chore: bump some dev deps, harden github actions (#16851)

Author: dummdidumm

.github/workflows/ecosystem-ci-trigger.yml

@@ -4,6 +4,8 @@ on:
   issue_comment:
     types: [created]
 
+permissions: {}
+
 jobs:
   trigger:
     runs-on: ubuntu-latest

.github/workflows/pkg.pr.new.yml

@@ -1,6 +1,8 @@
 name: Publish Any Commit
 on: [push, pull_request]
 
+permissions: {}
+
 jobs:
   build:
     permissions: {}

package.json

@@ -26,7 +26,7 @@
     "bench:debug": "node --allow-natives-syntax --inspect-brk ./benchmarking/run.js"
   },
   "devDependencies": {
-    "@changesets/cli": "^2.27.8",
+    "@changesets/cli": "^2.29.7",
     "@sveltejs/eslint-config": "^8.3.3",
     "@svitejs/changesets-changelog-github-compact": "^1.1.0",
     "@types/node": "^20.11.5",

packages/svelte/package.json

@@ -158,7 +158,7 @@
     "@types/aria-query": "^5.0.4",
     "@types/node": "^20.11.5",
     "dts-buddy": "^0.5.5",
-    "esbuild": "^0.21.5",
+    "esbuild": "^0.25.10",
     "rollup": "^4.22.4",
     "source-map": "^0.7.4",
     "tinyglobby": "^0.2.12",