chore(deps): update all non-major dependencies (#1163)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
       mobile: ${{ steps.filter.outputs.mobile }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: filter
         with:
           filters: |

.github/workflows/docker.yml

@@ -277,7 +277,7 @@ jobs:
       - name: Attest provenance for the merged image
         # Sigstore-signed in-toto attestation, verifiable with:
         #   gh attestation verify oci://ghcr.io/block/buzz:<tag> --owner block
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-name: ${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.manifest.outputs.digest }}

.github/workflows/release.yml

@@ -614,7 +614,7 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           # Disable dependency caching: a writable cache in this release workflow
           # (contents: write, feeds a signed installer) is a poisoning vector. pnpm
           # install runs uncached below.