build(deps): consolidate 8 dependabot bumps post history-rewrite

.github/workflows/pages.yml

@@ -22,7 +22,7 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac  # v2.4.4
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151  # v4.0.1
       # NOTE: --ignore-scripts removed so sharp's native binary download
       # and Playwright's chromium install (via rehype-mermaid) are allowed.
       - run: pnpm install --frozen-lockfile

.github/workflows/pre-release-gate.yml

@@ -45,7 +45,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac  # v2.4.4
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151  # v4.0.1
       - name: Run pnpm audit at high+ severity
         run: pnpm audit --audit-level=high --prod
 
@@ -57,7 +57,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac  # v2.4.4
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151  # v4.0.1
       # Frozen + ignore-scripts is the strictest install path: any lockfile
       # drift, missing entry, or sneaky postinstall fails the job.
       - name: Install with frozen lockfile and no lifecycle scripts
@@ -100,7 +100,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac  # v2.4.4
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151  # v4.0.1
       - run: pnpm install --frozen-lockfile --ignore-scripts
       - name: license allowlist
         run: >

.github/workflows/release.yml

@@ -120,7 +120,7 @@ jobs:
           persist-credentials: false
 
       - name: Provision toolchain (mise)
-        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac  # v2.4.4
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151  # v4.0.1
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -240,13 +240,13 @@ jobs:
       contents: write       # required to upload .sig.bundle to the release
     steps:
       - name: Download artifact bundle
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: release-artifacts
           path: artifacts/
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@1aa8e0f2454b781fbf0fbf306a4c9533a0c57409  # v3.7.0
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da  # v3.7.0
         with:
           cosign-release: "v2.4.1"
 
@@ -306,7 +306,7 @@ jobs:
       security-events: write
     steps:
       - name: Download artifact bundle
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: release-artifacts
           path: artifacts/
@@ -347,7 +347,7 @@ jobs:
         with:
           ref: ${{ needs.resolve.outputs.sha }}
           persist-credentials: false
-      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac  # v2.4.4
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151  # v4.0.1
       - run: pnpm install --frozen-lockfile
       - run: pnpm --filter '!@opencodehub/docs' -r build
       - name: Publish (dry-run)

package.json

@@ -24,7 +24,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.14",
-    "@commitlint/cli": "20.5.3",
+    "@commitlint/cli": "21.0.0",
     "@commitlint/config-conventional": "20.5.3",
     "@types/node": "25.6.0",
     "commitizen": "4.3.1",

packages/analysis/package.json

@@ -24,10 +24,10 @@
     "@opencodehub/sarif": "workspace:*",
     "@opencodehub/storage": "workspace:*",
     "@opencodehub/wiki": "workspace:*",
-    "write-file-atomic": "7.0.1"
+    "write-file-atomic": "8.0.0"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "@types/write-file-atomic": "4.0.3",
     "typescript": "6.0.3"
   }

packages/cli/package.json

@@ -33,11 +33,11 @@
     "commander": "14.0.3",
     "envinfo": "7.21.0",
     "listr2": "10.2.1",
-    "write-file-atomic": "7.0.1",
+    "write-file-atomic": "8.0.0",
     "yaml": "2.8.4"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "@types/write-file-atomic": "4.0.3",
     "typescript": "6.0.3"
   }

packages/cobol-proleap/package.json

@@ -26,7 +26,7 @@
     "@opencodehub/ingestion": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/core-types/package.json

@@ -21,7 +21,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/embedder/package.json

@@ -21,13 +21,13 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@aws-sdk/client-sagemaker-runtime": "3.1043.0",
+    "@aws-sdk/client-sagemaker-runtime": "3.1045.0",
     "@huggingface/tokenizers": "0.1.3",
     "@opencodehub/core-types": "workspace:*",
-    "onnxruntime-node": "1.25.1"
+    "onnxruntime-node": "1.26.0"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/frameworks/package.json

@@ -25,7 +25,7 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/ingestion/package.json

@@ -22,7 +22,7 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@aws-sdk/client-bedrock-runtime": "3.1043.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1045.0",
     "@cyclonedx/cyclonedx-library": "10.0.0",
     "@graphty/algorithms": "1.7.1",
     "@iarna/toml": "2.2.5",
@@ -55,10 +55,10 @@
     "tree-sitter-swift": "0.7.1",
     "tree-sitter-typescript": "0.23.2",
     "web-tree-sitter": "0.26.8",
-    "write-file-atomic": "7.0.1"
+    "write-file-atomic": "8.0.0"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "@types/spdx-correct": "^3.1.3",
     "@types/write-file-atomic": "4.0.3",
     "ajv": "8.20.0",

packages/mcp/package.json

@@ -32,7 +32,7 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/pack/package.json

@@ -29,7 +29,7 @@
     "@opencodehub/storage": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/policy/package.json

@@ -25,7 +25,7 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/sarif/package.json

@@ -28,7 +28,7 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/scanners/package.json

@@ -22,7 +22,7 @@
     "@opencodehub/sarif": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/scip-ingest/package.json

@@ -27,7 +27,7 @@
     "@opencodehub/core-types": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/search/package.json

@@ -23,7 +23,7 @@
     "@opencodehub/storage": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/storage/package.json

@@ -28,7 +28,7 @@
     "@opencodehub/core-types": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/summarizer/package.json

@@ -22,11 +22,11 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@aws-sdk/client-bedrock-runtime": "3.1043.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1045.0",
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "typescript": "6.0.3"
   }
 }

packages/wiki/package.json

@@ -19,14 +19,14 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@aws-sdk/client-bedrock-runtime": "3.1043.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1045.0",
     "@opencodehub/core-types": "workspace:*",
     "@opencodehub/storage": "workspace:*",
     "@opencodehub/summarizer": "workspace:*",
-    "write-file-atomic": "7.0.1"
+    "write-file-atomic": "8.0.0"
   },
   "devDependencies": {
-    "@types/node": "25.6.0",
+    "@types/node": "25.6.2",
     "@types/write-file-atomic": "4.0.3",
     "typescript": "6.0.3"
   }