chore(deps): refresh build toolchain

.github/workflows/build.yml

@@ -26,7 +26,7 @@ jobs:
     if: ${{ github.actor == vars.CI_ALLOWED_ACTOR }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - run: python3 test/test_release_workflow.py

.github/workflows/conan.yml

@@ -8,7 +8,7 @@ on:
 permissions:
   contents: read
 env:
-  CONAN_VERSION: "2.26.2"
+  CONAN_VERSION: "2.31.2"
 jobs:
   build:
     name: Linux ${{ matrix.linkage }} libraries, ${{ matrix.plugin_mode }} plugins
@@ -55,13 +55,13 @@ jobs:
             pkg-config \
             tar \
             xz-utils
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: conan-cache
         with:
           path: ~/.conan2/p
@@ -73,7 +73,7 @@ jobs:
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-${{ matrix.linkage }}-${{ matrix.plugin_mode }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-${{ matrix.linkage }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: compiler-cache
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -136,12 +136,12 @@ jobs:
         run: |
           set -euo pipefail
           conan cache clean "*" --source --build --download --temp
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.conan-cache.outputs.cache-hit != 'true' }}
         with:
           path: ~/.conan2/p
           key: ${{ steps.conan-cache.outputs.cache-primary-key }}
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.compiler-cache.outputs.cache-hit != 'true' }}
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -175,13 +175,13 @@ jobs:
             plugin_mode: dynamic
             static_plugins: "False"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: conan-cache
         with:
           path: ~/.conan2/p
@@ -193,7 +193,7 @@ jobs:
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-${{ matrix.linkage }}-${{ matrix.plugin_mode }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-${{ matrix.linkage }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: compiler-cache
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -245,12 +245,12 @@ jobs:
         run: |
           set -euo pipefail
           conan cache clean "*" --source --build --download --temp
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.conan-cache.outputs.cache-hit != 'true' }}
         with:
           path: ~/.conan2/p
           key: ${{ steps.conan-cache.outputs.cache-primary-key }}
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.compiler-cache.outputs.cache-hit != 'true' }}
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -272,13 +272,13 @@ jobs:
           - linkage: static
             shared: "False"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: conan-cache
         with:
           path: ~/.conan2/p
@@ -288,7 +288,7 @@ jobs:
             conan2-v2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-${{ matrix.linkage }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: compiler-cache
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -342,12 +342,12 @@ jobs:
         if: ${{ always() && !cancelled() }}
         shell: pwsh
         run: conan cache clean "*" --source --build --download --temp
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.conan-cache.outputs.cache-hit != 'true' }}
         with:
           path: ~/.conan2/p
           key: ${{ steps.conan-cache.outputs.cache-primary-key }}
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.compiler-cache.outputs.cache-hit != 'true' }}
         with:
           path: ${{ env.CCACHE_DIR }}

.github/workflows/release-packages.yml

@@ -42,7 +42,7 @@ concurrency:
 
 env:
   CHANNEL: "${{ inputs.channel || (github.ref_type == 'tag' && 'stable' || 'dev') }}"
-  CONAN_VERSION: "2.26.2"
+  CONAN_VERSION: "2.31.2"
   CONAN_REMOTE_NAME: "${{ vars.CONAN_REMOTE_NAME }}"
   CONAN_REMOTE_URL: "${{ vars.CONAN_REMOTE_URL }}"
   CONAN_REMOTE_USERNAME: "${{ vars.CONAN_REMOTE_USERNAME }}"
@@ -115,19 +115,19 @@ jobs:
       LINUX_BUILD_SHARED: "off"
       LINUX_ARCHS: ${{ matrix.target.os == 'linux' && matrix.target.arch || '' }}
       LINUX_TCLIBCS: musl
-      LLVM_MINGW_VERSION: "20251118"
+      LLVM_MINGW_VERSION: "20260616"
       OSS: ${{ matrix.target.os }}
       USE_DOCKER: "off"
       WINDOWS_BUILD_SHARED: "off"
       WINDOWS_ARCHS: ${{ matrix.target.os == 'windows' && matrix.target.arch || '' }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: conan-cache
         if: ${{ matrix.target.arch == 'x86_64' || matrix.target.arch == 'arm64' }}
         with:
@@ -243,14 +243,14 @@ jobs:
       - name: Trim Conan cache
         if: ${{ always() && !cancelled() }}
         run: conan cache clean "*" --source --build --download --temp
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && (matrix.target.arch == 'x86_64' || matrix.target.arch == 'arm64') && steps.conan-cache.outputs.cache-hit != 'true' }}
         with:
           path: |
             ~/.conan2/p
             ~/.cache/ccache
           key: ${{ steps.conan-cache.outputs.cache-primary-key }}
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cpp-release-candidate-${{ github.sha }}-${{ matrix.target.os }}-${{ matrix.target.arch }}
           path: candidate
@@ -272,13 +272,13 @@ jobs:
       OSS: macos
       USE_DOCKER: "off"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: conan-cache
         with:
           path: |
@@ -369,14 +369,14 @@ jobs:
       - name: Trim Conan cache
         if: ${{ success() }}
         run: conan cache clean "*" --source --build --download --temp
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ success() && steps.conan-cache.outputs.cache-hit != 'true' }}
         with:
           path: |
             ~/.conan2/p
             ~/.cache/ccache
           key: ${{ steps.conan-cache.outputs.cache-primary-key }}
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cpp-release-candidate-${{ github.sha }}-macos
           path: candidate
@@ -462,14 +462,14 @@ jobs:
       WINDOWS_BUILD_SHARED: "off"
       WINDOWS_ARCHS: ${{ matrix.target.os == 'windows' && matrix.target.arch || '' }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: cpp-release-candidate-${{ github.sha }}-${{ matrix.target.os }}-${{ matrix.target.arch }}
           path: candidate
@@ -521,14 +521,14 @@ jobs:
       OSS: macos
       USE_DOCKER: "off"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: cpp-release-candidate-${{ github.sha }}-macos
           path: candidate

