chore: update dependencies

.circleci/config.yml

@@ -125,7 +125,7 @@ jobs:
   package:
     parameters:
       platform:
-        description: the Linux distribution, with release, e.g. debian:bookworm, fedora:latest
+        description: the Linux distribution, with release, e.g. debian:trixie, fedora:latest
         type: string
       rclass:
         description: the resource class to use, usually arm.medium or medium
@@ -205,7 +205,7 @@ jobs:
         description: the Linux distribution (debian|ubuntu)
         type: string
       release:
-        description: the release name (bookworm|focal|jammy|noble)
+        description: the release name (bookworm|trixie|jammy|noble)
         type: string
       make_target:
         description: the make target to execute during the build
@@ -394,11 +394,11 @@ workflows:
           name: build_debian_bookworm
           dist: debian
           release: bookworm
-      # latest ubuntu uses sanitizers
       - build:
-          name: build_ubuntu_focal
-          dist: ubuntu
-          release: focal
+          name: build_debian_trixie
+          dist: debian
+          release: trixie
+      # latest ubuntu uses sanitizers
       - build:
           name: build_ubuntu_jammy
           dist: ubuntu
@@ -433,10 +433,10 @@ workflows:
           matrix:
             parameters:
               platform:
-                - ubuntu:focal
                 - ubuntu:jammy
                 - ubuntu:noble
                 - debian:bookworm
+                - debian:trixie
                 - almalinux:8
                 - almalinux:9
                 - fedora:latest

.circleci/make-deb-packages.sh

@@ -12,7 +12,7 @@ echo "PARAM_DIST: $PARAM_DIST"
 
 
 if [ -z "$PARAM_RELEASE" ]; then
-    echo "Env variable PARAM_RELEASE is not set! For example PARAM_RELEASE=focal for Ubuntu 20.04"
+    echo "Env variable PARAM_RELEASE is not set! For example PARAM_RELEASE=jammy for Ubuntu 22.04"
     exit 1
 elif [ -z "$PARAM_DIST" ]; then
     echo "Env variable PARAM_DIST is not set! For example PARAM_DIST=debian"

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown: # applies only to version-updates (not security-updates)
+      default-days: 7
+      semver-minor-days: 14 # wait 14 days before applying minor updates
+      semver-major-days: 28
+  - package-ecosystem: gitsubmodule
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/cifuzz.yml

@@ -20,7 +20,7 @@ jobs:
         dry-run: false
         language: c
     - name: Upload Crash
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts

.github/workflows/coverity.yml

@@ -12,7 +12,7 @@ jobs:
     steps:
       - run: |
           sudo apt-get update
-          sudo apt-get install -y \
+          sudo apt-get install --no-install-recommends -y \
             autoconf \
             automake \
             build-essential \
@@ -26,12 +26,12 @@ jobs:
             libunwind-dev \
             pkg-config \
             python3-sphinx
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: true
       - run: ./autogen.sh
       - run: ./configure --with-persistent-storage
-      - uses: vapier/coverity-scan-action@v1.8.0
+      - uses: vapier/coverity-scan-action@2068473c7bdf8c2fb984a6a40ae76ee7facd7a85 # v1.8.0
         with:
           project: varnish
           email: varnish-dev@varnish-cache.org