chore(deps): batch dependabot npm and actions bumps

.github/workflows/checks.yml

@@ -21,7 +21,7 @@ jobs:
           egress-policy: audit
 
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 2 # Recommended by turbo team
 

.github/workflows/codeql.yml

@@ -30,7 +30,7 @@ jobs:
           egress-policy: audit
 
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 1
 
@@ -40,13 +40,13 @@ jobs:
           skip-compact: "true"
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           languages: ${{ matrix.language }}
           # We can add custom queries later when needed
           # queries: security-extended
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/release-publish.yml

@@ -45,7 +45,7 @@ jobs:
       # The compact-npm-prod environment approval is the security gate, not the
       # branch ref.
       - name: Check out target ref
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.merge_commit_sha || github.ref }}

.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           token: ${{ steps.gh-app-token.outputs.token }}
@@ -105,7 +105,7 @@ jobs:
           fi
 
       - name: Commit version bump
-        uses: iarekylew00t/verified-bot-commit@5b4e8852dc472093935b8debcb81459bb79f7986 # v2.3.2
+        uses: iarekylew00t/verified-bot-commit@33985d44b7719dcaf0b854a0f4b0caad9bdc5b86 # v2.3.3
         with:
           message: "release: ${{ inputs.package }} v${{ steps.version.outputs.new }}"
           token: ${{ steps.gh-app-token.outputs.token }}

.github/workflows/scorecard.yml

@@ -34,7 +34,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Run analysis
@@ -52,6 +52,6 @@ jobs:
           path: results.sarif
           retention-days: 5
       - name: Upload SARIF to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463  # v4
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4
         with:
           sarif_file: results.sarif

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.5/schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",
@@ -31,78 +31,78 @@
       }
     }
   },
   "linter": {
     "enabled": true,
     "rules": {
       "recommended": true,
       "a11y": {},
       "correctness": {
         "noUnusedVariables": "error",
         "noUnusedImports": "error",
         "noChildrenProp": "off",
         "noInvalidDirectionInLinearGradient": "off",
         "noInvalidGridAreas": "off",
         "noInvalidPositionAtImportRule": "off",
         "noRenderReturnValue": "off",
         "noUnknownFunction": "off",
         "noUnknownMediaFeatureName": "off",
         "noUnknownProperty": "off",
         "noUnknownUnit": "off",
         "noUnmatchableAnbSelector": "off",
         "useExhaustiveDependencies": "off",
         "useJsxKeyInIterable": "off"
       },
       "performance": {
         "noBarrelFile": "error",
         "noReExportAll": "error",
         "noDelete": "off"
       },
       "style": {
         "noNonNullAssertion": "off",
         "noParameterAssign": "error",
         "useAsConstAssertion": "error",
         "useDefaultParameterLast": "error",
         "useEnumInitializers": "error",
         "useSelfClosingElements": "error",
         "useSingleVarDeclarator": "error",
         "noUnusedTemplateLiteral": "error",
         "useNumberNamespace": "error",
         "noInferrableTypes": "error",
         "noUselessElse": "error",
         "useConsistentArrayType": {
           "level": "error",
           "options": {
             "syntax": "shorthand"
           }
         }
       },
       "suspicious": {
         "noArrayIndexKey": "off",
         "noConfusingVoidType": "off",
         "noExplicitAny": "off",
         "noCommentText": "off",
         "noDuplicateAtImportRules": "off",
         "noDuplicateFontNames": "off",
         "noDuplicateJsxProps": "off",
         "noDuplicateSelectorsKeyframeBlock": "off",
         "noEmptyBlock": "off",
         "noImportantInKeyframe": "off",
         "noShorthandPropertyOverrides": "off",
         "noSuspiciousSemicolonInJsx": "off",
         "useErrorMessage": "error",
         "noConsole": {
           "level": "error",
           "options": {
             "allow": ["log"]
           }
         }
       },
       "security": {
         "noDangerouslySetInnerHtml": "off",
         "noDangerouslySetInnerHtmlWithChildren": "off"
       }
     }
   },
   "javascript": {
     "formatter": {
       "quoteStyle": "single",

