[fiws]

Resolves 14 of the 15 open Dependabot alerts and moves all workflows to the current major versions of their actions. The Node.js 20 deprecation warnings in CI go away as a result.

All alerts are in dev dependencies (vite/vitest, typedoc, ts-morph); none affect the published package.

Dependencies

Package	Before	After	Alerts
vite (direct)	8.3.0	8.3.6	#47, #48, #49, #53, #54, #57
vitest (direct)	5.0.1	5.1.0	brings @vitest/mocker 5.1.0: #55, #56
markdown-it (via typedoc)	14.3.0	14.3.3	#42, #50, #51, #52
source-map-js (via postcss/vite)	1.2.1	1.2.2	#46
brace-expansion (via minimatch)	5.0.9	5.0.12	#45

vite is 8.3.6 rather than the latest 8.3.7: 8.3.7 and its rolldown 1.2.18 were published today, so the repo's pnpm minimumReleaseAge policy rejects them. 8.3.6 already contains every fix.

Not fixed: minimatch (#58, medium)

The fix is only in minimatch 11, which removes APIs. typedoc 0.28.20 (latest) calls Minimatch#matchOne, removed in 11, on every entry point; I tried a pnpm override and typedoc crashes in discoverFiles before generating docs. Upstream tracks this in TypeStrong/typedoc#3150.

Overriding only ts-morph's copy works (pnpm coverage passes), but it would not close the alert, because typedoc's copy stays on 10.2.6. I left it out instead of adding an override that changes nothing for the alert.

Risk is low: the advisory needs an attacker-controlled glob pattern and optimizationLevel >= 2. minimatch defaults to 1, and the only patterns here are the repo's own typedoc.json entry points and scripts/coverage.ts globs. The alert can be closed once typedoc supports minimatch 11.

Workflows

Action	Before	After
actions/checkout	v4	v7
actions/setup-node	v4 / v6	v7
pnpm/action-setup	v4	v6
actions/configure-pages	v5	v6
actions/upload-pages-artifact	v3	v5
actions/deploy-pages	v4	v5

Breaking changes in these releases, checked against our usage:

• Node 24 runtime (checkout v5, setup-node v5, action-setup v5, configure-pages v6): needs runner ≥ 2.327.1; GitHub-hosted ubuntu-latest (now Ubuntu 26.04) qualifies.
• setup-node v5 automatic caching only applies when packageManager is npm; ours is pnpm@11.5.1, so nothing changes. Caching stays explicit (cache: pnpm) in CI, preview, and docs, and stays off in publish.yml, which setup-node recommends for workflows with elevated privileges.
• setup-node v7 no longer exports a dummy NODE_AUTH_TOKEN. publish.yml uses OIDC trusted publishing and never set a token, so this removes a placeholder that could clash with OIDC.
• checkout v7 blocks fork PR checkouts in pull_request_target/workflow_run; we use neither.
• upload-pages-artifact v4 no longer uploads dotfiles, which drops typedoc's .nojekyll. Pages is configured as build_type: workflow, so Jekyll never runs and the file isn't needed.
• action-setup v6 adds pnpm 11 support, matching our packageManager.

Also removed a stray blank line in ci.yml.

Verification

• actionlint passes on all workflows.
• Locally: pnpm install --frozen-lockfile, biome ci, type-check, check-doc-examples, pnpm test (111 tests), test:playwright, build, generate-docs pass.
• CI on this PR exercises the new checkout/pnpm/setup-node actions. docs.yml and publish.yml only run on main and on tags, so their Pages and publish steps first run after merge and on the next release.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/effect-playwright@c2da2a2

commit: c2da2a2