build: update npm dependencies (#689)

## Summary

Update all direct npm dependencies and devDependencies to the current
npm latest versions and pin them exactly instead of using caret or tilde
ranges.

## Changes

- Pin all direct runtime and development package versions in
`package.json` and refresh `package-lock.json`.
- Migrate ESLint from `.eslintrc.json` to flat config for ESLint 10.
- Update Jest and TypeScript configuration and test mocks to support the
latest ESM-only packages.
- Add response status handling and typed JSON access for the latest
`node-fetch` types.

## Checklist

- [x] I have read the latest README and followed the instructions.
- [x] I have added or updated tests for behavior changes.
- [x] I have updated README.md and action.yml when inputs or runtime
behavior changed.
- [x] I have run the relevant verification commands.

## Verification

- [x] `npm --userconfig=/private/tmp/empty-npmrc outdated --json
--include=dev` returned `{}`
- [x] `npm run all`
- [x] `npm run build`


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Added comprehensive test mocks for Actions APIs and fetch, improved
integration tests, and updated assertions for more precise error
validation.
  * Configured Jest to map external modules to local test mocks.

* **Chores**
* Migrated ESLint to the flat config format and replaced prior ESLint
config.
* Updated project dependencies and modernized TypeScript compiler
settings.

* **Refactor**
* Adjusted exported tool constants and made error handling more explicit
in version-fetching logic.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/peaceiris/actions-hugo/pull/689)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Codex <noreply@openai.com>

__tests__/get-arch.test.ts

@@ -10,6 +10,6 @@ describe('getArch', () => {
   test('exception', () => {
     expect(() => {
       getArch('mips');
-    }).toThrowError('mips is not supported');
+    }).toThrow('mips is not supported');
   });
 });

__tests__/get-latest-version.test.ts

@@ -45,6 +45,6 @@ describe('getLatestVersion()', () => {
   test('return exception 404', async () => {
     nock('https://formulae.brew.sh').get(`/api/formula/${Tool.Repo}.json`).reply(404);
 
-    await expect(getLatestVersion(Tool.Org, Tool.Repo, 'brew')).rejects.toThrowError(FetchError);
+    await expect(getLatestVersion(Tool.Org, Tool.Repo, 'brew')).rejects.toThrow(FetchError);
   });
 });

__tests__/get-os.test.ts

@@ -10,6 +10,6 @@ describe('getOS', () => {
   test('exception', () => {
     expect(() => {
       getOS('centos');
-    }).toThrowError('centos is not supported');
+    }).toThrow('centos is not supported');
   });
 });

__tests__/main.test.ts

@@ -65,7 +65,7 @@ describe('Integration testing run()', () => {
     process.env['INPUT_HUGO-VERSION'] = 'latest';
     nock('https://formulae.brew.sh').get(`/api/formula/${Tool.Repo}.json`).reply(404);
 
-    await expect(main.run()).rejects.toThrowError(FetchError);
+    await expect(main.run()).rejects.toThrow(FetchError);
   });
 });
 
@@ -82,6 +82,6 @@ describe('showVersion()', () => {
   });
 
   test('return not found', async () => {
-    await expect(main.showVersion('gitgit', ['--version'])).rejects.toThrowError(Error);
+    await expect(main.showVersion('gitgit', ['--version'])).rejects.toThrow('spawn gitgit ENOENT');
   });
 });

__tests__/mocks/actions-core.ts

@@ -0,0 +1,17 @@
+import path from 'path';
+
+export function getInput(name: string): string {
+  return process.env[`INPUT_${name.replace(/ /g, '_').toUpperCase()}`] || '';
+}
+
+export function addPath(inputPath: string): void {
+  process.env.PATH = `${inputPath}${path.delimiter}${process.env.PATH || ''}`;
+}
+
+export function debug(message: string): void {
+  void message;
+}
+
+export function info(message: string): void {
+  void message;
+}

__tests__/mocks/actions-exec.ts

@@ -0,0 +1,36 @@
+import {spawn} from 'child_process';
+
+interface ExecOptions {
+  listeners?: {
+    stdout?: (data: Buffer) => void;
+    stderr?: (data: Buffer) => void;
+  };
+}
+
+export async function exec(
+  commandLine: string,
+  args: string[] = [],
+  options: ExecOptions = {}
+): Promise<number> {
+  if (commandLine === 'hugo') {
+    const version = process.env.TEST_HUGO_VERSION || '';
+    const extended = process.env.TEST_HUGO_EXTENDED === 'true' ? ' extended' : '';
+    options.listeners?.stdout?.(Buffer.from(`hugo v${version}${extended}\n`));
+    return 0;
+  }
+
+  return new Promise((resolve, reject) => {
+    const child = spawn(commandLine, args);
+
+    child.stdout?.on('data', (data: Buffer) => {
+      options.listeners?.stdout?.(data);
+    });
+    child.stderr?.on('data', (data: Buffer) => {
+      options.listeners?.stderr?.(data);
+    });
+    child.on('error', reject);
+    child.on('close', code => {
+      resolve(code ?? 0);
+    });
+  });
+}

__tests__/mocks/actions-io.ts

@@ -0,0 +1,12 @@
+export async function mkdirP(dir: string): Promise<void> {
+  void dir;
+}
+
+export async function rmRF(target: string): Promise<void> {
+  void target;
+}
+
+export async function mv(source: string, dest: string): Promise<void> {
+  void source;
+  void dest;
+}

__tests__/mocks/actions-tool-cache.ts

@@ -0,0 +1,18 @@
+export async function downloadTool(url: string): Promise<string> {
+  const version = /hugo(?:_extended)?_([^_]+)_/.exec(url)?.[1] || '';
+  process.env.TEST_HUGO_VERSION = version;
+  process.env.TEST_HUGO_EXTENDED = url.includes('hugo_extended_') ? 'true' : 'false';
+  return '/tmp/hugo-archive';
+}
+
+export async function extractTar(assetPath: string, tempDir: string): Promise<string> {
+  void assetPath;
+  void tempDir;
+  return '/tmp/extracted';
+}
+
+export async function extractZip(assetPath: string, tempDir: string): Promise<string> {
+  void assetPath;
+  void tempDir;
+  return '/tmp/extracted';
+}

__tests__/mocks/node-fetch.ts

@@ -0,0 +1,53 @@
+import http from 'http';
+import https from 'https';
+
+export class FetchError extends Error {
+  name = 'FetchError' as const;
+
+  constructor(
+    message: string,
+    public type: string,
+    systemError?: Record<string, unknown>
+  ) {
+    super(message);
+    if (systemError) {
+      Object.assign(this, systemError);
+    }
+  }
+}
+
+interface ResponseLike {
+  ok: boolean;
+  status: number;
+  json: () => Promise<unknown>;
+}
+
+export default async function fetch(url: string | URL): Promise<ResponseLike> {
+  const target = url.toString();
+  const client = target.startsWith('https:') ? https : http;
+
+  return new Promise((resolve, reject) => {
+    const request = client.get(target, response => {
+      const chunks: Buffer[] = [];
+
+      response.on('data', (chunk: Buffer | string) => {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      });
+
+      response.on('end', () => {
+        const status = response.statusCode ?? 0;
+        const body = Buffer.concat(chunks).toString();
+
+        resolve({
+          ok: status >= 200 && status < 300,
+          status,
+          json: async () => JSON.parse(body) as unknown
+        });
+      });
+    });
+
+    request.on('error', error => {
+      reject(new FetchError(error.message, 'system'));
+    });
+  });
+}