fix(security): resolve Dependabot and CodeQL vulnerabilities

.github/workflows/add-or-validate-labels.yaml

@@ -1,6 +1,11 @@
 # Adds labels to pull requests based on the branch name. Labels are required by the "publish" workflow to determine
 name: 'Validate PR labels'
 
+permissions:
+  contents: read
+  pull-requests: read
+  issues: write
+
 on:
   workflow_dispatch: # Lets you see what labels would be added, but doesn't actually add them because no PR triggered it
   pull_request:

.github/workflows/main.yaml

@@ -1,5 +1,7 @@
 # This is the entry point for CI. It will setup the application, then run lint, test, and eventually publish if not the main branch
 name: 'Main'
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   pull_request:
@@ -53,6 +55,8 @@ jobs:
   code-coverage:
     needs: test
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     if: ${{ !startsWith(github.head_ref, 'version-bump') }}
     steps:
       - uses: actions/checkout@v6

.github/workflows/open-version-bump-pr.yaml

@@ -1,5 +1,10 @@
 name: 'Open Version Bump PR'
 
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
 on:
   workflow_dispatch:
     inputs:
@@ -36,6 +41,9 @@ jobs:
   createVersionBumpPR:
     if: (github.event.pull_request.merged == true || inputs.version-type != 'none' || inputs.dry-run == 'true') && needs.preflight.outputs.VERSION_INSTRUCTION != 'version-bump'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     needs: preflight # Will be skipped if preflight is skipped, which causes this to not run on closes w/o merge unless it's a manual run
     outputs:
       PR_NUMBER: ${{ steps.create-pr.outputs.pull-request-number }}

.github/workflows/pinned-dependencies.yaml

@@ -1,4 +1,6 @@
 name: 'Pinned dependencies'
+permissions:
+  contents: read
 on:
   push:
   pull_request:

package.json

@@ -5,7 +5,7 @@
   "license": "MIT",
   "repository": "git://github.com/smartcontractkit/ea-framework-js.git",
   "dependencies": {
-    "ajv": "8.17.1",
+    "ajv": "8.18.0",
     "axios": "1.13.2",
     "eventsource": "4.1.0",
     "fastify": "5.6.2",

scripts/adapter-generator.ts

@@ -1,11 +1,13 @@
 #!/usr/bin/env node
 
 import { resolve } from 'path'
-import { execSync } from 'child_process'
+import { execFileSync } from 'child_process'
 
 const pathArg = process.argv[2] || ''
 
 const generatorPath = resolve(__dirname, './generator-adapter/generators/app/index.js')
-const generatorCommand = `yo ${generatorPath} ${pathArg}`
-
-execSync(generatorCommand, { stdio: 'inherit' })
+const args = [generatorPath]
+if (pathArg) {
+  args.push(pathArg)
+}
+execFileSync('yo', args, { stdio: 'inherit' })