chore(deps): bump the github-actions group with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml and NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml.

Updates NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml from 0.1.26 to 0.1.29

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml's releases.

0.1.29

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Bump urllib3 to 2.8.0 in requirements-qt.txt (recompiled via uv pip compile --upgrade-package urllib3): the osv-scan runtime fixture flagged PYSEC-2026-4176 and PYSEC-2026-4177 on the pinned 2.7.0.
• Fix the dependabot-catalog-convergence update-branch guard. A bound pull request already current with the base made the API answer no new commits, which matched neither the success pattern nor a real error — the job exited before converging the catalog and left dependabot bumps red on tool-registry/catalog.

[0.1.29] - 2026-09-28

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

[0.1.28] - 2026-09-28

• Seven product facts re-verified after the 0.1.27 preflight stop. The product-facts-calendar release gate correctly refused tag 0.1.27: appveyor-public, semaphore-cloud-free, semaphore-community, azure-pipelines-private, bitbucket-free, buildkite-personal and ubicloud-free had all passed their expires_after. Each was re-read against its source_urls on 2026-09-28 and carries a staggered new expires_after. Three records needed correction, not just a date bump: Buildkite's plan is now named Free with 2,000 Linux vCPU minutes/month (was Personal/500), up to 10 concurrent jobs (was 3), up to 5 users (was 1) and 30-day retention (was 90); Semaphore's community edition moved from /community (404) to /open-source and is branded Semaphore Open Source; Ubicloud's credit statement was reconfirmed. No GitHub release exists for tag 0.1.27 — publication was stopped before the publish job.

[0.1.27] - 2026-09-28

• rust-supply-chain tool defaults refreshed. cargo_audit_version now defaults to 0.22.2 and cargo_machete_version to 0.9.2, the current upstream releases. Both remain caller-overridable inputs; only the default moved.

... (truncated)

Commits

• d92026c Merge pull request #144 from NDDev-OpenNetwork/release/0.1.29
• 5b773dc chore(release): 0.1.29
• 80698bd Merge pull request #142 from NDDev-OpenNetwork/release/0.1.28
• fd48db9 chore(release): 0.1.28
• 4326739 Merge pull request #141 from NDDev-OpenNetwork/fix/product-facts-refresh
• 80e9517 fix(catalog): re-verify seven expired product facts, correct three
• 84aaaa8 Merge pull request #139 from NDDev-OpenNetwork/release/0.1.27
• c22d68f chore(release): 0.1.27
• f09a486 Merge pull request #138 from NDDev-OpenNetwork/chore/rust-supply-chain-defaults
• 2a03f48 chore(rust-supply-chain): refresh caller-overridable tool defaults
• Additional commits viewable in compare view

Updates NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml from 0.1.26 to 0.1.29

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml's releases.

0.1.29

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Bump urllib3 to 2.8.0 in requirements-qt.txt (recompiled via uv pip compile --upgrade-package urllib3): the osv-scan runtime fixture flagged PYSEC-2026-4176 and PYSEC-2026-4177 on the pinned 2.7.0.
• Fix the dependabot-catalog-convergence update-branch guard. A bound pull request already current with the base made the API answer no new commits, which matched neither the success pattern nor a real error — the job exited before converging the catalog and left dependabot bumps red on tool-registry/catalog.

[0.1.29] - 2026-09-28

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

[0.1.28] - 2026-09-28

• Seven product facts re-verified after the 0.1.27 preflight stop. The product-facts-calendar release gate correctly refused tag 0.1.27: appveyor-public, semaphore-cloud-free, semaphore-community, azure-pipelines-private, bitbucket-free, buildkite-personal and ubicloud-free had all passed their expires_after. Each was re-read against its source_urls on 2026-09-28 and carries a staggered new expires_after. Three records needed correction, not just a date bump: Buildkite's plan is now named Free with 2,000 Linux vCPU minutes/month (was Personal/500), up to 10 concurrent jobs (was 3), up to 5 users (was 1) and 30-day retention (was 90); Semaphore's community edition moved from /community (404) to /open-source and is branded Semaphore Open Source; Ubicloud's credit statement was reconfirmed. No GitHub release exists for tag 0.1.27 — publication was stopped before the publish job.

[0.1.27] - 2026-09-28

• rust-supply-chain tool defaults refreshed. cargo_audit_version now defaults to 0.22.2 and cargo_machete_version to 0.9.2, the current upstream releases. Both remain caller-overridable inputs; only the default moved.

... (truncated)

Commits

• d92026c Merge pull request #144 from NDDev-OpenNetwork/release/0.1.29
• 5b773dc chore(release): 0.1.29
• 80698bd Merge pull request #142 from NDDev-OpenNetwork/release/0.1.28
• fd48db9 chore(release): 0.1.28
• 4326739 Merge pull request #141 from NDDev-OpenNetwork/fix/product-facts-refresh
• 80e9517 fix(catalog): re-verify seven expired product facts, correct three
• 84aaaa8 Merge pull request #139 from NDDev-OpenNetwork/release/0.1.27
• c22d68f chore(release): 0.1.27
• f09a486 Merge pull request #138 from NDDev-OpenNetwork/chore/rust-supply-chain-defaults
• 2a03f48 chore(rust-supply-chain): refresh caller-overridable tool defaults
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.