchore/scan-action@v7.4.2` (action.yml:29)
+- `flake8==7.4.1` (configs/pip/flake8/requirements.txt)
+- `pyinstaller==6.22.3` (configs/pip/pyinstaller/requirements.txt)
+- `svenstaro/upload-release-action@2.11.5` (action.yml:104)
 
 When updating dependencies:
-- Update the version in `action.yml`
+- Actions: update the commit SHA and the `# vX` comment in `action.yml`
+- Pip packages: update the version and all `--hash` entries (including transitive deps, required by `--require-hashes`)
 - Dependabot automatically creates PRs for GitHub Actions updates (see `.github/dependabot.yml`)
 - Python package versions must be updated manually
 
@@ -49,7 +49,7 @@ This action is tested via PR validation:
 
 ```yaml
 # Validation happens automatically on PRs via .github/workflows/mcvs-pr-validation.yml
-# Uses schubergphilis/mcvs-pr-validation-action@v0.2.0
+# Uses schubergphilis/mcvs-pr-validation-action@v0.2.2
 ```
 
 To test locally before committing:
@@ -84,29 +84,28 @@ The action has a **configurable error threshold** for Flake8:
 --exclude=client/,.venv/,venv/
 ```
 
-Pipeline fails if error count > 4 (action.yml:81-83). This threshold may need adjustment when adding strict linting rules.
+Pipeline fails if error count > 4 (action.yml:76). This threshold may need adjustment when adding strict linting rules.
 
 ## PyInstaller Binary Building
 
 Binary building is **conditional** and requires:
 1. Push event to a tag (`refs/tags/*`)
 2. Non-empty `pyinstaller-binary-name` input
 
-The binary is automatically attached to GitHub releases (action.yml:89-111).
+The binary is automatically attached to GitHub releases (action.yml:86-111).
 
 ## Action Inputs
 
 Required inputs when using this action:
 
 | Input | Required | Purpose |
 |-------|----------|---------|
-| `token` | Yes | GitHub token for package registry and Docker login |
+| `token` | Yes | GitHub token used to attach binaries to releases |
 | `pyinstaller-binary-name` | No | If set, builds and releases a binary |
 
 ## Important Workflow Notes
 
 - Projects using this action must have a `.python-version` file to specify Python version
 - `requirements.txt` is optional - only installed if present
 - Tests only run if `import pytest` is found in Python files
-- Security scanning uses severity cutoff of "high" (action.yml:39)
-- Docker login required for security scanning (action.yml:40-44)
+- Security scanning uses severity cutoff of "high" (action.yml:34)

action.yml

@@ -19,14 +19,14 @@ runs:
     # file.
     #
     # yamllint disable-line rule:line-length
-    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         cache: pip
     #
     # Code security scanning.
     #
     # yamllint disable-line rule:line-length
-    - uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v6.2.0
+    - uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
       with:
         only-fixed: false
         output-format: table

configs/pip/flake8/requirements.txt

@@ -1,4 +1,4 @@
-flake8==7.3.0 --hash=sha256:b9696257b9ce8beb888cdbe31cf885c90d31928fe202be0889a7cdafad32f01e --hash=sha256:fe044858146b9fc69b551a4b490d69cf960fcb78ad1edcb84e7fbb1b4a8e3872
-pycodestyle==2.14.0 --hash=sha256:c4b5b517d278089ff9d0abdec919cd97262a3367449ea1c8b49b91529167b783 --hash=sha256:dd6bf7cb4ee77f8e016f9c8e74a35ddd9f67e1d5fd4184d86c3b98e07099f42d
-pyflakes==3.4.0 --hash=sha256:b24f96fafb7d2ab0ec5075b7350b3d2d2218eab42003821c06344973d3ea2f58 --hash=sha256:f742a7dbd0d9cb9ea41e9a24a918996e8170c799fa528688d40dd582c8265f4f