.github/workflows/release-please.yml

@@ -10,6 +10,6 @@ jobs:
     if: ${{ github.actor == vars.CI_ALLOWED_ACTOR }}
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}

.github/workflows/reliability.yml

@@ -26,7 +26,7 @@ jobs:
           - name: Thread sanitizer
             preset: tsan
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install native dependencies
@@ -43,7 +43,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install native dependencies
@@ -72,7 +72,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install native dependencies

build-docker-linuxbrew.sh

@@ -3,6 +3,7 @@ set -euo pipefail
 
 docker buildx build . \
   -f docker/Dockerfile.linuxbrew \
+  --platform linux/amd64 \
   -t "registry.rstream.io/rstream-cpp-linuxbrew:$(cat version.txt)-snapshot-$(date +%F)" \
   -t registry.rstream.io/rstream-cpp-linuxbrew:latest \
   --load \

conan/Dockerfile

@@ -1,10 +1,10 @@
-FROM alpine:latest AS alpine
+FROM alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 AS alpine
 
 RUN apk update && apk add libstdc++
 
-FROM ubuntu:24.04
+FROM ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 # Install build tools
 RUN apt-get update && apt-get -y install --no-install-recommends \
@@ -26,7 +26,7 @@ RUN apt-get update && apt-get -y install --no-install-recommends \
 
 RUN apt-get update && apt-get -y install --no-install-recommends nasm
 
-ARG LLVM_MINGW_VERSION=20251118
+ARG LLVM_MINGW_VERSION=20260616
 
 RUN set -eux; \
     host_arch="$(dpkg --print-architecture)"; \
@@ -49,7 +49,7 @@ COPY --from=alpine /usr/lib/libstdc++.so.6 /usr/lib/*-linux-musl/libstdc++.so.6
 COPY --from=alpine /usr/lib/libgcc_s.so.1 /usr/lib/*-linux-musl/libgcc_s.so.1
 
 # Install conan
-ARG CONAN_VERSION=2.26.2
+ARG CONAN_VERSION=2.31.2
 
 RUN PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade "conan==${CONAN_VERSION}" PyYAML
 

conan/compose.yaml

@@ -6,7 +6,7 @@ services:
       context: ./
       dockerfile: Dockerfile
       args:
-        CONAN_VERSION: ${CONAN_VERSION:-2.26.2}
+        CONAN_VERSION: ${CONAN_VERSION:-2.31.2}
         CONAN_REMOTE_NAME: ${CONAN_REMOTE_NAME:-rstream}
         CONAN_REMOTE_URL: ${CONAN_REMOTE_URL:-}
         CONAN_REMOTE_USERNAME: ${CONAN_REMOTE_USERNAME:-}

docker/Dockerfile.conan.android

@@ -1,12 +1,14 @@
-FROM ubuntu:24.04 AS build
+FROM ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517 AS build
 
-ENV ANDROID_ARCH armv8
+ENV ANDROID_ARCH=armv8
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get -y install --no-install-recommends build-essential git cmake ninja-build tar gzip pkg-config jq
 
-RUN apt-get update && apt-get -y install --no-install-recommends python3-dev python3-numpy python3-pip && PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade conan
+ARG CONAN_VERSION=2.31.2
+
+RUN apt-get update && apt-get -y install --no-install-recommends python3-dev python3-numpy python3-pip && PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade "conan==${CONAN_VERSION}"
 
 RUN conan profile detect
 

docker/Dockerfile.conan.emscripten

@@ -1,10 +1,12 @@
-FROM ubuntu:24.04 AS build
+FROM ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517 AS build
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get -y install --no-install-recommends build-essential git cmake ninja-build tar gzip pkg-config jq
 
-RUN apt-get update && apt-get -y install --no-install-recommends python3-dev python3-numpy python3-pip && PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade conan
+ARG CONAN_VERSION=2.31.2
+
+RUN apt-get update && apt-get -y install --no-install-recommends python3-dev python3-numpy python3-pip && PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade "conan==${CONAN_VERSION}"
 
 RUN conan profile detect
 

docker/Dockerfile.conan.glibc

@@ -1,12 +1,12 @@
-ARG BASE=ubuntu:24.04
+ARG BASE=ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517
 
 FROM $BASE AS build
 
 ARG BUILD_TYPE="Release"
 
 ARG BUILD_LIBS_TYPE="shared"
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN mkdir -p /rstream/build