chore: Pre-release updates for 26.11.0

.github/workflows/generate_prs.yml

@@ -50,10 +50,10 @@ jobs:
           - trino-operator
           - zookeeper-operator
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
       - name: Install Ansible
         env:
           DEBIAN_FRONTEND: noninteractive

.github/workflows/pr_prek.yml

@@ -5,7 +5,7 @@ on:
   pull_request:
 
 env:
-  HADOLINT_VERSION: "v2.14.0"
+  HADOLINT_VERSION: "v2.15.1"
 
 permissions: {}
 
@@ -15,10 +15,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: stackabletech/actions/run-prek@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+      - uses: stackabletech/actions/run-prek@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           hadolint: ${{ env.HADOLINT_VERSION }}

.pre-commit-config.yaml

@@ -6,7 +6,9 @@ default_language_version:
 
 repos:
   - repo: https://github.com/crate-ci/typos
-    rev: 00f422f3b19c57bc6338715ebfe3316d38768461  # v1.50.3
+    # NOTE (@Techassi): As of 2026-11-03, 1.52.0 isn't yet available in PyPi.
+    # See https://github.com/crate-ci/typos/issues/1641
+    rev: 7f9d0819ca1c008ade73f4b41fa9d258d48f605b  # v1.51.1
     hooks:
       - id: typos
         # Drop the upstream default `--write-changes` so the hook only
@@ -33,7 +35,7 @@ repos:
         files: \.(yml|yaml)(\.j2)*$
 
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: a4d5d37e66ebcd6b3705204a1d6dbb56dea66338 # 0.49.0
+    rev: cbcdc463be5464e25e3e955a511599a67b9b987f # 0.50.0
     hooks:
       - id: markdownlint
         types: [text]
@@ -49,7 +51,7 @@ repos:
   # If you do not, you will need to delete the cached ruff binary shown in the
   # error message
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: c59bba8fb259db0fec2bbb77ad8ba51ea7341b56 # 0.15.20
+    rev: 25bcf95026b96e2dd3c0aec3090c3d6ef6ca2e6c # 0.17.3
     hooks:
       # Run the linter.
       - id: ruff-check
@@ -64,7 +66,7 @@ repos:
         files: ^(template/)?\.github/workflows/.*\.ya?ml(\.j2)?
 
   - repo: https://github.com/hadolint/hadolint
-    rev: 57e1618d78fd469a92c1e584e8c9313024656623 # 2.14.0
+    rev: 2eece55955ced00200be9729e9728cb7dacca505 # 2.15.1
     hooks:
       - id: hadolint
         exclude: \.j2$

config/versions.yaml

@@ -2,12 +2,12 @@
 # IMPORTANT
 # If you change the Rust toolchain version here, make sure to also change
 # docker-images/ubi10-rust-builder/Dockerfile
-rust_version: 1.97.1
+rust_version: 1.99.0
 
 # This nightly version is only used for cargo fmt invocations, because we use nightly-only
 # rustfmt config options in rustfmt.toml. The version should be kept in line with the version
 # used in the operator-rs repository.
-rust_nightly_version: nightly-2026-08-23
+rust_nightly_version: nightly-2026-11-02
 
 # This edition is mostly used for rustfmt commands and the rustfmt config file. The edition should
 # be kept in line with the edition in the operator-rs repository.
@@ -16,8 +16,11 @@ rust_edition: 2024
 # IMPORTANT
 # If you change the Hadolint version here, make sure to also change the hook
 # refs in the local and templated .pre-commit-config.yaml files.
-# And due to a bug you also need to update the version in .github/workflows/pr_pre_commit.yml
-hadolint_version: v2.14.0
+# See https://github.com/hadolint/hadolint/releases for the latest release.
+#
+# And due to a bug you also need to update the version in .github/workflows/pr_prek.yaml
+# See https://github.com/hadolint/hadolint/issues/886.
+hadolint_version: v2.15.1
 
 # IMPORTANT
 # If you change the Python version here, make sure to also change it in
@@ -29,7 +32,7 @@ python_version: 3.14
 # https://github.com/NixOS/nix/tags
 # Usually the latest version should just work and as such the version here can
 # be bumped without any constraints.
-nix_pkg_manager_version: 2.33.3
+nix_pkg_manager_version: 2.35.4
 
