chore(deps): update template actions

template/.github/{% if include_actions %}workflows{% endif %}/changelog.yml.jinja

@@ -97,7 +97,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install git-cliff
-        uses: taiki-e/install-action@v2.88.0
+        uses: taiki-e/install-action@v2.89.1
         with:
           # renovate: datasource=github-releases depName=orhun/git-cliff
           tool: git-cliff@2.14.2

template/.github/{% if include_actions %}workflows{% endif %}/{% if repo_visibility == 'public' %}codeql.yml{% endif %}.jinja

@@ -32,7 +32,7 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.39.1
+        uses: github/codeql-action/init@v4.39.2
         with:
           languages: python
           # Scopes the scan to shipped code. Without it the default suite reads test
@@ -41,4 +41,4 @@ jobs:
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v4.39.1
+        uses: github/codeql-action/analyze@v4.39.2

template/.github/{% if include_actions %}workflows{% endif %}/{% if repo_visibility == 'public' %}scorecard.yml{% endif %}.jinja

@@ -41,6 +41,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@v4.39.1
+        uses: github/codeql-action/upload-sarif@v4.39.2
         with:
           sarif_file: results.sarif

template/pyproject.toml.jinja

@@ -56,7 +56,7 @@ lint = [
     # the `lint-tools` Renovate PR, where any code the new checks need can land with
     # it. The annotation lets Renovate bump this template seed too.
     # renovate: datasource=pypi depName=ty
-    "ty==0.0.95",
+    "ty==0.0.96",
 ]
 docs = [
     # Griffe is imported directly by docs_build/_api_pages.py to discover the package's