build(deps): combine age-eligible Dependabot updates (#12)

<!-- Use a conventional commit-style title, such as "fix(hub): retain
prototype history". -->

## Why

<!-- Explain the problem and why this change matters in a short,
plain-English paragraph. Link the issue when applicable. -->

Bring the eligible Dependabot updates together so they can be reviewed
and landed as one maintenance change. This replaces #1, #2, #3, #5, #6,
#7, and #8. The Hub Vite update in #4 stays out because its
dependency-age check failed.

## What changes

<!-- Describe what becomes different for a first-time reader. Explain
necessary terms. Include accurate Mermaid diagrams when they clarify the
proposal, using before/after diagrams when helpful. Add screenshots for
meaningful UI changes. -->
<!-- Omit validation sections, checklists, and routine test/CI summaries
such as "CI is green" or "tests passed". Mention only known verification
gaps that affect the change, not disclaimers about drafting this
description. -->

Updates the Node setup action and Hub's JSON and Primer Brand
dependencies. The starter updates TanStack Router and its matching
history package together, along with Jest DOM and Vite.

Removes duplicate response fields that JSON 3 now rejects. Adjusts
existing tooltip tests for Primer's hover delay and rebuilds the bundled
canvas assets.

Author: nshki

.github/extensions/replica-prototype/assets/renderer-vendor.js

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm

.github/extensions/replica-prototype/assets/renderer.css

@@ -22,7 +22,7 @@ jobs:
         with:
           bundler-cache: true
           working-directory: hub
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: hub/package.json
           cache: npm
@@ -108,7 +108,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: hub/package.json
           cache: npm
@@ -121,7 +121,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: hub/package.json
           cache: npm
@@ -138,7 +138,7 @@ jobs:
         shard: [1, 2, 3, 4]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: hub/package.json
           cache: npm
@@ -151,7 +151,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: hub/package.json
           cache: npm
@@ -185,7 +185,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: hub/package.json
           cache: npm
@@ -200,7 +200,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: hub/package.json
           cache: npm

.github/workflows/actions-ci.yml

@@ -23,7 +23,7 @@ jobs:
         working-directory: packages/learning
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm

.github/workflows/hub-ci.yml

@@ -31,7 +31,7 @@ jobs:
         working-directory: starter
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm

.github/workflows/learning-ci.yml

@@ -4,7 +4,7 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" }
 gem "active_job-performs", "1.0.2"
 gem "active_record-associated_object", "1.0.0"
 gem "bootsnap", require: false
-gem "json", "~> 2.0"
+gem "json", "~> 3.0"
 gem "jwt", "~> 3.3"
 gem "oaken", "1.0.0"
 gem "propshaft"

.github/workflows/starter-ci.yml

@@ -132,7 +132,7 @@ GEM
       prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    json (2.21.2)
+    json (3.0.2)
     jwt (3.3.0)
       base64
     language_server-protocol (3.17.0.6)
@@ -374,7 +374,7 @@ DEPENDENCIES
   chusaku (= 1.5.2)
   debug
   foreman (= 0.90.0)
-  json (~> 2.0)
+  json (~> 3.0)
   jwt (~> 3.3)
   oaken (= 1.0.0)
   propshaft
@@ -439,7 +439,7 @@ CHECKSUMS
   i18n (1.15.2) sha256=00f9eb62412fe593b2a65a97daa75300d37abb8f7202ec748e94b6d46a9dd1b5
   io-console (0.9.2) sha256=efa74f891dd03c0939a931dfc6e74c2813d904763d456ea9762b0525e748db08
   irb (1.18.0) sha256=de9454a0703a54704b9811a5ef31a60c86949fbf4013fcf244fabc7c775248e3
-  json (2.21.2) sha256=1f1d3b7cf2b3ba1a69beca0bb6db13d5438b80bff3cd54cdaaa620b9b07c1c6a
+  json (3.0.2) sha256=8e6d7e7b11384c21230430cef90b71f14849a34a1f4452796670f7c981bd19df
   jwt (3.3.0) sha256=44cc34fbc341c148233cf66641522b4bce0dfb1ce55e8073f05c56f44f4ee546
   language_server-protocol (3.17.0.6) sha256=5ef2c0c138f8267e1bc631d3328347d354f96724b0af22f2c79516120443b7f0
   lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87

hub/Gemfile

@@ -1,4 +1,4 @@
-import { fireEvent, render, screen } from "@testing-library/react"
+import { fireEvent, render, screen, waitFor } from "@testing-library/react"
 import { ThemeProvider } from "@primer/react-brand"
 import { createRef } from "react"
 import { describe, expect, it, vi } from "vitest"
@@ -202,7 +202,7 @@ describe("Toolbar()", () => {
 
   it.each([false, true])(
     "explains Published on hover and focus without dispatching (resolved: %s)",
-    (resolved) => {
+    async (resolved) => {
       const onPublish = vi.fn()
       const publishButtonRef = createRef<HTMLButtonElement>()
       render(
@@ -230,7 +230,7 @@ describe("Toolbar()", () => {
       expect(button).toHaveAccessibleDescription("Latest changes already published")
       const tooltip = document.getElementById(button.getAttribute("aria-describedby")!)!
       fireEvent.mouseEnter(button)
-      expect(tooltip.matches(":popover-open")).toBe(true)
+      await waitFor(() => expect(tooltip.matches(":popover-open")).toBe(true))
       tooltip.hidePopover()
       fireEvent.focus(button)
       expect(tooltip.matches(":popover-open")).toBe(true)

hub/Gemfile.lock

@@ -216,7 +216,7 @@ describe("ShareLinksPage()", () => {
     expect(build.querySelector("strong")).toHaveTextContent("Build 2")
     expect(build).toHaveAccessibleDescription(/Commit: bbbbbbb\s+Author: @octocat\s+Published:/)
     fireEvent.mouseEnter(build)
-    expect(tooltip.matches(":popover-open")).toBe(true)
+    await waitFor(() => expect(tooltip.matches(":popover-open")).toBe(true))
     fireEvent.mouseLeave(build)
     await waitFor(() => expect(tooltip.matches(":popover-open")).toBe(false))
     fireEvent.focus(build)