[smorimoto]

Why

Bring the npm dependencies up to date, except @types/node. Dependabot covers only GitHub Actions in this repository, so npm bumps are manual.

What changed

• Update vite-plus to 1.5.0, ultracite to 8.1.1, knip to 6.44.2, semver to 7.8.6, systeminformation to 5.33.19, and @github/dependency-submission-toolkit to 3.0.0.
• Deduplicate semver in yarn.lock. Otherwise @actions/tool-cache keeps 7.8.5 and dist/index.mjs grows by about 120 KB with a second copy of semver.
• Rebuild dist/github-client.mjs and analysis/dist/index.mjs. The analysis bundle shrinks from 1.13 MB to 0.71 MB. Toolkit 3.0.0 now uses the same @actions/core 3 and @actions/github 9 as the rest of the repository, so the older copies leave the lockfile.

Scope

• Only direct dependencies change. Transitive dependencies keep their locked versions, except semver.
• @types/node stays at 24.19.2, and the Node.js 24 runtime does not change.
• No source or configuration change is needed. Toolkit 3.0.0 requires Node.js 24, which analysis/action.yml already declares. ultracite 8.1.1 requires oxlint 1.90 or later, and vite-plus 1.5.0 bundles oxlint 1.91.0.

Blast Radius

• semver 7.8.6 replaces the regular expression that trims whitespace in ranges. The ocaml-compiler input and the opam release selection depend on that code. A comparison of 7.8.5 and 7.8.6 over about 840,000 ranges found no difference in validRange, maxSatisfying, or satisfies.
• systeminformation osInfo().release is part of the opam cache key. The output matched on macOS, so existing caches should stay valid. Linux and Windows were not compared.
• The analysis action sends the same snapshot body as before. When GitHub rejects the snapshot, the action now also logs the HTTP status and the response body.
• CI exercises the main action on Linux, macOS, Windows, and a container.