build(deps): upgrade dependencies

[Nugine]

Overview

Upgrade the Deno/npm toolchain dependencies to their latest compatible versions.

Changes

Dependency	From	To	Note
@deno/dnt	0.42.3	0.43.2	latest
esbuild	0.25.12	0.28.2	latest
@actions/core	1.11.1	2.0.3	latest CJS-compatible
@actions/exec	1.1.1	1.1.1	stays on latest CJS-compatible
@actions/tool-cache	2.0.2	2.0.2	stays on latest CJS-compatible
@std/semver / octokit	—	—	already latest

Supporting changes:

• scripts/bundle.ts: drop the timers shim, which was removed in dnt 0.43
• Regenerated deno.lock, npm/package-lock.json, and dist/main.js against the pinned versions

Why @actions/* stays on 2.x/1.x

@actions/core@3.x, @actions/exec@3.x, and @actions/tool-cache@4.x are ESM-only packages (type: module, exports only expose an import condition). The bundle pipeline emits CommonJS (npm/script/main.js via dnt), and esbuild cannot resolve a require() of an ESM-only package — The path "." is not currently exported by package "@actions/core". The latest CJS-compatible versions are therefore kept until upstream restores CommonJS support (tracked in actions/toolkit#2294, actions/toolkit#2380).

Verification

• just ci passes locally (fmt, lint, check, bundle, and assert_unchanged all green)
• Build is idempotent: repeated builds produce identical dist/main.js
• dist/main.js smoke-tested with node dist/main.js (starts up correctly under a real action runtime)

Notes

• Dependabot PRs bumping the ESM-only @actions/* majors will not merge; the ignore instructions were issued on the previous PR
• Once feat: add support for commonjs loaders actions/toolkit#2380 lands, these packages can be bumped to latest and this PR's constraint can be revisited

[Copilot]

Pull request overview

Upgrades the Deno + npm toolchain dependencies used to build and bundle this GitHub Action, including updating the DNT build script and regenerating lockfiles to match the new pinned versions.

Changes:

• Bump Deno import-map dependencies (@deno/dnt, esbuild, @actions/core) to newer compatible versions.
• Update the DNT bundling script to remove the removed timers shim.
• Regenerate deno.lock and npm/package-lock.json for the updated dependency graph.

Reviewed changes

Copilot reviewed 2 out of 5 changed files in this pull request and generated 1 comment.

File	Description
scripts/bundle.ts	Removes the timers shim from the DNT build config.
deno.json	Updates import-map versions for DNT/esbuild/actions core.
deno.lock	Regenerates the Deno lockfile for updated jsr/npm dependencies.
npm/package-lock.json	Updates npm lockfile entries for the upgraded toolchain dependencies.

Files not reviewed (1)

• npm/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.