[Backport 8.x] Pin dependencies

.buildkite/Dockerfile

@@ -1,5 +1,5 @@
 ARG NODE_VERSION=${NODE_VERSION:-18}
-FROM node:$NODE_VERSION
+FROM node:latest@sha256:840dad0077213cadd2d734d542ae11cd0f648200be29504eb1b6e2c995d2b75a:$NODE_VERSION
 
 # Install required tools
 RUN apt-get clean -y && \

.buildkite/Dockerfile-make

@@ -1,5 +1,5 @@
 ARG NODE_JS_VERSION=${NODE_JS_VERSION:-18}
-FROM node:${NODE_JS_VERSION}
+FROM node:latest@sha256:840dad0077213cadd2d734d542ae11cd0f648200be29504eb1b6e2c995d2b75a:${NODE_JS_VERSION}
 
 ARG BUILDER_UID=1000
 ARG BUILDER_GID=1000

.github/workflows/nodejs.yml

@@ -11,10 +11,10 @@ jobs:
     outputs:
       src-only: "${{ steps.changes.outputs.src-only }}"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
-      - uses: dorny/paths-filter/@v3.0.2
+      - uses: dorny/paths-filter/@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: changes
         with:
           filters: |
@@ -36,12 +36,12 @@ jobs:
         os: [ubuntu-latest, windows-latest, macOS-latest]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -62,12 +62,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
         with:
           node-version: 22.x
 
@@ -92,12 +92,12 @@ jobs:
         os: [ubuntu-latest, windows-latest, macOS-latest]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
 
       - name: Use Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2
 
       - name: Install
         run: |

.github/workflows/npm-publish.yml

@@ -12,11 +12,11 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
           ref: ${{ github.event.inputs.branch }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
         with:
           node-version: "22.x"
           registry-url: "https://registry.npmjs.org"

.github/workflows/serverless-patch.yml

@@ -26,14 +26,14 @@ jobs:
         )
       )
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
           repository: elastic/elasticsearch-js
           ref: main
           path: stack
           fetch-depth: 0
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           persist-credentials: false
           repository: elastic/elasticsearch-serverless-js
@@ -42,7 +42,7 @@ jobs:
       - name: Apply patch from stack to serverless
         id: apply-patch
         run: $GITHUB_WORKSPACE/stack/.github/workflows/serverless-patch.sh
-      - uses: peter-evans/create-pull-request@v6
+      - uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6
         with:
           token: ${{ secrets.GH_TOKEN }}
           path: serverless

.github/workflows/stale.yml

@@ -8,7 +8,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8
         with:
           stale-issue-label: stale
           stale-pr-label: stale

package.json

@@ -53,38 +53,38 @@
     "node": ">=18"
   },
   "devDependencies": {
-    "@elastic/request-converter": "^8.15.2",
+    "@elastic/request-converter": "8.16.0",
     "@sinonjs/fake-timers": "github:sinonjs/fake-timers#0bfffc1",
-    "@types/debug": "^4.1.7",
-    "@types/ms": "^0.7.31",
-    "@types/node": "^18.19.55",
-    "@types/sinonjs__fake-timers": "^8.1.2",
-    "@types/split2": "^3.2.1",
-    "@types/stoppable": "^1.1.1",
-    "@types/tap": "^15.0.7",
-    "chai": "^4.3.7",
-    "cross-zip": "^4.0.0",
-    "desm": "^1.2.0",
-    "into-stream": "^7.0.0",
-    "js-yaml": "^4.1.0",
-    "license-checker": "^25.0.1",
-    "minimist": "^1.2.6",
-    "ms": "^2.1.3",
-    "node-abort-controller": "^3.0.1",
-    "node-fetch": "^2.6.7",
-    "ora": "^5.4.1",
-    "proxy": "^1.0.2",
-    "rimraf": "^3.0.2",
-    "semver": "^7.3.7",
-    "split2": "^4.1.0",
-    "stoppable": "^1.1.0",
-    "tap": "^21.0.1",
-    "ts-node": "^10.7.0",
-    "ts-standard": "^11.0.0",
-    "typescript": "^4.6.4",
-    "workq": "^3.0.0",
-    "xmlbuilder2": "^3.0.2",
-    "zx": "^7.2.2"
+    "@types/debug": "4.1.12",
+    "@types/ms": "0.7.34",
+    "@types/node": "18.19.59",
+    "@types/sinonjs__fake-timers": "8.1.5",
+    "@types/split2": "3.2.1",
+    "@types/stoppable": "1.1.3",
+    "@types/tap": "15.0.12",
+    "chai": "4.5.0",
+    "cross-zip": "4.0.1",
+    "desm": "1.3.1",
+    "into-stream": "7.0.0",
+    "js-yaml": "4.1.0",
+    "license-checker": "25.0.1",
+    "minimist": "1.2.8",
+    "ms": "2.1.3",
+    "node-abort-controller": "3.1.1",
+    "node-fetch": "2.7.0",
+    "ora": "5.4.1",
+    "proxy": "1.0.2",
+    "rimraf": "3.0.2",
+    "semver": "7.6.3",
+    "split2": "4.2.0",
+    "stoppable": "1.1.0",
+    "tap": "21.0.1",
+    "ts-node": "10.9.2",
+    "ts-standard": "11.0.0",
+    "typescript": "4.9.5",
+    "workq": "3.0.0",
+    "xmlbuilder2": "3.1.1",
+    "zx": "7.2.3"
   },
   "dependencies": {
     "@elastic/transport": "^8.9.0",