chore(deps): batch the open dependabot bumps (#156)

* ci(deps): bump pinned action SHAs

harden-runner v2.19.4 -> v2.20.0, checkout v7.0.0 -> v7.0.1, setup-node
v6.4.0 -> v7.0.0, scorecard-action v2.4.3 -> v2.4.4, and the three
codeql-action entry points (init, analyze, upload-sarif) onto their
shared v4 release SHA.

The composite action under .github/actions/setup still pins setup-node
v6.1.0; dependabot did not include it in the group.

* chore(deps): bump npm dependencies

biome 2.5.5 -> 2.5.6, turbo ^2.9.18 -> ^2.10.8, ora ^9.0.0 -> ^9.4.1,
fast-check ^4.5.2 -> ^4.9.0, chalk ^5.6.2 -> ^6.0.0.

chalk 6 requires Node 22, so builder and cli raise their engines floor
from >=20. Node 20 left maintenance in April 2026 and the simulator
already required 22.

biome 2.5.6 renames the linter rules key from recommended to preset, so
biome.json is migrated along with its schema URL. The lockfile was
regenerated once against the bumped ranges rather than merging the five
per-PR lockfiles.

Author: 0xisk

.github/workflows/checks.yml

@@ -17,12 +17,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - name: Check out code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2 # Recommended by turbo team
 

.github/workflows/codeql.yml

@@ -25,12 +25,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - name: Check out code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
@@ -40,13 +40,13 @@ jobs:
           skip-compact: "true"
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
         with:
           languages: ${{ matrix.language }}
           # We can add custom queries later when needed
           # queries: security-extended
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/release-publish.yml

@@ -45,7 +45,7 @@ jobs:
       # The compact-npm-prod environment approval is the security gate, not the
       # branch ref.
       - name: Check out target ref
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.merge_commit_sha || github.ref }}
@@ -130,7 +130,7 @@ jobs:
           } >> $GITHUB_STEP_SUMMARY
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".nvmrc"
           package-manager-cache: false # Prevent cache poisoning issues

.github/workflows/release.yml

@@ -70,7 +70,7 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Check out code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ steps.gh-app-token.outputs.token }}

.github/workflows/scorecard.yml

@@ -30,15 +30,15 @@ jobs:
       # actions: read
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: audit
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a  # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc  # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -52,6 +52,6 @@ jobs:
           path: results.sarif
           retention-days: 5
       - name: Upload SARIF to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4
         with:
           sarif_file: results.sarif

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.5/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.6/schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",
@@ -34,7 +34,7 @@
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "a11y": {},
       "correctness": {
         "noUnusedVariables": "error",

package.json

@@ -16,10 +16,10 @@
     "clean": "turbo run clean"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.5",
+    "@biomejs/biome": "2.5.6",
     "@types/node": "26.1.2",
     "ts-node": "^10.9.2",
-    "turbo": "^2.9.18",
+    "turbo": "^2.10.8",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9"
   }

packages/builder/package.json

@@ -31,7 +31,7 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "scripts": {
     "build": "tsc -p .",
@@ -47,9 +47,9 @@
     "vitest": "^4.1.9"
   },
   "dependencies": {
-    "chalk": "^5.6.2",
+    "chalk": "^6.0.0",
     "log-symbols": "^7.0.0",
-    "ora": "^9.0.0",
+    "ora": "^9.4.1",
     "shell-quote": "^1.10.0"
   }
 }

packages/cli/package.json

@@ -27,7 +27,7 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "bin": {
     "compact-builder": "dist/runBuilder.js",
@@ -47,7 +47,7 @@
   },
   "dependencies": {
     "@openzeppelin/compact-builder": "workspace:^",
-    "chalk": "^5.6.2",
-    "ora": "^9.0.0"
+    "chalk": "^6.0.0",
+    "ora": "^9.4.1"
   }
 }

packages/simulator/package.json

@@ -49,7 +49,7 @@
     "@noble/hashes": "^2.2.0",
     "@tsconfig/node24": "^24.0.3",
     "@types/node": "26.1.2",
-    "fast-check": "^4.5.2",
+    "fast-check": "^4.9.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9"
   },