From 71f3b55ffd8f44fff6c7d846328a7f62a1d7a18a Mon Sep 17 00:00:00 2001
From: Enoch Groot <enochgroot@protonmail.com>
Date: Tue, 22 Sep 2026 16:28:57 +0000
Subject: [PATCH] ci: pin coverage Python/gcovr and align lockfile docs

- Pin coverage job to Python 3.12 and gcovr==8.6
- Record package 3.4.0 in package-lock.json
- Name package-lock.json instead of a missing shrinkwrap in SECURITY.md
---
 .github/workflows/ci.yml | 5 ++---
 SECURITY.md              | 2 +-
 package-lock.json        | 4 ++--
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b4d86f1..ec70e59 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,10 +35,9 @@ jobs:
           node-version: 22
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          python-version: '3.x'
+          python-version: '3.12'
       - name: Install gcovr
-        run: |
-          gcovr --version || pip install --upgrade gcovr
+        run: pip install gcovr==8.6
       - name: Install dependencies
         run: npm ci
       # Fails the job when JS or native coverage drops below 95%.
diff --git a/SECURITY.md b/SECURITY.md
index ba18399..e7db3a7 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -76,7 +76,7 @@ that cap throws `msgpack pack limit exceeded` without walking the holes.
 The pins below are inventory, not a calendar SLA:
 
 - msgpack-c **c-7.0.2** (`e17beb371b59459a13b48e166a11e123bda5bf93`)
-- NAN **2.28.0** (compile-in; exact in `package.json` / shrinkwrap)
+- NAN **2.28.0** (compile-in; exact in `package.json` + `package-lock.json`)
 
 Risk-based window:
 
diff --git a/package-lock.json b/package-lock.json
index 70b689f..bd73cf9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "msgpack",
-  "version": "3.3.0",
+  "version": "3.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "msgpack",
-      "version": "3.3.0",
+      "version": "3.4.0",
       "license": "BSD-3-Clause",
       "dependencies": {
         "nan": "2.28.0"