fix: answer the review of the best practices stack, update every dependency and regenerate the testing reference

.github/requirements/pypi-publish.txt

@@ -448,13 +448,13 @@ packaging==26.3 \
     # via
     #   pypi-attestations
     #   twine
-platformdirs==4.13.5 \
-    --hash=sha256:05831adf87d392760f4b5c3a0a95579ab5a10b18b9b9bd43680dcb47544788a0 \
-    --hash=sha256:53d3ec4280b815c1e0b02edad7f9ee8fda1ba9c0865dd9c2e6e63849ce82fc1e
+platformdirs==4.13.7 \
+    --hash=sha256:47664602fbecad0a6efa561fb690d20dbc26875fe8aedf65ba362935df619bbb \
+    --hash=sha256:f7f351c027d6632c30471124e1fdb6ac0fef9ccc5cbac1b34cb333431b1fc3e1
     # via sigstore
-pyasn1==0.6.4 \
-    --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \
-    --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b
+pyasn1==0.6.5 \
+    --hash=sha256:4017b0fce125096b8573b39c989fdb1a4b19cf761e683398184550fea0e66587 \
+    --hash=sha256:6b11616a6bcf3a40e635f082bb232fa57b5e0dd7f517bd7ddd69ec3794508a47
     # via pypi-attestations
 pycparser==3.12 \
     --hash=sha256:a076f3f489b39b43ed13563a1dafe42447445bec2e294154ec5c57fcdda4c85e \

.github/workflows/ci.yml

@@ -422,7 +422,7 @@ jobs:
           name: coverage
       - name: SonarCloud Scan
         if: env.SONAR_TOKEN != ''
-        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8
+        uses: SonarSource/sonarqube-scan-action@4d1dc0c91ee400dcf8a6dddf2f705ac36542e304 # v8
         continue-on-error: true
         env:
           SONAR_HOST_URL: https://sonarcloud.io
@@ -758,7 +758,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
+      - uses: DavidAnson/markdownlint-cli2-action@696eb3f2509270d7b882d2aa68347bc676e7af34 # v25.0.0
         with:
           globs: |
             **/*.{md,mdx}
@@ -1060,7 +1060,7 @@ jobs:
           "$RUNNER_TEMP/pypi-publish/bin/python" -m twine --version
       # Still needed by the script tests below. The auditor no longer is
       # Python, so nothing installs a package for it any more.
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.x"
       - run: go mod download

.github/workflows/codeql.yml

@@ -56,7 +56,7 @@ jobs:
         with:
           go-version-file: go.mod
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -69,6 +69,6 @@ jobs:
           go mod download
           go build ./...
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/image-vulns.yml

@@ -49,7 +49,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       # The release's Install Trivy step, word for word.
       - name: Install Trivy

.github/workflows/release.yml

@@ -120,7 +120,7 @@ env:
   # Pinned exactly, not by range: goreleaser-action and sbom-action download
   # these binaries at run time into a job that holds the signing identity, so
   # SHA-pinning the action alone leaves the code that actually runs unpinned.
-  GORELEASER_VERSION: "v2.18.3"
+  GORELEASER_VERSION: "v2.19.0"
   SYFT_VERSION: "v1.55.0"
   # Fetched by hand in the docker job, never through an action (see Install
   # Trivy there). A test of cmd/audit_image_vulns holds it to the weekly scan
@@ -314,8 +314,9 @@ jobs:
         id: version
         run: echo "version=$(tr -d '[:space:]' < VERSION)" >> "$GITHUB_OUTPUT"
 
-      # cosign-release is pinned here and in the eight other installs of this
-      # action, because the cosign major decides how a signature is attached
+      # cosign-release is pinned here and in the eleven other installs of this
+      # action (ten more in this workflow, one in image-vulns.yml), because the
+      # cosign major decides how a signature is attached
       # and therefore who can find it afterwards. cosign 2.x writes a legacy
       # `sha256-<digest>.sig` tag; cosign 3.x attaches an OCI 1.1 referrer,
       # falling back to a tag on a registry that serves no referrers API
@@ -326,14 +327,14 @@ jobs:
       # release could change that behaviour without a commit here.
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       # No registry login in a rehearsal: the smoke builds pull through the
       # Actions cache and the multi-platform build is exported to disk, so a
       # rehearsal never needs a credential for either registry and is not
       # given one. The dispatched code runs in this job, and code that runs
       # without a login cannot push.
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         if: env.REHEARSAL != 'true'
         with:
           registry: ${{ env.REGISTRY }}
@@ -354,7 +355,7 @@ jobs:
           fi
 
