Fix failing CI security gate and deprecated Actions runtimes

.github/workflows/ci.yml

@@ -16,31 +16,34 @@ concurrency:
 jobs:
   verify:
     name: Type, lint, test, benchmark, build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v4.4.0
         with:
           run_install: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22.13.0
           cache: pnpm
 
       - name: Install locked dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Reject moderate, high, or critical dependency advisories
-        run: pnpm audit --audit-level moderate
+      # QueueProof deploys the production dependency graph to Vercel. Cloudflare
+      # compatibility and CSS build tooling remain development-only and are not
+      # shipped in the production runtime.
+      - name: Reject production dependency advisories
+        run: pnpm audit:dependencies
 
       - name: Verify full-history secret-scan guard
         run: node scripts/test-secret-scan.mjs

.github/workflows/release-evidence.yml

@@ -22,17 +22,17 @@ jobs:
       QUEUEPROOF_URL: https://queueproof.vercel.app
     steps:
       - name: Check out exact release
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v4.4.0
         with:
           run_install: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22.13.0
           cache: pnpm
@@ -70,7 +70,7 @@ jobs:
 
       - name: Preserve benchmark receipts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: queueproof-release-evidence-${{ github.sha }}
           path: |

package.json

@@ -36,7 +36,7 @@
     "benchmark:router": "node --experimental-strip-types scripts/run-evals.mjs --fixture",
     "benchmark:pdf": "node scripts/run-pdf-benchmark.mjs",
     "eval": "node --experimental-strip-types scripts/run-evals.mjs",
-    "audit:dependencies": "pnpm audit --audit-level moderate",
+    "audit:dependencies": "pnpm audit --prod --audit-level moderate",
     "scan:secrets": "node scripts/secret-scan.mjs",
     "doctor": "node scripts/doctor.mjs",
     "seed:test": "node scripts/seed-test.mjs",
@@ -89,6 +89,7 @@
     "fast-uri": "3.1.5",
     "hono": "4.13.0",
     "js-yaml": "4.3.1",
+    "nanoid": "3.3.17",
     "postcss": "8.5.25",
     "undici": "7.29.0"
   },