From 21a19b6645326de694d0c6b7a2e6d1d8cb47e417 Mon Sep 17 00:00:00 2001
From: Elkim <36666630+elkimek@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:20:47 +0100
Subject: [PATCH 1/3] fix: update both undici transports for security
 advisories

---
 package-lock.json                      | 14 +++++++-------
 package.json                           |  4 ++--
 tests/proxy-entrypoint-runtime.test.ts |  5 +++--
 tests/proxy-network-undici.test.ts     | 18 +++++++++++++++++-
 tests/proxy-network.test.ts            |  4 ++--
 5 files changed, 31 insertions(+), 14 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index b38620aa0..4a9913c00 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,7 +14,7 @@
         "@vercel/blob": "2.8.0",
         "ehbp": "0.3.2",
         "tinfoil": "^1.2.1",
-        "undici": "8.11.2"
+        "undici": "8.12.3"
       },
       "devDependencies": {
         "@cashu/cashu-ts": "4.11.0",
@@ -2876,9 +2876,9 @@
       }
     },
     "node_modules/@vercel/blob/node_modules/undici": {
-      "version": "6.28.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.1.tgz",
-      "integrity": "sha512-zWpdTVD54H48CIybL0rWQ3ukpb9d23wM7eH5RtfdmeP70cWHNjtfo7P4vZX+5CoDcO53J4Pu5uXp7lNfjc6DRA==",
+      "version": "6.29.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.1.tgz",
+      "integrity": "sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"
@@ -5163,9 +5163,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "8.11.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz",
-      "integrity": "sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==",
+      "version": "8.12.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.12.3.tgz",
+      "integrity": "sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==",
       "license": "MIT",
       "engines": {
         "node": ">=22.19.0"
diff --git a/package.json b/package.json
index 477716aae..3bffd4ffe 100644
--- a/package.json
+++ b/package.json
@@ -108,14 +108,14 @@
     "@vercel/blob": "2.8.0",
     "ehbp": "0.3.2",
     "tinfoil": "^1.2.1",
-    "undici": "8.11.2"
+    "undici": "8.12.3"
   },
   "overrides": {
     "@phala/dcap-qvl": {
       "elliptic": "$elliptic"
     },
     "@vercel/blob": {
-      "undici": "6.28.1"
+      "undici": "6.29.1"
     },
     "@tailwindcss/cli": {
       "@parcel/watcher": "2.6.0"
diff --git a/tests/proxy-entrypoint-runtime.test.ts b/tests/proxy-entrypoint-runtime.test.ts
index c0bdd5b09..de238b181 100644
--- a/tests/proxy-entrypoint-runtime.test.ts
+++ b/tests/proxy-entrypoint-runtime.test.ts
@@ -69,7 +69,7 @@ describe('proxy production entrypoint', () => {
     expect(proxyEntrypoint).toEqual({ fetch: proxyHandler });
   });
 
-  it('pins the Blob runtime artifacts from the last healthy deployment', () => {
+  it('pins the reviewed Blob SDK and patched compatible transport', () => {
     const packageJson = JSON.parse(readFileSync(
       new URL('../package.json', import.meta.url),
       'utf8',
@@ -80,9 +80,10 @@ describe('proxy production entrypoint', () => {
     ));
 
     expect(packageJson.dependencies['@vercel/blob']).toBe('2.8.0');
+    expect(packageJson.overrides['@vercel/blob'].undici).toBe('6.29.1');
     expect(packageLock.packages['node_modules/@vercel/blob'].version).toBe('2.8.0');
     expect(packageLock.packages['node_modules/@vercel/blob/node_modules/undici'].version)
-      .toBe('6.28.1');
+      .toBe('6.29.1');
   });
 
