Bump GitHub Actions runtime from node16 to node24

[Copilot]

Node.js 16 reached EOL in September 2023 and GitHub Actions has deprecated the node16 runtime. This upgrades the action to run on node24.

Changes

• action.yml: using: 'node16' → using: 'node24'
• main.js: Replace deprecated String.prototype.substr() with slice() (same semantics, spec-compliant); migrated from CommonJS require() to ES module import statements (required by the new ESM-only @actions/* packages)
• package.json: Bumped all @actions/* dependencies to their latest major versions to resolve undici CVEs; added "type": "module" for ESM support:
  • @actions/cache: ^4.0.0 → ^6.0.0
  • @actions/core: ^1.2.6 → ^3.0.0
  • @actions/exec: ^1.0.4 → ^3.0.0
  • @actions/io: ^1.0.2 → ^3.0.2
  • @actions/tool-cache: ^2.0.2 → ^4.0.0
• node_modules/: npm install + npm audit fix — npm audit now reports 0 vulnerabilities

Known incompatibilities

Area	Notes
substr deprecation	Removed from use; slice is the drop-in replacement
Global fetch (Node 18+)	Action uses @actions/http-client — no conflict
V8 v13	All syntax in main.js is fully compatible
ESM migration	All new major @actions/* versions are ESM-only; main.js now uses import instead of require()
undici ≤6.23.0 CVEs	Resolved — new @actions/http-client v4 pulls in undici 6.24.x (patched)

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[Tieske]

@copilot also fix the undici dependencies, even it it means major version bumps

[Copilot]

@copilot also fix the undici dependencies, even it it means major version bumps

Done in commit fec6f0e. All @actions/* packages have been bumped to their latest major versions (cache → v6, core → v3, exec → v3, io → v3, tool-cache → v4), which pull in @actions/http-client v4 (using undici ^6.23.0 resolved to 6.24.x). npm audit now reports 0 vulnerabilities.

Since all new major versions are ESM-only, main.js was also migrated from CommonJS require() to ES module import statements, and "type": "module" was added to package.json.

[Tieske]

looks ok. Test pass. only unsure about why all the dependencies (3000+ files) are included....

[luau-project]

I think such huge number of files changed is expected (due the bump from node 16 to node 24), because actions usually ship all dependencies to not miss any dep at runtime.

• Some actions (e.g.: that one from ilammy to setup MSVC dev prompt) choose to not ship the node_modules folder, but rely on the user to call first actions/checkout, which pulls all the @actions/* code.

• Other actions (e.g.: my setup-lua action) choose to use tools like vercel/ncc to bundle all the node_modules dependencies into a single *.js file. Bundling everything with ncc has the advantage to make the review easier. Still, the resulting bundled js file is quite huge (almost 100k lines).

[luau-project]

LGTM!