chore(deps): pin dependencies (#13237)

renovate[bot] · web-flow · commit d4a28b6142e4 · 2026-05-12T16:29:57.000Z
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://redirect.github.com/actions/cache) | action | pinDigest | → `27d5ce7` | | [actions/checkout](https://redirect.github.com/actions/checkout) | action | pinDigest | → `de0fac2` | | [actions/create-github-app-token](https://redirect.github.com/actions/create-github-app-token) | action | pinDigest | → `d72941d` | | [actions/github-script](https://redirect.github.com/actions/github-script) | action | pinDigest | → `ed59741` | | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | pinDigest | → `48b55a0` | | [actions/stale](https://redirect.github.com/actions/stale) | action | pinDigest | → `b5d41d4` | | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | action | pinDigest | → `b7c566a` | | [andresz1/size-limit-action](https://redirect.github.com/andresz1/size-limit-action) | action | pinDigest | → `e7493a7` | | [benc-uk/workflow-dispatch](https://redirect.github.com/benc-uk/workflow-dispatch) | action | pinDigest | → `7a02764` | | [dessant/lock-threads](https://redirect.github.com/dessant/lock-threads) | action | pinDigest | → `7266a7c` | | [karpikpl/list-changed-files-action](https://redirect.github.com/karpikpl/list-changed-files-action) | action | pinDigest | → `18aa81a` | | [restackio/update-json-file-action](https://redirect.github.com/restackio/update-json-file-action) | action | pinDigest | → `6f50afe` | | [stefanzweifel/git-auto-commit-action](https://redirect.github.com/stefanzweifel/git-auto-commit-action) | action | pinDigest | → `04702ed` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/11062) for more information. --- ### Configuration 📅 **Schedule**: (in timezone America/Los_Angeles) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apollographql/apollo-client).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
diff --git a/.github/workflows/api-extractor.yml b/.github/workflows/api-extractor.yml
@@ -9,10 +9,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
 
diff --git a/.github/workflows/arethetypeswrong.yml b/.github/workflows/arethetypeswrong.yml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - name: Install dependencies (with cache)
diff --git a/.github/workflows/change-prerelease-tag.yml b/.github/workflows/change-prerelease-tag.yml
@@ -23,7 +23,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         id: github-actions-bot-app-token
         with:
           app-id: 819772
@@ -32,7 +32,7 @@ jobs:
       # Check out the repository, using the Github Actions Bot app's token so
       # that we can push later.
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ steps.github-actions-bot-app-token.outputs.token }}
           # Checkout release branch entered when workflow was kicked off
@@ -42,7 +42,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
 
@@ -53,7 +53,7 @@ jobs:
           npm i
 
       - name: Update prerelease tag in .changeset/pre.json
-        uses: restackio/update-json-file-action@2.1
+        uses: restackio/update-json-file-action@6f50afee9a03a456a30cd574123db793319f7544 # 2.1
         with:
           file: .changeset/pre.json
           fields: '{"tag": "${{github.event.inputs.tag}}"}'
diff --git a/.github/workflows/cleanup-checks.yml b/.github/workflows/cleanup-checks.yml
@@ -16,9 +16,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: add label
-        uses: actions/github-script@v8.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const script = (await import('${{ github.workspace }}/.github/workflows/cleanup-checks.mjs')).setup({context,core,github,exec,glob,io})
@@ -31,10 +31,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
 
@@ -56,7 +56,7 @@ jobs:
         run: npm run update-size-limits
 
       - name: Commit changes back
-        uses: stefanzweifel/git-auto-commit-action@v7
+        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
         with:
           commit_message: "Clean up Prettier, Size-limit, and Api-Extractor"
           push_options: ""
diff --git a/.github/workflows/close-stale-issues.yml b/.github/workflows/close-stale-issues.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Close Stale Issues
-        uses: actions/stale@v10.2.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           # # Token for the repository. Can be passed in using `{{ secrets.GITHUB_TOKEN }}`.
           # repo-token: # optional, default is ${{ github.token }}
diff --git a/.github/workflows/compare-build-output.yml b/.github/workflows/compare-build-output.yml
@@ -10,12 +10,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           # Fetch entire git history so we have the parent commit to compare against
           fetch-depth: 0
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - name: Install dependencies (with cache)
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
@@ -26,10 +26,10 @@ jobs:
     # If you do not check out your code, Copilot will do this for you.
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "24.x"
 
