build(deps): bump the terraform-minor-patch group across 3 directories with 4 updates

.github/actions/scan-dependencies/action.yaml

@@ -41,6 +41,8 @@ runs:
       shell: bash
       run: |
         export BUILD_DATETIME=${{ inputs.build_datetime }}
+        export GRYPE_DB_CACHE_DIR="${RUNNER_TEMP}/grype-db-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}"
+        mkdir -p "${GRYPE_DB_CACHE_DIR}"
         ./scripts/reports/scan-vulnerabilities.sh
     - name: "Compress vulnerabilities report"
       shell: bash

.github/workflows/cicd-2-publish.yaml

@@ -61,7 +61,7 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
       - name: "Set correct Node.js version"
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ needs.metadata.outputs.nodejs_version }}
       - name: "Install dependencies"

.github/workflows/stage-1-pre-commit.yml

@@ -78,7 +78,7 @@ jobs:
 
       - name: "Cache Terraform plugins"
         if: contains(matrix.shard.name, 'terraform-')
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.terraform.d/plugin-cache
           key: ${{ runner.os }}-terraform-plugins-${{ hashFiles('**/.terraform.lock.hcl') }}

.tool-versions

@@ -3,15 +3,15 @@
 terraform 1.13.5
 tflint 0.62.1
 terraform-docs 0.24.0
-go 1.26.4
+go 1.26.5
 go:github.com/hashicorp/terraform-config-inspect latest
 pre-commit 4.6.0
 python 3.12
 vale 3.6.0
 gitleaks 8.30.1
 shellcheck 0.11.0
 actionlint 1.7.12
-jq 1.8.1
+jq 1.8.2
 yq 4.53.3
 nodejs 24.16.0
 make 4.4.1
@@ -20,7 +20,7 @@ make 4.4.1
 # The section below is reserved for Docker image versions.
 
 # TODO: Move this section - consider using a different file for the repository template dependencies.
-# docker/ghcr.io/anchore/grype v0.100.0@sha256:651e558f9ba84f2a790b3449c8a57cbbf4f34e004f7d3f14ae8f8cbeede4cd33 # SEE: https://github.com/anchore/grype/pkgs/container/grype
+# docker/ghcr.io/anchore/grype v0.116.0@sha256:fd4ab4d1042b522c896e73bdf09ab8bf384fa417df99d6dd0d6e1008c7e7c821 # SEE: https://github.com/anchore/grype/pkgs/container/grype
 # docker/ghcr.io/anchore/syft v0.92.0@sha256:63c60f0a21efb13e80aa1359ab243e49213b6cc2d7e0f8179da38e6913b997e0 # SEE: https://github.com/anchore/syft/pkgs/container/syft
 # docker/ghcr.io/gitleaks/gitleaks v8.18.0@sha256:fd2b5cab12b563d2cc538b14631764a1c25577780e3b7dba71657d58da45d9d9 # SEE: https://github.com/gitleaks/gitleaks/pkgs/container/gitleaks
 # docker/ghcr.io/igorshubovych/markdownlint-cli v0.37.0@sha256:fb3e79946fce78e1cde84d6798c6c2a55f2de11fc16606a40d49411e281d950d # SEE: https://github.com/igorshubovych/markdownlint-cli/pkgs/container/markdownlint-cli
@@ -31,4 +31,4 @@ make 4.4.1
 # docker/jdkato/vale v3.6.0@sha256:0ef22c8d537f079633cfff69fc46f69a2196072f69cab1ab232e8a79a388e425 # SEE: https://hub.docker.com/r/jdkato/vale/tags
 # docker/koalaman/shellcheck latest@sha256:e40388688bae0fcffdddb7e4dea49b900c18933b452add0930654b2dea3e7d5c # SEE: https://hub.docker.com/r/koalaman/shellcheck/tags
 # docker/mstruebing/editorconfig-checker 2.7.1@sha256:dd3ca9ea50ef4518efe9be018d669ef9cf937f6bb5cfe2ef84ff2a620b5ddc24 # SEE: https://hub.docker.com/r/mstruebing/editorconfig-checker/tags
-# docker/sonarsource/sonar-scanner-cli 5.0.1@sha256:494ecc3b5b1ee1625bd377b3905c4284e4f0cc155cff397805a244dee1c7d575 # SEE: https://hub.docker.com/r/sonarsource/sonar-scanner-cli/tags
+# docker/sonarsource/sonar-scanner-cli 12.1@sha256:23ca0f137965d9dff2198074043fd48d386280bc5d0ccac8c8349cea4cf096a9 # SEE: https://hub.docker.com/r/sonarsource/sonar-scanner-cli/tags

