fix(deps): pin dependencies

Author: renovate[bot]

.github/workflows/bump-versions-and-tag.yml

@@ -18,18 +18,18 @@ jobs:
   version_packages:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           # Need custom service user token to allow bypassing default branch protection rules
           # to push a bumped version directly to default branch (master/main)
           token: ${{ secrets.SERVICE_USER_GIT_TOKEN }}
 
       - name: Configure git credentials
-        uses: OleksiyRudenko/gha-git-credentials@v2
+        uses: OleksiyRudenko/gha-git-credentials@6132cfce45156e2c1562673f9be1a91a575ce879 # v2
         with:
           token: ${{ secrets.SERVICE_USER_GIT_TOKEN }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24.x"
 

.github/workflows/ci.yml

@@ -21,8 +21,8 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node_version }}
           cache: 'npm'

.github/workflows/commitlint.yml

@@ -14,8 +14,8 @@ jobs:
   commitlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: wagoid/commitlint-github-action@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6
         with:
           # https://github.com/wagoid/commitlint-github-action?tab=readme-ov-file#commitdepth
           commitDepth: '1'

.github/workflows/release.yml

@@ -13,8 +13,8 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '24.x'
           # This `registry-url` resolves an issue with lerna publishing:
@@ -37,6 +37,6 @@ jobs:
         run: node ./scripts/extract-last-ver-changelog.mjs
 
       - name: Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
         with:
           body_path: last-ver-changelog.txt