fix(ci): revert pnpm/action-setup to v4, switch JS audit to osv-scanner, bump cryptography

- Revert pnpm/action-setup from v6 (08c4be7e) back to v4 (fc06bc12)
  to fix pnpm 11 beta being installed despite version: 10, which caused
  ERR_PNPM_LOCKFILE_CONFIG_MISMATCH and ERR_PNPM_UNSUPPORTED_ENGINE
- Replace pnpm audit with google/osv-scanner in JS/TS security audit
  workflow since the npm registry audit endpoint returned 410 Gone
- Bump cryptography from >=46.0.6 to >=46.0.7 to fix CVE-2026-39892

Author: GenerQAQ

.github/workflows/dashboard-test.yaml

@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320
         with:
           version: 10
 

.github/workflows/docs-test.yaml

@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320
         with:
           version: 10
 

.github/workflows/landingpage-test.yaml

@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320
         with:
           version: 10
 
@@ -71,7 +71,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320
         with:
           version: 10
 
@@ -106,7 +106,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320
         with:
           version: 10
 

.github/workflows/security-reusable.yaml

@@ -89,22 +89,19 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - name: Setup Node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: src/client/acontext-ts/package-lock.json
-      - name: Setup pnpm
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
-          version: 10
+          go-version: '1.24'
+          cache: false
+      - name: Install osv-scanner
+        run: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
       - name: Audit TS SDK
         working-directory: src/client/acontext-ts
-        run: npm audit --audit-level=high --omit=dev
+        run: osv-scanner --lockfile=package-lock.json
       - name: Audit UI
         working-directory: src/server/ui
-        run: pnpm audit --audit-level=high --prod
+        run: osv-scanner --lockfile=pnpm-lock.yaml
       - name: Audit Landing Page
         working-directory: landingpage
-        run: pnpm audit --audit-level=high --prod
+        run: osv-scanner --lockfile=pnpm-lock.yaml

.github/workflows/ui-test.yaml

@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320
         with:
           version: 10
 

src/server/core/pyproject.toml

@@ -37,7 +37,7 @@ dependencies = [
     "novita-sandbox>=1.0.4",
     "urllib3>=2.6.3",
     "boto3>=1.42.19",
-    "cryptography>=46.0.6",
+    "cryptography>=46.0.7",
     "pygments>=2.20.0",
 ]