Merge branch 'main' into immutable-actions

Author: aegilops

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    cooldown:
+      default-days: 5
+      semver-major-days: 21
+      semver-minor-days: 14
+      semver-patch-days: 7
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'

.github/workflows/eslint.yml

@@ -30,11 +30,11 @@ jobs:
       actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     steps:
       - name: Checkout code
-        uses: actions/checkout@4.2.2
+        uses: actions/checkout@v5.0.0
 
       - name: Install ESLint
         run: |
-          npm install eslint@9.23.0
+          npm install eslint@9.34.0
           npm install @microsoft/eslint-formatter-sarif@3.1.0
           npm install eslint-plugin-github@6.0.0
 
@@ -48,7 +48,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload analysis results to GitHub
-        uses: github/codeql-action/upload-sarif@3.28.15
+        uses: github/codeql-action/upload-sarif@v3.30.0
         with:
           sarif_file: eslint-results.sarif
           wait-for-processing: true

.github/workflows/scorecard.yml

@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/test.yml

@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@4.2.2
+        uses: actions/checkout@v5.0.0
       - name: Setup Node
-        uses: actions/setup-node@4.3.0
+        uses: actions/setup-node@v4.4.0
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org/