-mccabe==0.7.0 --hash=sha256:6c2d30ab6be0e4a46919781807b4f0d834ebdd6c6e3dca0bda5a15f863427b6e
+flake8==7.4.1 --hash=sha256:78480274a6d7289d9cb8eafeda241fac57d4ea687d26e32dfdca37b72cdeddad --hash=sha256:84ea5afcaf344487b0ea5baaebb8100f4cfaebc01f755998f75876664029f587
+pycodestyle==2.15.0 --hash=sha256:12fd2f73c7b8ee8845a0431111df8faf4c1a07d6e64e2ee7f0c74014dab14181 --hash=sha256:318f5db083869b4c4dad922d0b11124fb27ab181b6730b93371da671e31bd50e
+pyflakes==4.0.0 --hash=sha256:0f7b7a78e8fcffd78b205200f045a70911f4179be1b42eac82c3323e0bf5c8aa --hash=sha256:492b27735181e3d4a6acfc08738948b666bf3e696781854ea6e0d8540d566d52
+mccabe==0.7.0 --hash=sha256:6c2d30ab6be0e4a46919781807b4f0d834ebdd6c6e3dca0bda5a15f863427b6e --hash=sha256:348e0240c33b60bbdf4e523192ef919f28cb2c3d7d5c7794f74009290f236325

configs/pip/pyinstaller/requirements.txt

@@ -1 +1,6 @@
-pyinstaller==v6.19.0 --hash=sha256:1ec54ef967996ca61dacba676227e2b23219878ccce5ee9d6f3aada7b8ed8abf --hash=sha256:3c5c251054fe4cfaa04c34a363dcfbf811545438cb7198304cd444756bc2edd2 --hash=sha256:4190e76b74f0c4b5c5f11ac360928cd2e36ec8e3194d437bf6b8648c7bc0c134 --hash=sha256:481a909c8e60c8692fc60fcb1344d984b44b943f8bc9682f2fcdae305ad297e6 --hash=sha256:4ab2bb52e58448e14ddf9450601bdedd66800465043501c1d8f1cab87b60b122 --hash=sha256:8bd68abd812d8a6ba33b9f1810e91fee0f325969733721b78151f0065319ca11 --hash=sha256:a0fc5f6b3c55aa54353f0c74ffa59b1115433c1850c6f655d62b461a2ed6cbbe --hash=sha256:b5bb6536c6560330d364d91522250f254b107cf69129d9cbcd0e6727c570be33 --hash=sha256:c2d5a539b0bfe6159d5522c8c70e1c0e487f22c2badae0f97d45246223b798ea --hash=sha256:da6d5c6391ccefe73554b9fa29b86001c8e378e0f20c2a4004f836ba537eff63 --hash=sha256:e649ba6bd1b0b89b210ad92adb5fbdc8a42dd2c5ca4f72ef3a0bfec83a424b83 --hash=sha256:ec73aeb8bd9b7f2f1240d328a4542e90b3c6e6fbc106014778431c616592a865
+pyinstaller==6.22.3 --hash=sha256:052f4a1cd4f81092ccb7a18fe8ebc9ecf832a5917317e39fb3775af4e959b253 --hash=sha256:312da84b4b31ab9750066a823734c11b7c68757fdd67c9f038bf19c330a954e4 --hash=sha256:020d4fe0627f5c73dfbcfad1a6578ef354d5fe4bdccd9d8e5a615528f5a45d2b --hash=sha256:9e4f7bd64b2103f14b4a6240fb9155e9fe7bc61391b4043bbddb7d3ebc8ab0fa --hash=sha256:f82d0fb89f21c3ed6f482ee16f341bc59e8a31dbabb9bae9ef04e53ade4dc0d9 --hash=sha256:451a4ae14b719365bf1a2f0a99dae7b3463060061c3a394c70d5264cfb439528 --hash=sha256:ea240b5dfa831ff673c97505eee0ec24670bccf71396c83109440348944c83d0 --hash=sha256:a2b6fc26601e8c2596c3d54981566934a3382e85d05d0fe91b55b6a8dcc6b282 --hash=sha256:46a3e30a118341a1ec20667a5a95aa7e0aa8c4fa129893c0151b3eb3f801a722 --hash=sha256:500bd58c7bf7e584a8435adccbd763a0b918d5c12b08d74ff50fd79b2915458b --hash=sha256:31df3cc4261e804a53d358b7897c293ec8b88b167a7cca06c78018085c855f97 --hash=sha256:05eb2f5615503e72939a7224d68b4aff572c6b0438ee4a17d0a4b481f399362d
+altgraph==0.17.5 --hash=sha256:f3a22400bce1b0c701683820ac4f3b159cd301acab067c51c653e06961600597 --hash=sha256:c87b395dd12fabde9c99573a9749d67da8d29ef9de0125c7f536699b4a9bc9e7
+packaging==26.3 --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79
+setuptools==84.0.0 --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 --hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73
+pyinstaller-hooks-contrib==2026.7 --hash=sha256:24257a04c7a5a7a034cf28e39dcee20fbeeb9f043076729480f2e1b69904408a --hash=sha256:5fbcaacb22c4f4aac869a127dce283f67a4b4cfcc37d496f2446603e6d68aefa
+macholib==1.16.4 ; sys_platform == "darwin" --hash=sha256:da1a3fa8266e30f0ce7e97c6a54eefaae8edd1e5f86f3eb8b95457cae90265ea --hash=sha256:f408c93ab2e995cd2c46e34fe328b130404be143469e41bc366c807448979362