   it('answers preflight and method probes without initializing Blob storage', async () => {
diff --git a/tests/proxy-network-undici.test.ts b/tests/proxy-network-undici.test.ts
index 72493949f..54de03caa 100644
--- a/tests/proxy-network-undici.test.ts
+++ b/tests/proxy-network-undici.test.ts
@@ -17,7 +17,10 @@ async function transport() {
   const paths: string[] = [];
   const server = createServer((request, response) => {
     paths.push(request.url!);
-    if (request.url === '/redirect') {
+    if (request.url === '/encoding-overflow') {
+      response.writeHead(200, {'content-encoding': 'gzip, gzip, gzip, gzip, gzip, gzip'});
+      response.end();
+    } else if (request.url === '/redirect') {
       response.writeHead(302, {location: 'http://127.0.0.1/private'});
       response.end('redirect blocked by caller policy');
     } else {
@@ -90,3 +93,16 @@ it('destroys the installed dispatcher when an in-flight response is aborted', as
   expect(test.close).not.toHaveBeenCalled();
   expect(test.paths).toEqual(['/stream']);
 });
+
+it('rejects excessive content encodings without crashing the proxy process', async () => {
+  const test = await transport();
+  await expect(fetchWithPinnedProxyDns(test.url + '/encoding-overflow', {}, test))
+    .rejects.toMatchObject({cause: {message: 'too many content-encodings in response: 6, maximum allowed is 5'}});
+  await vi.waitFor(() => expect(test.destroy).toHaveBeenCalledOnce());
+  expect(test.close).not.toHaveBeenCalled();
+
+  const response = await fetchWithPinnedProxyDns(test.url + '/', {}, test);
+  expect(await response.text()).toBe('first second');
+  expect(test.paths).toEqual(['/encoding-overflow', '/']);
+  expect(test.close).toHaveBeenCalledOnce();
+});
diff --git a/tests/proxy-network.test.ts b/tests/proxy-network.test.ts
index 1d37fb3ce..b78a3894c 100644
--- a/tests/proxy-network.test.ts
+++ b/tests/proxy-network.test.ts
@@ -25,8 +25,8 @@ describe('proxy DNS pinning transport', () => {
 
     expect(packageJson.engines.node).toBe('>=24.20.0 <25');
     expect(packageLock.packages[''].engines.node).toBe(packageJson.engines.node);
-    expect(packageJson.dependencies.undici).toBe('8.11.2');
-    expect(packageLock.packages['node_modules/undici'].version).toBe('8.11.2');
+    expect(packageJson.dependencies.undici).toBe('8.12.3');
+    expect(packageLock.packages['node_modules/undici'].version).toBe('8.12.3');
     expect(source).toContain("import { Agent, fetch as undiciFetch } from 'undici'");
     expect(source).not.toContain("import('undici')");
   });

From 6b99c641717873c0a39630e08c542a71bdc09c0e Mon Sep 17 00:00:00 2001
From: Elkim <36666630+elkimek@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:23:59 +0100
Subject: [PATCH 2/3] fix: patch Vitest and Zod and refresh compatible tooling

