chore(deps): batch dependabot npm and actions bumps

[0xisk]

Types of changes

What types of changes does your code introduce to OpenZeppelin Midnight Contracts?
Put an x in the boxes that apply

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation Update (if none of the other choices apply)

Batches the open Dependabot PRs into one so they review, run CI, and land
together instead of as five separate PRs. Same approach as #122.

npm / yarn

Package	Change	Replaces
@biomejs/biome	2.5.0 → 2.5.5	#125
@types/node	25.9.3 → 26.1.2 (root, builder, cli, simulator)	#127
shell-quote	^1.8.4 → ^1.10.0 (builder)	#126
tar	7.5.15 → 7.5.22 (transitive, security group)	#123
undici	6.25.0 → 6.28.0 (transitive, security group)	#123
vite	8.0.16 → 8.1.5 (transitive, security group)	#123

Also bumps the biome.json $schema URL to 2.5.5 to match the new CLI.

GitHub Actions

Action	Change	Replaces
actions/checkout	v6.0.3 → v7.0.0 (5 workflows)	#129
github/codeql-action/{init,analyze,upload-sarif}	→ 8aad20d (v4)	#129
iarekylew00t/verified-bot-commit	v2.3.2 → v2.3.3	#129

#129 is cherry-picked as-is, so Dependabot stays the author of that commit.

PR Checklist

• I have read the Contributing Guide
• I have added tests that prove my fix is effective or that my feature works
• I have added documentation of new methods and any new behavior or changes to existing behavior
• CI Workflows Are Passing

Further comments

Supersedes #123, #125, #126, #127, #129.

Three things worth a reviewer's eye:

1. @types/node 25 → 26 is a major bump. yarn types passes clean across
   all three packages, so nothing in the tree depends on the removed 25.x
   surface. The repo still targets Node 24 via @tsconfig/node24, which is
   unchanged.

2. biome 2.5.5 forces a format-only reflow. It wraps it.each(...) chains
   and trailing commas differently from 2.5.0, so lint:ci fails on the
   formatting 2.5.0 produced. SampleZOwnable.test.ts is reformatted in its own
   commit (style(simulator):) to keep it out of the dependency diff. The change
   is line wrapping and trailing-comma placement only, verified token-identical
   to the previous content once whitespace and commas are normalised.

3. The security-group versions land above Dependabot's targets. tar,
   undici and vite are transitive, so there is no range in any manifest to
   pin them; regenerating the lockfile takes the newest version satisfying the
   existing ranges. That is at or above what chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #123 asked for in every case
   (undici 6.27.0 is the release carrying the four advisory fixes, 6.28.0 is
   the current 6.x). chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #123 was also opened before chore(deps): batch dependabot npm dependency bumps #122 landed, so it described
   vite as 8.0.14 → 8.1.0; main already sits at 8.0.16.

Validation (local): yarn lint:ci clean, yarn types clean. yarn test could
not be run locally (unrelated sandbox restriction on loading native .node
binaries — plain main fails the same way here), so CI is the source of truth
for the test suite.

Summary by CodeRabbit

• Chores

  • Updated development tooling and type definitions.
  • Updated build and testing utilities.
  • Refreshed automated workflow actions for code checks, releases, security analysis, and reporting.
  • Updated the code-formatting configuration schema.

• Tests

  • Modernized parameterized integration test formatting without changing coverage or assertions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 184076a1-3473-4ed1-ae50-c046ebb14346

📥 Commits

Reviewing files that changed from the base of the PR and between 2534a49 and 970a701.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (11)

• .github/workflows/checks.yml
• .github/workflows/codeql.yml
• .github/workflows/release-publish.yml
• .github/workflows/release.yml
• .github/workflows/scorecard.yml
• biome.json
• package.json
• packages/builder/package.json
• packages/cli/package.json
• packages/simulator/package.json
• packages/simulator/test/integration/SampleZOwnable.test.ts

---

Walkthrough

This PR updates pinned GitHub Actions revisions, refreshes Biome and Node-related development tooling, upgrades shell-quote, and reformats two simulator parameterized tests without changing their assertions.

Changes

Maintenance updates

Layer / File(s)	Summary
Workflow action pin updates .github/workflows/*.yml	Checkout, CodeQL, SARIF upload, and verified bot commit actions are updated to newer pinned revisions.
Tooling version alignment biome.json, package.json, packages/*/package.json	Biome schema and development dependency versions are refreshed across the repository.
Parameterized test syntax packages/simulator/test/integration/SampleZOwnable.test.ts	Two Vitest table tests adopt it.each(testCases) syntax while retaining their existing assertions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• OpenZeppelin/compact-tools#87: Updates overlapping pinned actions in release workflows.
• OpenZeppelin/compact-tools#110: Modifies overlapping GitHub Actions references.

Suggested reviewers: pepebndc, andrew-fleming

Poem

I’m a rabbit with pins freshly bright,
Hopping through workflows day and night.
Biome leaves a newer trail,
Tests wear syntax without fail.
Carrots compile—what a delight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the PR as a batch of Dependabot npm and GitHub Actions dependency updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/batch-dependabot-updates

---

_{Comment @coderabbitai help to get the list of available commands.}