fix(deps): pin dependencies

.github/.nvmrc

@@ -1 +1 @@
-20.11.0
+20.20.2

.github/actions/setup-workspace/action.yaml

@@ -9,14 +9,14 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v4.4.0
       with:
         node-version: ${{ inputs.node-version }}
 
     - uses: pnpm/action-setup@v2.4.0
       id: pnpm-install
       with:
-        version: 8.10.2
+        version: 8.15.9
         run_install: false
 
     - name: Get pnpm store directory
@@ -25,7 +25,7 @@ runs:
       run: |
         echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v4.4.0
       with:
         registry-url: https://registry.npmjs.org
         node-version-file: .github/.nvmrc

.github/workflows/codeql.yml

@@ -58,7 +58,7 @@ jobs:
 
     steps:
       - name: Cancel Previous Runs
-        uses: styfle/cancel-workflow-action@0.12.1
+        uses: styfle/cancel-workflow-action@0.13.1
         with:
           all_but_latest: true
           access_token: ${{ secrets.STORM_BOT_GITHUB_TOKEN }}
@@ -76,7 +76,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v3.36.2
         with:
           languages: ${{ matrix.language }}
 
@@ -107,6 +107,6 @@ jobs:
         shell: bash
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v3.36.2
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/git-guardian.yml

@@ -16,13 +16,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.6.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: GitGuardian scan
-        uses: GitGuardian/ggshield/actions/secret@v1.39.0
+        uses: GitGuardian/ggshield/actions/secret@v1.51.0
         with:
           args:
             "--exclude pnpm-lock.yaml --exclude tools/config/verdaccio.yml

.github/workflows/greetings.yml

@@ -17,7 +17,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/first-interaction@v1
+      - uses: actions/first-interaction@v1.3.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           issue-message: "Thank you for your interest in this project! We will review this issue and reach out to you ASAP"

.github/workflows/labels.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
           token: ${{ secrets.STORMIE_GITHUB_TOKEN }}

.github/workflows/lock.yml

@@ -19,7 +19,7 @@ jobs:
     name: 🔒 Lock closed issues and PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@v5.0.1
         with:
           github-token: ${{ secrets.STORMIE_GITHUB_TOKEN }}
           issue-inactive-days: "30"

.github/workflows/release.yml

@@ -61,7 +61,7 @@ jobs:
       - start
     steps:
       - name: Checkout [Pull Request]
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.3.1
         if: ${{ github.event_name == 'pull_request' }}
         with:
           # By default, PRs will be checked-out based on the Merge Commit, but we want the actual branch HEAD.
@@ -72,7 +72,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout `main` branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.3.1
         if: ${{ github.event_name != 'pull_request' }}
         with:
           # We need to fetch all branches and commits so that Nx affected has a base to compare against.
@@ -90,7 +90,7 @@ jobs:
 
       - name: Derive appropriate SHAs for base and head for `nx affected` commands
         id: setSHAs
-        uses: nrwl/nx-set-shas@v4
+        uses: nrwl/nx-set-shas@v4.4.0
         with:
           main-branch-name: main
           workflow-id: release.yml

Cargo.toml

@@ -110,46 +110,46 @@ acidic-server = { path = "./crates/acidic-server" }
 acidic-template-engine = { path = "./crates/acidic-template-engine" }
 
 # Storm Software Crates
-storm-config = "0.2.8"
-storm-workspace = "0.19.59"
+storm-config = "=0.2.8"
+storm-workspace = "=0.19.257"
 
