[mvantellingen]

Removes the repo-local pinact, zizmor and other security workflows. These checks now run as org-wide required workflows from labd/.github-workflows, so keeping copies in this repo would only run them twice.

CI fixes

• pnpm audit --audit-level=critical failed on two critical advisories in the next 16.4.0 dev dependency (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr); bumped to 16.4.2.

npm trusted publishing

The org-level NPM_TOKEN secret is gone, so all npm publishes go through trusted publishing (OIDC). The release job already uses OIDC (environment: release, id-token: write, upgraded npm, NPM_CONFIG_PROVENANCE: true, no npm tokens). To match labd/commercetools-node-mock, this PR also:

• adds push-with-git-cli: true to changesets/action
• sets package.json repository.url to git+https://github.com/labd/nextjs-basic-auth-middleware.git and publishConfig.provenance to true

On npmjs.com, nextjs-basic-auth-middleware needs a trusted publisher with repository labd/nextjs-basic-auth-middleware, workflow release.yaml and environment release.

pnpm 12

Already on pnpm@12.13.0; follow-up fixes:

• pnpm 12 ignores pnpm settings in .npmrc (pnpm config get savePrefix returned undefined), so save-prefix, auto-install-peers and strict-peer-dependencies moved to pnpm-workspace.yaml (savePrefix: "", autoInstallPeers: true, strictPeerDependencies: false) and .npmrc was removed. Verified with pnpm config get.
• minimumReleaseAge: 10080 kept as-is (already present), trustPolicy: no-downgrade unchanged.
• Lockfile unchanged; pnpm install --frozen-lockfile passes.
• labd/gh-actions-typescript/pnpm-install → v1.1.0, with cache: false in the release job.