fix(deps): pin dependencies

.github/workflows/next-build-image.yaml

@@ -233,7 +233,7 @@ jobs:
             fetch-depth: 0
 
         - name: Download digests
-          uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+          uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
           with:
             path: /tmp/digests
             pattern: digests-*

.github/workflows/pr-podman-push.yaml

@@ -138,7 +138,7 @@ jobs:
       - name: Download Skip Status Artifact
         if: ${{ github.event.workflow_run.conclusion == 'success' }}
         id: download-skip-status
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         env:
           SKIP_ARTIFACT_NAME: ${{ steps.get-artifact-name.outputs.skip_artifact_name }}
         with:
@@ -173,7 +173,7 @@ jobs:
 
       - name: Download Image Artifacts
         if: ${{ github.event.workflow_run.conclusion == 'success' && steps.check-skip.outputs.is_skipped != 'true' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         env:
           ARTIFACT_NAME: ${{ steps.get-artifact-name.outputs.artifact_name }}
         with:

.github/workflows/push-e2e-runner.yaml

@@ -177,7 +177,7 @@ jobs:
         uses: ./.github/actions/get-sha
 
       - name: Download digests
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: /tmp/digests
           pattern: digests-*

package.json

@@ -57,7 +57,7 @@
     "turbo": "2.10.12"
   },
   "resolutions": {
-    "refractor@npm:3.6.0/prismjs": "^1.30.0"
+    "refractor@npm:3.6.0/prismjs": "1.30.0"
   },
   "jest": {
     "testTimeout": 20000

packages/app/package.json

@@ -93,7 +93,7 @@
     "@red-hat-developer-hub/backstage-plugin-theme": "1.3.0",
     "@red-hat-developer-hub/backstage-plugin-translations": "0.6.0",
     "history": "5.3.0",
-    "lodash": "^4.17.21",
+    "lodash": "4.18.1",
     "material-icons": "1.13.14",
     "react": "18.3.1",
     "react-dom": "18.3.1",
@@ -102,7 +102,7 @@
     "react-use": "17.6.1",
     "tss-react": "4.9.21",
     "zen-observable": "0.10.0",
-    "zod": "^4.0.0"
+    "zod": "4.6.5"
   },
   "devDependencies": {
     "@backstage/frontend-test-utils": "0.6.3",
@@ -112,7 +112,7 @@
     "@testing-library/react": "14.3.1",
     "@testing-library/user-event": "14.6.7",
     "@types/jquery": "3.5.34",
-    "@types/lodash": "^4.17.21",
+    "@types/lodash": "4.17.25",
     "@types/react": "18.3.31",
     "@types/react-dom": "18.3.7",
     "@types/zen-observable": "0.8.7",

packages/backend/package.json

@@ -51,7 +51,7 @@
     "@backstage/plugin-user-settings-backend": "0.4.6",
     "@internal/plugin-dynamic-plugins-info-backend": "workspace:*",
     "@internal/plugin-licensed-users-info-backend": "workspace:*",
-    "@module-federation/sdk": "^2.3.3",
+    "@module-federation/sdk": "2.8.1",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/auto-instrumentations-node": "0.78.0",
     "@opentelemetry/core": "2.9.0",

yarn.lock

@@ -10765,7 +10765,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/lodash@npm:^4.17.21":
+"@types/lodash@npm:4.17.25":
   version: 4.17.25
   resolution: "@types/lodash@npm:4.17.25"
   checksum: 10c0/ca2049f16bf527e04d6e27702e3912a484faaff587de77a5c58e0d243b9292a655e1d7f7e5bdf2ffdf49a76da10673097f8dd4901990679058d47ccd99051877
@@ -12302,13 +12302,13 @@ __metadata:
     "@testing-library/react": "npm:14.3.1"
     "@testing-library/user-event": "npm:14.6.7"
     "@types/jquery": "npm:3.5.34"
-    "@types/lodash": "npm:^4.17.21"
+    "@types/lodash": "npm:4.17.25"
     "@types/react": "npm:18.3.31"
     "@types/react-dom": "npm:18.3.7"
     "@types/zen-observable": "npm:0.8.7"
     cross-env: "npm:7.0.3"
     history: "npm:5.3.0"
-    lodash: "npm:^4.17.21"
+    lodash: "npm:4.18.1"
     material-icons: "npm:1.13.14"
     prettier: "npm:3.9.6"
     react: "npm:18.3.1"
@@ -12319,7 +12319,7 @@ __metadata:
     tss-react: "npm:4.9.21"
     typescript: "npm:5.9.3"
     zen-observable: "npm:0.10.0"
-    zod: "npm:^4.0.0"
+    zod: "npm:4.6.5"
   languageName: unknown
   linkType: soft
 
@@ -12870,7 +12870,7 @@ __metadata:
     "@backstage/types": "npm:1.2.2"
     "@internal/plugin-dynamic-plugins-info-backend": "workspace:*"
     "@internal/plugin-licensed-users-info-backend": "workspace:*"
-    "@module-federation/sdk": "npm:^2.3.3"
+    "@module-federation/sdk": "npm:2.8.1"
     "@opentelemetry/api": "npm:1.9.1"
     "@opentelemetry/auto-instrumentations-node": "npm:0.78.0"
     "@opentelemetry/core": "npm:2.9.0"
@@ -21608,7 +21608,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash@npm:^4.16.4, lodash@npm:^4.17.15, lodash@npm:^4.17.20, lodash@npm:^4.17.21, lodash@npm:^4.17.4, lodash@npm:^4.18.1":
+"lodash@npm:4.18.1, lodash@npm:^4.16.4, lodash@npm:^4.17.15, lodash@npm:^4.17.20, lodash@npm:^4.17.21, lodash@npm:^4.17.4, lodash@npm:^4.18.1":
   version: 4.18.1
   resolution: "lodash@npm:4.18.1"
   checksum: 10c0/757228fc68805c59789e82185135cf85f05d0b2d3d54631d680ca79ec21944ec8314d4533639a14b8bcfbd97a517e78960933041a5af17ecb693ec6eecb99a27
@@ -25117,7 +25117,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"prismjs@npm:^1.30.0":
+"prismjs@npm:1.30.0, prismjs@npm:^1.30.0":
   version: 1.30.0
   resolution: "prismjs@npm:1.30.0"
   checksum: 10c0/f56205bfd58ef71ccfcbcb691fd0eb84adc96c6ff21b0b69fc6fdcf02be42d6ef972ba4aed60466310de3d67733f6a746f89f2fb79c00bf217406d465b3e8f23
@@ -30838,7 +30838,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"zod@npm:^3.25 || ^4.0, zod@npm:^3.25.76 || ^4.0.0, zod@npm:^4.0.0, zod@npm:^4.1.13, zod@npm:^4.2.0, zod@npm:^4.3.6":
+"zod@npm:4.6.5, zod@npm:^3.25 || ^4.0, zod@npm:^3.25.76 || ^4.0.0, zod@npm:^4.0.0, zod@npm:^4.1.13, zod@npm:^4.2.0, zod@npm:^4.3.6":
   version: 4.6.5
   resolution: "zod@npm:4.6.5"
   checksum: 10c0/32eb6c5e98becbe045675b2141c3611451c16ba567f9779231d79af41c4d651ca1c22f154aef7e6c6e77b929f23e43f1154ca05b82e119e922353725d6776af5