package.json

@@ -16,8 +16,8 @@
     "clean": "turbo run clean"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.0",
-    "@types/node": "25.9.3",
+    "@biomejs/biome": "2.5.5",
+    "@types/node": "26.1.2",
     "ts-node": "^10.9.2",
     "turbo": "^2.9.18",
     "typescript": "^6.0.3",

packages/builder/package.json

@@ -41,7 +41,7 @@
   },
   "devDependencies": {
     "@tsconfig/node24": "^24.0.3",
-    "@types/node": "25.9.3",
+    "@types/node": "26.1.2",
     "@types/shell-quote": "^1.7.5",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9"
@@ -50,6 +50,6 @@
     "chalk": "^5.6.2",
     "log-symbols": "^7.0.0",
     "ora": "^9.0.0",
-    "shell-quote": "^1.8.4"
+    "shell-quote": "^1.10.0"
   }
 }

packages/cli/package.json

@@ -41,7 +41,7 @@
   },
   "devDependencies": {
     "@tsconfig/node24": "^24.0.3",
-    "@types/node": "25.9.3",
+    "@types/node": "26.1.2",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9"
   },

packages/simulator/package.json

@@ -44,7 +44,7 @@
     "@midnight-ntwrk/midnight-js-contracts": "^4.1.0",
     "@midnight-ntwrk/midnight-js-types": "^4.1.0",
     "@tsconfig/node24": "^24.0.3",
-    "@types/node": "25.9.3",
+    "@types/node": "26.1.2",
     "fast-check": "^4.5.2",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9"

packages/simulator/test/integration/SampleZOwnable.test.ts

@@ -352,36 +352,34 @@ describe('SampleZOwnable', () => {
           counter: MAX_U64,
         },
       ];
-      it.each(
-        testCases,
-      )('should match commitment for $label with counter $counter', async ({
-        ownerPK,
-        counter,
-      }) => {
-        const id = createIdHash(ownerPK, secretNonce);
-
-        // Check buildCommitmentFromId
-        const hashFromContract = await ownable._computeOwnerCommitment(
-          id,
-          counter,
-        );
-        const hashFromHelper1 = buildCommitmentFromId(
-          id,
-          INSTANCE_SALT,
-          counter,
-        );
-        expect(hashFromContract).toEqual(hashFromHelper1);
-
-        // Check buildCommitment
-        const hashFromHelper2 = buildCommitment(
-          ownerPK,
-          secretNonce,
-          INSTANCE_SALT,
-          counter,
-          DOMAIN,
-        );
-        expect(hashFromHelper1).toEqual(hashFromHelper2);
-      });
+      it.each(testCases)(
+        'should match commitment for $label with counter $counter',
+        async ({ ownerPK, counter }) => {
+          const id = createIdHash(ownerPK, secretNonce);
+
+          // Check buildCommitmentFromId
+          const hashFromContract = await ownable._computeOwnerCommitment(
+            id,
+            counter,
+          );
+          const hashFromHelper1 = buildCommitmentFromId(
+            id,
+            INSTANCE_SALT,
+            counter,
+          );
+          expect(hashFromContract).toEqual(hashFromHelper1);
+
+          // Check buildCommitment
+          const hashFromHelper2 = buildCommitment(
+            ownerPK,
+            secretNonce,
+            INSTANCE_SALT,
+            counter,
+            DOMAIN,
+          );
+          expect(hashFromHelper1).toEqual(hashFromHelper2);
+        },
+      );
     });
 
     describe('_computeOwnerId', () => {
@@ -403,16 +401,14 @@ describe('SampleZOwnable', () => {
         },
       ];
 
-      it.each(
-        testCases,
-      )('should match local and contract owner id for $label', async ({
-        eitherOwner,
-        nonce,
-      }) => {
-        const ownerId = await ownable._computeOwnerId(eitherOwner, nonce);
-        const expId = createIdHash(eitherOwner.left, nonce);
-        expect(ownerId).toEqual(expId);
-      });
+      it.each(testCases)(
+        'should match local and contract owner id for $label',
+        async ({ eitherOwner, nonce }) => {
+          const ownerId = await ownable._computeOwnerId(eitherOwner, nonce);
+          const expId = createIdHash(eitherOwner.left, nonce);
+          expect(ownerId).toEqual(expId);
+        },
+      );
 
       it('should fail to compute ContractAddress id', async () => {
         const eitherContract =