From d636c171a6997dcd18302f9b2b7c74b4fcf87427 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 25 Aug 2026 07:56:58 +0000
Subject: [PATCH] Pin dependencies

---
 .github/workflows/major-version.yml | 2 +-
 action.yml                          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/major-version.yml b/.github/workflows/major-version.yml
index 79d83b4..63ff2db 100644
--- a/.github/workflows/major-version.yml
+++ b/.github/workflows/major-version.yml
@@ -11,6 +11,6 @@ jobs:
     name: Update Major Version Tag
     runs-on: ubuntu-latest
     steps:
-      - uses: nowactions/update-majorver@v1
+      - uses: nowactions/update-majorver@f2014bbbba95b635e990ce512c5653bd0f4753fb # v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/action.yml b/action.yml
index 96078ee..43a2767 100644
--- a/action.yml
+++ b/action.yml
@@ -16,7 +16,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: ${{ inputs.php-version }}
     - name: Validate composer.json and composer.lock
@@ -24,7 +24,7 @@ runs:
       shell: bash
     - name: Cache Composer packages
       id: composer-cache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       with:
         path: vendor
         key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}