## Summary
Update all direct npm dependencies and devDependencies to the current
npm latest versions and pin them exactly instead of using caret or tilde
ranges.
## Changes
- Pin all direct runtime and development package versions in
`package.json` and refresh `package-lock.json`.
- Migrate ESLint from `.eslintrc.json` to flat config for ESLint 10.
- Update Jest and TypeScript configuration and test mocks to support the
latest ESM-only packages.
- Add response status handling and typed JSON access for the latest
`node-fetch` types.
## Checklist
- [x] I have read the latest README and followed the instructions.
- [x] I have added or updated tests for behavior changes.
- [x] I have updated README.md and action.yml when inputs or runtime
behavior changed.
- [x] I have run the relevant verification commands.
## Verification
- [x] `npm --userconfig=/private/tmp/empty-npmrc outdated --json
--include=dev` returned `{}`
- [x] `npm run all`
- [x] `npm run build`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added comprehensive test mocks for Actions APIs and fetch, improved
integration tests, and updated assertions for more precise error
validation.
* Configured Jest to map external modules to local test mocks.
* **Chores**
* Migrated ESLint to the flat config format and replaced prior ESLint
config.
* Updated project dependencies and modernized TypeScript compiler
settings.
* **Refactor**
* Adjusted exported tool constants and made error handling more explicit
in version-fetching logic.
[](https://app.coderabbit.ai/change-stack/peaceiris/actions-hugo/pull/689)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Codex <noreply@openai.com>
## Summary
- Support multiple Hugo release asset names for Linux, macOS, and
Windows so renamed upstream assets no longer fail with a plain 404.
- Preserve compatibility with legacy Hugo assets that used filename
forms such as `hugo_v0.20.3_*`, macOS `.zip` archives, and
`Linux_ARM`-style names.
- Add retry handling for missing candidate assets and macOS `.pkg`
extraction via `pkgutil --expand-full`, with focused URL and installer
tests plus the rebuilt `lib/index.js` bundle.
## References
- Fixes https://github.com/peaceiris/actions-hugo/issues/652
- `hugo-version: latest` still resolves through Homebrew; this change
does not fall back to an older Hugo version when the resolved release
has no compatible asset.
- Review note: `lib/index.js` is generated by `npm run build` and
contains bundled dependency code.
## Test plan
- [x] `RUNNER_TEMP=/tmp npm run all`
- [x] `npm run build`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Broadened test coverage for asset URL generation, download retry
behavior, and extraction across OSes and architectures.
* **Bug Fixes**
* More resilient installer with multiple candidate download URLs and
retry handling for transient failures.
* Improved extraction logic to correctly handle platform- and
format-specific archives.
[](https://app.coderabbit.ai/change-stack/peaceiris/actions-hugo/pull/687)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Codex <noreply@openai.com>
* gha: Add Pull Request to stale target
* gha: Add ncc check step (Close#98 )
* src: Rename showVersion()
* test: Add not to be cases
* Remove old comment
* gha: Add update major tag workflow (Close#97 )
