chore(deps): roll up safe dependency updates

[jusso-dev]

Summary

• bundle Dependabot PRs build(deps): bump actions/attest from 36051bcae73b7c2a8a6945a48cbf80953c6baa35 to f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 #2, build(deps): bump docker/build-push-action from 6.19.2 to 7.3.0 #3, chore(deps): bump gitleaks/gitleaks-action from 2.3.9 to 3.0.0 #4, build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 #5, build(deps): bump github/codeql-action/init from adfda868f108ac4222129de456ea554034a27db7 to e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 #6, and build(deps): bump the production group across 1 directory with 3 updates #7 into one verified update
• update pinned GitHub Actions plus ioredis, nodemailer, and uuid
• keep Node 26 runtime PR build(deps): bump node from 24-bookworm-slim to 26-bookworm-slim #1 and @types/node PR build(deps-dev): bump @types/node from 24.13.3 to 26.1.1 in the development group across 1 directory #8 deferred to P1: Plan Node 26 runtime and type-definition upgrade #34
• preserve all Parker reporting routes, settings, documentation, and worker code from main

Dependabot disposition

PR	Dependency	Disposition
#1	node:24-bookworm-slim to Node 26	Deferred to #34 for coordinated runtime migration
#2	actions/attest v4 at f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6	Bundled
#3	docker/build-push-action 6.19.2 to 7.3.0 at 53b7df96c91f9c12dcc8a07bcb9ccacbed38856a	Bundled
#4	gitleaks/gitleaks-action v2 at ff98106e4c7b2bc287b24eaf42907196329070c7	Bundled
#5	actions/upload-artifact 4.6.2 to 7.0.1 at 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	Bundled
#6	github/codeql-action v4 at e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81	Bundled for both init and analyze
#7	ioredis 5.8.2 to 5.11.1; nodemailer 9.0.1 to 9.0.3; uuid 13.0.x / ^13.0.0 to 14.0.1	Bundled
#8	@types/node 24.13.3 to 26.1.1	Deferred to #34 with Node 26 runtime

CI failure and fix

CI run 30232165990 exposed a Docker Buildx v7 exporter incompatibility. Pull request builds combined load: true with explicit provenance and SBOM attestations, producing docker exporter does not currently support exporting manifest lists.

Pull request smoke builds now disable provenance and SBOM so the single-platform image can load into Docker for inspection. Push builds still use provenance: mode=max, sbom: true, registry push, and the same steps.build.outputs.digest consumed by the publication attestation step.

Replacement run 30232334472 confirmed the Buildx build/load succeeds, then exposed a pre-existing smoke assertion bug: invalid reference format: repository name (jusso-dev/Muster) must be lowercase. The inspect step now normalizes the repository name to lowercase using the same Bash expansion as the anonymous-pull check.

Validation

• pnpm install --frozen-lockfile --offline --ignore-scripts
• pnpm check
• prettier --check .github/workflows/ci.yml
• actionlint .github/workflows/ci.yml
• verified git diff origin/main...HEAD contains only dependency/workflow files
• verified Parker application, worker, and documentation paths have no diff from main
• independent review found no blocking issues
• remote m3-max Docker build produced exact revision 9190390c570582ecc4d7955a0d545eee4ebc5d68 as linux/amd64, digest sha256:85421f2f2d7d482b119da2a9f238774d716f751d57ad26e0aa21455182fa8f3b
• isolated Compose project muster_issue24_9190390 bootstrapped a clean synthetic workspace; Postgres, Redis, MinIO, and web reached healthy state; /api/v1/health and /api/v1/ready returned healthy
• isolated containers, network, volumes, synthetic environment file, and unique application image were removed after validation

Risk summary

• no new packages, install scripts, or runtime services
• updated production dependencies retain MIT or MIT-0 licensing
• bundled dependencies remain compatible with Node 24; Node 26 runtime and type definitions stay isolated in P1: Plan Node 26 runtime and type-definition upgrade #34
• uuid and GitHub Action major-version changes are covered by full lint, typecheck, unit tests, build, workflow lint, live PR CI, and isolated container startup
• push-only provenance, SBOM, publication attestation, and anonymous-pull paths remain intentionally unchanged; PR smoke CI verifies the Docker-load path

Closes #24

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates GitHub Actions revisions, container build and verification settings, security workflow pins, and the ioredis, nodemailer, and uuid dependency versions.

Changes

Workflow and dependency updates

Layer / File(s)	Summary
CI container build updates .github/workflows/ci.yml	Updates artifact, Docker build, and attestation actions; gates provenance and SBOM to pushes, enables maximum cache export, and computes the image reference for pull-request verification.
Security workflow action updates .github/workflows/security.yml	Updates CodeQL, Gitleaks, artifact upload, and Docker build action revisions.
Package dependency updates apps/web/package.json, packages/auth/package.json, packages/database/package.json	Upgrades ioredis to 5.11.1, nodemailer to 9.0.3, and uuid to 14.0.1.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• jusso-dev/Muster#2: Repins the actions/attest step in the CI workflow.
• jusso-dev/Muster#3: Updates docker/build-push-action to v7.3.0.
• jusso-dev/Muster#5: Updates artifact uploads to actions/upload-artifact v7.0.1.

Suggested labels: dependencies, github_actions, javascript

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The dependency and CI updates align with the Dependabot rollup objective and defer blocked upgrades as described.
Out of Scope Changes check	✅ Passed	The diff stays limited to dependency and CI pin updates plus the needed container smoke-test tweaks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the PR’s main purpose: rolling up safe dependency and action updates.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/issue24

---

_{Comment @coderabbitai help to get the list of available commands.}