ci: pin GitHub Actions by commit-hash

Ref: https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash

.github/workflows/lint.yml

@@ -10,10 +10,10 @@ jobs:
   lint:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v5.0.0"
+      - uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8" # v5.0.0
 
       - name: "Setup Node.js"
-        uses: "actions/setup-node@v5.0.0"
+        uses: "actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903" # v6.0.0
         with:
           node-version: "lts/*"
           cache: "npm"

.github/workflows/release.yml

@@ -13,13 +13,13 @@ jobs:
       pull-requests: "write"
       id-token: "write"
     steps:
-      - uses: "actions/checkout@v5.0.0"
+      - uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8" # v5.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: "Setup Node.js"
-        uses: "actions/setup-node@v5.0.0"
+        uses: "actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903" # v6.0.0
         with:
           node-version: "lts/*"
           cache: "npm"

.github/workflows/test.yml

@@ -10,10 +10,10 @@ jobs:
   test:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v5.0.0"
+      - uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8" # v5.0.0
 
       - name: "Setup Node.js"
-        uses: "actions/setup-node@v5.0.0"
+        uses: "actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903" # v6.0.0
         with:
           node-version: "lts/*"
           cache: "npm"

.oxlintrc.json

@@ -164,6 +164,7 @@
     "arrow-body-style": ["error", "always"],
     "promise/param-names": "error",
     "promise/no-new-statics": "error",
+    "promise/no-multiple-resolved": "error",
     "promise/no-nesting": "error",
     "unicorn/catch-error-name": "error",
     "unicorn/consistent-date-clone": "error",
@@ -171,6 +172,7 @@
     "unicorn/escape-case": "error",
     "unicorn/explicit-length-check": "error",
     "unicorn/new-for-builtins": "error",
+    "unicorn/no-array-callback-reference": "error",
     "unicorn/no-array-for-each": "error",
     "unicorn/no-array-method-this-argument": "error",
     "unicorn/no-document-cookie": "error",

README.md

@@ -37,10 +37,10 @@ More information about **formatting rules** vs **code-quality rules** can be fou
 npm install --save-dev \
   eslint@^9.22.0 \
   eslint-plugin-promise@^7.2.1 \
-  eslint-plugin-unicorn@^61.0.0 \
+  eslint-plugin-unicorn@^62.0.0 \
   eslint-plugin-import-x@^4.6.1 \
   globals@^16.0.0 \
-  typescript@^5.8.3 \
+  typescript@^5.9.3 \
   typescript-eslint@^8.32.0 \
   eslint-config-conventions@latest
 ```

package.json

@@ -49,7 +49,7 @@
   "peerDependencies": {
     "eslint": "^9.22.0",
     "eslint-plugin-promise": "^7.2.1",
-    "eslint-plugin-unicorn": "^61.0.0",
+    "eslint-plugin-unicorn": "^61.0.0 || ^62.0.0",
     "eslint-plugin-import-x": "^4.6.1",
     "globals": "^16.0.0",
     "typescript-eslint": "^8.32.0"
@@ -75,18 +75,18 @@
     }
   },
   "devDependencies": {
-    "@types/node": "24.7.0",
+    "@types/node": "24.9.1",
     "globals": "16.4.0",
-    "editorconfig-checker": "6.1.0",
-    "oxlint": "1.20.0",
-    "@oxlint/migrate": "1.20.0",
-    "eslint": "9.37.0",
+    "editorconfig-checker": "6.1.1",
+    "oxlint": "1.24.0",
+    "@oxlint/migrate": "1.24.0",
+    "eslint": "9.38.0",
     "eslint-plugin-promise": "7.2.1",
-    "eslint-plugin-unicorn": "61.0.2",
+    "eslint-plugin-unicorn": "62.0.0",
     "eslint-plugin-import-x": "4.16.1",
-    "typescript-eslint": "8.46.0",
+    "typescript-eslint": "8.46.2",
     "prettier": "3.6.2",
-    "semantic-release": "24.2.9",
+    "semantic-release": "25.0.1",
     "typescript": "5.9.3"
   }
 }