chore(deps): pin dependencies

.github/actions/prepare/action.yml

@@ -5,7 +5,7 @@ name: Prepare
 runs:
   steps:
     - uses: pnpm/action-setup@v4
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
       with:
         cache: pnpm
         node-version: "20"

.github/workflows/accessibility-alt-text-bot.yml

@@ -3,7 +3,7 @@ jobs:
     if: ${{ !endsWith(github.actor, '[bot]') }}
     runs-on: ubuntu-latest
     steps:
-      - uses: github/[email protected]
+      - uses: github/accessibility-alt-text-bot@602a5efcf386c52ef8b9a11ead9bfa6ef8d56ba5 # v1.4.0
 
 name: Accessibility Alt Text Bot
 

.github/workflows/ci.yml

@@ -3,44 +3,44 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - uses: ./.github/actions/prepare
       - run: pnpm build
       - run: node ./lib/index.js
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - uses: ./.github/actions/prepare
       - run: pnpm lint
   lint_knip:
     name: Lint Knip
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - uses: ./.github/actions/prepare
       - run: pnpm lint:knip
   prettier:
     name: Prettier
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - uses: ./.github/actions/prepare
       - run: pnpm format --list-different
   test:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - uses: ./.github/actions/prepare
       - run: pnpm run test --coverage
       - uses: codecov/codecov-action@v3
   type_check:
     name: Type Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - uses: ./.github/actions/prepare
       - run: pnpm tsc
 

.github/workflows/contributors.yml

@@ -2,13 +2,13 @@ jobs:
   contributors:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
       - uses: ./.github/actions/prepare
       - env:
           GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN }}
-        uses: JoshuaKGoldberg/[email protected]
+        uses: JoshuaKGoldberg/all-contributors-auto-action@944abe4387e751b5bbb38616cb25cf4a4ca998f2 # v0.5.0
 
 name: Contributors
 

.github/workflows/post-release.yml

@@ -2,11 +2,11 @@ jobs:
   post_release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
       - run: echo "npm_version=$(npm pkg get version | tr -d '"')" >> "$GITHUB_ENV"
-      - uses: apexskier/github-release-commenter@v1
+      - uses: apexskier/github-release-commenter@3bd413ad5e1d603bfe2282f9f06f2bdcec079327 # v1
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           comment-template: |

.github/workflows/pr-review-requested.yml

@@ -2,7 +2,7 @@ jobs:
   pr_review_requested:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions-ecosystem/action-remove-labels@v1
+      - uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1
         with:
           labels: "status: waiting for author"
       - if: failure()

.github/workflows/release.yml

@@ -5,7 +5,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
           ref: main
@@ -14,7 +14,7 @@ jobs:
       - env:
           GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        uses: JoshuaKGoldberg/[email protected]
+        uses: JoshuaKGoldberg/release-it-action@77373cfc2535e21149518381cb09e1c04c6068fe # v0.2.2
 
 name: Release
 

package.json

@@ -31,27 +31,27 @@
 		"*": "prettier --ignore-unknown --write"
 	},
 	"devDependencies": {
-		"@eslint/js": "^9.16.0",
-		"@release-it/conventional-changelog": "^9.0.3",
-		"@types/eslint__js": "^8.42.3",
-		"@types/node": "^22.10.1",
-		"@vitest/coverage-v8": "^2.1.8",
-		"@vitest/eslint-plugin": "^1.1.14",
-		"console-fail-test": "^0.5.0",
-		"eslint": "^9.16.0",
-		"eslint-plugin-n": "^17.14.0",
-		"husky": "^9.1.7",
-		"knip": "^5.39.2",
-		"lint-staged": "^15.2.10",
-		"prettier": "^3.4.2",
-		"prettier-plugin-curly": "^0.3.1",
-		"prettier-plugin-packagejson": "^2.5.6",
-		"prettier-plugin-sh": "^0.14.0",
-		"release-it": "^17.10.0",
-		"tsup": "^8.3.5",
-		"typescript": "^5.7.2",
-		"typescript-eslint": "^8.17.0",
-		"vitest": "^2.1.8"
+		"@eslint/js": "9.16.0",
+		"@release-it/conventional-changelog": "9.0.3",
+		"@types/eslint__js": "8.42.3",
+		"@types/node": "22.10.1",
+		"@vitest/coverage-v8": "2.1.8",
+		"@vitest/eslint-plugin": "1.1.14",
+		"console-fail-test": "0.5.0",
+		"eslint": "9.16.0",
+		"eslint-plugin-n": "17.14.0",
+		"husky": "9.1.7",
+		"knip": "5.39.2",
+		"lint-staged": "15.2.10",
+		"prettier": "3.4.2",
+		"prettier-plugin-curly": "0.3.1",
+		"prettier-plugin-packagejson": "2.5.6",
+		"prettier-plugin-sh": "0.14.0",
+		"release-it": "17.10.0",
+		"tsup": "8.3.5",
+		"typescript": "5.7.2",
+		"typescript-eslint": "8.17.0",
+		"vitest": "2.1.8"
 	},
 	"packageManager": "[email protected]+sha512.6e2baf77d06b9362294152c851c4f278ede37ab1eba3a55fda317a4a17b209f4dbb973fb250a77abc463a341fcb1f17f17cfa24091c4eb319cda0d9b84278387",
 	"engines": {