fix: resolve all npm audit advisories

[aeaa1998]

Stack 2/3 — based on #202, merge that first. Review only the top commit; the diff will shrink once #202 lands.

• 1/3 chore: bump action runtime to Node 24 #202 Node 24 runtime → main
• 2/3 this PR — npm audit fixes → chore: bump action runtime to Node 24 #202
• 3/3 chore: bump pinned github actions to latest majors #204 GitHub Actions bumps → this branch

Summary

npm audit: 17 advisories (1 critical, 10 high) → 0. 112 lockfile entries changed (79 upgrades, 3 majors, 12 added, 11 removed, 7 downgrades).

Direct dependencies

Package	Manifest	Resolved	Type	Breaking?
axios	^1.7.7 → ^1.20.0	1.8.4 → 1.20.0	prod, bundled	No — minor. Behaviour change noted below
@actions/core	^1.10.1 → ^1.11.1	1.11.1 → 1.11.1 (unchanged)	prod, bundled	No — floor raise only
@typescript-eslint/eslint-plugin	^8.28.0 → ^8.68.0	8.29.0 → 8.68.0	dev	Yes — see config change
@typescript-eslint/parser	^8.28.0 → ^8.68.0	8.29.0 → 8.68.0	dev	Yes — see config change
eslint	^9.23.0 (unchanged)	9.24.0 → 9.39.5	dev	No
js-yaml	^4.1.0 (unchanged)	4.1.0 → 4.3.2	dev	No

The two ^1.x floor raises matter because the old carets still permitted the vulnerable versions — a fresh install without the lockfile could land on one.

Breaking changes

Change	Impact	Handled by
typescript-eslint 8.68 rejects a relative parserOptions.tsconfigRootDir	npm run lint fails on all 5 source files	eslint.config.mjs now passes the absolute __dirname it already computes

No breaking changes reach the shipped action — the only two bundled packages moved by a minor and by nothing at all.

Transitive changes worth calling out

Package	Change	Why	Risk
@actions/http-client	2.2.3 → 2.1.1 (downgrade)	2.2.x depends on undici ^5.25.4; 2.1.1 has no undici dep. This — not an @actions/core bump — is what cleared the 12 undici advisories	Low: only @actions/core's OIDC helper uses http-client, and this action never calls it. See note below
undici	5.29.0 → removed	Dropped with the above	None — dead code here
@fastify/busboy	2.1.1 → removed	undici's only dependency	None
proxy-from-env	1.1.0 → 2.1.0 (major)	axios proxy resolution	Low, and relevant — see below
minimatch	9.0.5 → 10.2.6 (major)	The last remaining advisory; pinned under typescript-estree	Dev-only
eslint-visitor-keys	4.2.0 → 5.0.1 (major)	Under @typescript-eslint/visitor-keys	Dev-only
prettier-eslint/@typescript-eslint/*	6.21.0 → 6.15.0 (downgrade)	npm re-resolved prettier-eslint's private tree	Dev-only, and already an abandoned eslint 8 subtree
form-data	4.0.2 → 4.0.6	Multipart upload body	Covered by e2e below
follow-redirects	1.15.9 → 1.16.0	axios redirects	Covered by e2e below

On the @actions/http-client downgrade

Worth a reviewer's eye. npm audit fix resolved the undici advisories by moving backwards to a release that predates the undici dependency, rather than forwards. It's harmless here — @actions/core only pulls http-client in for getIDToken(), which this action never calls — but the forward-looking fix is @actions/core 3.x (which depends on @actions/http-client ^4.0.0). That is a major bump with its own API review, so it's deliberately out of scope for this PR.

dist/

dist/index.js drops 1.36MB → 655KB, entirely from undici leaving the bundle. Regenerated with npm run package; check-dist confirms it matches a clean rebuild.

The old bundle also emitted DEP0169 DeprecationWarning: url.parse() on every run. Gone.

A real user-facing fix, not just CVE hygiene

axios older than 1.16.1 issues plain-HTTP (non-CONNECT) requests for HTTPS when a proxy is configured. On the pre-bump bundle that produces a hard 405 Method Not Allowed from the proxy, i.e. the action is broken today for anyone on a self-hosted runner behind a corporate egress proxy. This was reproduced directly: the pre-bump bundle fails, this branch's bundle succeeds against the same endpoint.

Validation

CI on this branch, both green:

• build-test
• Check dist/

Because this swaps the HTTP client, the rebuilt bundle was also exercised against the live API (api.appetize.io), covering both upload modes and the real GITHUB_OUTPUT path:

Path	Result
create (appFile, multipart, 7.7MB apk)	✅
update (publicKey + appFile, with disableHome / launchUrl / buttonText)	✅
create (appUrl, JSON body)	✅

The appUrl path is worth noting: it is covered by no automated test — the unit tests never touch the network and test.yml only exercises appFile — so it was verified by hand here.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01UTdciRVE8crbaoxq4JyXt4