 # Check https://pypi.org/project/jinja2-cli/#history for updates
-jinja2_cli_version: 1.0.0
+jinja2_cli_version: 1.0.1

template/.github/workflows/build.yaml.j2

@@ -43,14 +43,14 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
 
       - name: Check for changed files
         id: check
-        uses: stackabletech/actions/detect-changes@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/detect-changes@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           patterns: |
             - '.github/workflows/build.yaml'
@@ -107,7 +107,7 @@ jobs:
           version: ubuntu-latest
 
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -157,7 +157,7 @@ jobs:
           version: ${{ matrix.runner.name }}
 
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -198,15 +198,15 @@ jobs:
           echo "OPERATOR_VERSION=$NEW_VERSION" | tee -a "$GITHUB_OUTPUT"
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
         shell: bash
         run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
 
       - name: Build Container Image
         id: build
-        uses: stackabletech/actions/build-container-image@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/build-container-image@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           image-name: ${{ env.OPERATOR_NAME }}
           image-index-manifest-tag: ${{ steps.version.outputs.OPERATOR_VERSION }}
@@ -215,7 +215,7 @@ jobs:
 
       - name: Publish Container Image to oci.stackable.tech
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: stackabletech/actions/publish-image@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/publish-image@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$sdp+github-action-build
@@ -226,7 +226,7 @@ jobs:
 
       - name: Publish Container Image to quay.io
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: stackabletech/actions/publish-image@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/publish-image@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           image-registry-uri: quay.io
           image-registry-username: stackable+robot_sdp_github_action_build
@@ -251,12 +251,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Publish and Sign Image Index to oci.stackable.tech
-        uses: stackabletech/actions/publish-image-index-manifest@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/publish-image-index-manifest@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$sdp+github-action-build
@@ -265,7 +265,7 @@ jobs:
           canonical-image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}
 
       - name: Publish and Sign Image Index to quay.io
-        uses: stackabletech/actions/publish-image-index-manifest@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/publish-image-index-manifest@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           image-registry-uri: quay.io
           image-registry-username: stackable+robot_sdp_github_action_build
@@ -289,13 +289,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
 
       - name: Package, Publish, and Sign Helm Chart to oci.stackable.tech
-        uses: stackabletech/actions/publish-helm-chart@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/publish-helm-chart@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           chart-registry-uri: oci.stackable.tech
           chart-registry-username: robot$sdp-charts+github-action-build
@@ -307,7 +307,7 @@ jobs:
           publish-and-sign: ${{ !github.event.pull_request.head.repo.fork }}
 
       - name: Package, Publish, and Sign Helm Chart to quay.io
-        uses: stackabletech/actions/publish-helm-chart@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/publish-helm-chart@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           chart-registry-uri: quay.io
           chart-registry-username: stackable+robot_sdp_charts_github_action_build
@@ -339,13 +339,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run OpenShift Preflight Check for oci.stackable.tech
-        uses: stackabletech/actions/run-openshift-preflight@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/run-openshift-preflight@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           image-index-uri: oci.stackable.tech/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }}
           image-architecture: ${{ matrix.arch }}
 
       - name: Run OpenShift Preflight Check for quay.io
-        uses: stackabletech/actions/run-openshift-preflight@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/run-openshift-preflight@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           image-index-uri: quay.io/stackable/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }}
           image-architecture: ${{ matrix.arch }}
@@ -432,7 +432,7 @@ jobs:
           echo "COMBINED_CHECKS_RESULT=$COMBINED_CHECKS_RESULT" | tee -a "$GITHUB_OUTPUT"
 
