From e31e0a7eb2bd0c7811c6f9c479da4281006978a3 Mon Sep 17 00:00:00 2001
From: James McKinney <26463+jpmckinney@users.noreply.github.com>
Date: Tue, 24 Jun 2025 16:41:42 -0400
Subject: [PATCH] build: Update to latest profile template

---
 .github/workflows/ci.yml         |  2 ++
 .github/workflows/js.yml         |  2 ++
 .github/workflows/shell.yml      |  2 ++
 .github/workflows/spellcheck.yml |  2 ++
 common-requirements.txt          | 14 +++++++-------
 5 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b92694c15..8be55fd53 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,8 @@ on: [push, pull_request]
 jobs:
   build:
     uses: open-contracting/.github/.github/workflows/ci-profile.yml@main
+    permissions:
+      contents: read
     secrets:
       private-key: ${{ secrets.PRIVATE_KEY }}
       elasticsearch-password: ${{ secrets.ELASTICSEARCH_PASSWORD }}
diff --git a/.github/workflows/js.yml b/.github/workflows/js.yml
index f0d0e38b5..bc34612db 100644
--- a/.github/workflows/js.yml
+++ b/.github/workflows/js.yml
@@ -3,5 +3,7 @@ on: [push, pull_request]
 jobs:
   lint:
     uses: open-contracting/.github/.github/workflows/js.yml@main
+    permissions:
+      contents: read
     with:
       filenames: docs/_static/script.js
diff --git a/.github/workflows/shell.yml b/.github/workflows/shell.yml
index dfdb0acfb..67df87a17 100644
--- a/.github/workflows/shell.yml
+++ b/.github/workflows/shell.yml
@@ -3,3 +3,5 @@ on: [push, pull_request]
 jobs:
   lint:
     uses: open-contracting/.github/.github/workflows/shell.yml@main
+    permissions:
+      contents: read
diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/spellcheck.yml
index d67a6d01e..8e72d55ff 100644
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/spellcheck.yml
@@ -3,6 +3,8 @@ on: [push, pull_request]
 jobs:
   lint:
     uses: open-contracting/.github/.github/workflows/spellcheck.yml@main
+    permissions:
+      contents: read
     with:
       ignore: fo,sme,zar
       skip: docson,locale,examples,country.csv,currency.csv,language.csv,mediaType.csv
diff --git a/common-requirements.txt b/common-requirements.txt
index 62a2917b5..c91b9ee37 100644
--- a/common-requirements.txt
+++ b/common-requirements.txt
@@ -42,7 +42,7 @@ docutils==0.18
     # via
     #   myst-parser
     #   sphinx
-elastic-transport==8.4.0
+elastic-transport==8.17.1
     # via elasticsearch
 elasticsearch==8.6.2
     # via ocdsindex
@@ -51,7 +51,7 @@ exceptiongroup==1.2.2
     #   anyio
     #   cattrs
     #   pytest
-h11==0.13.0
+h11==0.16.0
     # via
     #   uvicorn
     #   wsproto
@@ -88,7 +88,7 @@ mdurl==0.1.2
     # via markdown-it-py
 myst-parser==0.18.1
     # via -r common-requirements.in
-ocds-babel==0.3.6
+ocds-babel==0.3.7
     # via -r common-requirements.in
 ocdsextensionregistry==0.6.5
     # via -r common-requirements.in
@@ -114,7 +114,7 @@ pytz==2021.1
     # via babel
 pyyaml==6.0.1
     # via myst-parser
-requests==2.32.2
+requests==2.32.4
     # via
     #   elasticsearch
     #   ocdsextensionregistry
@@ -124,7 +124,7 @@ requests-cache==1.1.0
     # via ocdsextensionregistry
 selenium==4.11.2
     # via -r common-requirements.in
-setuptools==75.2.0
+setuptools==80.9.0
     # via sphinx-intl
 six==1.16.0
     # via url-normalize
@@ -158,7 +158,7 @@ sphinxcontrib-qthelp==1.0.3
     # via sphinx
 sphinxcontrib-serializinghtml==1.1.5
     # via sphinx
-standard-theme @ git+https://github.com/open-contracting/standard_theme.git@d56505d69fceeb43535a3387172b2024eead536e#egg=standard_theme
+standard-theme @ git+https://github.com/open-contracting/standard_theme.git@fe5c0879e00db6d00b1d10a7df98826ba46abdbe#egg=standard_theme
     # via -r common-requirements.in
 starlette==0.40.0
     # via sphinx-autobuild
@@ -180,7 +180,7 @@ uc-micro-py==1.0.1
     # via linkify-it-py
 url-normalize==1.4.3
     # via requests-cache
-urllib3==1.26.19
+urllib3==2.5.0
     # via
     #   elastic-transport
     #   requests