chore(deps): update toolchain and security actions (#174)

* chore(deps): update development toolchain

* ci(deps): update security actions

* ci: use manifest pnpm version

Author: steipete

.github/workflows/ci.yml

@@ -15,8 +15,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7.0.1
       - uses: pnpm/action-setup@v6
-        with:
-          version: 11.1.2
       - uses: actions/setup-node@v7
         with:
           node-version: 26

.github/workflows/codeql.yml

@@ -66,13 +66,13 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ matrix.config_file }}
 
       - name: Analyze
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
         with:
           category: "/codeql/${{ matrix.category }}"

.github/workflows/crabbox-hydrate.yml

@@ -31,7 +31,6 @@ permissions:
 
 env:
   NODE_VERSION: "24"
-  PNPM_VERSION: "11.1.2"
 
 jobs:
   hydrate:
@@ -44,8 +43,6 @@ jobs:
           ref: ${{ inputs.ref || github.ref }}
 
       - uses: pnpm/action-setup@v6.0.9
-        with:
-          version: ${{ env.PNPM_VERSION }}
 
       - uses: actions/setup-node@v7
         with:

.github/workflows/release.yml

@@ -61,8 +61,6 @@ jobs:
 
       - name: Set up pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 11.1.2
 
       - name: Set up Node
         uses: actions/setup-node@v7

.github/workflows/secret-scan.yml

@@ -47,10 +47,10 @@ jobs:
           echo "head=$head" >> "$GITHUB_OUTPUT"
 
       - name: Scan with TruffleHog
-        uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
+        uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.96.0
         with:
           path: ./
           base: ${{ steps.scan-range.outputs.base }}
           head: ${{ steps.scan-range.outputs.head }}
-          version: "3.95.9"
+          version: "3.96.0"
           extra_args: --only-verified --debug

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## 0.7.2 - Unreleased
 
 - Fixed diff-scoped review and CI runs to include changed features regardless of their previous review status, preventing warm-state gates from silently skipping changed code, thanks @youhaowei.
+- Updated pnpm, Node typings, formatter and linter tooling, and security workflow actions.
 - Added Rust seed context for Cargo manifests, paired crate entrypoints, and directly declared modules across crate roots and binary layouts, thanks @Tanmay-008.
 
 ## 0.7.1 - 2026-07-20

package.json

@@ -34,14 +34,14 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
-    "oxfmt": "^0.59.0",
-    "oxlint": "^1.73.0",
+    "@types/node": "^26.1.2",
+    "oxfmt": "^0.61.0",
+    "oxlint": "^1.76.0",
     "typescript": "^7.0.2",
     "vitest": "^4.1.10"
   },
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "pnpm@11.1.2"
+  "packageManager": "pnpm@11.18.0"
 }