build(deps): refresh review tooling and security scanners

.github/workflows/codeql.yml

@@ -66,13 +66,13 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ matrix.config_file }}
 
       - name: Analyze
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: "/codeql/${{ matrix.category }}"

.github/workflows/crabbox-hydrate.yml

@@ -44,7 +44,7 @@ jobs:
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
-          version: 11.27.1
+          version: 11.28.0
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/secret-scan.yml

@@ -47,10 +47,10 @@ jobs:
           echo "head=$head" >> "$GITHUB_OUTPUT"
 
       - name: Scan with TruffleHog
-        uses: trufflesecurity/trufflehog@f714bf454f350590f4a24c3ddb1aef02c35bf5b6 # v3.97.5
+        uses: trufflesecurity/trufflehog@4dd8831c5f12599465d4d45c3c447b4018a34c85 # v3.97.9
         with:
           path: ./
           base: ${{ steps.scan-range.outputs.base }}
           head: ${{ steps.scan-range.outputs.head }}
-          version: "3.97.5"
+          version: "3.97.9"
           extra_args: --only-verified --debug

AGENTS.md

@@ -10,7 +10,7 @@ User documentation is in `docs/`; the static website assets are in `website/`.
 
 ## Build, Test, and Development Commands
 
-Use pnpm with Node 22.x (22.12+), 24.x, or 26+ for Vitest 5 development. The published
+Use pnpm with Node 22.x (22.13+), 24.x, or 26+ for pnpm 11 and Vitest 5 development. The published
 CLI continues to support Node 22 or newer.
 Keep `@types/node` on the Node 22 major to typecheck against that runtime floor.
 

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 0.8.2 - Unreleased
 
+- Updated Vitest and V8 coverage to 5.0.2, pnpm to 11.28.0, CodeQL to 4.38.2, and both the TruffleHog action and scanner to 3.97.9, thanks @dependabot[bot].
 - Fixed non-Git patch audits to retain symlink edits and literal backslashes in Unix filenames without reading linked targets.
 - Fixed diff-scoped review, CI, and revalidation to include both paths of committed renames, preventing features mapped to the old path from being silently skipped.
 

README.md

@@ -97,7 +97,7 @@ pnpm build
 pnpm pack:smoke
 ```
 
-Use Node.js 22.x (22.12+), 24.x, or 26+ and the pnpm version declared in `package.json`
+Use Node.js 22.x (22.13+), 24.x, or 26+ and the pnpm version declared in `package.json`
 for development with Vitest 5. CI tests Node.js 22, 24, and 26; the published CLI
 continues to support Node.js 22 or newer. `pnpm test:coverage` runs the full suite
 with V8 coverage, prints a text report, and writes JSON summary and HTML reports

package.json

@@ -52,5 +52,5 @@
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "pnpm@11.27.1+sha512.a81d4c21b9b09a4b0aebf90ef5e527d4262bdda322d26082978cb549023ac6d9cafc98b19fffaa5c71db438a65f70224edb78d7311187861ff96480d1cdca23c"
+  "packageManager": "pnpm@11.28.0+sha512.8ed239371de82244b6cccf9e2023c18ea8439961f2ec3fe898913b9f7ee2e76ca0a45717580aca3c7997c135f6d4f5de4524cbeee1a2ccac430c03d134e2a48c"
 }