From 716843970eb9e8d5ff9aa0ce99fd119dbdc985ee Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 30 Apr 2026 11:31:02 +0000
Subject: [PATCH 1/2] Initial plan


From c20480d9ea0825edeb543fa7cb23ed5b47bc8714 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 30 Apr 2026 11:42:07 +0000
Subject: [PATCH 2/2] chore(deps): update all rate-limited and major dependency
 upgrades
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- reqwest: 0.13.2 → 0.13.3
- zip: 8.5.1 → 8.6.0 (Cargo.lock)
- @astrojs/starlight: ^0.38.2 → ^0.38.4
- @iconify/json: ^2.2.456 → ^2.2.468
- @biomejs/biome: 2.4.12 → 2.4.13
- lefthook: ^2.1.4 → ^2.1.6
- typescript: ^6.0.0 → ^6.0.3
- pnpm-workspace.yaml @dallay/agentsync catalog: 1.42.3 → 1.42.10
- Dockerfile: rust:1.94-alpine → rust:1.95-alpine
- pnpm/action-setup: v6.0.0 → v6.0.3 (3 workflows)
- actions/setup-node: v6.3.0 → v6.4.0 (deploy-docs.yml)
- googleapis/release-please-action: v4.4.1 → v5.0.0 (major)
- SonarSource/sonarqube-scan-action: v7.1 → v8.0.0 (major)
- dallay/common-actions: v1 → v2 (7 workflows, major)

Agent-Logs-Url: https://github.com/dallay/agentsync/sessions/8aa7ee44-5438-4012-b492-756b08349296

Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
---
 .github/workflows/cleanup-cache.yml         |  2 +-
 .github/workflows/contributor-report.yml    |  2 +-
 .github/workflows/deploy-docs.yml           |  4 +-
 .github/workflows/greetings.yml             |  2 +-
 .github/workflows/issue-labeler.yml         |  2 +-
 .github/workflows/label.yml                 |  2 +-
 .github/workflows/labels-sync.yml           |  2 +-
 .github/workflows/release.yml               |  6 +-
 .github/workflows/semantic-pull-request.yml |  2 +-
 .github/workflows/sonarcloud.yml            |  2 +-
 .github/workflows/stale.yml                 |  2 +-
 Cargo.lock                                  | 87 +++++++++++++--------
 Cargo.toml                                  |  2 +-
 Dockerfile                                  |  2 +-
 npm/agentsync/package.json                  |  2 +-
 package.json                                |  4 +-
 pnpm-workspace.yaml                         |  2 +-
 website/docs/package.json                   |  4 +-
 18 files changed, 77 insertions(+), 54 deletions(-)

diff --git a/.github/workflows/cleanup-cache.yml b/.github/workflows/cleanup-cache.yml
index e7defdce..771c4860 100644
--- a/.github/workflows/cleanup-cache.yml
+++ b/.github/workflows/cleanup-cache.yml
@@ -10,5 +10,5 @@ permissions:
 
 jobs:
   cleanup:
-    uses: dallay/common-actions/.github/workflows/cleanup-cache.yml@v1
+    uses: dallay/common-actions/.github/workflows/cleanup-cache.yml@v2
     secrets: inherit
diff --git a/.github/workflows/contributor-report.yml b/.github/workflows/contributor-report.yml
index 8e81ec1e..c0fa612b 100644
--- a/.github/workflows/contributor-report.yml
+++ b/.github/workflows/contributor-report.yml
@@ -18,5 +18,5 @@ env:
 
 jobs:
   report:
-    uses: dallay/common-actions/.github/workflows/contributor-report.yml@v1.2.1
+    uses: dallay/common-actions/.github/workflows/contributor-report.yml@v2
     secrets: inherit
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index f651cac0..b9963a51 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -22,12 +22,12 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6
+        uses: pnpm/action-setup@903f9c1a6ebcba6cf41d87230be49611ac97822e # v6.0.3
         with:
           version: 10
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: 'pnpm'
diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml
index 9338d359..e5cc00be 100644
--- a/.github/workflows/greetings.yml
+++ b/.github/workflows/greetings.yml
@@ -8,5 +8,5 @@ permissions:
 
 jobs:
   greet:
-    uses: dallay/common-actions/.github/workflows/greetings.yml@v1
+    uses: dallay/common-actions/.github/workflows/greetings.yml@v2
     secrets: inherit
diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml
index 5415068d..3c4ecb9f 100644
--- a/.github/workflows/issue-labeler.yml
+++ b/.github/workflows/issue-labeler.yml
@@ -9,5 +9,5 @@ permissions:
 
