{"agent":"claude","input":"Pin every third-party uses: line in .github/workflows to the full commit SHA of its latest release, written as owner/repo@<sha> # vX.Y.Z; leave the local uses: ./ alone and check release notes for removed inputs on any major jump. Upgrade the npm dependencies to the latest compatible versions with npm, run npm run all, and commit the rebuilt dist/ so check-dist passes. Leave out any upgrade that breaks the build or tests and say why. Open a pull request with one line per bump, actions and npm packages listed separately.","resources":[{"url":"https://github.com/your-org/your-app"}]}