Pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
@arethetypeswrong/cli (source)	devDependencies	pin	^0.18.5 → 0.18.5
@aws-sdk/client-s3 (source)	devDependencies	pin	^3.1117.0 → 3.1117.0
@testing-library/dom	devDependencies	pin	^10.4.1 → 10.4.1
@testing-library/jest-dom	devDependencies	pin	^7.0.1 → 7.0.1
@testing-library/react	devDependencies	pin	^16.3.2 → 16.3.2
@testing-library/user-event	devDependencies	pin	^14.6.6 → 14.6.6
jsdom	devDependencies	pin	^30.0.1 → 30.0.1
publint (source)	devDependencies	pin	^0.3.24 → 0.3.24
react (source)	devDependencies	pin	^19.2.8 → 19.2.8
react-dom (source)	devDependencies	pin	^19.2.8 → 19.2.8
typescript (source)	devDependencies	pin	^7.0.2 → 7.0.2

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

? Verifying lockfile against supply-chain policies (354 entries)...
✗ Lockfile failed supply-chain policy check (354 entries in 8.5s)
[ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION] 92 lockfile entries failed verification:
  @aws-sdk/checksums@3.1000.29 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:06:52.197Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/client-s3@3.1117.0 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-24T19:02:28.742Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/core@3.977.9 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:12:55.198Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/credential-provider-env@3.972.70 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:08:59.148Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/credential-provider-http@3.972.72 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:07:59.200Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/credential-provider-ini@3.973.15 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:09:08.134Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/credential-provider-login@3.972.77 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:06:58.723Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/credential-provider-node@3.972.81 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:08:07.174Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/credential-provider-process@3.972.70 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:06:59.021Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/credential-provider-sso@3.973.14 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:07:07.085Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/credential-provider-web-identity@3.972.76 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:07:06.076Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/middleware-sdk-s3@3.972.75 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:09:20.251Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/nested-clients@3.997.44 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:08:01.680Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/signature-v4-multi-region@3.996.46 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:08:00.600Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/token-providers@3.1116.0 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:07:59.972Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/types@3.974.5 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:07:51.851Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @aws-sdk/xml-builder@3.972.40 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-21T19:08:52.969Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @oxc-project/runtime@0.146.0 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-19T08:38:01.000Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @oxc-project/types@0.146.0 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-19T08:36:12.000Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  @oxfmt/binding-android-arm-eabi@0.64.0 [MINIMUM_RELEASE_AGE_VIOLATION] was published at 2026-08-18T15:02:27.000Z, within the minimumReleaseAge cutoff (2026-08-17T19:46:37.133Z)
  …and 72 more

The lockfile contains entries that the active policies reject. This can mean the lockfile is stale, or that someone committed a lockfile that bypassed the policy locally — inspect recent changes to pnpm-lock.yaml before trusting it. If the changes look expected, run "pnpm clean --lockfile" and then "pnpm install" to rebuild from a fresh resolution. Alternatively, relax the policy that flagged them.