Bump npm-dependencies group with TypeScript 6.0.3, @types/node 24.x, and security fixes

[bigdaz]

Supersedes #1023.

1. Adjust dependabot's TypeScript choices

Dependabot's group bump included two changes that we don't want to take as-is:

• typescript: 5.9.3 → 7.0.2. Pinned to 6.0.3 instead.
• @types/node: 25.9.2 → 26.1.1. Downgraded to the latest 24.x (24.13.3), matching the Node 24 runtime the actions target.

All other updates from #1023 are kept unchanged (@actions/cache 6.2.0, semver 7.8.5, @typescript-eslint/eslint-plugin 8.65.0, esbuild 0.28.1, eslint 10.7.0, globals 17.7.0, prettier 3.9.6, ts-jest 29.4.12), and the branch is rebased onto current main.

The prettier 3.9.6 bump reformats two union types in sources/src/cache-service.ts; that reformatting is included so npm run check passes.

2. Clear 5 open security advisories

npm audit reported 4 high and 1 low severity advisory. All are fixable with semver-compatible transitive updates — npm audit fix clears them without --force, and package.json is untouched.

Production (bundled into dist/, so they ship in the actions):

Package	Before	After	Via
undici	6.24.1	6.28.0	@actions/github, @actions/http-client
undici	7.24.5	7.29.0	cheerio
brace-expansion	5.0.6	5.0.9	@actions/glob → minimatch
brace-expansion	2.0.3	2.1.4	@actions/artifact → archiver

Dev only: shell-quote 1.8.4 → 1.10.0 (npm-run-all), js-yaml 3.14.2 → 3.15.1 (ts-jest), @babel/core 7.28.0 → 7.29.x (ts-jest, low severity).

These were outstanding because the lockfile pins transitive resolutions while .github/dependabot.yml only bumps direct dependencies. Because undici and brace-expansion are production dependencies, the bundled dist/ output will change when the update-dist bot runs.

3. Downgrade nock to 14.0.17

nock 15.0.0 was published by mistake. The registry marks it deprecated:

v15.0.0 was released accidentally and is unstable. Please use v14.x until v15 is officially ready.

nock's latest dist-tag still points at 14.0.17 for exactly this reason, and 15.x remains a beta line (beta = 15.0.0-beta.14). Dependabot picked up 15.0.0 in an earlier group bump simply because it is the highest published version. This moves us to 14.0.17, pulling @mswjs/interceptors 0.39.8 → 0.41.9 and adding propagate 2.0.1.

Dependabot will likely re-propose nock 15.0.0 on its next weekly run, since no ignore rule was added.

4. Delete unused sources/.nvmrc

The file pinned Node v16, contradicting package.json engines (>=24.0.0), the esbuild node24 target, and .tool-versions (nodejs 24.3.0). Nothing reads it — no workflow uses node-version-file and there are no other references in the repo. Stale since 5e52225.

5. Run CI workflows on Node 24

ci-check-and-unit-test.yml, ci-update-dist.yml, and update-checksums-file.yml pinned node-version: 20, so npm clean-install was emitting EBADENGINE warnings for the root package against its own engines: >=24.0.0. All three now use Node 24, matching .github/actions/build-dist/action.yml.

Worth noting: ci-update-dist.yml built dist/ on Node 20 in its inline steps while build-dist/action.yml built it on Node 24, so the committed distribution could previously be produced under either version.

Verification

• ./build — clean
• npm run check (prettier + eslint) — clean
• npm test — 373 tests, 15 suites, all passing
• npm audit — found 0 vulnerabilities (was 4 high, 1 low)
• npx tsc --noEmit — one pre-existing error in @octokit/request-error types (Cannot find name 'ErrorOptions'), identical on main with TypeScript 5.9.3, so not a regression. tsc is not part of the build or CI.

A clean regeneration of package-lock.json from package.json was also evaluated. It likewise yields 0 vulnerabilities and 373 passing tests, but churns 80 transitive packages including the @azure/core-* / @azure/storage-blob stack used by @actions/cache. Since it offers no security benefit over the current lockfile, it was not adopted.

Known-failing checks (pre-existing on main)

The three smoke-tests / restore-gradle-home / … (windows-latest) jobs fail with Build was not cached: unexpected execution of test task. The identical three jobs fail on main in run 30723964208, on the very commit this branch is based on, so they are not caused by these changes.

Not included

npm outdated also shows eslint 10.7.0 → 10.8.0 and globals 17.7.0 → 17.8.0. Both are dev-only and dependabot's weekly npm group run will propose them.

🤖 Generated with Claude Code