update publish action for better security

Author: amitguptagwl

.github/workflows/publish.yml

@@ -16,14 +16,14 @@ jobs:
     # uncomment the line below and use the same name. This lets you add a
     # required-reviewer gate in repo Settings > Environments if you want
     # one last manual "approve" click before publish actually runs.
-    # environment: npm-publish
+    environment: npm-publish
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: 24
           registry-url: 'https://registry.npmjs.org'
@@ -45,6 +45,6 @@ jobs:
         run: npm publish
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
         with:
           generate_release_notes: true

CHANGELOG.md

@@ -2,6 +2,9 @@
 
 Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion
 
+**5.9.2 / 2026-06-17*
+- dummy release to test changes in github action
+
 **5.9.1 / 2026-06-17*
 - dummy release to test release from github action