 # Other Dependencies
-indoc = "2.0.4"
-itertools = "0.12.1"
-indexmap = { version = "2.2.6", features = ["serde"] }
-thiserror = "2.0.17"
-tempfile = "3.10.1"
-directories = "5.0.1"
-lazy_static = "1.4.0"
-handlebars = "6.3.2"
-colored = "2.1.0"
-cacache = "13.0.0"
-backtrace = "0.3.71"
-protoc-bin-vendored = "3.0.0"
-
-napi = { version = '2.10.2', default-features = false, features = ['napi4'] }
-napi-build = '2.0.1'
-napi-derive = '2.9.3'
-
-pest = "2.7.8"
-pest_derive = "2.7.8"
-
-prost = "0.12.3"
-prost-types = "0.12.3"
-
-serde = { version = "1.0.197", features = ["derive"] }
-serde_derive = "1.0.197"
-serde_json = "1.0.115"
-
-strum = "0.27.2"
-strum_macros = "0.27.2"
-
-tonic = "0.11.0"
-tonic-build = { version = "0.11.0", default-features = false, features = [
+indoc = "=2.0.5"
+itertools = "=0.12.1"
+indexmap = { version = "=2.2.6", features = ["serde"] }
+thiserror = "=2.0.18"
+tempfile = "=3.10.1"
+directories = "=5.0.1"
+lazy_static = "=1.4.0"
+handlebars = "=6.4.1"
+colored = "=2.1.0"
+cacache = "=13.0.0"
+backtrace = "=0.3.71"
+protoc-bin-vendored = "=3.0.0"
+
+napi = { version = '=2.16.1', default-features = false, features = ['napi4'] }
+napi-build = '=2.1.2'
+napi-derive = '=2.16.1'
+
+pest = "=2.7.9"
+pest_derive = "=2.7.9"
+
+prost = "=0.12.3"
+prost-types = "=0.12.3"
+
+serde = { version = "=1.0.197", features = ["derive"] }
+serde_derive = "=1.0.197"
+serde_json = "=1.0.115"
+
+strum = "=0.27.2"
+strum_macros = "=0.27.2"
+
+tonic = "=0.11.0"
+tonic-build = { version = "=0.11.0", default-features = false, features = [
     "prost",
     "cleanup-markdown",
 ] }
-tonic-reflection = "0.6.0"
+tonic-reflection = "=0.6.0"
 
 [profile.release]
 # configuration adapted from oxc

apps/engine/Cargo.toml

@@ -18,11 +18,11 @@ acidic-rpc = { path = "../../crates/rpc" }
 tokio = { version = "1.37.0", features = ["rt-multi-thread", "macros"] }
 tokio-stream = "0.1.15"
 tokio-util = "0.7.10"
-tonic = "0.11.0"
-tonic-health = "0.11.0"
-tonic-types = "0.11.0"
-tonic-web = "0.11.0"
-tower-http = "0.5.2"
+tonic = "0.14.0"
+tonic-health = "0.14.0"
+tonic-types = "0.14.0"
+tonic-web = "0.14.0"
+tower-http = "0.6.0"
 tower-lsp-macros = "0.9.0"
 tracing = "0.1.40"
 tracing-subscriber = { version = "0.3.18", features = ["tracing-log", "fmt"] }

apps/vscode-extension/package.json

@@ -286,15 +286,15 @@
     "@storm-stack/logging": "latest",
     "@storm-stack/serialization": "latest",
     "@storm-stack/telemetry": "latest",
-    "@vscode/vsce": "2.21.1",
+    "@vscode/vsce": "2.32.0",
     "esbuild-plugin-pino": "^2.3.3",
     "eslint": "^8.57.1",
     "espree": "^9.6.1",
     "express": "^4.22.1",
     "langium": "^2.1.3",
     "pino-pretty": "^10.3.1",
-    "react": "18.2.0",
-    "react-dom": "18.2.0",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
     "react-error-boundary": "^4.1.2",
     "ts-pattern": "^5.9.0",
     "vscode-languageclient": "^9.0.1",

package.json

@@ -19,7 +19,7 @@
     "url": "https://github.com/sponsors/storm-software"
   },
   "license": "Apache-2.0",
-  "packageManager": "pnpm@10.26.0",
+  "packageManager": "pnpm@10.34.1",
   "engines": { "node": ">=22.14.0", "pnpm": ">=10.22.0" },
   "keywords": ["acidic", "storm-software", "storm"],
   "scripts": {

packages/node-engine/package.json

@@ -14,15 +14,15 @@
     "@storm-stack/telemetry": "latest",
     "@storm-stack/unique-identifier": "latest",
     "@storm-stack/utilities": "latest",
-    "bentocache": "1.0.0-beta.7",
+    "bentocache": "1.6.1",
     "chalk": "^5.6.2",
     "chokidar": "^3.6.0",
     "eslint": "^8.57.1",
     "glob": "^10.5.0",
     "handlebars": "^4.7.8",
     "handlebars-utils": "^1.0.6",
     "langium": "^2.1.3",
-    "prettier": "^3.7.4",
+    "prettier": "^3.8.3",
     "ts-morph": "^20.0.0",
     "vscode-uri": "^3.1.0",
     "zod": "^3.25.76",

packages/service-graph/package.json

@@ -38,8 +38,8 @@
     "@types/react": "^18.3.27"
   },
   "peerDependencies": {
-    "react": "18.2.0",
-    "react-dom": "18.2.0"
+    "react": "18.3.1",
+    "react-dom": "18.3.1"
   },
   "publishConfig": {
     "access": "public"