@@ -42,7 +42,7 @@ jobs:
 
       - name: Cache downloaded skills and instructions
         id: cache-skills
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: |
             .github/instructions/docs.instructions.md
diff --git a/.github/workflows/devtools-errorcodes.yml b/.github/workflows/devtools-errorcodes.yml
@@ -9,13 +9,13 @@ jobs:
   dispatch:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         id: github-actions-bot-app-token
         with:
           app-id: 819772
           private-key: ${{ secrets.APOLLO_GITHUB_ACTIONS_BOT_PRIVATE_KEY }}
           repositories: apollo-client-devtools
-      - uses: benc-uk/workflow-dispatch@v1
+      - uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 # v1
         with:
           workflow: update-errorcodes.yml
           repo: apollographql/apollo-client-devtools
diff --git a/.github/workflows/docmodel.yml b/.github/workflows/docmodel.yml
@@ -9,10 +9,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
 
@@ -23,7 +23,7 @@ jobs:
         run: npm run docmodel
 
       - name: Upload documentation model artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: client-api-documentation
           path: docs/public/client.api.json
diff --git a/.github/workflows/exit-prerelease.yml b/.github/workflows/exit-prerelease.yml
@@ -18,7 +18,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         id: github-actions-bot-app-token
         with:
           app-id: 819772
@@ -27,7 +27,7 @@ jobs:
       # Check out the repository, using the Github Actions Bot app's token so
       # that we can push later.
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ steps.github-actions-bot-app-token.outputs.token }}
           # Checkout release branch entered when workflow was kicked off
@@ -37,7 +37,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
 
diff --git a/.github/workflows/knip.yml b/.github/workflows/knip.yml
@@ -7,8 +7,8 @@ jobs:
     runs-on: ubuntu-latest
     name: Ubuntu/Node v20
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       - name: Install dependencies (with cache)
         uses: bahmutov/npm-install@v1
       - name: Run knip
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'apollographql/apollo-client'
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v6
+      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6
         with:
           github-token: ${{ github.token }}
           log-output: true
diff --git a/.github/workflows/publish-pr-releases.yml b/.github/workflows/publish-pr-releases.yml
@@ -14,22 +14,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
 
       - name: Check if any files in codegen/ changed
         id: changed-files-codegen
-        uses: karpikpl/list-changed-files-action@1.1.4
+        uses: karpikpl/list-changed-files-action@18aa81a078f5f0f2d7f3865414fff1eba2c29a25 # 1.1.4
         with:
           file-filter: "codegen/**"
 
       - name: Check if any files in scripts/codemods/ac3-to-ac4/ changed
         id: changed-files-codemod
-        uses: karpikpl/list-changed-files-action@1.1.4
+        uses: karpikpl/list-changed-files-action@18aa81a078f5f0f2d7f3865414fff1eba2c29a25 # 1.1.4
         with:
           file-filter: "scripts/codemods/ac3-to-ac4/**"
 
diff --git a/.github/workflows/scheduled-test-canary.yml b/.github/workflows/scheduled-test-canary.yml
@@ -23,10 +23,10 @@ jobs:
         tag: ${{ fromJson(github.event_name == 'workflow_dispatch' && inputs.tags || '["canary", "experimental"]') }}
         branch: ${{ fromJson(github.event_name == 'workflow_dispatch' && inputs.branches || '["main", "release-3.13", "release-4.0"]') }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ matrix.branch }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - uses: bahmutov/npm-install@v1
diff --git a/.github/workflows/size-limit.yml b/.github/workflows/size-limit.yml
@@ -10,14 +10,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - name: Install dependencies (with cache)
         uses: bahmutov/npm-install@v1
       - name: Run size-limit
-        uses: andresz1/size-limit-action@v1
+        uses: andresz1/size-limit-action@e7493a72a44b113341c0cf6186ab49c17c4b65c1 # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/sync-skill.yml b/.github/workflows/sync-skill.yml
@@ -9,13 +9,13 @@ jobs:
   dispatch:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@v1
+      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         id: github-actions-bot-app-token
         with:
           app-id: 819772
           private-key: ${{ secrets.APOLLO_GITHUB_ACTIONS_BOT_PRIVATE_KEY }}
           repositories: skills
-      - uses: benc-uk/workflow-dispatch@v1
+      - uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 # v1
         with:
           workflow: sync-apollo-client-skill.yml
           repo: apollographql/skills
