chore(deps): bump the actions group with 5 updates

.github/workflows/binary-size.yml

@@ -37,7 +37,7 @@ jobs:
       actions: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@master
         with:
@@ -55,7 +55,7 @@ jobs:
           cargo-llvm-lines@${{ env.CARGO_LLVM_LINES_VERSION }}
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
 
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
@@ -73,7 +73,7 @@ jobs:
         run: python3 scripts/ci/measure_binary_size.py --out-dir size-out
 
       - name: Upload size artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: size-metrics
           path: size-out/
@@ -175,7 +175,7 @@ jobs:
       # github-action-benchmark deploys the gh-pages site after auto-push.
       deployments: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@master
         with:
@@ -193,7 +193,7 @@ jobs:
           cargo-llvm-lines@${{ env.CARGO_LLVM_LINES_VERSION }}
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
 
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
@@ -212,7 +212,7 @@ jobs:
 
       # This artifact is the comparison baseline for PR runs.
       - name: Upload size artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: size-metrics
           path: size-out/

.github/workflows/claude.yml

@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/codspeed.yml

@@ -76,7 +76,7 @@ jobs:
             packages: -p whatsapp-rust
             features: --features bench-harness
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -118,7 +118,7 @@ jobs:
       # the cache key: it hits while the package is valid and misses the moment
       # the runner image bumps glibc.
       - name: Cache the libc6-dbg package
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/libc6-dbg
           key: libc6-dbg-${{ runner.arch }}-${{ steps.libc6.outputs.version }}
@@ -249,7 +249,7 @@ jobs:
           CHATSTATE_TTL_SECS: "3"
         options: --log-driver none
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -291,7 +291,7 @@ jobs:
       # the cache key: it hits while the package is valid and misses the moment
       # the runner image bumps glibc.
       - name: Cache the libc6-dbg package
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/libc6-dbg
           key: libc6-dbg-${{ runner.arch }}-${{ steps.libc6.outputs.version }}

.github/workflows/copilot-setup-steps.yml

@@ -34,15 +34,15 @@ jobs:
         options: --log-driver none
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@master
         with:
           toolchain: nightly-2026-06-16
 
       - name: Cache install-action tools
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ~/.install-action

.github/workflows/docker.yml

@@ -48,7 +48,7 @@ jobs:
           platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - id: meta
         uses: docker/metadata-action@v6

.github/workflows/e2e.yml

@@ -52,7 +52,7 @@ jobs:
           --log-opt max-file=1
           --log-opt compress=false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - uses: dtolnay/rust-toolchain@master
@@ -63,7 +63,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }},cargo-nextest
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -94,7 +94,7 @@ jobs:
         run: scripts/ci/nextest_timed.sh e2e -p e2e-tests
       - name: Publish test timings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-timings-e2e
           path: ${{ runner.temp }}/test-timings

.github/workflows/main.yml

@@ -42,7 +42,7 @@ jobs:
     name: Format Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check Bartender image pins
         run: scripts/ci/sync-bartender-image.sh --check
       - uses: dtolnay/rust-toolchain@master
@@ -66,7 +66,7 @@ jobs:
       # This job never pushes, and the codegen shells out to `git fetch` against
       # a different repository; the checkout token has no business being left in
       # .git/config for that.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@master
@@ -76,14 +76,14 @@ jobs:
       # RUSTC_WRAPPER is set workspace-wide, so cargo needs sccache on PATH even
       # in a job this small.
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       - run: cargo run -p whatspec-codegen -- --check
 
   clippy:
     name: Clippy Linter
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: nightly-2026-06-16
@@ -96,7 +96,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }}
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -111,7 +111,7 @@ jobs:
     name: Build & Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Reclaim unused Android SDK space
         run: |
           df -h /
@@ -130,7 +130,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }},cargo-nextest
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -159,7 +159,7 @@ jobs:
         run: scripts/ci/nextest_timed.sh workspace --workspace --exclude e2e-tests
       - name: Publish test timings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-timings-build-and-test
           path: ${{ runner.temp }}/test-timings
@@ -187,7 +187,7 @@ jobs:
     # set, and paying that on the workflow's most-read job put it on the
     # critical path for nothing. Here it runs beside everything else.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: nightly-2026-06-16
@@ -196,7 +196,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }},cargo-nextest
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       - name: Cache Rust build (registry + target)
         uses: Swatinem/rust-cache@v2
         with:
@@ -221,7 +221,7 @@ jobs:
           exit "$status"
       - name: Publish test timings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-timings-waproto-serde
           path: ${{ runner.temp }}/test-timings
@@ -237,7 +237,7 @@ jobs:
     # webrtc/opus tree compiles once and is cached (sccache), so the steady-state cost is the
     # workspace recompile with voip on, not the deps. The heavy relay e2e tests stay out of `--lib`.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Reclaim unused Android SDK space
         run: |
           df -h /
@@ -255,7 +255,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }},cargo-nextest
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -295,7 +295,7 @@ jobs:
           exit "$status"
       - name: Publish test timings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-timings-all-features
           path: ${{ runner.temp }}/test-timings
@@ -311,7 +311,7 @@ jobs:
       # rustdoc, never by clippy or rustc, so they need their own gate.
       RUSTDOCFLAGS: "-D warnings"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Reclaim unused Android SDK space
         run: |
           df -h /
@@ -328,7 +328,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }}
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -351,7 +351,7 @@ jobs:
     outputs:
       crates: ${{ steps.crates.outputs.crates }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: crates
         run: echo "crates=$(scripts/ci/feature_matrix_crates.sh)" >> "$GITHUB_OUTPUT"
 
@@ -373,7 +373,7 @@ jobs:
       matrix:
         crate: ${{ fromJSON(needs.feature-matrix-crates.outputs.crates) }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # No Android SDK reclaim here, unlike the three jobs that build the whole
       # workspace. A runner starts this leg with 87G free and one crate's
       # `check` comes nowhere near it, so the `rm -rf` bought 10G nothing asked
@@ -396,7 +396,7 @@ jobs:
         with:
           tool: cargo-hack
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -425,19 +425,19 @@ jobs:
       RUSTFLAGS: ""
       NEXTEST_PROFILE: ci
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Pinned rather than `@stable`: this version is the workspace MSRV
       # (`rust-version` in the root Cargo.toml). To raise the floor, bump both
       # together — a floating `stable` would silently let the declared MSRV rot.
-      - uses: dtolnay/rust-toolchain@1.94.1
+      - uses: dtolnay/rust-toolchain@1.100.0
       # The pre-built nextest binary is toolchain-independent — it drives this
       # MSRV cargo the same way it drives the nightly one.
       - name: Install protoc and cargo-nextest
         uses: taiki-e/install-action@v2
         with:
           tool: protoc@${{ env.PROTOC_VERSION }},cargo-nextest
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -478,7 +478,7 @@ jobs:
           -p whatsapp-rust-sqlite-storage -p whatsapp-rust-tokio-transport
       - name: Publish test timings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-timings-msrv
           path: ${{ runner.temp }}/test-timings

.github/workflows/miri.yml

@@ -78,7 +78,7 @@ jobs:
             cache-key: libsignal-address
             args: -p wacore-libsignal --lib address
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@master

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       tag: ${{ steps.version.outputs.tag }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract and validate version
         id: version
@@ -63,7 +63,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@master
         with:
@@ -75,7 +75,7 @@ jobs:
           tool: cargo-release@0.25.20
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       - uses: Swatinem/rust-cache@v2
         with:
           cache-targets: "false"
@@ -90,7 +90,7 @@ jobs:
     needs: [preflight, publish]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0