Bump npm-dependencies group with TypeScript 6.0.3, @types/node 24.x, and security fixes (#1033)

Supersedes #1023.

## 1. Adjust dependabot's TypeScript choices

Dependabot's group bump included two changes that we don't want to take
as-is:

- **typescript**: `5.9.3` → `7.0.2`. Pinned to **6.0.3** instead.
- **@types/node**: `25.9.2` → `26.1.1`. Downgraded to the latest 24.x
(**24.13.3**), matching the Node 24 runtime the actions target.

All other updates from #1023 are kept unchanged (`@actions/cache` 6.2.0,
`semver` 7.8.5, `@typescript-eslint/eslint-plugin` 8.65.0, `esbuild`
0.28.1, `eslint` 10.7.0, `globals` 17.7.0, `prettier` 3.9.6, `ts-jest`
29.4.12), and the branch is rebased onto current `main`.

The prettier 3.9.6 bump reformats two union types in
`sources/src/cache-service.ts`; that reformatting is included so `npm
run check` passes.

## 2. Clear 5 open security advisories

`npm audit` reported 4 high and 1 low severity advisory. All are fixable
with **semver-compatible transitive updates** — `npm audit fix` clears
them without `--force`, and `package.json` is untouched.

**Production** (bundled into `dist/`, so they ship in the actions):

| Package | Before | After | Via |
| --- | --- | --- | --- |
| `undici` | 6.24.1 | 6.28.0 | `@actions/github`, `@actions/http-client`
|
| `undici` | 7.24.5 | 7.29.0 | `cheerio` |
| `brace-expansion` | 5.0.6 | 5.0.9 | `@actions/glob` → `minimatch` |
| `brace-expansion` | 2.0.3 | 2.1.4 | `@actions/artifact` → `archiver` |

**Dev only:** `shell-quote` 1.8.4 → 1.10.0 (`npm-run-all`), `js-yaml`
3.14.2 → 3.15.1 (`ts-jest`), `@babel/core` 7.28.0 → 7.29.x (`ts-jest`,
low severity).

These were outstanding because the lockfile pins transitive resolutions
while `.github/dependabot.yml` only bumps direct dependencies. Because
`undici` and `brace-expansion` are production dependencies, the bundled
`dist/` output will change when the update-dist bot runs.

## 3. Downgrade nock to 14.0.17

**nock 15.0.0 was published by mistake.** The registry marks it
deprecated:

> v15.0.0 was released accidentally and is unstable. Please use v14.x
until v15 is officially ready.

nock's `latest` dist-tag still points at 14.0.17 for exactly this
reason, and 15.x remains a beta line (`beta` = `15.0.0-beta.14`).
Dependabot picked up 15.0.0 in an earlier group bump simply because it
is the highest published version. This moves us to 14.0.17, pulling
`@mswjs/interceptors` 0.39.8 → 0.41.9 and adding `propagate` 2.0.1.

Dependabot will likely re-propose nock 15.0.0 on its next weekly run,
since no ignore rule was added.

## 4. Delete unused `sources/.nvmrc`

The file pinned Node `v16`, contradicting `package.json` engines
(`>=24.0.0`), the esbuild `node24` target, and `.tool-versions` (`nodejs
24.3.0`). Nothing reads it — no workflow uses `node-version-file` and
there are no other references in the repo. Stale since 5e522253.

## 5. Run CI workflows on Node 24

`ci-check-and-unit-test.yml`, `ci-update-dist.yml`, and
`update-checksums-file.yml` pinned `node-version: 20`, so `npm
clean-install` was emitting `EBADENGINE` warnings for the root package
against its own `engines: >=24.0.0`. All three now use Node 24, matching
`.github/actions/build-dist/action.yml`.

Worth noting: `ci-update-dist.yml` built `dist/` on Node 20 in its
inline steps while `build-dist/action.yml` built it on Node 24, so the
committed distribution could previously be produced under either
version.

## Verification

- `./build` — clean
- `npm run check` (prettier + eslint) — clean
- `npm test` — 373 tests, 15 suites, all passing
- `npm audit` — **found 0 vulnerabilities** (was 4 high, 1 low)
- `npx tsc --noEmit` — one pre-existing error in
`@octokit/request-error` types (`Cannot find name 'ErrorOptions'`),
identical on `main` with TypeScript 5.9.3, so not a regression. `tsc` is
not part of the build or CI.

A clean regeneration of `package-lock.json` from `package.json` was also
evaluated. It likewise yields 0 vulnerabilities and 373 passing tests,
but churns 80 transitive packages including the `@azure/core-*` /
`@azure/storage-blob` stack used by `@actions/cache`. Since it offers no
security benefit over the current lockfile, it was not adopted.

### Known-failing checks (pre-existing on `main`)

The three `smoke-tests / restore-gradle-home / … (windows-latest)` jobs
fail with `Build was not cached: unexpected execution of test task`. The
identical three jobs fail on `main` in run
[30723964208](https://github.com/gradle/actions/actions/runs/30723964208),
on the very commit this branch is based on, so they are not caused by
these changes.

## Not included

`npm outdated` also shows `eslint` 10.7.0 → 10.8.0 and `globals` 17.7.0
→ 17.8.0. Both are dev-only and dependabot's weekly npm group run will
propose them.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

sources/package.json

@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@actions/artifact": "6.2.1",
-    "@actions/cache": "6.0.1",
+    "@actions/cache": "6.2.0",
     "@actions/core": "3.0.1",
     "@actions/exec": "3.0.0",
     "@actions/github": "9.1.1",
@@ -45,7 +45,7 @@
     "@actions/tool-cache": "4.0.0",
     "@octokit/webhooks-types": "7.6.1",
     "cheerio": "1.2.0",
-    "semver": "7.8.3",
+    "semver": "7.8.5",
     "string-argv": "0.3.2",
     "unhomoglyph": "1.0.6",
     "which": "7.0.0"
@@ -53,20 +53,20 @@
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@types/jest": "30.0.0",
-    "@types/node": "25.9.2",
+    "@types/node": "24.13.3",
     "@types/semver": "7.7.1",
     "@types/unzipper": "0.10.11",
     "@types/which": "3.0.4",
-    "@typescript-eslint/eslint-plugin": "8.61.0",
+    "@typescript-eslint/eslint-plugin": "8.65.0",
     "dedent": "1.7.2",
-    "esbuild": "0.28.0",
-    "eslint": "10.4.1",
-    "globals": "17.6.0",
+    "esbuild": "0.28.1",
+    "eslint": "10.7.0",
+    "globals": "17.7.0",
     "jest": "30.4.2",
-    "nock": "15.0.0",
+    "nock": "14.0.17",
     "npm-run-all": "4.1.5",
-    "prettier": "3.8.4",
-    "ts-jest": "29.4.11",
-    "typescript": "5.9.3"
+    "prettier": "3.9.6",
+    "ts-jest": "29.4.12",
+    "typescript": "6.0.3"
   }
 }