infrastructure/modules/iam/README.md

@@ -173,10 +173,10 @@ No providers.
 
 | Name | Source | Version |
 | ---- | ------ | ------- |
-| <a name="module_policies"></a> [policies](#module\_policies) | terraform-aws-modules/iam/aws//modules/iam-policy | 6.6.0 |
+| <a name="module_policies"></a> [policies](#module\_policies) | terraform-aws-modules/iam/aws//modules/iam-policy | 6.6.1 |
 | <a name="module_policy_label"></a> [policy\_label](#module\_policy\_label) | ../tags | n/a |
 | <a name="module_role_label"></a> [role\_label](#module\_role\_label) | ../tags | n/a |
-| <a name="module_roles"></a> [roles](#module\_roles) | terraform-aws-modules/iam/aws//modules/iam-role | 6.6.0 |
+| <a name="module_roles"></a> [roles](#module\_roles) | terraform-aws-modules/iam/aws//modules/iam-role | 6.6.1 |
 | <a name="module_this"></a> [this](#module\_this) | ../tags | n/a |
 
 ## Resources

infrastructure/modules/iam/main.tf

@@ -39,7 +39,7 @@ module "role_label" {
 
 module "policies" {
   source   = "terraform-aws-modules/iam/aws//modules/iam-policy"
-  version  = "6.6.0"
+  version  = "6.6.1"
   for_each = module.this.enabled ? var.policies : {}
 
   name        = module.policy_label[each.key].id
@@ -63,7 +63,7 @@ module "policies" {
 
 module "roles" {
   source   = "terraform-aws-modules/iam/aws//modules/iam-role"
-  version  = "6.6.0"
+  version  = "6.6.1"
   for_each = module.this.enabled ? var.roles : {}
 
   name            = module.role_label[each.key].id

infrastructure/modules/lambda/README.md

@@ -124,13 +124,13 @@ module "lambda_with_layers" {
 
 | Name | Version |
 | ---- | ------- |
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.50.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.55.0 |
 
 ## Modules
 
 | Name | Source | Version |
 | ---- | ------ | ------- |
-| <a name="module_lambda_function"></a> [lambda\_function](#module\_lambda\_function) | terraform-aws-modules/lambda/aws | 8.7.0 |
+| <a name="module_lambda_function"></a> [lambda\_function](#module\_lambda\_function) | terraform-aws-modules/lambda/aws | 8.8.0 |
 | <a name="module_this"></a> [this](#module\_this) | ../tags | n/a |
 
 ## Resources

infrastructure/modules/lambda/main.tf

@@ -5,7 +5,7 @@
 module "lambda_function" {
   source = "terraform-aws-modules/lambda/aws"
   # downgrade version as workaround for bug https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/733
-  version = "8.7.0"
+  version = "8.8.0"
 
   function_name          = local.function_name
   description            = var.function_description

infrastructure/modules/s3-bucket/README.md

@@ -107,7 +107,7 @@ No providers.
 
 | Name | Source | Version |
 | ---- | ------ | ------- |
-| <a name="module_s3_bucket"></a> [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | 5.13.0 |
+| <a name="module_s3_bucket"></a> [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | 5.14.1 |
 | <a name="module_this"></a> [this](#module\_this) | ../tags | n/a |
 
 ## Resources

infrastructure/modules/s3-bucket/main.tf

@@ -17,7 +17,7 @@
 
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
-  version = "5.13.0"
+  version = "5.14.1"
 
   create_bucket = module.this.enabled