chore(deps-dev): bump the npm-minor-patch group in /tests/web-a11y with 2 updates

.github/DEPENDENCY-MAINTENANCE.md

@@ -60,3 +60,17 @@ Nachweis / evidence: YAML round-trip, Dependabot schema and manifest coverage ch
 hosted checks are recorded on the configuration PR before merge.
 Risiko / risk: update proposals still require compatibility and security review.
 Neu pruefen bei / reevaluate on: new manifests, moved paths, changed pins or maintenance ownership.
+
+## Claude-GitHub-Integration entfernt / Claude GitHub Integration Retired
+
+DE: Die Claude-GitHub-App und ihre automatischen PR-/Issue-Workflows wurden
+auf ausdruecklichen Ownerwunsch entfernt. Fuer dieses Repository starten keine
+Claude-Code-GitHub-Actions mehr. Lokale Claude-Werkzeuge und CLAUDE.md bleiben
+unabhaengige Entwicklungswerkzeuge. Technische Checks und menschliche Reviews
+gelten weiter; Abhaengigkeits-PRs erhalten kein Auto-Merge.
+
+EN: The owner explicitly retired the Claude GitHub App and its automatic
+PR/issue workflows. This repository no longer starts Claude Code GitHub Actions.
+Local Claude tools and CLAUDE.md remain independent development tools.
+Technical checks and human reviews remain required; dependency PRs receive
+no auto-merge.

.github/workflows/agent-secret-scan.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install ripgrep
         run: sudo apt-get update && sudo apt-get install -y ripgrep

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup .NET 10
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0

.github/workflows/gitleaks.yml

@@ -9,11 +9,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Run gitleaks
-        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/homogeneity-check.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/linked-intake-evidence-native-proof.yml

@@ -70,7 +70,7 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Check out the exact pushed SHA
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1

.github/workflows/pages.yml

@@ -28,15 +28,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup .NET 10
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: npm
@@ -92,4 +92,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/project-statistics-proof.yml

@@ -26,12 +26,12 @@ jobs:
       - name: Preserve package bytes
         shell: pwsh
         run: git config --global core.autocrlf false
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
           persist-credentials: false
-      - uses: astral-sh/setup-uv@d0d8abe699bfb85fec6de9f7adb5ae17292296ff
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e
       - name: Install pinned Spec Kit
         shell: pwsh
         run: |
@@ -44,7 +44,7 @@ jobs:
         run: |
           if ((git rev-parse HEAD).Trim() -cne $env:EXPECTED_HEAD) { throw 'Delivery head mismatch.' }
           ./scripts/prove-project-statistics-context.ps1 -Repo . -EvidenceDirectory (Join-Path $env:RUNNER_TEMP 'statistics-proof')
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         if: always()
         with:
           name: project-statistics-${{ matrix.os }}

.github/workflows/requirements-intake-governance.yml

@@ -47,8 +47,8 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v6
         with:
           python-version: '3.12'
       - name: Validate requirements and intake alignment

.github/workflows/security-supply-chain.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup .NET 10
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0

docs/maintenance/ai-review-retirement-impact.json

@@ -0,0 +1,102 @@
+{
+  "schemaVersion": "1.1",
+  "feature": "retire-claude-github-integration",
+  "entries": [
+    {
+      "scope": "Retire Claude GitHub PR and issue automation",
+      "owner": "Repository Maintainer",
+      "decision": "UpdateRequired",
+      "reevaluationTrigger": "Explicit owner decision to introduce another GitHub review integration",
+      "documents": [
+        ".github/DEPENDENCY-MAINTENANCE.md"
+      ],
+      "criticality": "Usage",
+      "risk": "Retired AI review is not acceptance evidence; technical checks and manual reviews remain binding",
+      "rationale": "Record the explicit owner decision, operational boundaries and independent local tools",
+      "navigationImpact": "Retirement policy remains in the existing maintenance guide or README",
+      "languageStrategy": "German first, equivalent English",
+      "canonicalSource": ".github/DEPENDENCY-MAINTENANCE.md",
+      "distributionClass": "sourceOnly",
+      "languagePartners": [],
+      "readerPaths": [
+        ".github/DEPENDENCY-MAINTENANCE.md -> technical checks -> reviewed PR"
+      ],
+      "documentClass": "ActiveSemantic",
+      "audiences": [
+        "Maintainers",
+        "AI agents"
+      ],
+      "evidence": ".github/DEPENDENCY-MAINTENANCE.md",
+      "changeId": "CHG001",
+      "homeSyncRequired": false,
+      "platformAndExampleProof": "macOS repository Documentation Impact validator and workflow YAML parsing; exact-head hosted checks on the delivery PR"
+    },
+    {
+      "scope": "Generated legacy Profile 2 statistics block",
+      "owner": "Repository Maintainer",
+      "decision": "GeneratedUpdate",
+      "reevaluationTrigger": "Changed statistics source configuration, renderer or method",
+      "documents": [
+        "docs/project-statistics.md"
+      ],
+      "criticality": "Normal",
+      "risk": "Git statistics do not establish quality, acceptance or measured AI productivity",
+      "rationale": "Render statistics from the committed retirement evidence using the installed canonical configuration",
+      "navigationImpact": "Existing canonical ledger entry point is retained",
+      "languageStrategy": "German first, equivalent English",
+      "canonicalSource": "docs/project-statistics.config.json",
+      "distributionClass": "sourceOnly",
+      "languagePartners": [],
+      "readerPaths": [
+        "docs/project-statistics.md -> source configuration -> Git history"
+      ],
+      "documentClass": "Generated",
+      "audiences": [
+        "Maintainers",
+        "AI agents"
+      ],
+      "evidence": "docs/project-statistics.md",
+      "changeId": "CHG002",
+      "generatedSource": {
+        "path": "docs/project-statistics.config.json",
+        "renderer": "bash scripts/render-project-statistics.sh --repo ."
+      },
+      "homeSyncRequired": false,
+      "platformAndExampleProof": "Installed legacy renderer preview, rendering and check-only on macOS"
+    },
+    {
+      "scope": "Installed separate project-statistics context outputs",
+      "owner": "Repository Maintainer",
+      "decision": "GeneratedUpdate",
+      "reevaluationTrigger": "Changed context configuration, renderer or method",
+      "documents": [
+        "docs/project-statistics/report.md",
+        "docs/project-statistics/snapshot.json"
+      ],
+      "criticality": "Normal",
+      "risk": "Context output is transparency evidence, not human or product acceptance",
+      "rationale": "Keep the separate UTC statistics context synchronized with committed source changes",
+      "navigationImpact": "Separate context keeps its existing navigation",
+      "languageStrategy": "Bilingual report; language-neutral JSON snapshot",
+      "canonicalSource": "docs/project-statistics/config.json",
+      "distributionClass": "sourceOnly",
+      "languagePartners": [],
+      "readerPaths": [
+        "docs/project-statistics/report.md -> snapshot.json -> config.json"
+      ],
+      "documentClass": "Generated",
+      "audiences": [
+        "Maintainers",
+        "AI agents"
+      ],
+      "evidence": "docs/project-statistics/report.md",
+      "changeId": "CHG003",
+      "generatedSource": {
+        "path": "docs/project-statistics/config.json",
+        "renderer": "bash .specify/presets/project-statistics-governance/scripts/project-statistics.sh update --repo . --config docs/project-statistics/config.json"
+      },
+      "homeSyncRequired": false,
+      "platformAndExampleProof": "Installed context renderer dry-run, update and read-only status on macOS"
+    }
+  ]
+}