---
 package-lock.json | 169 ++++++++++++++++++++++------------------------
 package.json      |  11 +--
 2 files changed, 87 insertions(+), 93 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 4a9913c00..15909d960 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18,7 +18,7 @@
       },
       "devDependencies": {
         "@cashu/cashu-ts": "4.11.0",
-        "@csstools/css-tokenizer": "4.0.0",
+        "@csstools/css-tokenizer": "4.0.2",
         "@evolu/common": "8.24.1",
         "@evolu/web": "3.6.5",
         "@jridgewell/trace-mapping": "0.3.31",
@@ -31,8 +31,8 @@
         "@tailwindcss/node": "4.3.3",
         "@types/istanbul-lib-instrument": "1.7.8",
         "@types/jsdom": "30.0.0",
-        "@types/node": "26.1.0",
-        "@vitest/coverage-istanbul": "4.1.11",
+        "@types/node": "26.6.5",
+        "@vitest/coverage-istanbul": "4.1.12",
         "axe-core": "4.13.0",
         "elliptic": "file:scripts/vendor-packages/elliptic-verify-only",
         "fake-indexeddb": "^6.2.5",
@@ -45,7 +45,7 @@
         "tailwindcss": "4.3.3",
         "typescript": "7.0.2",
         "venice-e2ee": "https://github.com/elkimek/venice-e2ee/archive/7da6228c0cef3ad516196129eea2f9d64760e6b3.tar.gz",
-        "vitest": "^4.1.11"
+        "vitest": "^4.1.12"
       },
       "engines": {
         "node": ">=24.20.0 <25"
@@ -596,9 +596,9 @@
       }
     },
     "node_modules/@csstools/css-tokenizer": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-4.0.0.tgz",
-      "integrity": "sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA==",
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-4.0.2.tgz",
+      "integrity": "sha512-OoKoR0f76dCY666JlcbhmVTs2drYj1GUXZTYTcbUgJjh9Nv41aFfZ21bPQTERm5+L5cBDo466NltB2lplS5GBw==",
       "dev": true,
       "funding": [
         {
@@ -2458,12 +2458,12 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "26.1.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.0.tgz",
-      "integrity": "sha512-O0A1G3xPGy4w7AgQdAQYUlQ+BKk2Oovw8eRpofyp5KdBZULnbe+WqaOVNrm705SHphCiG4XHsACrSmPu1f+Kgw==",
+      "version": "26.6.5",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.5.tgz",
+      "integrity": "sha512-uMzsv9stDdofIZBx4UGh4Z9ZgXnGC9seRDscilBcTHAeOFk67MZg/k9bWVfO+bk4qZmG+l52hRnLwUiH2LnJTg==",
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~8.3.0"
+        "undici-types": "~8.9.0"
       }
     },
     "node_modules/@types/tough-cookie": {
@@ -2894,15 +2894,6 @@
         "zod": "4.1.11"
       }
     },
-    "node_modules/@vercel/cli-config/node_modules/zod": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.11.tgz",
-      "integrity": "sha512-WPsqwxITS2tzx1bzhIKsEs19ABD5vmCVa4xBo2tq/SrV4RNZtfws1EnCWQXM6yh8bD08a1idvkB5MZSBiZsjwg==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    },
     "node_modules/@vercel/cli-exec": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@vercel/cli-exec/-/cli-exec-1.0.1.tgz",
@@ -2930,9 +2921,9 @@
       }
     },
     "node_modules/@vitest/coverage-istanbul": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-istanbul/-/coverage-istanbul-4.1.11.tgz",
-      "integrity": "sha512-pK9LJtOS534bmUwdwLpGD9qL52DeqVWSInrXFMNqrvWLbbAhuIPAlRup3UbsjFOMqCC/p3MmmX7uXV7ZTkcFfQ==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-istanbul/-/coverage-istanbul-4.1.12.tgz",
+      "integrity": "sha512-f98TiCqF7IriBQEpm6usi56wyD4G1cRYabI15f3Jm7R355q9tlwqJ0j1oPf+tWZ7D0LPnCh3dU70duRt10erHg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2951,20 +2942,20 @@
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "vitest": "4.1.11"
+        "vitest": "4.1.12"
       }
     },
     "node_modules/@vitest/expect": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz",
-      "integrity": "sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.12.tgz",
+      "integrity": "sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.11",
-        "@vitest/utils": "4.1.11",
+        "@vitest/spy": "4.1.12",
+        "@vitest/utils": "4.1.12",
         "chai": "^6.2.2",
         "tinyrainbow": "^3.1.0"
       },
@@ -2973,13 +2964,13 @@
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz",
-      "integrity": "sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.12.tgz",
+      "integrity": "sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.1.11",
+        "@vitest/spy": "4.1.12",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -3000,9 +2991,9 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz",
-      "integrity": "sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.12.tgz",
+      "integrity": "sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3013,13 +3004,13 @@
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz",
-      "integrity": "sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.12.tgz",
+      "integrity": "sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.1.11",
+        "@vitest/utils": "4.1.12",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -3027,14 +3018,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz",
-      "integrity": "sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.12.tgz",
+      "integrity": "sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.11",
-        "@vitest/utils": "4.1.11",
+        "@vitest/pretty-format": "4.1.12",
+        "@vitest/utils": "4.1.12",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -3043,9 +3034,9 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz",
