* Fix release tag push and pin actions by SHA (#335)
The release workflow's tag push was rejected by the tag ruleset because
actions/checkout persisted GITHUB_TOKEN credentials, which took precedence
over the dd-octo-sts token in the explicit push URL. Drop the persisted
credentials and downgrade contents permission to read.
Also pin actions/download-artifact and actions/setup-node by commit SHA.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Specify node-gyp-build to major v4 (#336)
* build(deps-dev): bump @types/node from 25.7.0 to 25.9.1 (#333)
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.7.0 to 25.9.1.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.9.1
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Attila Szegedi <szegedi@users.noreply.github.com>
* v5.14.4
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Christoph Hamsen <37963496+xopham@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Attila Szegedi <szegedi@users.noreply.github.com>