chore: minor security improvements

.github/dependabot.yml

@@ -1,3 +1,5 @@
+# Dependabot version updates. Opens PRs to keep dependency versions fresh.
+# Docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 version: 2
 updates:
   - package-ecosystem: 'npm'
@@ -29,3 +31,21 @@ updates:
           - 'oxfmt'
           - 'oxlint-tsgolint'
           - '@solana-config/oxc'
+
+  # GitHub Actions used across .github/workflows/*.
+  # Third-party actions are pinned to commit SHAs and this keeps the pins from rotting.
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+        # Minor and patch bumps are grouped into one PR.
+        # Majors are split out so each can be reviewed on its own.
+        update-types:
+          - 'minor'
+          - 'patch'

.github/workflows/main.yml

@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
@@ -99,7 +99,7 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
@@ -113,7 +113,7 @@ jobs:
 
       - name: Create Release Pull Request or Publish
         id: changesets
-        uses: changesets/action@v2.1.1
+        uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           version-script: pnpm release:version
@@ -134,7 +134,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v3
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
 
       - name: Auto-approve the PR
         if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'

.npmrc

@@ -0,0 +1,3 @@
+# Default registry for package-name lookups. Scope-specific entries in an inherited user or global
+# .npmrc still take precedence, so the lockfile pins stay the real integrity control.
+registry=https://registry.npmjs.org/

package.json

@@ -13,7 +13,7 @@
     "devDependencies": {
         "@changesets/changelog-github": "^1.0.1",
         "@changesets/cli": "^3.0.2",
-        "@codama/release-tools": "github:codama-idl/release-tools#v1.0.0",
+        "@codama/release-tools": "github:codama-idl/release-tools#v1.2.0",
         "@solana-config/oxc": "^0.1.1",
         "@types/node": "^26",
         "agadoo": "^3.0.0",

packages/dynamic-client/package.json

@@ -53,7 +53,7 @@
         "build": "rimraf dist && tsup && tsc -p ./tsconfig.declarations.json",
         "dev": "vitest --project node",
         "test": "pnpm generate-program-types && pnpm test:types && pnpm test:treeshakability && pnpm test:unit",
-        "anchor:build": "cd test/programs/anchor && anchor build --ignore-keys",
+        "anchor:build": "cd test/programs/anchor && anchor build --ignore-keys -- --locked",
         "anchor:sync:build": "pnpm anchor:build && node ./scripts/anchor/sync-anchor-builds.mjs && pnpm anchor:generate-idl && pnpm generate-program-types",
         "anchor:generate-idl": "node ./scripts/anchor/generate-idl-from-anchor.mjs",
         "test:treeshakability": "for file in dist/index.*.mjs; do agadoo $file; done",

pnpm-workspace.yaml

@@ -1,2 +1,5 @@
 packages:
   - "packages/*"
+
+# No dependency may run install or build scripts.
+onlyBuiltDependencies: []