security: harden supply-chain and CI configuration

.github/actions/ci/action.yaml

@@ -7,7 +7,7 @@ runs:
     - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
       with:
         run_install: false
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         cache: pnpm
         cache-dependency-path: ./pnpm-lock.yaml
@@ -17,5 +17,5 @@ runs:
       shell: bash
     - run: pnpm fmt:check
       shell: bash
-    - run: npx turbo run lint test type-check
+    - run: pnpm exec turbo run lint test type-check
       shell: bash

.github/workflows/ci-packages.yaml

@@ -17,7 +17,8 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 2
+          persist-credentials: false
       - uses: ./.github/actions/ci

.github/workflows/copilot-setup-steps.yml

@@ -26,13 +26,15 @@ jobs:
     # If you do not check out your code, Copilot will do this for you.
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Enable pnpm via corepack
         run: corepack enable
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: "./package.json"
           cache: "pnpm"

.github/workflows/dependabot-changeset.yaml

@@ -13,7 +13,8 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: IzumiSy/deps2changesets@main

.github/workflows/doc-check.yaml

@@ -11,10 +11,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Check links in docs
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@82202e5e9c2f4ef1a55a3d02563e1cb6041e5332 # v2.4.1
         with:
           args: |
             --no-progress

.github/workflows/pkg-pr-new.yaml

@@ -16,11 +16,13 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           cache: pnpm
           cache-dependency-path: ./pnpm-lock.yaml

.github/workflows/release.yaml

@@ -16,14 +16,14 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         with:
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          cache: pnpm
-          cache-dependency-path: ./pnpm-lock.yaml
           node-version-file: "./package.json"
       - run: pnpm install
       - uses: changesets/action@06245a4e0a36c064a573d4150030f5ec548e4fcc # v1.4.10

package.json

@@ -21,5 +21,5 @@
   "engines": {
     "node": "24.x"
   },
-  "packageManager": "pnpm@10.24.0"
+  "packageManager": "pnpm@11.1.2"
 }

packages/core/package.json

@@ -60,8 +60,6 @@
     "graphql": "^16.14.0",
     "lucide-react": "^1.8.0",
     "papaparse": "^5.5.3",
-    "react": "^19.2.5",
-    "react-dom": "^19.2.5",
     "react-hook-form": "^7.71.2",
     "react-router": "^7.14.1",
     "sonner": "^2.0.7",
@@ -79,6 +77,8 @@
     "@vitejs/plugin-react": "catalog:",
     "happy-dom": "^20.6.2",
     "postcss": "^8",
+    "react": "^19.2.5",
+    "react-dom": "^19.2.5",
     "tailwindcss": "catalog:",
     "tw-animate-css": "^1.4.0",
     "typescript": "^5",