lablabs · jaygridley · May 19, 2026 · May 19, 2026 · May 19, 2026 · May 19, 2026
diff --git a/.github/workflows/cache-warmup.yaml b/.github/workflows/cache-warmup.yaml
@@ -11,24 +11,24 @@ permissions:
 
 env:
   # renovate: datasource=github-releases depName=jdx/mise
-  MISE_VERSION: 2025.10.10
+  MISE_VERSION: 2026.5.12
 
 jobs:
   pre-commit:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Setup Mise
-        uses: jdx/mise-action@e3d7b8d67a7958d1207f6ed871e83b1ea780e7b0 # v3.3.1
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
           version: ${{ env.MISE_VERSION }}
 
       - name: Cache pre-commit
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/pre-commit
           key: ${{ runner.os }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}-warmup

diff --git a/.github/workflows/cleanup.yaml b/.github/workflows/cleanup.yaml
@@ -24,7 +24,7 @@ jobs:
         chart: ${{ fromJSON(needs.metadata-collector.outputs.charts) }}
     steps:
       - name: GitHub Slug Action
-        uses: rlespinasse/github-slug-action@955b5ba4560860f8a633bd24190941f16016e42c # v5.1.0
+        uses: rlespinasse/github-slug-action@e6f261660910b273384c5c42b17a0217881b217a # v5.6.0
 
       - name: Cleanup Helm chart
         run: |

diff --git a/.github/workflows/metadata-collector.yaml b/.github/workflows/metadata-collector.yaml
@@ -17,12 +17,12 @@ jobs:
       charts: ${{ steps.changed-charts.outputs.all_changed_files || steps.changed-charts-tag.outputs.all_changed_files }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # pragma: allowlist secret
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # pragma: allowlist secret
         with:
           persist-credentials: true # needed for private repositories
 
       - name: Get changed charts without tag
-        uses: step-security/changed-files@95b56dadb92a30ca9036f16423fd3c088a71ee94 # v46.0.5
+        uses: step-security/changed-files@2e07db73e5ccdb319b9a6c7766bd46d39d304bad # v47.0.5
         id: changed-charts
         if: github.ref_type != 'tag'
         with:

diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
@@ -17,17 +17,17 @@ concurrency:
 
 env:
   # renovate: datasource=github-releases depName=jdx/mise
-  MISE_VERSION: 2025.10.10
+  MISE_VERSION: 2026.5.12
   # renovate: datasource=github-releases depName=helm/helm
-  HELM_VERSION: v3.18.6
+  HELM_VERSION: v3.21.0
   # renovate: datasource=github-tags depName=python/cpython
-  PYTHON_VERSION: v3.13.7
+  PYTHON_VERSION: v3.14.5
   # renovate: datasource=github-releases depName=helm/chart-testing-action
   CHART_TESTING_VERSION: v3.13.0
   # renovate: datasource=github-releases depName=adrienverge/yamllint
-  CHART_TESTING_YAMLLINT_VERSION: v1.37.1
+  CHART_TESTING_YAMLLINT_VERSION: v1.38.0
   # renovate: datasource=github-releases depName=23andMe/Yamale
-  CHART_TESTING_YAMALE_VERSION: 6.0.0
+  CHART_TESTING_YAMALE_VERSION: 6.1.0
 
 jobs:
   metadata-collector:
@@ -40,17 +40,17 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Setup Mise
-        uses: jdx/mise-action@e3d7b8d67a7958d1207f6ed871e83b1ea780e7b0 # v3.3.1
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
           version: ${{ env.MISE_VERSION }}
 
       - name: Cache pre-commit
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/pre-commit
           key: ${{ runner.os }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
@@ -65,11 +65,11 @@ jobs:
   artifacthub-lint:
     runs-on: ubuntu-24.04
     container:
-      image: docker.io/artifacthub/ah:v1.21.0 # referencing version via env variable not supported in GHA
+      image: docker.io/artifacthub/ah:v1.22.0 # referencing version via env variable not supported in GHA
       options: --user=root
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -86,21 +86,21 @@ jobs:
         chart: ${{ fromJSON(needs.metadata-collector.outputs.charts) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
         with:
           version: ${{ env.HELM_VERSION }}
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
+        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
         with:
           version: ${{ env.CHART_TESTING_VERSION }}
           yamllint_version: ${{ env.CHART_TESTING_YAMLLINT_VERSION }}
@@ -127,7 +127,7 @@ jobs:
 
       - name: Create kind cluster
         if: ${{ steps.chart-type.outputs.type == 'application' }} # Only run installation tests for application charts, skip library charts
-        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
 
       # FIXME config: Place custom steps to install CRDs or other dependencies here
 
@@ -150,17 +150,17 @@ jobs:
         chart: ${{ fromJSON(needs.metadata-collector.outputs.charts) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
         with:
           version: ${{ env.HELM_VERSION }}
 
       - name: GitHub Slug Action
-        uses: rlespinasse/github-slug-action@955b5ba4560860f8a633bd24190941f16016e42c # v5.1.0
+        uses: rlespinasse/github-slug-action@e6f261660910b273384c5c42b17a0217881b217a # v5.6.0
 
       - name: Build Helm dependencies
         # Build Helm chart dependencies locally to support both chart-testing lint and install operations.

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -11,7 +11,7 @@ permissions:
 
 env:
   # renovate: datasource=github-releases depName=helm/helm
-  HELM_VERSION: v3.18.6
+  HELM_VERSION: v3.21.0
 
 jobs:
   metadata-collector:
@@ -32,17 +32,17 @@ jobs:
         chart: ${{ fromJSON(needs.metadata-collector.outputs.charts) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
         with:
           version: ${{ env.HELM_VERSION }}
 
       - name: Set up ORAS
-        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
+        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
 
       - name: Build Helm dependencies
         run: scripts/helm-dependency-build.sh $CHART_NAME

diff --git a/.github/workflows/template-sync.yaml b/.github/workflows/template-sync.yaml
diff --git a/.github/workflows/version-check.yaml b/.github/workflows/version-check.yaml
@@ -19,12 +19,12 @@ jobs:
         chart: ${{ fromJSON(needs.metadata-collector.outputs.charts) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: true # needed for private repositories
 
       - name: Set up ORAS
-        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
+        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
 
       - name: Check if chart version exists
         run: |

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -1,7 +1,7 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     # renovate: datasource=github-tags depName=pre-commit/pre-commit-hooks
-    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b # v5.0.0 # pragma: allowlist secret
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0 # pragma: allowlist secret
     hooks:
       - id: trailing-whitespace
         args: ["--markdown-linebreak-ext=md"]
@@ -40,6 +40,6 @@ repos:
 
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
     # renovate: datasource=github-releases depName=zizmorcore/zizmor-pre-commit
-    rev: 69fa534d69454f44ddd4451b5e2da7a1c48e525b # v1.11.0 # pragma: allowlist secret
+    rev: 9257c6050c0261b8c57e712f632dc4a8010109a9 # v1.25.2 # pragma: allowlist secret
     hooks:
       - id: zizmor
diff --git a/.templatesyncignore.local b/.templatesyncignore.local
@@ -0,0 +1 @@
+# This file prevents overriding files that are specific to individual templated addons.
diff --git a/.tool-versions b/.tool-versions
@@ -1,4 +1,4 @@
-python 3.13.7
-pre-commit 4.2.0
-helm 3.18.2
+python 3.14.5
+pre-commit 4.6.0
+helm 3.21.0
 helm-docs 1.14.2
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		# This file prevents overriding files that are specific to individual templated addons.