From ad60bd3a364c7deaf5dccf786bc821e16ca9802d Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 6 Mar 2026 05:38:08 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/auto-release.yml | 2 +-
 .github/workflows/build.yml        | 4 ++--
 package.json                       | 2 +-
 pnpm-lock.yaml                     | 4 +++-
 4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index eb4dea5..ec401d3 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '22.22.1'
 
       - name: Get swarm-cli version
         id: version
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f6d02a1..74f5f30 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,12 +18,12 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@v3
         with:
-          version: 9
+          version: 9.15.9
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '22.22.1'
           cache: 'pnpm'
 
       - name: Install dependencies
diff --git a/package.json b/package.json
index 85574b4..de1e269 100644
--- a/package.json
+++ b/package.json
@@ -16,6 +16,6 @@
     "@ethersphere/swarm-cli": "2.36.1"
   },
   "devDependencies": {
-    "@yao-pkg/pkg": "^6.8.0"
+    "@yao-pkg/pkg": "6.8.0"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a6c53d8..40af3f9 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -13,7 +13,7 @@ importers:
         version: 2.36.1
     devDependencies:
       '@yao-pkg/pkg':
-        specifier: ^6.8.0
+        specifier: 6.8.0
         version: 6.8.0
 
 packages:
@@ -719,6 +719,7 @@ packages:
   prebuild-install@7.1.1:
     resolution: {integrity: sha512-jAXscXWMcCK8GgCoHOfIr0ODh5ai8mj63L2nWrjuAgXE6tDyYGnx4/8o/rCgU+B4JSyZBKbeZqzhtwtC3ovxjw==}
     engines: {node: '>=10'}
+    deprecated: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
     hasBin: true
 
   process-nextick-args@2.0.1:
@@ -846,6 +847,7 @@ packages:
   tar@7.5.1:
     resolution: {integrity: sha512-nlGpxf+hv0v7GkWBK2V9spgactGOp0qvfWRxUMjqHyzrt3SgwE48DIv/FhqPHJYLHpgW1opq3nERbz5Anq7n1g==}
     engines: {node: '>=18'}
+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
 
   text-decoder@1.2.3:
     resolution: {integrity: sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==}