chore(deps): pin dependencies

.github/workflows/build-artifacts.yml

@@ -55,7 +55,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: ${{ inputs.fetch_depth }}
 
@@ -64,7 +64,7 @@ jobs:
         with:
           toolchain: ${{ inputs.toolchain }}
       - name: Rust Cache
-        uses: Swatinem/rust-cache@v2.8.1
+        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
       - name: Install musl toolchain
         if: ${{ inputs.rpm }}
         run: |
@@ -122,7 +122,7 @@ jobs:
 
       - name: Upload artifacts
         if: ${{ inputs.upload_artifact && steps.build.outcome == 'success' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ inputs.artifact_name }}
           path: dist

.github/workflows/ci.yml

@@ -15,13 +15,13 @@ jobs:
     name: Linting and Formatting
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Install rust
         uses: dtolnay/rust-toolchain@master
         with:
           toolchain: stable
       - name: Rust Cache
-        uses: Swatinem/rust-cache@v2.8.1
+        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
       - name: Run cargo clippy to pick up any errors
         run: cargo clippy --all-targets -- -Dwarnings
       - name: Check code is formatted
@@ -90,7 +90,7 @@ jobs:
     needs: build
     steps:
       - name: Download linux artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
         with:
           name: dist-linux
           path: dist-linux

.github/workflows/release.yml

@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   get-next-version:
-    uses: semantic-release-action/next-release-version/.github/workflows/next-release-version.yml@v4
+    uses: semantic-release-action/next-release-version/.github/workflows/next-release-version.yml@0cdefe1224944c23645e5131f7a5189672c0df92 # v4
 
   build-artifacts:
     name: Build ${{ matrix.name }} artifacts
@@ -54,7 +54,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
 
@@ -64,21 +64,21 @@ jobs:
           toolchain: stable
 
       - name: Rust Cache
-        uses: Swatinem/rust-cache@v2.8.1
+        uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
 
       - name: Install semantic-release-cargo
         run: cargo install --locked semantic-release-cargo
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "node"
 
       - name: Install dependencies
         run: npm ci
 
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           pattern: dist-*
           merge-multiple: true

Cargo.toml

@@ -35,7 +35,7 @@ toml = "0.9.0"
 shell-words = "1.1.0"
 
 [dev-dependencies]
-tempfile = "3.19.1"
+tempfile = "=3.19.1"
 
 [package.metadata.generate-rpm]
 assets = [

docs/themes/purehugo/package.json

@@ -1,8 +1,8 @@
 {
   "devDependencies": {
-    "gulp": "^5.0.0",
-    "gulp-concat": "^2.5.2",
-    "gulp-minify-css": "^1.1.0",
-    "gulp-uglify": "^3.0.0"
+    "gulp": "5.0.1",
+    "gulp-concat": "2.6.1",
+    "gulp-minify-css": "1.2.4",
+    "gulp-uglify": "3.0.2"
   }
 }

package.json

@@ -1,8 +1,8 @@
 {
   "devDependencies": {
-    "@semantic-release/commit-analyzer": "^13.0.1",
-    "@semantic-release/exec": "^7.1.0",
-    "@semantic-release/release-notes-generator": "^14.0.3",
-    "semantic-release": "^24.2.5"
+    "@semantic-release/commit-analyzer": "13.0.1",
+    "@semantic-release/exec": "7.1.0",
+    "@semantic-release/release-notes-generator": "14.1.0",
+    "semantic-release": "24.2.9"
   }
 }