-      "integrity": "sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.12.tgz",
+      "integrity": "sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -3053,13 +3044,13 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz",
-      "integrity": "sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.12.tgz",
+      "integrity": "sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.11",
+        "@vitest/pretty-format": "4.1.12",
         "convert-source-map": "^2.0.0",
         "tinyrainbow": "^3.1.0"
       },
@@ -3302,9 +3293,9 @@
       "license": "CC-BY-4.0"
     },
     "node_modules/chai": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
-      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.3.0.tgz",
+      "integrity": "sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3504,9 +3495,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.1.tgz",
-      "integrity": "sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
       "dev": true,
       "license": "MIT"
     },
@@ -4899,9 +4890,9 @@
       "license": "MIT"
     },
     "node_modules/std-env": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz",
-      "integrity": "sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.3.0.tgz",
+      "integrity": "sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==",
       "dev": true,
       "license": "MIT"
     },
@@ -5028,9 +5019,9 @@
       "license": "MIT"
     },
     "node_modules/tinyexec": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
-      "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz",
+      "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5055,9 +5046,9 @@
       }
     },
     "node_modules/tinyrainbow": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.1.tgz",
-      "integrity": "sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.2.0.tgz",
+      "integrity": "sha512-LgO3D9yZJjApUiuUfl9iFAwrtaX4+lok3wJIqttGoKCHlWUqHqbQpnxCf82L8FjgKsh4iGo78hqJwgL8F6To2A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5172,9 +5163,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
-      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
       "license": "MIT"
     },
     "node_modules/update-browserslist-db": {
@@ -5355,19 +5346,19 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.11.tgz",
-      "integrity": "sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==",
+      "version": "4.1.12",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.12.tgz",
+      "integrity": "sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.1.11",
-        "@vitest/mocker": "4.1.11",
-        "@vitest/pretty-format": "4.1.11",
-        "@vitest/runner": "4.1.11",
-        "@vitest/snapshot": "4.1.11",
-        "@vitest/spy": "4.1.11",
-        "@vitest/utils": "4.1.11",
+        "@vitest/expect": "4.1.12",
+        "@vitest/mocker": "4.1.12",
+        "@vitest/pretty-format": "4.1.12",
+        "@vitest/runner": "4.1.12",
+        "@vitest/snapshot": "4.1.12",
+        "@vitest/spy": "4.1.12",
+        "@vitest/utils": "4.1.12",
         "es-module-lexer": "^2.0.0",
         "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
@@ -5395,12 +5386,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.11",
-        "@vitest/browser-preview": "4.1.11",
-        "@vitest/browser-webdriverio": "4.1.11",
-        "@vitest/coverage-istanbul": "4.1.11",
-        "@vitest/coverage-v8": "4.1.11",
-        "@vitest/ui": "4.1.11",
+        "@vitest/browser-playwright": "4.1.12",
+        "@vitest/browser-preview": "4.1.12",
+        "@vitest/browser-webdriverio": "^4.1.11",
+        "@vitest/coverage-istanbul": "4.1.12",
+        "@vitest/coverage-v8": "4.1.12",
+        "@vitest/ui": "4.1.12",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
@@ -5602,9 +5593,9 @@
       "license": "MIT"
     },
     "node_modules/zod": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
-      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "license": "MIT",
       "peer": true,
       "funding": {
diff --git a/package.json b/package.json
index 3bffd4ffe..215a2079d 100644
--- a/package.json
+++ b/package.json
@@ -75,7 +75,7 @@
   },
   "devDependencies": {
     "@cashu/cashu-ts": "4.11.0",
-    "@csstools/css-tokenizer": "4.0.0",
+    "@csstools/css-tokenizer": "4.0.2",
     "@evolu/common": "8.24.1",
     "@evolu/web": "3.6.5",
     "@jridgewell/trace-mapping": "0.3.31",
@@ -87,8 +87,8 @@
     "@tailwindcss/cli": "4.3.3",
     "@types/istanbul-lib-instrument": "1.7.8",
     "@types/jsdom": "30.0.0",
-    "@types/node": "26.1.0",
-    "@vitest/coverage-istanbul": "4.1.11",
+    "@types/node": "26.6.5",
+    "@vitest/coverage-istanbul": "4.1.12",
     "axe-core": "4.13.0",
     "elliptic": "file:scripts/vendor-packages/elliptic-verify-only",
     "fake-indexeddb": "^6.2.5",
@@ -99,7 +99,7 @@
     "tailwindcss": "4.3.3",
     "typescript": "7.0.2",
     "venice-e2ee": "https://github.com/elkimek/venice-e2ee/archive/7da6228c0cef3ad516196129eea2f9d64760e6b3.tar.gz",
-    "vitest": "^4.1.11",
+    "vitest": "^4.1.12",
     "magic-string": "0.30.21",
     "@tailwindcss/node": "4.3.3",
     "postcss": "8.5.26"
@@ -117,6 +117,9 @@
     "@vercel/blob": {
       "undici": "6.29.1"
     },
+    "@vercel/cli-config": {
+      "zod": "4.6.7"
+    },
     "@tailwindcss/cli": {
       "@parcel/watcher": "2.6.0"
     },

