[mpsq]

PE-1695

• Updates pnpm to 12.12.1 and regenerates the lockfile. Only a few indirect dependencies moved, and pnpm audit is clean.
• pnpm now pins new dependencies to exact versions (saveExact).
• Dependabot can open up to 15 PRs at once, so majors (one PR each) no longer stall the queue.
• Every workflow job now gets only the permissions it needs, and a timeout.
• CodeQL now also checks our workflow files for risky third-party actions.

After merging: watch the first npm release, since the publish job's permissions moved.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The changes since the previous review appear safe to merge.

_{Reviews (4) · Last reviewed commit: "Run CodeQL on GitHub-hosted runners" · Reviewed by Greptile}