       - if: env.REHEARSAL != 'true' && steps.dockerhub-login.outputs.skip == 'false'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           registry: docker.io
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -830,18 +831,18 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       # Nothing is signed or attested in a rehearsal, so nothing below runs and
       # this job needs no credential then either.
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         if: env.REHEARSAL != 'true'
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         if: env.REHEARSAL != 'true' && env.DOCKERHUB_SKIP == 'false'
         with:
           registry: docker.io
@@ -1083,8 +1084,8 @@ jobs:
       # before a tag does.
       - name: Install oras
         env:
-          ORAS_VERSION: "1.3.5"
-          ORAS_SHA256: "f48a73ea6d026a862c3919fc773da9a8c86fc259c2c737d5baed3b8b9614ad22"
+          ORAS_VERSION: "1.3.6"
+          ORAS_SHA256: "66fb0ad7206f3f6fa77ed5b552049d364ccf4b50b1684554f731f76302b52ca0"
         run: |
           set -euo pipefail
           TARBALL="oras_${ORAS_VERSION}_linux_amd64.tar.gz"
@@ -1149,10 +1150,11 @@ jobs:
       # (go-containerregistry v0.21.3), and its entry on ghcr.io reads
       # "application/vnd.oci.empty.v1+json" with no annotations; v3.1.3
       # (v0.21.7) writes the artifactType and still no annotations, measured
-      # against a registry:2. cosign main carries v0.22.1 since 2026-09-05
-      # (sigstore/cosign#5098) and no release ships it yet, and even that
-      # repairs nothing already written, since the update path skips a digest
-      # the index already lists.
+      # against a registry:2. v3.1.4, the release installed here, is the first
+      # to ship v0.22.1 (sigstore/cosign#5098), so the entries it appends
+      # should carry the annotations as well; that is still to be measured as
+      # the earlier ones were, and it repairs nothing already written, since
+      # the update path skips a digest the index already lists.
       #
       # Who reads the descriptor rather than the manifest: `gh attestation
       # verify --bundle-from-oci`, Kyverno's ClusterPolicy SigstoreBundle
@@ -1167,8 +1169,9 @@ jobs:
       # Docker Hub.
       #
       # The script reads each listed manifest and rewrites the tag only when
-      # an entry says less than its manifest does, so it is a no-op once
-      # cosign ships the fix and a guard for any client that regresses. Last
+      # an entry says less than its manifest does, so it leaves alone an entry
+      # a cosign with the fix appended, repairs the ones earlier releases
+      # wrote, and guards against any client that regresses. Last
       # because it rewrites what every step above appended to.
       #
       # A failure here warns and does not fail the job. This job gates every
@@ -1243,7 +1246,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       # Fetched by hand rather than through anchore/sbom-action/download-syft.
       # That action is SHA-pinned, but on Linux it downloads
@@ -1454,7 +1457,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       - name: Take the rehearsal's own build
         if: env.REHEARSAL == 'true'
@@ -1495,7 +1498,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       # This job produces no binaries of its own: it downloads what the release
       # actually published and verifies it against the cosign-signed
@@ -1514,8 +1517,9 @@ jobs:
           REHEARSAL_ARCHIVE: ${{ env.REHEARSAL == 'true' && format('{0}/rehearsal/rehearsal-assets.tar', runner.temp) || '' }}
         run: bash scripts/fetch-release-assets.sh "${RELEASE_TAG#v}" dist
 
-      # npm >= 11.5.1 performs the OIDC exchange that trusted publishing needs;
-      # setup-node's Node 22 ships an older npm, so it is upgraded below.
+      # npm >= 11.5.1 performs the OIDC exchange that trusted publishing needs.
+      # setup-node's Node 24 ships npm 11, which validates the packages; the
+      # publish step upgrades it to the npm release pinned there.
       # Provenance is attached automatically under trusted publishing (no
       # --provenance flag), and publish-npm.sh skips any version already on the
       # registry, so re-running this job is safe.
@@ -1526,7 +1530,7 @@ jobs:
       # publisher names. The job id is not part of the binding.
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 22
+          node-version: 24
           registry-url: https://registry.npmjs.org
 
       # A published npm version is permanent, so a broken tarball must fail the
@@ -1575,7 +1579,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       - name: Take the rehearsal's own build
         if: env.REHEARSAL == 'true'
@@ -1658,7 +1662,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       - name: Take the rehearsal's own build
         if: env.REHEARSAL == 'true'
@@ -1674,13 +1678,13 @@ jobs:
         run: bash scripts/fetch-release-assets.sh "${RELEASE_TAG#v}" dist
 