From a7d9b8ab27a3daf4983a5226569cfc2df36eadd5 Mon Sep 17 00:00:00 2001
From: Elkim <36666630+elkimek@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:23:59 +0100
Subject: [PATCH 3/3] chore: update pinned CI actions and their contract
 assertions

---
 .github/workflows/codeql.yml       |  6 +--
 .github/workflows/real-models.yml  |  4 +-
 .github/workflows/supply-chain.yml |  6 +--
 .github/workflows/sync-compat.yml  | 10 ++---
 .github/workflows/test.yml         | 72 +++++++++++++++---------------
 tests/ci-browser-contracts.test.ts |  2 +-
 6 files changed, 50 insertions(+), 50 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 80d3c19d2..afce46bac 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,7 +32,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm
@@ -42,7 +42,7 @@ jobs:
       - name: Install dependencies and compile canonical UI sources
         run: npm ci
 
-      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           languages: ${{ matrix.language }}
           # security-extended adds taint-flow + injection rules beyond the
@@ -103,6 +103,6 @@ jobs:
               # fully scanned.
               - tests/**
 
-      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/real-models.yml b/.github/workflows/real-models.yml
index f580db567..5e1bacdfd 100644
--- a/.github/workflows/real-models.yml
+++ b/.github/workflows/real-models.yml
@@ -34,7 +34,7 @@ jobs:
       GETBASED_VOICE_TTS_BACKEND: wasm
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm
@@ -63,7 +63,7 @@ jobs:
           git rev-parse HEAD > real-model-revision.txt
           echo "Real-model workflow: $SELECTED_MODEL; revision: $(git rev-parse HEAD)" >> "$GITHUB_STEP_SUMMARY"
           echo 'Only the selected workflow was tested. GPU and larger voice tiers require separate hardware evidence.' >> "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: real-model-${{ inputs.model }}-${{ github.sha }}
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index b8e2528a9..8cae09591 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -44,7 +44,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm
@@ -59,7 +59,7 @@ jobs:
         run: npm run sbom
 
       - name: Upload CycloneDX SBOM
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: getbased-cyclonedx-sbom
           path: artifacts/getbased.cdx.json
@@ -77,7 +77,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm
diff --git a/.github/workflows/sync-compat.yml b/.github/workflows/sync-compat.yml
index a9c814023..f4b0f58cd 100644
--- a/.github/workflows/sync-compat.yml
+++ b/.github/workflows/sync-compat.yml
@@ -26,7 +26,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         if: github.event_name == 'pull_request'
         with:
           node-version: 24
@@ -63,7 +63,7 @@ jobs:
           path: .ci/getbased-relay
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm
@@ -130,7 +130,7 @@ jobs:
 
       - name: Upload transport logs on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: sync-transport-${{ matrix.evolu-client }}-logs
           path: |
@@ -165,7 +165,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm
@@ -186,7 +186,7 @@ jobs:
 
