chore: refresh dependencies, pin CI actions and harden workflows

[bnimit]

Maintenance pass over alpha. No source behaviour changes.

	Before	After
yarn audit	3 critical / 122 high / 98 moderate	0 / 0 / 0
CI gates	lint, test	lint, test, build
Third-party actions	mutable tags	SHA-pinned

Verified locally: yarn install --frozen-lockfile, yarn lint (0 errors, 0 warnings), yarn test (196 passed / 28 files), yarn build all pass. Generated dist/index.d.ts is byte-identical to the published 0.0.7-alpha.79, so the public type surface is unchanged.

Dependencies

yarn.lock regenerated against the existing semver ranges — no range widening. Clears protobufjs 8.0.0 → 8.8.0 (critical RCE), vitest 4.0.18 → 4.1.11 (critical), plus lodash-es, fast-xml-parser and uuid, all three of which ship to consumers.

Four files reflowed for prettier 3.9 (union-type formatting only).

peerDependencies

cesium 1.118.x → ^1.137.0. We build and test against 1.137+ while declaring 1.118, so npm 7+ reports an unmet peer for every consumer on a supported cesium. Nothing forced the old pin — resium and @reearth/cesium-mvt-imagery-provider both accept 1.x.

CI

• yarn build added to ci.yml. Only lint and test ran, so a type error breaking tsc && vite build could reach alpha and only fail at release time.
• All third-party actions pinned to commit SHAs with version comments. npm_release.yml in particular handed NPM_TOKEN to a mutable tag.
• release_alpha.yml / release_alpha_prepare.yml aligned to checkout + setup-node v6. They were still on v4 while the rest of the repo was on v6.
• actions/labeler step and .github/labeler.yml removed. labeler matches changed file paths, but the config listed conventional-commit keywords (bug, fix, docs), so it only ever matched files with those literal names and labelled nothing. It also blocks the v7 bump, which fails config validation against the v5 schema change — see run 33486136320.

Reviewer notes

Two new resolutions, both with caveats.

vite: ^7.3.6 is required to install at all. vitest 4.1.x widened its vite dependency to ^6 || ^7 || ^8, so a fresh resolve nests a second copy on vite 8 and yarn 1's linker aborts with Invariant Violation: could not find a copy of vite to link. Pinning to the 7.x line restores the single deduped vite. Remove when we move to vite 8.

lodash-es: ^4.18.1 does not protect consumers. @reearth/cesium-mvt-imagery-provider hard-pins 4.17.21 and 1.6.2 is the newest release, so it cannot dedupe. resolutions are ignored for consumers of a published package — this cleans our own tree and CI audit only. The durable fix is a release of reearth/cesium-mvt-imagery-provider.

cesium 1.139.1 → 1.145.0 and resium 1.19.4 → 1.26.0 moved in the lockfile. Both within already-declared ranges, and dev/CI-only — consumers resolve cesium themselves via the peer dep. Tests, build and emitted types are clean, but unit tests do not prove a map renderer still renders, so this wants a manual smoke-test of the viewer before the next release. Happy to hold both back if reviewers would rather split them out.

vite-plugin-dts prints a TS2742 on the non-exported EntityExt. The emitted declarations are unaffected (verified byte-identical to the published baseline); I did not establish whether the message predates this change.

Renovate fallout

SHA-pinning conflicts with #142, #143 and #154 — they will need rebasing. #157 (labeler v7) is obsoleted by the labeler removal.

Deliberately out of scope

ESLint 8 → 10 flat-config migration, Node 24, and Yarn 4 are each their own PR. pull-requests: write in pr_title.yml is likely reducible to read now the labeler is gone, but I did not want an unverified permission change to break title checks on every PR.

🤖 Generated with Claude Code