Merge remote-tracking branch 'mozilla/main' into env-logger-features

.github/workflows/check-vm.yml

@@ -94,7 +94,7 @@ jobs:
             rm -rf target # Don't sync this back to host
 
       - if: matrix.os == 'netbsd'
-        uses: vmactions/netbsd-vm@7c9086fdb4cc1aa814cda6e305390c2b966551a9
+        uses: vmactions/netbsd-vm@46a58bbf03682b4cb24142b97fa315ae52bed573
         with:
           usesh: true
           envs: "CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG GITHUB_ACTIONS"
@@ -157,7 +157,7 @@ jobs:
             cargo test --no-fail-fast --release
             rm -rf target # Don't sync this back to host
 
-      - uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v5.0.7
+      - uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
         with:
           files: lcov.info
           fail_ci_if_error: false

.github/workflows/clippy.yml

@@ -46,7 +46,7 @@ jobs:
       # respective default features only. Can reveal warnings otherwise
       # hidden given that a plain cargo clippy combines all features of the
       # workspace. See e.g. https://github.com/mozilla/neqo/pull/1695.
-      - run: cargo hack clippy --all-targets --feature-powerset --exclude-features gecko -- -D warnings
+      - run: cargo hack clippy --all-targets --benches --feature-powerset --exclude-features gecko -- -D warnings
       - run: cargo doc --workspace --no-deps --document-private-items
         env:
           RUSTDOCFLAGS: "--deny rustdoc::broken_intra_doc_links --deny warnings"

.github/workflows/qns.yml

@@ -54,7 +54,7 @@ jobs:
             # set latest tag for default branch
             type=raw,value=latest,enable={{is_default_branch}}
 
-      - uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
+      - uses: docker/build-push-action@67a2d409c0a876cbe6b11854e3e25193efe4e62d # v6.12.0
         if: github.event_name != 'pull_request'
         with:
           push: true
@@ -65,7 +65,7 @@ jobs:
           cache-to: type=gha,mode=max
           platforms: 'linux/amd64, linux/arm64'
 
-      - uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
+      - uses: docker/build-push-action@67a2d409c0a876cbe6b11854e3e25193efe4e62d # v6.12.0
         id: docker_build_and_push
         with:
           tags: ${{ steps.meta.outputs.tags }}

qns/Dockerfile

@@ -1,4 +1,4 @@
-FROM lukemathwalker/cargo-chef@sha256:d14930e5e1113a4c35d45def583d6f14aa62d941fc268145fe5d4f5c26d5704a AS chef
+FROM lukemathwalker/cargo-chef@sha256:9d68a1b38034d02bf694f819433a40f20ded326d2f20593724f166911db28ef8 AS chef
 
 WORKDIR /app