       - name: Upload browser logs on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: evolu8-${{ matrix.browser }}-logs
           path: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index db372a61a..a8194bee0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
@@ -106,7 +106,7 @@ jobs:
         run: node scripts/ci-compiled.mts seal
       - name: Seal immutable artifact and catalog transport
         run: node scripts/ci-artifact.mjs seal --artifact dist --transport .local-notes/ci/transport
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: shipping-inputs
           path: |
@@ -119,7 +119,7 @@ jobs:
           include-hidden-files: true
           if-no-files-found: error
           retention-days: 14
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: failure()
         with:
           name: prepare-failure
@@ -134,11 +134,11 @@ jobs:
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: shipping-inputs
       - name: Restore the qualified catalog before compilation
@@ -157,7 +157,7 @@ jobs:
       - name: Enforce resource budgets before affected unit tests
         if: needs.prepare.outputs.full != 'true' && needs.prepare.outputs.performance == 'true' && needs.prepare.outputs.kit != 'true'
         run: node scripts/sveltekit-performance-budget.mjs --artifact "$GETBASED_KIT_ARTIFACT" --output .local-notes/ci/performance
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always() && needs.prepare.outputs.full != 'true' && needs.prepare.outputs.performance == 'true' && needs.prepare.outputs.kit != 'true'
         with:
           name: shipping-performance-budget
@@ -175,7 +175,7 @@ jobs:
       - name: Affected unit tests and mandatory changed-source checks
         if: needs.prepare.outputs.full != 'true'
         run: node scripts/pr-test-scope.mjs --run unit --output .local-notes/ci/affected.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always() && needs.prepare.outputs.full == 'true'
         with:
           name: unit-coverage
@@ -199,11 +199,11 @@ jobs:
       matrix: ${{ fromJSON(needs.prepare.outputs.native_matrix) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: shipping-inputs
       - name: Restore the qualified catalog before compilation
@@ -239,7 +239,7 @@ jobs:
           LANE: ${{ matrix.id }}
           SHARD: ${{ matrix.shard }}
         run: node scripts/ci-results.mjs coverage-inventory --directory ".local-notes/ci/coverage/$LANE" --shard "$SHARD" --output ".local-notes/ci/coverage-inventories/$LANE.json"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: native-results-${{ matrix.id }}
@@ -248,14 +248,14 @@ jobs:
           include-hidden-files: true
           if-no-files-found: warn
           retention-days: 14
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always() && matrix.coverage == true
         with:
           name: coverage-raw-${{ matrix.id }}
           path: .local-notes/ci/coverage/${{ matrix.id }}
           include-hidden-files: true
           if-no-files-found: error
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always() && matrix.coverage == true
         with:
           name: coverage-inventory-${{ matrix.id }}
@@ -277,11 +277,11 @@ jobs:
       matrix: ${{ fromJSON(needs.prepare.outputs.kit_matrix) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: shipping-inputs
       - name: Restore the qualified catalog before compilation
@@ -312,7 +312,7 @@ jobs:
       - name: Enforce resource budgets before the first shipping shard
         if: needs.prepare.outputs.full != 'true' && needs.prepare.outputs.performance == 'true' && startsWith(matrix.shard, '1/')
         run: node scripts/sveltekit-performance-budget.mjs --artifact "$GETBASED_KIT_ARTIFACT" --output .local-notes/ci/performance
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always() && needs.prepare.outputs.full != 'true' && needs.prepare.outputs.performance == 'true' && startsWith(matrix.shard, '1/')
         with:
           name: shipping-performance-budget
@@ -402,7 +402,7 @@ jobs:
           process_status=${PIPESTATUS[0]}
           printf '\nps_status=%s (PID/PPID/comm only; exited processes are recorded in pw:browser job logs)\n' "$process_status" >> "$directory/remaining-processes.txt"
           exit 0
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: kit-receipt-${{ matrix.id }}-attempt-${{ github.run_attempt }}
@@ -410,7 +410,7 @@ jobs:
           include-hidden-files: true
           if-no-files-found: error
           retention-days: 14
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: kit-results-${{ matrix.id }}
@@ -427,11 +427,11 @@ jobs:
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: shipping-inputs
       - name: Restore the qualified catalog before compilation
@@ -447,7 +447,7 @@ jobs:
       - run: npx --no-install playwright install --with-deps chromium
       - name: Enforce unchanged startup, first-use and offline budgets in isolation
         run: node scripts/sveltekit-performance-budget.mjs --artifact "$GETBASED_KIT_ARTIFACT" --output .local-notes/ci/performance
