chore: update dependencies

.github/pinact.yaml

@@ -0,0 +1,10 @@
+version: 3
+
+min_age:
+  value: 7
+
+rules:
+  # First-party actions are trusted, skip the min-age check for them
+  - min_age: 0
+    conditions:
+      - expr: ActionRepoOwner == "labd"

.github/workflows/release.yaml

@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: labd/gh-actions-typescript/pnpm-install@4d7a6c7088328753fdbacbb9204aae4e2b9b00e2 # 1.0.0
+        uses: labd/gh-actions-typescript/pnpm-install@a43f95146e7e81612083238af16f503de7f614a8 # v1.0.3
 
       - name: Lint
         run: pnpm lint
@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: labd/gh-actions-typescript/pnpm-install@4d7a6c7088328753fdbacbb9204aae4e2b9b00e2 # 1.0.0
+        uses: labd/gh-actions-typescript/pnpm-install@a43f95146e7e81612083238af16f503de7f614a8 # v1.0.3
 
       - name: Check types
         run: pnpm tsc
@@ -38,10 +38,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: labd/gh-actions-typescript/pnpm-install@4d7a6c7088328753fdbacbb9204aae4e2b9b00e2 # 1.0.0
+        uses: labd/gh-actions-typescript/pnpm-install@a43f95146e7e81612083238af16f503de7f614a8 # v1.0.3
 
       - name: Test
         run: pnpm test
@@ -52,14 +52,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        node: ["20.x", "22.x", "24.x"]
+        node: ["22.x", "24.x", "26.x"]
         os: [ubuntu-latest, macOS-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: labd/gh-actions-typescript/pnpm-install@4d7a6c7088328753fdbacbb9204aae4e2b9b00e2 # 1.0.0
+        uses: labd/gh-actions-typescript/pnpm-install@a43f95146e7e81612083238af16f503de7f614a8 # v1.0.3
         with:
           node-version: ${{ matrix.node }}
 
@@ -78,12 +78,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Node.js
-        uses: labd/gh-actions-typescript/pnpm-install@4d7a6c7088328753fdbacbb9204aae4e2b9b00e2 # 1.0.0
+        uses: labd/gh-actions-typescript/pnpm-install@a43f95146e7e81612083238af16f503de7f614a8 # v1.0.3
         with:
           node-version: 24.x
 
@@ -94,7 +94,7 @@ jobs:
         run: npm i -g npm@11.12.1
 
       - name: Create and publish versions
-        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
         with:
           title: "Release new version"
           commit: "update version"

.github/workflows/security.yaml

@@ -0,0 +1,38 @@
+name: Security Checks
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+
+permissions: {}
+
+jobs:
+  workflows:
+    # Only run on pull requests from the same repository
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Pin actions
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
+        with:
+          skip_push: true
+          verify: true
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false
+          annotations: true
+          min-severity: high

package.json

@@ -41,14 +41,14 @@
 		"next": ">=13.1"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "2.4.12",
-		"@changesets/cli": "2.30.0",
-		"@types/node": "22.15.3",
-		"@vitest/coverage-v8": "3.2.3",
-		"next": "15.5.15",
-		"tsdown": "0.12.5",
-		"typescript": "6.0.2",
-		"vitest": "3.2.3"
+		"@biomejs/biome": "2.5.15",
+		"@changesets/cli": "3.0.3",
+		"@types/node": "26.6.4",
+		"@vitest/coverage-v8": "5.0.3",
+		"next": "16.4.0",
+		"tsdown": "0.23.0",
+		"typescript": "7.0.2",
+		"vitest": "5.0.3"
 	},
-	"packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319"
+	"packageManager": "pnpm@12.13.0+sha512.1e55719bf26e809dce5c5084fdebaa64efb3da9038ae5d68a9f8a68311f1a45841c8c3b76a37298c3b66f6bcc80409a9b7f33c78a7168a3e90fb65a5d8235ae4"
 }