factory: weekly upgrades 2026-10-19

.github/workflows/cf-fallback.yml

@@ -84,10 +84,10 @@ jobs:
           # This job only reads the tree; no need to persist the token.
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         if: steps.check.outputs.deploy == 'true'
         with:
-          node-version: 22
+          node-version: 24
           cache: npm
 
       - name: Install

.github/workflows/ci.yml

@@ -12,19 +12,19 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 22
+          node-version: 24
           cache: npm
 
       - run: npm ci
 
       - name: Typecheck
         run: npm run typecheck
 
-      # The suite runs inside workerd via @cloudflare/vitest-pool-workers, so
+      # The suite runs inside workerd via @cloudflare/vitest-plugin, so
       # it needs no Cloudflare account and no secrets. Deploys are not done
       # here: Cloudflare Workers Builds publishes main, and cf-fallback.yml
       # covers the pushes it misses.

.github/workflows/semgrep.yml

@@ -20,7 +20,7 @@ jobs:
     env:
       SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
     container:
-      image: semgrep/semgrep
+      image: semgrep/semgrep:1.181.0@sha256:81474464c1f07483ba0682a44787fd93c91397419762a04abe2bafaae396304b
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - run: semgrep ci

README.md

@@ -225,7 +225,7 @@ published that commit. It needs the `CLOUDFLARE_API_TOKEN` and
 `CLOUDFLARE_ACCOUNT_ID` repository secrets. Neither path applies D1 migrations:
 run `npm run db:migrate` before merging a change that adds one.
 
-Tests run in workerd via `@cloudflare/vitest-pool-workers` and need no
+Tests run in workerd via `@cloudflare/vitest-plugin` and need no
 Cloudflare account. The pricing tests check against Cloudflare's own worked
 billing examples, so if the rate table drifts they fail.