chore: refresh lockfile, use htmlnano + pin workflow deps (#28946)

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:lts
+FROM node:lts@sha256:48db4f6ea21d134be744207225753a1730c4bc1b4cdf836d44511c36bf0e34d7
 
 RUN apt-get update && \
     apt-get install -fy libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdbus-1-3 libdrm2 libxkbcommon0 libatspi2.0-0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2 && \

.github/workflows/cache-cleanup.yml

@@ -22,14 +22,14 @@ jobs:
           gh extension install actions/gh-actions-cache
 
           echo "Fetching list of cache keys"
-          cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH -L 100 | cut -f 1 )
+          cacheKeysForPR=$(gh actions-cache list -R "$REPO" -B "$BRANCH" -L 100 | cut -f 1 )
 
           ## Setting this to not fail the workflow while deleting cache keys.
           set +e
           echo "Deleting caches..."
           for cacheKey in $cacheKeysForPR
           do
-              gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
+              gh actions-cache delete "$cacheKey" -R "$REPO" -B "$BRANCH" --confirm
           done
           echo "Done"
         env:

.github/workflows/lint-workflows.yml

@@ -26,6 +26,6 @@ jobs:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       # From https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
       - name: Check workflow files
-        run: |
-          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/590d3bd9dde0c91f7a66071d40eb84716526e5a6/scripts/download-actionlint.bash) 1.6.25
-          ./actionlint -color -shellcheck=""
+        uses: docker://rhysd/actionlint:1.7.1
+        with:
+          args: -color

.github/workflows/release-pr.yml

@@ -39,7 +39,7 @@ jobs:
           GH_REPO: ${{ github.repository }}
           COMMENT_AT: ${{ github.event.comment.created_at }}
         run: |
-          pr="$(gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/${GH_REPO}/pulls/${PR_NUMBER})"
+          pr="$(gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/"${GH_REPO}"/pulls/"${PR_NUMBER}")"
           head_sha="$(echo "$pr" | jq -r .head.sha)"
           updated_at="$(echo "$pr" | jq -r .updated_at)"
 
@@ -47,7 +47,7 @@ jobs:
               exit 1
           fi
 
-          echo "head_sha=$head_sha" >> $GITHUB_OUTPUT
+          echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           ref: ${{ steps.pr.outputs.head_sha }}

.github/workflows/stackblitz-link.yml

@@ -11,7 +11,7 @@ jobs:
   stackblitz:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: huang-julien/reproduire-sur-stackblitz@v1.0.2
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: huang-julien/reproduire-sur-stackblitz@9ceccbfbb0f2f9a9a8db2d1f0dd909cf5cfe67aa # v1.0.2
         with:
           reproduction-heading: '### Reproduction'

package.json

@@ -44,6 +44,7 @@
     "nuxt": "workspace:*",
     "postcss": "8.4.45",
     "rollup": "4.21.2",
+    "send": ">=0.19.0",
     "typescript": "5.6.2",
     "ufo": "1.5.4",
     "vite": "5.4.4",

packages/ui-templates/lib/render.ts

@@ -6,7 +6,7 @@ import type { Plugin } from 'vite'
 // @ts-expect-error https://github.com/GoogleChromeLabs/critters/pull/151
 import Critters from 'critters'
 import { genObjectFromRawEntries } from 'knitwork'
-import htmlMinifier from 'html-minifier'
+import htmlnano from 'htmlnano'
 import { glob } from 'tinyglobby'
 import { camelCase } from 'scule'
 
@@ -86,7 +86,7 @@ export const RenderPlugin = () => {
         }
 
         // Minify HTML
-        html = htmlMinifier.minify(html, { collapseWhitespace: true })
+        html = await htmlnano.process(html, { collapseWhitespace: 'aggressive' }).then(r => r.html)
 
         if (!isCompleteHTML) {
           html = html.replace('<html><head></head><body>', '')

packages/ui-templates/package.json

@@ -18,12 +18,11 @@
     "test": "pnpm lint && pnpm build"
   },
   "devDependencies": {
-    "@types/html-minifier": "4.0.5",
     "@types/lodash-es": "4.17.12",
     "@unocss/reset": "0.62.3",
     "critters": "0.0.24",
-    "html-minifier": "4.0.0",
     "html-validate": "8.22.0",
+    "htmlnano": "^2.1.1",
     "jiti": "1.21.6",
     "knitwork": "1.1.0",
     "lodash-es": "4.17.21",