 jobs:
   label:
-    uses: dallay/common-actions/.github/workflows/issue-labeler.yml@v1
+    uses: dallay/common-actions/.github/workflows/issue-labeler.yml@v2
     secrets: inherit
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index 7dbd8964..f9dd55d9 100644
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -8,5 +8,5 @@ permissions:
 
 jobs:
   label:
-    uses: dallay/common-actions/.github/workflows/pr-labeler.yml@v1
+    uses: dallay/common-actions/.github/workflows/pr-labeler.yml@v2
     secrets: inherit
diff --git a/.github/workflows/labels-sync.yml b/.github/workflows/labels-sync.yml
index 9f139ff2..a1539f13 100644
--- a/.github/workflows/labels-sync.yml
+++ b/.github/workflows/labels-sync.yml
@@ -13,5 +13,5 @@ permissions:
 
 jobs:
   sync:
-    uses: dallay/common-actions/.github/workflows/labels-sync.yml@v1
+    uses: dallay/common-actions/.github/workflows/labels-sync.yml@v2
     secrets: inherit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 291a20fe..f116a409 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,7 +50,7 @@ jobs:
 
       - name: Release Please
         id: release
-        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
           token: ${{ steps.app-token.outputs.token }}
           config-file: release-please-config.json
@@ -315,7 +315,7 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6
+        uses: pnpm/action-setup@903f9c1a6ebcba6cf41d87230be49611ac97822e # v6.0.3
         with:
           version: 10
 
@@ -476,7 +476,7 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6
+        uses: pnpm/action-setup@903f9c1a6ebcba6cf41d87230be49611ac97822e # v6.0.3
         with:
           version: 10
 
diff --git a/.github/workflows/semantic-pull-request.yml b/.github/workflows/semantic-pull-request.yml
index 65c9ea3b..d4cecde5 100644
--- a/.github/workflows/semantic-pull-request.yml
+++ b/.github/workflows/semantic-pull-request.yml
@@ -9,5 +9,5 @@ permissions:
 
 jobs:
   lint:
-    uses: dallay/common-actions/.github/workflows/semantic-pr.yml@v1
+    uses: dallay/common-actions/.github/workflows/semantic-pr.yml@v2
     secrets: inherit
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 2f9821ef..2f07046a 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -75,7 +75,7 @@ jobs:
 
       - name: Analyze with SonarCloud
         if: ${{ env.SONAR_TOKEN != '' && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) }}
-        uses: SonarSource/sonarqube-scan-action@299e4b793aaa83bf2aba7c9c14bedbb485688ec4 # v7
+        uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0
         with:
           args: >-
             -Dsonar.projectBaseDir=.
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index a3344ae7..68312b38 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -10,5 +10,5 @@ permissions:
 
 jobs:
   stale:
-    uses: dallay/common-actions/.github/workflows/stale.yml@ae3cdbb9ec2a94622a72d984da9254bc70e071dc # v1
+    uses: dallay/common-actions/.github/workflows/stale.yml@6ecd716dcfb6a9e8a9c494d1eac210cc1d73d75f # v2
     secrets: inherit
diff --git a/Cargo.lock b/Cargo.lock
index 8cc00a56..f6a72e2f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -10,13 +10,13 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aes"
-version = "0.8.4"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+checksum = "66bd29a732b644c0431c6140f370d097879203d79b80c94a6747ba0872adaef8"
 dependencies = [
- "cfg-if",
  "cipher",
- "cpufeatures 0.2.17",
+ "cpubits",
+ "cpufeatures 0.3.0",
 ]
 
 [[package]]
@@ -203,6 +203,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
 dependencies = [
  "hybrid-array",
+ "zeroize",
 ]
 
 [[package]]
@@ -283,11 +284,11 @@ dependencies = [
 
 [[package]]
 name = "cipher"
-version = "0.4.4"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+checksum = "e34d8227fe1ba289043aeb13792056ff80fd6de1a9f49137a5f499de8e8c78ea"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common 0.2.1",
  "inout",
 ]
 
@@ -340,6 +341,12 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"
+
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -352,7 +359,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -432,6 +439,12 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -478,6 +491,15 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
 [[package]]
 name = "deflate64"
 version = "0.1.12"
@@ -513,7 +535,6 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
  "crypto-common 0.1.7",
- "subtle",
 ]
 
 [[package]]
@@ -525,6 +546,8 @@ dependencies = [
  "block-buffer 0.12.0",
  "const-oid",
  "crypto-common 0.2.1",
+ "ctutils",
+ "zeroize",
 ]
 
