[OskarEichler]

Issue

Both workflows execute actions/checkout through the mutable v4 tag. If that upstream tag were retargeted after an action compromise, substituted code would execute inside Fuse.js CI. The documentation workflow grants contents: write.

Fix

Pin both checkout uses to commit 11d5960a326750d5838078e36cf38b85af677262, the commit currently referenced by v4. The version comment keeps Dependabot and reviewers aware of the intended major release.

Verification

• Confirmed the SHA resolves from the assessed v4 tag
• Both workflow files parse successfully as YAML
• git diff --check passed

Breaking changes

None.

[lbesecker195]

Verified actions/checkout tag v4 resolves to commit 11d5960a326750d5838078e36cf38b85af677262 (lightweight tag, so no dereferencing needed), and those are the only two checkout@v4 uses in deploy-docs.yml and nodejs.yml on main. Heads up that #846 edits the line right below in both files, so whichever lands second will likely need a rebase. LGTM.