Merge pull request #612 from BloomBooks/BL_harden_deps_pnpm

Follow-up on pnpm

Author: andrew-polk

.github/workflows/build-and-deploy.yml

@@ -14,10 +14,10 @@ jobs:
 
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v3
+              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
             - name: Install Vite+ (manages Node.js and pnpm)
-              uses: voidzero-dev/setup-vp@v1
+              uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1.12.0
               with:
                   version: 0.1.24
                   node-version-file: .node-version

.github/workflows/lighthouse.yml

@@ -13,9 +13,9 @@ jobs:
         runs-on: ubuntu-latest
         if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'master') }}
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             - name: Audit root using Lighthouse
-              uses: treosh/lighthouse-ci-action@v12
+              uses: treosh/lighthouse-ci-action@3e7e23fb74242897f95c0ba9cabad3d0227b9b18 # 12.6.2
               with:
                   urls: |
                       https://alpha.bloomlibrary.org
@@ -26,7 +26,7 @@ jobs:
             # We have to run this separately with a separate budget file because the redirect causes
             # lighthouse to think we are running at the root
             - name: Audit /covid19 using Lighthouse
-              uses: treosh/lighthouse-ci-action@v12
+              uses: treosh/lighthouse-ci-action@3e7e23fb74242897f95c0ba9cabad3d0227b9b18 # 12.6.2
               with:
                   urls: |
                       https://alpha.bloomlibrary.org/covid19

package.json

@@ -17,7 +17,7 @@
         "crowdin-download": "crowdin download sources --config src/translations/crowdin.yml && crowdin download --config src/translations/crowdin.yml",
         "lint": "eslint \"src/**/!(*.d).ts{,x}\"",
         "prepare": "husky install",
-        "postinstall": "patch-package && husky install && shx rm -rf .git/hooks && shx ln -s ../.husky .git/hooks"
+        "postinstall": "husky install && shx rm -rf .git/hooks && shx ln -s ../.husky .git/hooks"
     },
     "dependencies": {
         "@contentful/rich-text-react-renderer": "15.22.11",
@@ -137,8 +137,6 @@
         "jsdom": "25.0.1",
         "lint-staged": "10.5.4",
         "ncp": "2.0.0",
-        "patch-package": "6.4.7",
-        "postinstall-postinstall": "2.1.0",
         "prettier": "2.2.1",
         "pretty-quick": "3.1.0",
         "react-select": "3.2.0",