From ce7b47f2dc45ec00879fe3211b86206acfbdc671 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 20:43:08 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/auto-release.yml | 2 +-
 .github/workflows/build.yml        | 6 +++---
 package.json                       | 2 +-
 pnpm-lock.yaml                     | 4 +++-
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index eb4dea5..d4a8652 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '22.22.2'
 
       - name: Get swarm-cli version
         id: version
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f6d02a1..6630532 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,14 +16,14 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@v3.0.0
         with:
-          version: 9
+          version: 9.15.9
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '22.22.2'
           cache: 'pnpm'
 
       - name: Install dependencies
diff --git a/package.json b/package.json
index 85574b4..de1e269 100644
--- a/package.json
+++ b/package.json
@@ -16,6 +16,6 @@
     "@ethersphere/swarm-cli": "2.36.1"
   },
   "devDependencies": {
-    "@yao-pkg/pkg": "^6.8.0"
+    "@yao-pkg/pkg": "6.8.0"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a6c53d8..40af3f9 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -13,7 +13,7 @@ importers:
         version: 2.36.1
     devDependencies:
       '@yao-pkg/pkg':
-        specifier: ^6.8.0
+        specifier: 6.8.0
         version: 6.8.0
 
 packages:
@@ -719,6 +719,7 @@ packages:
   prebuild-install@7.1.1:
     resolution: {integrity: sha512-jAXscXWMcCK8GgCoHOfIr0ODh5ai8mj63L2nWrjuAgXE6tDyYGnx4/8o/rCgU+B4JSyZBKbeZqzhtwtC3ovxjw==}
     engines: {node: '>=10'}
+    deprecated: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
     hasBin: true
 
   process-nextick-args@2.0.1:
@@ -846,6 +847,7 @@ packages:
   tar@7.5.1:
     resolution: {integrity: sha512-nlGpxf+hv0v7GkWBK2V9spgactGOp0qvfWRxUMjqHyzrt3SgwE48DIv/FhqPHJYLHpgW1opq3nERbz5Anq7n1g==}
     engines: {node: '>=18'}
+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
 
   text-decoder@1.2.3:
     resolution: {integrity: sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==}