From d71d17641bbdafa53541693c76b7bdafb35422b0 Mon Sep 17 00:00:00 2001
From: Nora Blomaard <n.blomaard@gmail.com>
Date: Wed, 20 May 2026 13:21:37 +0200
Subject: [PATCH 1/2] ci: update GitHub Actions

---
 .github/workflows/pr-preview.yml        | 2 +-
 .github/workflows/release-please.yml    | 4 ++--
 .github/workflows/test-and-build.yml    | 2 +-
 .github/workflows/test.yml              | 4 ++--
 .github/workflows/update-release-pr.yml | 4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index 6b34e59938..a0877bba95 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -25,7 +25,7 @@ jobs:
           submodules: "true"
 
       - name: Use Node.js 20.x
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e #v6.4.0
         with:
           node-version: "20.x"
 
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index ade78fc9cc..28928025fe 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -12,7 +12,7 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 #v4.4.0
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 #v5.0.0
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -21,7 +21,7 @@ jobs:
         with:
           submodules: "true"
         if: ${{ steps.release.outputs.releases_created }}
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6.3.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e #v6.4.0
         with:
           node-version: "20.x"
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/test-and-build.yml b/.github/workflows/test-and-build.yml
index 64d4e6f036..b5044bdc18 100644
--- a/.github/workflows/test-and-build.yml
+++ b/.github/workflows/test-and-build.yml
@@ -10,7 +10,7 @@ jobs:
         with:
           submodules: "true"
       - name: Use Node.js 18.x
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e #v6.4.0
         with:
           node-version: "18.x"
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 12bfc92f87..ffd08e07bf 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v2.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
 
       - name: Use Node.js 18.x
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e #v6.4.0
         with:
           node-version: "18.x"
 
diff --git a/.github/workflows/update-release-pr.yml b/.github/workflows/update-release-pr.yml
index f41269a74d..7f92067384 100644
--- a/.github/workflows/update-release-pr.yml
+++ b/.github/workflows/update-release-pr.yml
@@ -16,12 +16,12 @@ jobs:
       pull-requests: write
     
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
         with:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
       
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e #v6.4.0
         with:
           node-version: '20'
       

From 375f58d479a18c17b9a8927de5bd2cc7a13bbb95 Mon Sep 17 00:00:00 2001
From: Nora Blomaard <n.blomaard@gmail.com>
Date: Wed, 20 May 2026 13:21:53 +0200
Subject: [PATCH 2/2] ci: add dependabot config

---
 .github/dependabot.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..70552485c7
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: 2022 Alliander N.V.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+version: 2
+
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "dependencies"
+      - "github-actions"
\ No newline at end of file