build(deps): consolidate open Dependabot updates

[0xisk]

Types of changes

Maintenance: dependency updates. None of the categories below strictly apply — this is a grouped Dependabot bump.

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation Update (if none of the other choices apply)

Consolidates the 7 open Dependabot PRs into a single PR so they can be reviewed and merged together, then closes the individual ones. There is no grouping configured in dependabot.yml, and the github-actions ecosystem was sitting at its 5-open-PR cap, so this batches everything by hand.

GitHub Actions

Action	From	To
actions/checkout	v7.0.0	v7.0.1
actions/setup-node	v6.4.0	v7.0.0 (major)
github/codeql-action/{init,analyze,upload-sarif}	v4.36.3	v4.37.2

Supersedes #705, #704, #701, #702, #703.

codeql-action/upload-sarif (in scorecard.yml) shares the same release SHA as init/analyze, and CodeQL requires all sub-actions on one version. All three move together to v4.37.2 across codeql.yml and scorecard.yml so scanning stays consistent.

npm

Package	Range before	Range after	Lockfile resolves
@biomejs/biome (dev)	^2.5.2	^2.5.5	2.5.5
brace-expansion (transitive)	5.0.6	5.0.7	5.0.7

Supersedes #706, #697.

brace-expansion is a transitive dependency in the npm_and_yarn security group; it moves in the lockfile only (no package.json range change). The lockfile was regenerated once for a single coherent result rather than cherry-picking conflicting per-PR lockfiles. Drift is limited to the bumped packages and biome's platform sub-packages.

Biome $schema sync

biome migrate bumped biome.json's $schema URL (2.5.4 → 2.5.5) so editor validation tracks the installed version and biome ci stops nudging a migration. Schema-URL only, no rule/config changes. The 2.5.4 → 2.5.5 patch introduced no formatting changes (biome format is a no-op), so unlike the previous consolidation there is no reformat commit.

PR Checklist

• I have read the Contributing Guide
• I have added tests — N/A (no behavior change)
• I have added documentation — N/A
• CI Workflows Are Passing

Further comments

Verified locally before pushing:

• yarn lint:ci (biome 2.5.5) — 139 files checked, clean, exit 0.
• Lockfile drift limited to the bumped packages and biome's platform sub-packages; no unrelated transitive churn.
• yarn types (full compile of 66 contracts + tsc) — 8/8 turbo tasks, exit 0.

[coderabbitai]

Walkthrough

GitHub Actions pins are updated across CI, CodeQL, scorecard, testing, and release workflows. Biome’s schema reference and development dependency are also updated to newer versions.

Changes

GitHub Actions pin updates

Layer / File(s)	Summary
Workflow action revisions .github/workflows/checks.yml, .github/workflows/codeql.yml, .github/workflows/create-release.yml, .github/workflows/prepare-release.yml, .github/workflows/release.yml, .github/workflows/scorecard.yml, .github/workflows/test.yml	Checkout, CodeQL, SARIF upload, and Node.js setup actions use newer pinned revisions while workflow logic remains unchanged.

Biome tooling updates

Layer / File(s)	Summary
Biome version alignment biome.json, package.json	The Biome schema reference changes to 2.5.5 and the development dependency changes to ^2.5.5.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• OpenZeppelin/compact-contracts#553: Updates overlapping checkout and CodeQL action pins.
• OpenZeppelin/compact-contracts#592: Updates CodeQL-related workflow action versions.

Suggested reviewers: andrew-fleming

Poem

I’m a rabbit with pins in a row,
Watching checkout revisions grow.
CodeQL hops bright,
Biome shines light,
And tidy workflows now flow!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes this maintenance PR consolidating multiple Dependabot dependency updates.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/consolidate-dependabot

---

_{Comment @coderabbitai help to get the list of available commands.}