       # An exact SDK version rather than 10.0.x: dnx's behaviour is an SDK
-      # property (10.0.402 installs without asking when stdin is not a
+      # property (10.0.403 installs without asking when stdin is not a
       # terminal and accepts --yes without needing it, which the docs rely
       # on), and the digest `make validate-nuget` pins is the container image
       # of this same SDK. Bump the two together.
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: "10.0.402"
+          dotnet-version: "10.0.403"
 
       # A pointer package plus six runtime-identifier packages, each carrying
       # the native binary as the tool's entry point (the .NET 10 tool layout).
@@ -1791,7 +1795,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       - name: Take the rehearsal's own build
         if: env.REHEARSAL == 'true'
@@ -1865,7 +1869,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       - name: Take the rehearsal's own build
         if: env.REHEARSAL == 'true'
@@ -1906,8 +1910,8 @@ jobs:
           # Pin to a specific version of the mcp-publisher tool for supply-chain integrity.
           # Bump when a new mcp-publisher release is verified. Server version published comes from
           # the git tag (handled in the previous step by update-server-json-sha.sh).
-          MCP_PUBLISHER_VERSION: "v1.8.1"
-          MCP_PUBLISHER_SHA256: "a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc"
+          MCP_PUBLISHER_VERSION: "v1.8.6"
+          MCP_PUBLISHER_SHA256: "1fbe93fc0783c2394d8012c8d6e50a59e98cb2cc2d216264cc69f405d0e21340"
         run: |
           set -euo pipefail
           TARBALL="mcp-publisher_linux_amd64.tar.gz"
@@ -1947,7 +1951,7 @@ jobs:
             # only errors the registry itself labels transient, plus a
             # not-yet-visible npm, PyPI or NuGet version, which is
             # indistinguishable from registry-side propagation lag. Strings
-            # are quoted from the v1.8.1 validators
+            # are quoted from the v1.8.6 validators
             # (internal/validators/registries/{npm,pypi,nuget,oci}.go); a
             # genuine "not found (status: 404)" is deliberately absent, so a
             # truly unpublished package fails fast. "wait for validation to
@@ -1995,7 +1999,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       - name: Take the rehearsal's own build
         if: env.REHEARSAL == 'true'
@@ -2100,7 +2104,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: "v3.1.3"
+          cosign-release: "v3.1.4"
 
       - name: Take the rehearsal's own build
         if: env.REHEARSAL == 'true'

.github/workflows/scorecard.yml

@@ -118,6 +118,6 @@ jobs:
             echo "::error file=results.sarif::a run is not Scorecard's supply-chain category, so it is not uploaded"
             exit 1
           }
-      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: results.sarif

CODE_OF_CONDUCT.md

@@ -60,7 +60,11 @@ representative at an online or offline event.
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement by email to
-[mail@jmrp.io](mailto:mail@jmrp.io).
+[mail@jmrp.io](mailto:mail@jmrp.io). Email is not encrypted on its own, so to
+keep a report private on its way, encrypt it if you can to the maintainer's
+OpenPGP key, published at <https://github.com/jmrplens.gpg> with the
+fingerprint `0A99 3B26 8654 DBBA 52B7 E8D3 FCF6 5339 1E2C 91FC`, which carries
+that address.
 
 All complaints will be reviewed and investigated promptly and fairly.
 

CONTRIBUTING.md

@@ -42,7 +42,7 @@ Say in the issue that you are taking it, so nobody else starts the same work, an
 ### Prerequisites
 
 - **Go 1.27+** — [Download](https://go.dev/dl/)
-- **Node.js 24.18+ with Corepack**, required for the documentation site and MCP Inspector. The `packageManager` field in `site/package.json` names the pnpm version (`pnpm@12.14.0` today) and is authoritative; pnpm settings live in `site/pnpm-workspace.yaml`.
+- **Node.js 24.18+ with Corepack**, required for the documentation site and MCP Inspector. The `packageManager` field in `site/package.json` names the pnpm version (`pnpm@12.16.1` today) and is authoritative; pnpm settings live in `site/pnpm-workspace.yaml`.
 - **Git** — configured with push access
 - **GitLab instance** — with a Personal Access Token (`api` scope)
 

Dockerfile

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: MIT
 
 # --- Build stage ---
-FROM --platform=$BUILDPLATFORM golang:1.27.3-alpine3.24@sha256:f2c872bcee949b7be9c490efd02b48a8a2fbf947cdf533f1c58525ec9d8170fd AS builder
+FROM --platform=$BUILDPLATFORM golang:1.27.3-alpine3.24@sha256:d200d2dd76b03a99b52651fd1325aff7dcd35422c35c01bac56571b0507f3deb AS builder
 
 # hadolint ignore=DL3018
 RUN apk add --no-cache git ca-certificates