Bump all dependencies to latest versions (#392)

* Initial plan

* Bump all dependencies and adapt code for ESM-only @actions/* packages

Dependencies bumped:
- @actions/core: ^1.10.0 → ^3.0.0
- @actions/exec: ^1.1.1 → ^3.0.0
- @actions/github: ^6.0.1 → ^9.0.0
- @babel/parser: ^7.28.4 → ^7.29.0
- @eslint/js: ^9.39.0 → ^10.0.1
- @octokit/openapi-types: ^26.0.0 → ^27.0.0
- @types/node: ^24.9.2 → ^25.4.0
- eslint: ^9.39.0 → ^10.0.3
- js-yaml: ^4.1.0 → ^4.1.1
- prettier: 3.6.2 → 3.8.1
- typescript-eslint: ^8.46.2 → ^8.57.0
- vitest: ^4.0.6 → ^4.0.18

Code changes:
- Update import of ExecOptions from @actions/exec (v3 exports map)
- Replace InstanceType<typeof GitHub> with ReturnType<typeof getOctokit>
- Update test mocks to use vi.mock for ESM-only packages
- Update tsconfig moduleResolution to Bundler for ESM support
- Add .npmrc for pnpm @octokit/* type hoisting

Co-authored-by: flaxel <19373153+flaxel@users.noreply.github.com>

* Address code review: remove redundant mock default in test

Co-authored-by: flaxel <19373153+flaxel@users.noreply.github.com>

* Add copilot[bot] to CLA allowlist

Co-authored-by: flaxel <19373153+flaxel@users.noreply.github.com>

* Fix CLA allowlist: escape brackets in copilot[bot] for minimatch

Co-authored-by: flaxel <19373153+flaxel@users.noreply.github.com>

* Fix CLA allowlist: use correct bot login (Copilot) and wildcard (copilot*)

Co-authored-by: flaxel <19373153+flaxel@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: flaxel <19373153+flaxel@users.noreply.github.com>

Author: Copilot

.github/workflows/cla.yml

@@ -24,4 +24,4 @@ jobs:
           path-to-document: "https://github.com/Staffbase/autodev-action/blob/main/CLA.md"
           # branch should not be protected
           branch: "signatures"
-          allowlist: 0x46616c6b,axdotl,flaxel,kaitimmer,ricoberger,staffbase-robert,bot*
+          allowlist: 0x46616c6b,axdotl,flaxel,kaitimmer,ricoberger,staffbase-robert,bot*,Copilot,copilot*

.npmrc

@@ -0,0 +1 @@
+public-hoist-pattern[]=@octokit/*

dist/index.js

@@ -25,23 +25,23 @@
   "author": "Staffbase SE",
   "license": "Apache-2.0",
   "dependencies": {
-    "@actions/core": "^1.10.0"
+    "@actions/core": "^3.0.0"
   },
   "devDependencies": {
-    "@actions/exec": "^1.1.1",
-    "@actions/github": "^6.0.1",
-    "@babel/parser": "^7.28.4",
-    "@eslint/js": "^9.39.0",
-    "@octokit/openapi-types": "^26.0.0",
-    "@types/node": "^24.9.2",
+    "@actions/exec": "^3.0.0",
+    "@actions/github": "^9.0.0",
+    "@babel/parser": "^7.29.0",
+    "@eslint/js": "^10.0.1",
+    "@octokit/openapi-types": "^27.0.0",
+    "@types/node": "^25.4.0",
     "@vercel/ncc": "^0.38.4",
-    "eslint": "^9.39.0",
+    "eslint": "^10.0.3",
     "eslint-plugin-simple-import-sort": "^12.1.1",
-    "js-yaml": "^4.1.0",
-    "prettier": "3.6.2",
+    "js-yaml": "^4.1.1",
+    "prettier": "3.8.1",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.46.2",
-    "vitest": "^4.0.6"
+    "typescript-eslint": "^8.57.0",
+    "vitest": "^4.0.18"
   },
   "packageManager": "pnpm@9.14.4"
 }