diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index de6cf05..17286e9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,16 +1,31 @@
-# Please see the documentation for all configuration options:
-# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
 version: 2
 updates:
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: github-actions
+    directory: /
     schedule:
-      interval: "weekly"
+      interval: weekly
     open-pull-requests-limit: 10
     cooldown:
       default-days: 7
     labels:
-      - "dependencies"
-      - "github_actions"
+      - dependencies
+
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7
+    labels:
+      - dependencies
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7
+    labels:
+      - dependencies
diff --git a/.github/workflows/fix-code-style.yml b/.github/workflows/fix-code-style.yml
index 34302a9..c898ac9 100644
--- a/.github/workflows/fix-code-style.yml
+++ b/.github/workflows/fix-code-style.yml
@@ -15,7 +15,7 @@ jobs:
       # persist-credentials: true is required so `git-auto-commit-action` below
       # can push the reformatted files back to the branch.
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.2 # zizmor: ignore[artipacked]
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked]
 
       - name: Cache Composer dependencies
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
diff --git a/.github/workflows/update-changelog.yml b/.github/workflows/update-changelog.yml
index 815b382..27204c1 100644
--- a/.github/workflows/update-changelog.yml
+++ b/.github/workflows/update-changelog.yml
@@ -15,7 +15,7 @@ jobs:
       # persist-credentials: true is required so `git-auto-commit-action` below
       # can push the CHANGELOG update.
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.2 # zizmor: ignore[artipacked]
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked]
         with:
           ref: main
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index d964f71..7643e7f 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -18,11 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      security-events: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
-        with:
-          advanced-security: false
diff --git a/.gitignore b/.gitignore
index 12d978a..f9481e9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,7 +4,6 @@
 .phpunit.cache
 .vscode
 build
-composer.lock
 coverage
 docs
 node_modules
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..7253a5c
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+min-release-age=7