From 8b6a4cfd45ffd046e8d6700bf6cc40115015d617 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 16:01:30 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/actiond-production.yaml | 8 ++++----
 .github/workflows/local-linux.yaml        | 8 ++++----
 .github/workflows/release-please.yml      | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/actiond-production.yaml b/.github/workflows/actiond-production.yaml
index c8d001a..a3b132a 100644
--- a/.github/workflows/actiond-production.yaml
+++ b/.github/workflows/actiond-production.yaml
@@ -17,10 +17,10 @@ jobs:
     env:
       USE_BAZEL_VERSION: '9.2.0'
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
-          node-version: '24'
+          node-version: '24.22.1'
       - uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
         with:
           bazelisk-cache: true
@@ -63,7 +63,7 @@ jobs:
           bazelisk run --script_path="$PWD/.web-e2e/run" @rules_web_e2e//worker:runner
           .web-e2e/run --bazel=bazelisk doctor
           .web-e2e/run --bazel=bazelisk test //:e2e_test //:component_test //:native_config_test //:visual_test //:component_visual_test //:native_visual_test
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: actiond-production-vrt
diff --git a/.github/workflows/local-linux.yaml b/.github/workflows/local-linux.yaml
index 44ff881..3b9c560 100644
--- a/.github/workflows/local-linux.yaml
+++ b/.github/workflows/local-linux.yaml
@@ -28,10 +28,10 @@ jobs:
       LOCAL_HOST_SENTINEL: must-not-reach-browser
       LOCAL_BROWSER_CACHE_CONFIGURED: '1'
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
-          node-version: '24'
+          node-version: '24.22.1'
       - uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
         with:
           bazelisk-cache: true
@@ -44,7 +44,7 @@ jobs:
           fi
       - name: Test local E2E, components, video, VRT, lifecycle, and caching
         run: node e2e-tests/run.ts local "$RUNNER_TEMP/local-browser"
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: local-browser-${{ matrix.os }}-${{ matrix.bazel }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 83cca65..e9fb160 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
           # A PAT is required so created tags trigger module-release.
           token: ${{ secrets.GH_RELEASE_TOKEN }}