chore(deps): dependency sweep

[apify-deps]

Summary

Dependency sweep — in-range freshening (all within existing ranges):

• @actions/core ^3.0.0 → ^3.0.1
• @actions/core (execute-workflow) ^2.0.0 → ^2.0.3
• @actions/github ^6.0.0 → ^6.0.1
• @apify/tsconfig ^0.1.1 → ^0.1.2
• @types/node ^25.5.0 → ^25.9.5
• eslint ^10.1.0 → ^10.9.1
• prettier ^3.8.1 → ^3.9.6
• typescript ^6.0.2 → ^6.0.3
• typescript-eslint ^8.58.0 → ^8.68.0
• vitest ^4.1.2 → ^4.1.11
• plus transitive lockfile freshening (pnpm update -r)

✅ Dismissed (don't apply to our usage)

• undici (medium) — not_used: the only copy below the patched floor (5.29.0) is pulled transitively via @actions/github@6.0.1 → @actions/http-client@2.2.3, which uses undici solely as a ProxyAgent for connection routing (lib/index.js). None of the three vulnerable paths are exercised: we never call setCookie with untrusted domain/unparsed fields, never enable interceptors.retry() as a forwarding proxy, and Octokit never constructs a duck-typed Blob body with an untrusted .type. A fix requires a major bump of @actions/github (to 8.0.1+, out of the declared ^6.0.0 range) since undici isn't a separately overridable dep here. (alert #39, alert #40, alert #41)

🤖 Generated with Claude Code