Harden CI permissions and CSV export

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # keeps the SHA-pinned actions in ci.yml current
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -6,39 +6,45 @@ on:
   pull_request:
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+# Default to no permissions; each job requests only what it needs.
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # never cancel an in-flight deploy on main
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22.x"
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
         env:
           VITE_BASE: /${{ github.event.repository.name }}/
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: ./dist
 
   deploy:
     if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
     needs: build
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

docs/requirements.txt

@@ -12,18 +12,18 @@ markupsafe==3.0.2
 mergedeep==1.3.4
 mkdocs==1.6.1
 mkdocs-get-deps==0.2.0
-mkdocs-material==9.6.14
+mkdocs-material==9.7.7
 mkdocs-material-extensions==1.3.1
 packaging==25.0
 paginate==0.5.7
 pathspec==0.12.1
 platformdirs==4.3.8
 pygments==2.20.0
-pymdown-extensions==10.21.3
+pymdown-extensions==11.0.1
 python-dateutil==2.9.0.post0
 pyyaml==6.0.2
 pyyaml-env-tag==1.1
 requests==2.33.0
 six==1.17.0
-urllib3==2.7.0
+urllib3==2.8.0
 watchdog==6.0.0

index.html

@@ -1,15 +1,14 @@
 <!doctype html>
 <html lang="en">
-  <html>
-    <head>
-      <meta charset="UTF-8" />
-      <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-      <title>Picture Naming Task</title>
-    </head>
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="referrer" content="no-referrer" />
+    <title>Picture Naming Task</title>
+  </head>
 
-    <body>
-      <div id="root"></div>
-      <script type="module" src="/src/main.ts"></script>
-    </body>
-  </html>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
 </html>

package.json

@@ -2,7 +2,7 @@
   "name": "picture-naming-task",
   "type": "module",
   "version": "1.0.0",
-  "packageManager": "pnpm@10.10.0",
+  "packageManager": "pnpm@10.34.6",
   "description": "jsPysch implmentation of the Boston Naming Task with multilingual support",
   "author": "Cian Monnin",
   "scripts": {
@@ -12,14 +12,14 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@opendatacapture/runtime-v1": "^1.8.2"
+    "@opendatacapture/runtime-v1": "^1.16.6"
   },
   "devDependencies": {
-    "@douglasneuroinformatics/eslint-config": "^5.2.4",
-    "@douglasneuroinformatics/tsconfig": "^1.0.2",
-    "@types/node": "^20.17.8",
-    "eslint": "^9.17.0",
+    "@douglasneuroinformatics/eslint-config": "^5.3.7",
+    "@douglasneuroinformatics/tsconfig": "^1.0.5",
+    "@types/node": "^20.19.43",
+    "eslint": "^9.39.5",
     "typescript": "~5.5.4",
-    "vite": "^6.4.3"
+    "vite": "^6.4.4"
   }
 }