SonarQube reviewer guide

Summary: Upgrade GitHub Actions workflows to latest versions (v4) and update all project dependencies to newer minor/patch versions, including breaking changes to @commitlint (v17→v20) and other key packages.

Review Focus: The major version upgrades to @commitlint (v17→v20), @loopback/build (v12.0.3→v12.0.11), and related ecosystem packages may require attention for compatibility. Also verify the aquasecurity/trivy-action ref change from version pinning to commit hash. Check the package.json overrides for any implications of the new versions.

Start review at: .github/workflows/main.yaml and .github/workflows/trivy.yaml. These files contain the breaking infrastructure changes - GitHub Actions v4 updates and the Trivy security scanner version bump with a commit hash reference instead of semantic versioning, which affects CI/CD reliability and security scanning processes.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

🎉 This PR is included in version 1.0.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