Update workers-types, pin actions to hashes, use dependabot

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: '/'
+    versioning-strategy: increase
+
+    schedule:
+      interval: monthly
+
+    # Only accept updates older than a week
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: github-actions
+    directory: '/'
+
+    schedule:
+     interval: monthly
+
+    # Only accept updates older than a week
+    cooldown:
+      default-days: 7

.github/workflows/bonk.yml

@@ -24,7 +24,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
         with:
           fetch-depth: 1
 

.github/workflows/changesets.yml

@@ -16,14 +16,14 @@ jobs:
     runs-on: macos-latest-large
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
         with:
           # See https://github.com/changesets/action/issues/187
           token: ${{ secrets.GH_ACCESS_TOKEN }}
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: 24
           cache: 'npm'
@@ -36,7 +36,7 @@ jobs:
 
       - name: Create Version PR or Publish to NPM
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b
         with:
           publish: npx changeset publish
         env:

.github/workflows/new-pr-review.yml

@@ -28,7 +28,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
         with:
           fetch-depth: 30 # Some history for context; not the full clone.
 

.github/workflows/prerelease.yml

@@ -1,12 +1,12 @@
 name: Publish prereleases
-on: 
+on:
   pull_request:
   push:
     branches:
       - main
       - next
-  
-permissions: 
+
+permissions:
   contents: read
 
 jobs:
@@ -16,18 +16,18 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: 24
           cache: 'npm'
 
       - name: Install Dependencies
         run: npm ci
 
-      - name: Build Package 
+      - name: Build Package
         run: npm run build
 
       - run: npx pkg-pr-new publish --comment=update

.github/workflows/semgrep.yml

@@ -16,11 +16,11 @@ jobs:
     name: semgrep-oss
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
         with:
           fetch-depth: 1
       - id: cache-semgrep
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
         with:
           path: ~/.local
           key: semgrep-1.160.0-${{ runner.os }}

.github/workflows/tests.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: 24
           cache: 'npm'
@@ -43,10 +43,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: 24
           cache: 'npm'

package.json

@@ -43,7 +43,7 @@
   "license": "MIT OR Apache-2.0",
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
-    "@cloudflare/workers-types": "^4.20260511.1",
+    "@cloudflare/workers-types": "^4.20260602.1",
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.19.19",
     "eslint": "^10.3.0",