       - name: Send Notification
-        uses: stackabletech/actions/send-slack-notification@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/send-slack-notification@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           combined-checks-result: ${{ steps.combine.outputs.COMBINED_CHECKS_RESULT }}
           publish-helm-chart-result: ${{ needs.publish-helm-chart.result }}

template/.github/workflows/general_daily_security.yml

@@ -7,7 +7,7 @@ name: Daily Security Audit
 
 on:
   schedule:
-    - cron: '15 4 * * *'
+    - cron: "15 4 * * *"
   workflow_dispatch:
 
 permissions: {}
@@ -20,7 +20,7 @@ jobs:
       # rustsec/audit-check publishes its results as a Check run, which requires this scope
       checks: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0

template/.github/workflows/integration-test-custom.yaml

@@ -23,14 +23,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
 
       - name: Run Integration Test
         id: test
-        uses: stackabletech/actions/run-integration-test@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/run-integration-test@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }}
           otlp-bearer-token: ${{ secrets.OTLP_BEARER_TOKEN }}
@@ -41,7 +41,7 @@ jobs:
 
       - name: Send Notification
         if: ${{ failure() || github.run_attempt > 1 }}
-        uses: stackabletech/actions/send-slack-notification@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/send-slack-notification@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }}
           dashboard-url: ${{ steps.test.outputs.dashboard-url }}

template/.github/workflows/integration-test-profile.yaml

@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -42,7 +42,7 @@ jobs:
 
       - name: Run Integration Test
         id: test
-        uses: stackabletech/actions/run-integration-test@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/run-integration-test@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }}
           otlp-bearer-token: ${{ secrets.OTLP_BEARER_TOKEN }}
@@ -51,7 +51,7 @@ jobs:
 
       - name: Send Notification
         if: ${{ failure() || github.run_attempt > 1 }}
-        uses: stackabletech/actions/send-slack-notification@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+        uses: stackabletech/actions/send-slack-notification@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }}
           dashboard-url: ${{ steps.test.outputs.dashboard-url }}

template/.github/workflows/pr_prek.yaml.j2

@@ -27,12 +27,12 @@ jobs:
         with:
           packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
           version: ubuntu-latest
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
           fetch-depth: 0
-      - uses: stackabletech/actions/run-prek@34a64229959b15db6c5f307db8809805ba7edc55 # v0.18.3
+      - uses: stackabletech/actions/run-prek@d5c85b3cef351617f19de803812b42b839e20168 # v0.18.4
         with:
           rust: ${{ env.RUST_TOOLCHAIN_VERSION }}
           hadolint: ${{ env.HADOLINT_VERSION }}

template/.pre-commit-config.yaml.j2

@@ -11,7 +11,9 @@ repos:
   # typos has no layered configuration (https://github.com/crate-ci/typos/issues/193).
   # A templated config can currently not be extended locally.
   - repo: https://github.com/crate-ci/typos
-    rev: 00f422f3b19c57bc6338715ebfe3316d38768461  # v1.50.3
+    # NOTE (@Techassi): As of 2026-11-03, 1.52.0 isn't yet available in PyPi.
+    # See https://github.com/crate-ci/typos/issues/1641
+    rev: 7f9d0819ca1c008ade73f4b41fa9d258d48f605b  # v1.51.1
     hooks:
       - id: typos
         # Drop the upstream default `--write-changes` so the hook only
@@ -42,7 +44,7 @@ repos:
         args: ["--strict"]
 
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: a4d5d37e66ebcd6b3705204a1d6dbb56dea66338 # 0.49.0
+    rev: cbcdc463be5464e25e3e955a511599a67b9b987f # 0.50.0
     hooks:
       - id: markdownlint
         types: [text]
@@ -62,7 +64,7 @@ repos:
   # If you do not, you will need to delete the cached ruff binary shown in the
   # error message
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: c59bba8fb259db0fec2bbb77ad8ba51ea7341b56 # 0.15.20
+    rev: 25bcf95026b96e2dd3c0aec3090c3d6ef6ca2e6c # 0.17.3
     hooks:
       # Run the linter.
       - id: ruff-check
@@ -75,7 +77,7 @@ repos:
       - id: actionlint
 
   - repo: https://github.com/hadolint/hadolint
-    rev: 57e1618d78fd469a92c1e584e8c9313024656623 # 2.14.0
+    rev: 2eece55955ced00200be9729e9728cb7dacca505 # 2.15.1
     hooks:
       - id: hadolint