 [[package]]
@@ -572,7 +595,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -799,11 +822,11 @@ checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
 [[package]]
 name = "hmac"
-version = "0.12.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
- "digest 0.10.7",
+ "digest 0.11.2",
 ]
 
 [[package]]
@@ -1062,11 +1085,11 @@ dependencies = [
 
 [[package]]
 name = "inout"
-version = "0.1.4"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -1093,7 +1116,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1337,11 +1360,11 @@ checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
 
 [[package]]
 name = "pbkdf2"
-version = "0.12.2"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"
 dependencies = [
- "digest 0.10.7",
+ "digest 0.11.2",
  "hmac",
 ]
 
@@ -1581,9 +1604,9 @@ checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "reqwest"
-version = "0.13.2"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab3f43e3283ab1488b624b44b0e988d0acea0b3214e694730a055cb6b2efa801"
+checksum = "62e0021ea2c22aed41653bc7e1419abb2c97e038ff2c33d0e1309e49a97deec0"
 dependencies = [
  "base64",
  "bytes",
@@ -1653,7 +1676,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1710,7 +1733,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1858,13 +1881,13 @@ dependencies = [
 
 [[package]]
 name = "sha1"
-version = "0.10.6"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
+ "cpufeatures 0.3.0",
+ "digest 0.11.2",
 ]
 
 [[package]]
@@ -2029,7 +2052,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2597,7 +2620,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3033,9 +3056,9 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "8.5.1"
+version = "8.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcab981e19633ebcf0b001ddd37dd802996098bc1864f90b7c5d970ce76c1d59"
+checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
 dependencies = [
  "aes",
  "bzip2",
diff --git a/Cargo.toml b/Cargo.toml
index 08ab5700..6b6b0008 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -51,7 +51,7 @@ walkdir = "2.5"
 pathdiff = "0.2"
 
 # HTTP + async runtime (added for skills.sh integration feature)
-reqwest = { version = "0.13.2", features = ["json", "gzip", "stream", "blocking"] }
+reqwest = { version = "0.13.3", features = ["json", "gzip", "stream", "blocking"] }
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "fs"] }
 tracing = "0.1"
 tracing-subscriber = "0.3"
diff --git a/Dockerfile b/Dockerfile
index eb16398f..ca603918 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,7 @@
 # Stage 1: Build environment
 # Using official Rust image with Alpine for smaller base
 # -----------------------------------------------------------------------------
-FROM rust:1.94-alpine AS builder
+FROM rust:1.95-alpine AS builder
 
 # Build arguments for flexibility
 ARG TARGETPLATFORM
diff --git a/npm/agentsync/package.json b/npm/agentsync/package.json
index d7010319..35237636 100644
--- a/npm/agentsync/package.json
+++ b/npm/agentsync/package.json
@@ -45,7 +45,7 @@
 	},
 	"devDependencies": {
 		"@types/node": "^25.5.0",
-		"typescript": "^6.0.0"
+		"typescript": "^6.0.3"
 	},
 	"optionalDependencies": {
 		"@dallay/agentsync-darwin-arm64": "1.42.10",
diff --git a/package.json b/package.json
index 17a982da..213aff2e 100644
--- a/package.json
+++ b/package.json
@@ -27,9 +27,9 @@
 		"docs:astro": "pnpm --filter agentsync-docs run astro"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "2.4.12",
+		"@biomejs/biome": "2.4.13",
 		"@dallay/agentsync": "catalog:",
-		"lefthook": "^2.1.4"
+		"lefthook": "^2.1.6"
 	},
 	"version": "1.42.10"
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index d4a728b8..51a65b4a 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -3,7 +3,7 @@ packages:
   - website/docs
 
 catalog:
-  '@dallay/agentsync': 1.42.3
+  '@dallay/agentsync': 1.42.10
   '@semantic-release/changelog': ^6.0.3
   '@semantic-release/exec': ^7.1.0
   '@semantic-release/git': ^10.0.1
diff --git a/website/docs/package.json b/website/docs/package.json
index abcc4e31..bd2b0a7f 100644
--- a/website/docs/package.json
+++ b/website/docs/package.json
@@ -10,10 +10,10 @@
 		"astro": "astro"
 	},
 	"dependencies": {
-		"@astrojs/starlight": "^0.38.2",
+		"@astrojs/starlight": "^0.38.4",
 		"@fontsource/geist-mono": "^5.2.7",
 		"@fontsource/geist-sans": "^5.2.5",
-		"@iconify/json": "^2.2.456",
+		"@iconify/json": "^2.2.468",
 		"astro": "^6.1.1",
 		"sharp": "^0.34.5",
 		"starlight-theme-black": "^0.6.0",