chore(deps): batch dependabot updates

[gre-ledger]

✅ Checklist

• Changeset added (pnpm changelog) — required for any library API or behaviour change
  • N/A: dev-tooling and CI only, no published library code changes
• Tests added or updated (or explain why not needed)
  • N/A: dependency bumps only
• pnpm build && pnpm typecheck && pnpm lint && pnpm test pass locally

📝 Description

Single PR replacing the 10 open Dependabot PRs, so the lockfile is resolved once instead of 6 sequential rebases.

npm (catalog + root devDeps)

package	from	to	PR
@swc/core	1.15.46	1.15.47	#32
@types/node	26.1.1	26.1.2	#34
knip	6.29.0	6.30.0	#33
nx	^23.1.0	^23.1.1	#35
oxfmt	0.60.0	0.61.0	#31
oxlint	1.75.0	1.76.0	#36

github-actions

action	from	to	PR
actions/checkout	v4	v7.0.1	#30
jdx/mise-action	v2	v4.2.3	#27
SonarSource/sonarqube-scan-action	v6	v8.2.1	#29
SonarSource/sonarqube-quality-gate-action	dc2f7b0	v1.2.0	#28

sonar.yml was added after #22 merged, so it still carried the old checkout/mise-action pins — those are now aligned with the other three workflows.

Note

Two deliberate deviations from the Dependabot proposals:

• sonarqube-quality-gate-action: Dependabot proposed 8e9b0ca, an untagged commit on the default branch (the existing dc2f7b0 pin was also untagged, with a stale # v1.1.0 comment). Pinned to the v1.2.0 release SHA instead, so future bumps track releases rather than drifting with master.
• sonarqube-scan-action v6 → v8 carries one breaking change: skipSignatureVerification now defaults to false, so the action GPG-verifies the downloaded scanner binary. Our steps pass no with: inputs, only SONAR_TOKEN, so nothing else changes — but this is the one item worth watching on the Sonar jobs in this PR's own CI run.

Local verification (all green): pnpm install --frozen-lockfile, pnpm build, pnpm typecheck, pnpm lint, pnpm test, pnpm format, pnpm knip.

🔗 Context

• JIRA: N/A
• Supersedes: chore(deps): bump jdx/mise-action from 2.4.4 to 4.2.3 #27 chore(deps): bump SonarSource/sonarqube-quality-gate-action from dc2f7b0dd95544cd550de3028f89193576e958b9 to 8e9b0ca0a7273d6f16986388d98393efdfcf56fd #28 chore(deps): bump SonarSource/sonarqube-scan-action from 6.0.0 to 8.2.1 #29 chore(deps): bump actions/checkout from 4.3.1 to 7.0.1 #30 chore(deps): bump oxfmt from 0.60.0 to 0.61.0 #31 chore(deps): bump @swc/core from 1.15.46 to 1.15.47 #32 chore(deps-dev): bump knip from 6.29.0 to 6.30.0 #33 chore(deps): bump @types/node from 26.1.1 to 26.1.2 #34 chore(deps-dev): bump nx from 23.1.0 to 23.1.1 #35 chore(deps): bump oxlint from 1.75.0 to 1.76.0 #36

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🟡 Human review recommended

It includes a large lockfile regeneration plus major GitHub Actions upgrades in CI paths (Sonar), which warrants a final human validation of the workflow behavior in CI.

Pull request overview

This PR consolidates multiple Dependabot updates into a single dependency + workflow bump, keeping the monorepo’s tooling (Nx/Knip/SWC/Oxlint/Oxfmt) and Sonar-related GitHub Actions pins current while minimizing lockfile churn.

Changes:

• Bump root dev-tooling dependencies (Nx, Knip) and pnpm catalog versions (@swc/core, @types/node, oxlint, oxfmt).
• Update GitHub Actions pins in Sonar/PR workflows (checkout, mise-action, Sonar scan, Sonar quality gate).
• Regenerate pnpm-lock.yaml to reflect the new resolved dependency graph.

File summaries

File	Description
pnpm-workspace.yaml	Updates catalog versions for shared tooling dependencies.
package.json	Bumps root devDependencies for Nx and Knip.
pnpm-lock.yaml	Lockfile regeneration reflecting updated tooling and transitive deps.
.github/workflows/sonar.yml	Aligns Sonar workflow action pins with newer releases (checkout/mise/sonar scan).
.github/workflows/pull_request.yml	Updates Sonar scan + quality gate action pins for PR checks.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 4/5 changed files
• Comments generated: 0
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[LL782]

Looks sane!

Caveat: I haven't done any manual testing