fix(security): patch CVE-2026-111497 runtime and vulnerable dependencies

.github/workflows/test.yml

@@ -10,10 +10,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v3
 
-      - name: Install Node v16
+      - name: Install Node v24
         uses: actions/setup-node@v3.0.0
         with:
-          node-version: 16
+          node-version: 24.22.1
 
       - name: Cache pnpm modules
         uses: actions/cache@v3
@@ -23,9 +23,9 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-
       - name: Install pnpm
-        uses: pnpm/action-setup@v2.2.1
+        uses: pnpm/action-setup@v4
         with:
-          version: 6.0.2
+          version: 8.15.9
 
       - name: Install dependencies
         run: pnpm i

index.test.js

@@ -50,7 +50,7 @@ test("an invalid scope", async () => {
 
 	expect(valid).toBe(false);
 	expect(errors[0].message).toBe(
-		"type must be one of [build, ci, docs, feat, fix, perf, refactor, revert, style, test]"
+		"type must be one of [build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test]"
 	);
 	expect(warnings).toStrictEqual([]);
 });

package.json

@@ -26,5 +26,17 @@
 		"husky": "^7.0.4",
 		"is-ci": "^3.0.1",
 		"jest": "^28.0.2"
+	},
+	"pnpm": {
+		"overrides": {
+			"minimatch@>=3.0.0 <3.1.4": "^3.1.4",
+			"lodash@>=4.0.0 <4.18.0": "^4.18.0",
+			"brace-expansion@>=1.0.0 <1.1.20": "^1.1.20",
+			"braces@>=3.0.0 <3.0.3": "^3.0.3",
+			"browserslist@>=4.0.0 <4.28.7": "^4.28.7",
+			"js-yaml@>=3.0.0 <3.15.2": "^3.15.2",
+			"picomatch@>=2.0.0 <2.3.2": "^2.3.2",
+			"semver@>=5.0.0 <5.7.2": "^5.7.2"
+		}
 	}
 }