From af561d02a95e37c9dd1c60e7d77280fec07c77c1 Mon Sep 17 00:00:00 2001
From: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Date: Tue, 25 Aug 2026 05:51:13 +0100
Subject: [PATCH] Cap @actions/exec and @actions/core below the ESM-only 3.x
 majors

@actions/exec 3.0.0 and @actions/core 3.0.1 ship as ESM-only
(package.json "type": "module"), which the CommonJS ncc bundle cannot
require() (see the failing bumps in #623 and #624, same failure mode as the
already-capped @actions/io). Extend the existing ESM cap to these two packages
so Dependabot stays on their 2.x (CommonJS) line until the action migrates to
ESM. @actions/http-client 3.x remains CommonJS and is intentionally not capped.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/dependabot.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 28b238980..f0028db08 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,10 +15,16 @@ updates:
       # below 7 (the native compiler rewrite) until ts-jest supports it.
       - dependency-name: "typescript"
         versions: [">=7"]
-      # @actions/io 3.x is ESM-only, which breaks the CommonJS ncc build.
-      # Stay on 2.x (CommonJS, Node 24 support) until the action moves to ESM.
+      # @actions/io, @actions/exec and @actions/core 3.x are ESM-only
+      # (package.json "type": "module"), which the CommonJS ncc bundle cannot
+      # require(). @actions/http-client 3.x is still CommonJS, so it is not
+      # capped. Stay on 2.x for the ESM packages until the action migrates to ESM.
       - dependency-name: "@actions/io"
         versions: [">=3"]
+      - dependency-name: "@actions/exec"
+        versions: [">=3"]
+      - dependency-name: "@actions/core"
+        versions: [">=3"]
 
   - package-ecosystem: "github-actions"
     directory: "/"