chore(deps): combine open dependency updates

[mostafa]

Combines all open Dependabot PRs into a single branch so they can be reviewed, tested, and merged together. Each upstream PR is preserved as its own commit (authored by dependabot[bot]), plus reconciliation commits for python/Cargo.lock and core.wasm.

Several of the grouped PRs that this branch originally combined were closed and reopened with newer versions by later Dependabot runs, and main moved on in the meantime. This branch has been rebuilt on top of the current main and now tracks the current open set.

Included updates

GitHub Actions (ci-actions group, #41)

• actions/checkout 6.0.2 -> 6.0.3
• golangci/golangci-lint-action 9.2.0 -> 9.2.1
• astral-sh/setup-uv 8.1.0 -> 8.2.0

Rust (rust-deps group, #48, supersedes #35)

• serde_json 1.0.149 -> 1.0.150
• prefix-trie 0.8.3 -> 0.9.2
• http 1.4.0 -> 1.4.2
• regex 1.12.3 -> 1.12.4

Rust / Python crate

• pyo3 0.28.3 -> 0.29.0 (chore(deps): bump pyo3 from 0.28.3 to 0.29.0 in /python #39)

Go go/ressrf (go-wasm-deps group, #45, supersedes #32)

• github.com/tetratelabs/wazero 1.11.0 -> 1.12.0
• golang.org/x/crypto 0.52.0 -> 0.53.0 (with golang.org/x/sys 0.45.0 -> 0.46.0 indirect)

Go go-native/ressrf (go-native-deps group, #46, supersedes #33)

• github.com/tetratelabs/wazero 1.11.0 -> 1.12.0
• golang.org/x/crypto 0.52.0 -> 0.53.0 (with golang.org/x/sys 0.45.0 -> 0.46.0 indirect)

Node (node-deps group, #26, which subsumes #40)

• tsx 4.21.0 -> 4.22.4
• @types/node 25.6.2 -> 25.9.3
• esbuild -> 0.28.1 (transitive via tsx, the remaining half of chore(deps): bump esbuild and tsx in /node #40)

Python (python-deps group, #47, supersedes #34)

• requests 2.28 -> 2.34.2
• pytest 7 -> 9.1.0
• pytest-asyncio 0.21 -> 1.4.0
• maturin build requirement 1.13.1 -> 1.14.0

Python (transitive)

• cryptography 48.0.0 -> 48.0.1 (chore(deps): bump cryptography from 48.0.0 to 48.0.1 in /python #44)
• idna 3.13 -> 3.15 (chore(deps): bump idna from 3.13 to 3.15 in /python #24)

Local fixes carried alongside the bumps

• fix(python): point readme at the package-local python/README.md. maturin 1.14, now the build requirement via chore(deps): bump the python-deps group across 1 directory with 4 updates #47, rejects readme paths that resolve outside the package metadata root.
• chore(deps): bump Go toolchains to go 1.26.4 (go/ressrf) and go1.25.11 (go-native/ressrf toolchain) to clear the govulncheck gate (GO-2026-5037 / CVE-2026-27145 and GO-2026-5039 / CVE-2026-42507).

Reconciliation

• python/Cargo.lock re-resolved to prefix-trie 0.9.2 and its new array-const-fn-init transitive dependency. The pyo3 PR last regenerated this lockfile while prefix-trie was still 0.8.3 in ressrf-core, so combining it with the rust-deps bump required a fresh resolve.
• core.wasm rebuilt from the updated Rust core (prefix-trie 0.9) and copied to go/ressrf/core.wasm and node/core.wasm. The build-wasm CI job rebuilds and re-commits it if the canonical build differs.

#40 is fully covered: its tsx bump matches #26 and its esbuild 0.28.1 bump is already present in the reconciled node/package-lock.json.

Test plan

All four ecosystems were built and tested locally on macOS arm64:

• Rust workspace: cargo test --workspace --all-features -> 174 passed, 3 ignored
• WASM crate: bash go/ressrf/build_wasm.sh -> ok, committed core.wasm rebuilt with prefix-trie 0.9
• Go (go/ressrf): go build, go vet, go test ./... -> 209 passed
• Go (go-native/ressrf): go build, go vet, go test ./... -> 422 passed
• Python: uv sync (maturin 1.14.0 + pyo3 0.29 + prefix-trie 0.9) then pytest -> 45 passed, 6 skipped; uv lock --check clean
• Node: tsc build + tsc --noEmit lint + test run via tsx -> 206 passed

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ mostafa
❌ github-actions[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[mostafa]

@gonzaloserrano Are you happy with this?

[gonzaloserrano]

Sorry, somehow I missed this PR.

[mostafa]

@gonzaloserrano No worries! More dep updates are in the pipe. I'll merge this and raise another PR.