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: shipping-performance-budget
@@ -462,11 +462,11 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: shipping-inputs
       - name: Restore the qualified catalog before compilation
@@ -479,16 +479,16 @@ jobs:
         run: npm ci
       - name: Verify exact shipping bytes and current authored sources
         run: node scripts/ci-artifact.mjs verify --artifact dist --transport .local-notes/ci/transport --github-env
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: unit-coverage
           path: tests
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: coverage-raw-*
           path: tests/.playwright-coverage
           merge-multiple: true
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: coverage-inventory-*
           path: .local-notes/ci/coverage-inventories
@@ -503,7 +503,7 @@ jobs:
           REQUIRE_PLAYWRIGHT_COVERAGE_SHARDS: '1'
           PLAYWRIGHT_COVERAGE_DIR: tests/.playwright-coverage
         run: node scripts/playwright-coverage.mjs
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: production-coverage
@@ -529,11 +529,11 @@ jobs:
           PREPARE_RESULT: ${{ needs.prepare.result }}
         run: test "$PREPARE_RESULT" = success
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: needs.prepare.result == 'success'
         with:
           name: shipping-inputs
@@ -552,7 +552,7 @@ jobs:
         run: |
           node -e 'require("node:fs").writeFileSync("/tmp/ci-needs.json",process.env.NEEDS_JSON)'
           node scripts/ci-results.mjs aggregate --needs /tmp/ci-needs.json --plan "$CI_TEST_PLAN" --output .local-notes/ci/aggregate.json
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: needs.prepare.outputs.kit == 'true'
         with:
           pattern: kit-receipt-*
@@ -567,7 +567,7 @@ jobs:
           EXPECTED_COMMIT_SHA: ${{ github.sha }}
           PRODUCTION_BASE_URL: https://app.getbased.health
         run: node scripts/production-smoke.mjs
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: acceptance-gate
@@ -597,7 +597,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
@@ -679,7 +679,7 @@ jobs:
         if: always()
         run: |
           printf '%s\n' '## DIAGNOSTIC WebKit run' 'Only canonical Lens Shell and Wearables desktop WebKit cases were selected.' 'This run does not execute the normal matrix or provide the test release gate.' >> "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: diagnostic-webkit-${{ github.run_id }}-${{ github.run_attempt }}
@@ -714,7 +714,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
@@ -767,7 +767,7 @@ jobs:
         if: always()
         run: |
           printf '%s\n' '## DIAGNOSTIC Cocoa mobile WebKit Routstr PWA run' 'Only the canonical Routstr model-choice unavailable-origin cold-launch case was selected, with its existing assertions and deadline.' 'This run does not execute the normal matrix or provide the test release gate.' >> "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: diagnostic-webkit-pwa-routstr-${{ github.run_id }}-${{ github.run_attempt }}
@@ -804,7 +804,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24
           cache: npm
@@ -848,7 +848,7 @@ jobs:
       - name: Label the focused evidence
         if: always()
         run: echo 'Focused Cocoa Evolu diagnostics only; the normal release matrix is still required.' >> "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: diagnostic-evolu-${{ matrix.project }}-${{ github.run_id }}
diff --git a/tests/ci-browser-contracts.test.ts b/tests/ci-browser-contracts.test.ts
index 1a976cd42..2e1fdb27a 100644
--- a/tests/ci-browser-contracts.test.ts
+++ b/tests/ci-browser-contracts.test.ts
@@ -250,7 +250,7 @@ describe('manual WebKit diagnostic isolation', () => {
     expect(diagnostic).toContain('This run does not execute the normal matrix or provide the test release gate.');
     expect(diagnostic).toContain('name: diagnostic-webkit-pwa-routstr-${{ github.run_id }}-${{ github.run_attempt }}');
     for (const file of ['results', 'guard.json', 'scope.json', 'case.log', 'build.log', 'build-seal.json', 'build-verify.json', 'build-metrics.json', 'transport/manifest.json']) expect(diagnostic).toContain('.local-notes/ci/webkit-pwa-routstr-diagnostics/' + file);
-    for (const pin of ['actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1', 'actions/setup-node@820762786026740c76f36085b0efc47a31fe5020', 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a']) expect(diagnostic).toContain(pin);
+    for (const pin of ['actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1', 'actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1', 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9']) expect(diagnostic).toContain(pin);
     const canonical = fs.readFileSync('tests/pwa/sveltekit-routstr-model-settings.spec.ts', 'utf8');
     expect(canonical.match(/^test\('/gm)).toHaveLength(1);
     expect(canonical).toContain("test('static Routstr models retain private and regular choices through unavailable-origin cold launch'");