build(deps): upgrade Node.js to 26 and pnpm to 11

Update package manager configuration to pnpm 11.22.0 and Node.js requirement to Node 26 across Dockerfile, GitHub Actions workflows, root package.json, and workspace configurations.

Upgrade dependencies, update GitHub Action versions, and remove deprecated scorecard workflow.

.github/actions/setup-node-pnpm/action.yml

@@ -5,11 +5,11 @@ inputs:
   node-version:
     description: Node.js version to install.
     required: false
-    default: "24"
+    default: "26"
   pnpm-version:
     description: pnpm version to activate via Corepack.
     required: false
-    default: "10"
+    default: "11"
   install:
     description: Whether to run pnpm install.
     required: false
@@ -31,7 +31,7 @@ runs:
   using: composite
   steps:
     - name: Set up Node.js
-      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
 
@@ -51,7 +51,7 @@ runs:
 
     - name: Cache pnpm store
       if: ${{ inputs.cache == 'true' }}
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm-store.outputs.path }}
         key: ${{ runner.os }}-pnpm-${{ inputs.pnpm-version }}-store-${{ hashFiles(inputs.cache-dependency-path) }}

.github/workflows/ci.yml

@@ -21,8 +21,8 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  NODE_VERSION: "24"
-  PNPM_VERSION: "10"
+  NODE_VERSION: "26"
+  PNPM_VERSION: "11"
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
@@ -580,7 +580,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 

.github/workflows/crowdin-translations.yml

@@ -19,8 +19,8 @@ concurrency:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  NODE_VERSION: "24"
-  PNPM_VERSION: "10"
+  NODE_VERSION: "26"
+  PNPM_VERSION: "11"
 
 jobs:
   synchronize:

.github/workflows/e2e-runner.yml

@@ -28,8 +28,8 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  NODE_VERSION: "24"
-  PNPM_VERSION: "10"
+  NODE_VERSION: "26"
+  PNPM_VERSION: "11"
   E2E_DATABASE_URL: postgres://bookorbit:bookorbit@localhost:5432/bookorbit_e2e
   NODE_ENV: test
   JWT_SECRET: scanner-e2e-secret-1234

.github/workflows/e2e.yml

@@ -17,7 +17,7 @@ concurrency:
 permissions: read-all
 
 env:
-  NODE_VERSION: "24"
+  NODE_VERSION: "26"
 
 jobs:
   setup:
@@ -33,7 +33,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 

.github/workflows/release.yml

@@ -15,8 +15,8 @@ permissions: read-all
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  NODE_VERSION: "24"
-  PNPM_VERSION: "10"
+  NODE_VERSION: "26"
+  PNPM_VERSION: "11"
 
 jobs:
   commitlint:

.github/workflows/repo-charts.yml

@@ -34,9 +34,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 26
 
       - name: Test generators
         run: node --test scripts/star-history/generate.test.mjs scripts/crowdin-stats/generate.test.mjs

.github/workflows/scorecard.yml

@@ -1,51 +0,0 @@
-name: OpenSSF Scorecard
-
-on:
-  branch_protection_rule:
-  push:
-    branches: [main]
-  schedule:
-    - cron: "30 1 * * 6"
-  workflow_dispatch:
-
-concurrency:
-  group: scorecard-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  analysis:
-    name: Scorecard analysis
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'branch_protection_rule'
-    permissions:
-      actions: read # Read workflow metadata used by Scorecard checks.
-      contents: read # Read the repository being analyzed.
-      id-token: write # Publish signed Scorecard results.
-      security-events: write # Upload the SARIF report to code scanning.
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Run Scorecard
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: scorecard-results
-          path: results.sarif
-          retention-days: 5
-
-      - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
-        with:
-          sarif_file: results.sarif