Pin third-party actions to full-length commit SHAs (with version comments) instead of mutable tags/branches to prevent supply-chain tampering via retagged releases. Resolves SonarCloud rule githubactions:S7637.
Bumps the actions group with 1 update in the / directory: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: skylartaylor <26588250+skylartaylor@users.noreply.github.com>
- crates/mcp: JSON-RPC MCP server (18 tools, resources, prompts), headless and attached backends, end-to-end agent tests - apps/figcraft-cli: info/export/convert/render/run/commands/mcp/perf - crates/pdf: vector PDF export via krilla with embedded text; file.exportFramesPdf - apps/figcraft-web + packaging/{macos,windows,linux,freebsd,web} + release/ci workflows - engine vectoredit: edit points/handles/bend/add/delete-heal; canvas overlay and edit strip Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>