Merge branch 'chore/deps-safe-bumps'

Author: ChanMeng666

.github/workflows/arch-render-selftest.yml

@@ -21,9 +21,9 @@ jobs:
   selftest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20
           cache: npm

.github/workflows/ci.yml

@@ -18,10 +18,10 @@ jobs:
       matrix:
         node: [18, 20, 22]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js ${{ matrix.node }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -97,10 +97,10 @@ jobs:
     # breaks the docs site, the playground, the MCP shim or the VS Code extension
     # used to reach `main` green. This job compiles all four.
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -173,10 +173,10 @@ jobs:
     # `eval:ci` and the benchmark are Linux-only on purpose: the eval is already
     # covered by the matrix above and bench timings are runner-dependent.
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -200,8 +200,8 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20
           cache: npm
@@ -243,10 +243,10 @@ jobs:
     # That class of fault is invisible to `tsc`, vitest and `vite build` alike,
     # which is the whole argument for this leg.
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -327,10 +327,10 @@ jobs:
     # Route lists are derived from docs-site/sync-docs.mjs, so a new page or example
     # extends this job the day it lands.
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           # Node 22, not 18/20: archlive.spec.ts decodes the widget's `#z=` hash with
           # `DecompressionStream("deflate-raw")`, which Node only gained in 21.2.

.github/workflows/codeql.yml

@@ -40,7 +40,7 @@ jobs:
       matrix:
         language: [javascript-typescript]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9

.github/workflows/deploy.yml

@@ -56,9 +56,9 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm

.github/workflows/eval-g1.yml

@@ -33,10 +33,10 @@ jobs:
       # referencing the secret directly in an `if:` expression.
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm

.github/workflows/eval-l2.yml

@@ -56,10 +56,10 @@ jobs:
       # referencing the secret directly in an `if:` expression.
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm

.github/workflows/eval-live.yml

@@ -42,10 +42,10 @@ jobs:
       # referencing the secret directly in an `if:` expression.
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm

.github/workflows/nightly.yml

@@ -36,9 +36,9 @@ jobs:
     name: Production smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
 
@@ -61,9 +61,9 @@ jobs:
       status: ${{ steps.audit.outputs.status }}
       report: ${{ steps.audit.outputs.report }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -117,7 +117,7 @@ jobs:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -148,9 +148,9 @@ jobs:
           - os: windows-latest
             node: 22
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -188,10 +188,10 @@ jobs:
     name: E2E against production (read-only)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           # Node 22, matching ci.yml's e2e-docs leg: archlive.spec.ts imports the
           # playground's `#z=` decoder, which needs `DecompressionStream("deflate-raw")`

.github/workflows/release.yml

@@ -26,7 +26,7 @@
 #   description). NOTE: the MCP registry is in public preview and may reset data / change
 #   behaviour; this step is kept strict (fails loudly) so a regression surfaces here.
 #
-# House style mirrors ci.yml / deploy.yml (actions/checkout@v5, actions/setup-node@v5).
+# House style mirrors ci.yml / deploy.yml (actions/checkout@v7.0.1, actions/setup-node@v7.0.0).
 
 name: Release (npm + MCP registry via OIDC)
 
@@ -44,10 +44,10 @@ jobs:
     name: Publish (npm + MCP registry)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           registry-url: 'https://registry.npmjs.org' # required for OIDC token exchange

CHANGELOG.md

@@ -137,6 +137,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   room boundary**, so a relationally-laid plan gets rooms that reflow or interior partitions, never
   both. Both edits are comment-only and change no byte of either drawing.
 
+### Security
+
+- **Twelve transitive advisories cleared, lockfile-only** (backlog 3.1 (a)) — `npm audit` goes
+  **19 vulnerabilities (2 critical, 9 high, 8 moderate) → 7 (2 critical, 1 high, 4 moderate)** with
+  no manifest change and no `--force`: `@hono/node-server`, `brace-expansion`, `dompurify`,
+  `fast-uri`, `hono`, `ip-address`, `js-yaml`, `linkify-it`, `nanoid`, `postcss`, `qs` and `undici`,
+  every one a patch or minor. **No output byte moved** — `describe()`, `lint()` and every storey's
+  SVG across all 30 shipped examples (95 artifacts) are SHA-256 identical before and after, with the
+  sweep proved able to fail first. `hono`/`@hono/node-server` reach the tree only through
+  `@modelcontextprotocol/sdk`; `packages/mcp`'s own manifest is byte-unchanged, so **no shim version
+  bump is due** — and those code paths are unreachable anyway, the shim being stdio-only.
+
+  The seven that remain are recorded in `docs/backlog.md` 3.1 with why, and one of those reasons is a
+  correction: **the `vitest` 5 major will not clear the `esbuild` advisory.** It has two nodes, and
+  the one npm's `fixAvailable` does not name is **tsup's** `esbuild@0.27.7` — `tsup@8.5.1` pins
+  `esbuild ^0.27.0` and cannot reach the fixed `0.28.1`. Both `esbuild` advisories are against
+  `esbuild serve`, a dev server tsup never starts.
+
+### Changed
+
+- **GitHub Action pins bumped, still SHA-pinned** (backlog 3.2, superseding dependabot #60 and #23):
+  `actions/checkout` v7.0.0 → **v7.0.1** (`3d3c42e5aac5ba805825da76410c181273ba90b1`, 18 sites) and
+  `actions/setup-node` v6.4.0 → **v7.0.0** (`820762786026740c76f36085b0efc47a31fe5020`, 16 sites).
+  Each SHA was resolved from GitHub's own tag ref rather than taken from the bot; both tags are
+  lightweight, so neither needed peeling. **`setup-node` is a MAJOR and nothing here is affected**:
+  its `action.yml` diff is purely additive (two new cache outputs), `runs.using` stays `node24`, no
+  workflow reads `NODE_AUTH_TOKEN` or uses `mirror`, and the root `package.json` declares no
+  `packageManager`/`devEngines`, so v7's automatic package-manager caching cannot switch itself on
+  where a step deliberately omits `cache: npm`. Its "remove dummy `NODE_AUTH_TOKEN` export" fix is a
+  net positive for `release.yml`'s OIDC publish. Also `@fontsource/ibm-plex-mono` `^5.2.7` → `^5.3.0`
+  in both site workspaces (dependabot #25), and a stale house-style comment in `release.yml` that
+  still named `actions/checkout@v5` / `actions/setup-node@v5` now names what is pinned.
+
 ### Documentation
 
 - **New backlog items G.12 and G.13.** G.12 is the language gap behind `relational.arch`’s four