update dependencies, tighten CI, update node version

.github/workflows/ci.yml

@@ -10,18 +10,21 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Full Build (node ${{ matrix.node_version }})
     runs-on: ubuntu-latest
     strategy:
       matrix:
         node_version:
-          - 20.x
           - 22.x
+          - 24.x
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node_version }}
 

.github/workflows/codeql-analysis.yml

@@ -38,11 +38,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +53,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -67,4 +67,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3

.github/workflows/commitlint.yml

@@ -12,11 +12,14 @@ on:
       - main
       - gh-pages
 
+permissions:
+  contents: read
+
 jobs:
   commitlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@v6
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6

.github/workflows/release.yml

@@ -4,23 +4,25 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
     # Only gate push events by commit message; allow workflow_dispatch always
     if: >
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish'))
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: lts/*
+          node-version: 24.15.0
 
       - name: Install dependencies
         run: yarn

package.json

@@ -11,8 +11,8 @@
   "scripts": {
     "release:version": "lerna version",
     "release:version-simulate": "lerna version --no-push --no-git-tag-version",
-    "release:publish": "lerna publish from-git --yes --no-verify-access",
-    "release:publish-manual": "lerna publish from-package --yes --no-verify-access",
+    "release:publish": "lerna publish from-git --yes --no-verify-access --provenance",
+    "release:publish-manual": "lerna publish from-package --yes --no-verify-access --provenance",
     "build": "lerna run build",
     "preci": "lerna run build",
     "ci": "npm-run-all format:validate ci:subpackages",
@@ -26,14 +26,14 @@
     "ncu-u": "ncu -ws --root -u"
   },
   "devDependencies": {
-    "@commitlint/cli": "20.1.0",
-    "@commitlint/config-conventional": "20.0.0",
-    "chai": "6.2.0",
+    "@commitlint/cli": "20.5.3",
+    "@commitlint/config-conventional": "20.5.3",
+    "chai": "6.2.2",
     "cz-conventional-changelog": "3.3.0",
     "husky": "9.1.7",
-    "lerna": "9.0.0",
-    "lint-staged": "16.2.4",
-    "mocha": "11.7.4",
+    "lerna": "9.0.7",
+    "lint-staged": "16.4.0",
+    "mocha": "11.7.5",
     "npm-run-all": "4.1.5",
     "prettier": "3.6.2",
     "shx": "0.4.0",

packages/dts-generator/api-report/dts-generator.api.md

@@ -66,7 +66,7 @@ export interface Directives {
 export function downloadApiJson(libs: string[], version: string, targetDir?: string): Promise<void>;
 
 // @public
-export function generate({ apiFile, dependencyApiFiles, directiveFiles, targetFile, dependencyDTSFilesForCheck, dependenciesTypePackagesForCheck, generateGlobals, runCheckCompile, errorOutputFile, }: GenerateConfig): Promise<boolean>;
+export function generate(input: GenerateConfig): Promise<boolean>;
 
 // @public
 export type GenerateConfig = {

packages/dts-generator/package.json

@@ -27,23 +27,23 @@
     "@ui5/logger": "^4.0.2",
     "argparse": "^2.0.1",
     "es-main": "^1.4.0",
-    "fs-extra": "11.3.2",
-    "lodash": "4.17.21",
+    "fs-extra": "11.3.4",
+    "lodash": "4.18.1",
     "lodash.combinations": "18.11.1",
     "node-fetch": "^3.3.2",
     "prettier": "3.6.2",
-    "resolve": "^1.22.10",
-    "sanitize-html": "2.17.0",
-    "semver": "^7.7.3",
+    "resolve": "^1.22.12",
+    "sanitize-html": "2.17.3",
+    "semver": "^7.7.4",
     "strip-json-comments": "^5.0.3",
     "typescript": "^5.9.3"
   },
   "devDependencies": {
-    "@microsoft/api-extractor": "^7.53.1",
+    "@microsoft/api-extractor": "^7.58.7",
     "@types/argparse": "^2.0.17",
-    "@types/lodash": "4.17.20",
-    "@types/sanitize-html": "2.16.0",
-    "@types/urijs": "1.19.25",
+    "@types/lodash": "4.17.24",
+    "@types/sanitize-html": "2.16.1",
+    "@types/urijs": "1.19.26",
     "copyfiles": "^2.4.1",
     "del-cli": "^7.0.0",
     "npm-run-all": "^4.1.5"
@@ -65,6 +65,6 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=16.18.0"
+    "node": ">=20.0.0"
   }
 }

packages/ts-interface-generator/package.json

@@ -39,13 +39,13 @@
     "@types/jest": "30.0.0",
     "@types/node": "24.7.2",
     "@types/openui5": "1.127.0",
-    "@types/yargs": "17.0.33",
-    "@typescript-eslint/eslint-plugin": "8.46.1",
-    "@typescript-eslint/parser": "8.46.1",
+    "@types/yargs": "17.0.35",
+    "@typescript-eslint/eslint-plugin": "8.59.1",
+    "@typescript-eslint/parser": "8.59.1",
     "eslint": "9.37.0",
-    "jest": "30.2.0",
+    "jest": "30.3.0",
     "npm-run-all": "4.1.5",
-    "ts-jest": "29.4.5",
+    "ts-jest": "29.4.9",
     "typescript": "5.9.3"
   },
   "dependencies": {

test-packages/typed-json-model/webapp/controller/App.controller.ts

@@ -1,8 +1,8 @@
 import Controller from "sap/ui/core/mvc/Controller";
 import { TypedJSONContext, TypedJSONModel } from "../model/model";
 import { exampleBinding } from "./Example";
-import { List$ItemClickEvent } from "sap/ui/webc/main/List";
 import MessageBox from "sap/m/MessageBox";
+import { ListBase$ItemPressEvent } from "sap/m/ListBase";
 
 type PurchaseOrderId = `PO-${string}`;
 type PurchaseOrderType = "Purchase Order";
@@ -54,7 +54,7 @@ export default class App extends Controller {
   /**
    * Example on how to how to use the typed context
    */
-  onPressItem(event: List$ItemClickEvent): void {
+  onPressItem(event: ListBase$ItemPressEvent): void {
     const context = event.getSource().getBindingContext() as TypedJSONContext<
       { order: PurchaseOrder },
       `/order/items/${number}`