Supply chain measures

.github/workflows/bump.yml

@@ -27,6 +27,7 @@ on:
           - prerelease
 
 permissions:
+  id-token: none
   contents: write
 
 jobs:

.github/workflows/codeql-analysis.yml

@@ -25,6 +25,7 @@ jobs:
     name: Analyze
     runs-on: ubuntu-latest
     permissions:
+      id-token: none
       actions: read
       contents: read
       security-events: write

.github/workflows/headers.yml

@@ -6,6 +6,7 @@ on:
     - cron: "0 0 * * 0" # Runs every Sunday at midnight UTC
 
 permissions:
+  id-token: none
   contents: write # Grants write access to push changes
   pull-requests: write # and create PRs
 

.github/workflows/node.js.yml

@@ -9,6 +9,10 @@ on:
   pull_request:
     branches: [ master, v25, v26, v27 ]
 
+permissions:
+  id-token: none
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

express-zod-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "express-zod-api",
-  "version": "28.0.1-beta.0",
+  "version": "28.0.1-beta.1",
   "description": "A Typescript framework to help you get an API server up and running with I/O schema validation and custom middlewares in minutes.",
   "license": "MIT",
   "repository": {

pnpm-workspace.yaml

@@ -11,6 +11,7 @@ gitChecks: false
 engineStrict: true
 autoInstallPeers: false
 dedupePeers: true
+minimumReleaseAge: 10080
 publicHoistPattern:
   - "@typescript-eslint/*" # used as an assumed transitive in migration
   - "@vitest/*" # used by vitest.setup.ts and vitest.config.ts

renovate.json

@@ -4,7 +4,7 @@
   "dependencyDashboard": false,
   "postUpdateOptions": ["pnpmDedupe"],
   "ignorePaths": ["**/compat-test/**"],
-  "minimumReleaseAge": "1 day",
+  "minimumReleaseAge": "7 days",
   "packageRules": [
     {
       "groupName": "TypeScript-ESLint and its rule tester",