From 834bb558b27c7cced4a25863ea5e418dd8507990 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 2 Jun 2026 15:36:21 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/auto-release.yml |  6 +++---
 .github/workflows/build.yml        | 20 ++++++++++----------
 package.json                       |  2 +-
 pnpm-lock.yaml                     |  5 ++++-
 4 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index eb4dea5..8513e39 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -16,14 +16,14 @@ jobs:
     
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v4.4.0
         with:
-          node-version: '22'
+          node-version: '22.22.3'
 
       - name: Get swarm-cli version
         id: version
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f6d02a1..241a052 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,17 +13,17 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.3.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@v3.0.0
         with:
-          version: 9
+          version: 9.15.9
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v4.4.0
         with:
-          node-version: '22'
+          node-version: '22.22.3'
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -41,31 +41,31 @@ jobs:
           cat build/VERSION.txt
 
       - name: Upload Linux x64 binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: swarm-cli-linux
           path: build/swarm-cli-linux
 
       - name: Upload Linux ARM64 binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: swarm-cli-linux-arm
           path: build/swarm-cli-linux-arm
 
       - name: Upload macOS x64 binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: swarm-cli-macos
           path: build/swarm-cli-macos
 
       - name: Upload macOS ARM64 binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: swarm-cli-macos-arm
           path: build/swarm-cli-macos-arm
 
       - name: Upload Windows binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: swarm-cli-windows
           path: build/swarm-cli-windows.exe
diff --git a/package.json b/package.json
index 85574b4..de1e269 100644
--- a/package.json
+++ b/package.json
@@ -16,6 +16,6 @@
     "@ethersphere/swarm-cli": "2.36.1"
   },
   "devDependencies": {
-    "@yao-pkg/pkg": "^6.8.0"
+    "@yao-pkg/pkg": "6.8.0"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a6c53d8..9567d84 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -13,7 +13,7 @@ importers:
         version: 2.36.1
     devDependencies:
       '@yao-pkg/pkg':
-        specifier: ^6.8.0
+        specifier: 6.8.0
         version: 6.8.0
 
 packages:
@@ -719,6 +719,7 @@ packages:
   prebuild-install@7.1.1:
     resolution: {integrity: sha512-jAXscXWMcCK8GgCoHOfIr0ODh5ai8mj63L2nWrjuAgXE6tDyYGnx4/8o/rCgU+B4JSyZBKbeZqzhtwtC3ovxjw==}
     engines: {node: '>=10'}
+    deprecated: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
     hasBin: true
 
   process-nextick-args@2.0.1:
@@ -846,6 +847,7 @@ packages:
   tar@7.5.1:
     resolution: {integrity: sha512-nlGpxf+hv0v7GkWBK2V9spgactGOp0qvfWRxUMjqHyzrt3SgwE48DIv/FhqPHJYLHpgW1opq3nERbz5Anq7n1g==}
     engines: {node: '>=18'}
+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
 
   text-decoder@1.2.3:
     resolution: {integrity: sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==}
@@ -882,6 +884,7 @@ packages:
 
   uuid@9.0.1:
     resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==}
+    deprecated: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
     hasBin: true
 
   wcwidth@1.0.1: