sync: traer a develop la segunda tanda del triaje de Dependabot (#730, #732, #734, #735, #738)

.github/dependabot.yml

@@ -9,8 +9,19 @@ updates:
       # Un major por paquete rompe los 5 workspaces (ver PRs #720 y #721, cerrados).
       - dependency-name: "@nestjs/*"
         update-types: ["version-update:semver-major"]
+      # nestjs-pino 5.x exige Node >= 22.12 y el repo corre en Node 20 por diseño
+      # (engines raíz `>=20 <21`, imágenes node:20-alpine). Es una migración de
+      # runtime, no un bump (ver PR #727, cerrado).
+      - dependency-name: "nestjs-pino"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: monthly
+    groups:
+      # init, autobuild, analyze y upload-sarif tienen que moverse JUNTOS: analyze
+      # rechaza la configuración escrita por un init de otra versión (ver PRs #731
+      # y #733, cerrados). Dependabot los trata como dependencias distintas.
+      codeql-action:
+        patterns: ["github/codeql-action*"]

.github/workflows/ci-cd.yml

@@ -927,7 +927,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build ${{ matrix.service }} (push only from main/tags)
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}

.github/workflows/docker-images.yml

@@ -52,7 +52,7 @@ jobs:
 
       - name: Compute tags
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ghcr.io/${{ github.repository_owner }}/${{ matrix.name }}
           # `type=ref,event=tag` publishes the git tag VERBATIM — `v1.1.0`, with
@@ -74,7 +74,7 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           # Build context is the repository root for all services (the Dockerfiles
           # COPY repo-relative paths; agent-runtime builds the workspace packages).

.github/workflows/openssf-scorecard.yml

@@ -112,7 +112,7 @@ jobs:
           retention-days: 90
 
       - name: Upload results to code scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: scorecard-results.sarif
 

.github/workflows/published-canary.yml

@@ -67,7 +67,7 @@ jobs:
       # duplicated, so a week of red is one thread and not seven.
       - name: Open or update the canary issue
         if: failure() && github.event_name == 'schedule'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
@@ -106,7 +106,7 @@ jobs:
       # healthy again the thread says so and closes itself.
       - name: Close the canary issue when the registry is healthy again
         if: success() && github.event_name == 'schedule'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const existing = await github.rest.issues.listForRepo({

.github/workflows/sdk-cli-ci.yml

@@ -421,16 +421,16 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           languages: javascript-typescript
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           category: "/language:javascript-typescript"
 
@@ -457,7 +457,7 @@ jobs:
           severity: 'CRITICAL,HIGH'
 
       - name: Upload Trivy SARIF Report
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

src/apps/core-api/package.json

@@ -42,7 +42,6 @@
     "helmet": "8.2.0",
     "keyv": "5.6.0",
     "nestjs-pino": "4.6.1",
-    "passport-custom": "1.1.1",
     "pino": "10.3.1",
     "pino-http": "11.0.0",
     "prom-client": "15.1.3",

src/packages/agent-runtime/package.json

@@ -44,7 +44,7 @@
   },
   "dependencies": {
     "@beyondnet/evolith-core-domain": "^1.3.0",
-    "yaml": "2.9.0"
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "@types/jest": "30.0.0",

src/packages/core-domain/package.json

@@ -106,7 +106,7 @@
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
     "typescript": "6.0.3",
-    "yaml": "2.9.0",
+    "yaml": "2.9.1",
     "zod": "4.4.3"
   },
   "peerDependencies": {

src/packages/infra-providers/package.json

@@ -33,7 +33,7 @@
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
     "fs-extra": "10.1.0",
-    "yaml": "2.9.0"
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "@types/fs-extra": "11.0.4",

src/packages/mcp-server/package.json

@@ -68,7 +68,7 @@
     "prom-client": "15.1.3",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2",
-    "yaml": "2.9.0"
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "@nestjs/cli": "11.0.24",

src/sdk/cli/package.json

@@ -94,7 +94,7 @@
     "inherits": "2.0.4",
     "nest-commander": "3.20.1",
     "path-to-regexp": "8.4.2",
-    "yaml": "2.9.0"
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "@nestjs/testing": "11.1.28",