V5.14.4 proposal (#337)

* Fix release tag push and pin actions by SHA (#335)

The release workflow's tag push was rejected by the tag ruleset because
actions/checkout persisted GITHUB_TOKEN credentials, which took precedence
over the dd-octo-sts token in the explicit push URL. Drop the persisted
credentials and downgrade contents permission to read.

Also pin actions/download-artifact and actions/setup-node by commit SHA.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Specify node-gyp-build to major v4 (#336)

* build(deps-dev): bump @types/node from 25.7.0 to 25.9.1 (#333)

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.7.0 to 25.9.1.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Attila Szegedi <szegedi@users.noreply.github.com>

* v5.14.4

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Christoph Hamsen <37963496+xopham@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Attila Szegedi <szegedi@users.noreply.github.com>

Author: 5 people

.github/workflows/release.yml

@@ -25,16 +25,18 @@ jobs:
     environment: npm
     permissions:
       id-token: write # Required for OIDC
-      contents: write
+      contents: read
     steps:
       - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
         id: octo-sts
         with:
           scope: DataDog/pprof-nodejs
           policy: self.github.release.push-tags
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-      - uses: actions/download-artifact@v4
-      - uses: actions/setup-node@v3
+        with:
+          persist-credentials: false # drop GITHUB_TOKEN so the dd-octo-sts token is used for the tag push
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
@@ -58,8 +60,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-      - uses: actions/download-artifact@v4
-      - uses: actions/setup-node@v3
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@datadog/pprof",
-  "version": "5.14.3",
+  "version": "5.14.4",
   "description": "pprof support for Node.js",
   "repository": {
     "type": "git",
@@ -36,13 +36,13 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "node-gyp-build": "<5.0",
+    "node-gyp-build": "^4.8.4",
     "pprof-format": "^2.2.1",
     "source-map": "^0.7.4"
   },
   "devDependencies": {
     "@types/mocha": "^10.0.1",
-    "@types/node": "25.7.0",
+    "@types/node": "25.9.1",
     "@types/semver": "^7.5.8",
     "@types/sinon": "^21.0.1",
     "@types/tmp": "^0.2.3",