chore(deps): refresh toolchain and actions

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: pnpm/action-setup@v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@v7
         with:
           node-version: 26

.github/workflows/codeql.yml

@@ -66,13 +66,13 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/init@9e3211c9a3b9311dfe05da2ed48eea3386f042dd # v4.37.6
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ matrix.config_file }}
 
       - name: Analyze
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/analyze@9e3211c9a3b9311dfe05da2ed48eea3386f042dd # v4.37.6
         with:
           category: "/codeql/${{ matrix.category }}"

.github/workflows/crabbox-hydrate.yml

@@ -42,7 +42,7 @@ jobs:
         with:
           ref: ${{ inputs.ref || github.ref }}
 
-      - uses: pnpm/action-setup@v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@v7
         with:

.github/workflows/release.yml

@@ -60,7 +60,7 @@ jobs:
           fi
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Set up Node
         uses: actions/setup-node@v7

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 - Reworked the README around a verified install and quickstart path, with deeper command, mapper, provider, and safety details linked to the existing docs.
 - Updated transitive Vitest dependencies.
+- Updated pnpm, formatter and linter tooling, and GitHub Actions dependencies.
 
 ## 0.7.2 - 2026-08-01
 

package.json

@@ -37,13 +37,13 @@
   "devDependencies": {
     "@types/node": "^26.1.2",
     "@types/proper-lockfile": "^4.1.4",
-    "oxfmt": "^0.61.0",
-    "oxlint": "^1.76.0",
+    "oxfmt": "^0.62.0",
+    "oxlint": "^1.77.0",
     "typescript": "^7.0.2",
     "vitest": "^4.1.10"
   },
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "pnpm@11.18.0"
+  "packageManager": "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee"
 }

src/findings.ts

@@ -90,15 +90,13 @@ type CanonicalEvidenceRef = {
 function canonicalEvidence(finding: ReviewOutput["findings"][number]["evidence"]): string {
   return JSON.stringify(
     finding
-      .map(
-        (evidence): CanonicalEvidenceRef => ({
-          path: evidence.path,
-          startLine: evidence.startLine,
-          endLine: evidence.endLine,
-          symbol: evidence.symbol,
-          quote: evidence.quote,
-        }),
-      )
+      .map((evidence): CanonicalEvidenceRef => ({
+        path: evidence.path,
+        startLine: evidence.startLine,
+        endLine: evidence.endLine,
+        symbol: evidence.symbol,
+        quote: evidence.quote,
+      }))
       .toSorted(compareCanonicalEvidence),
   );
 }

src/registry-verifier.ts

@@ -179,12 +179,11 @@ export async function verifyPackageSpec(
   // already returns a verdict, but a future refactor or a rogue
   // `fetchImpl` that throws a non-Error (e.g. a Symbol or null) would
   // otherwise poison the cache with a permanently-rejected promise.
-  const verdictPromise = resolveVerdict(spec, options).catch(
-    (error: unknown): RegistryVerdict =>
-      unknownVerdict(
-        spec,
-        error instanceof Error ? `${error.name}: ${error.message}` : String(error),
-      ),
+  const verdictPromise = resolveVerdict(spec, options).catch((error: unknown): RegistryVerdict =>
+    unknownVerdict(
+      spec,
+      error instanceof Error ? `${error.name}: ${error.message}` : String(error),
+    ),
   );
   if (cache) {
     cache.set(cacheKey, verdictPromise);