[lopopolo]

Refresh the repository's development toolchain and security-audit integration. Library sources, Cargo dependency requirements, public API, feature flags, MSRV, generated bindings/data, and crate versions remain unchanged. Rust intentionally continues to track stable.

Versions:

• Node LTS 24.21.0 → 24.22.0 (October 14 release).
• pnpm 11.28.5 → 12.14.0 (October 15); exact Corepack integrity pin.
• Prettier 3.9.6 → 3.9.10 (October 10).
• zizmor 1.30.1 → 1.31.1 (October 15); zizmor action 0.6.4 → 0.7.1 (October 15).
• mise bootstrap 2026.8.10 → 2026.10.14 (October 18), with official archive checksums; setup-node 7.0.0 → 7.1.0 (October 8).

Upstream review and risk:

• Reviewed pnpm 12 changes. The generated lockfile records official pnpm platform packages in a separate package-manager document; Prettier remains the only direct npm dependency. No new registry, exotic source, or build permission.
• Reviewed zizmor action source changes, including action.sh, action.yml, wheel lockfiles, and synchronization source. Human review requested: installation changes from Docker to a hash-verified binary wheel downloaded with pip's --require-hashes and --only-binary flags, then extracted without running a package setup script. Existing runner images provide Python. The version remains supplied by mise; the action's SARIF upload pin also advances. No auto-merge.
• Reviewed exact action release commits, setup-node changes, mise release notes, and generated lock URLs/checksums/provenance. Existing local-action references use GitHub's self-repository syntax.
• cargo-deny 0.20.2, cargo-mutants 27.1.0, and cargo-outdated 0.19.0 are already current where declared. Keep intentional lower-bound Rust dependency requirements; fresh Cargo resolution selects current compatible releases.

Cooldown: routine pins are at least seven full days old, verified with registry and official release metadata. Hold pnpm 12.15.0, Node 24.22.1, zizmor-action 0.8.0, crates-io-auth-action 1.0.6, and newer mise releases under routine cooldown. Node stays on LTS rather than the Current line.

Validation on macOS arm64:

• Generated platform locks retain existing targets and include Linux x64/ARM64/musl, both macOS architectures, and Windows x64 artifact metadata produced by mise; locked native installation passed. No hand-edited lock entries.
• Frozen pnpm install, deduplication check, and npm audit passed; zero known npm vulnerabilities.
• Prettier and offline pedantic zizmor passed with no findings.
• Stable Rust formatting and Clippy with warnings denied passed. Default, all-features, and no-default-features tests passed (183 passing test/doctest executions across the three configurations).
• Pinned cargo-deny: advisories, bans, licenses, and sources all passed. cargo package --allow-dirty passed.
• git diff --check passed. Cross-platform checks are left to PR CI.

Supersedes #356 with current eligible versions; the older update PRs are closed as superseded.

All cross-platform PR CI checks passed, including the repository’s MSRV coverage.