Bundle includes apache-arrow code generation (new Function) since v4.38.3 #4252

Since v4.38.3, lib/entry-points.js includes apache-arrow's createIsValidFunction, which builds a predicate with new Function from runtime values. It comes in through @azure/storage-blob 12.34.0 (via @actions/artifact and @actions/cache), which lazily imports apache-arrow for its Arrow blob-list parser. v4.38.2 didn't include it; v4.39.0 still does.

Static analysis can't verify the generated function, so supply-chain auditing tools treat these releases as unverifiable. As far as I can tell nothing in the action lists blobs, so the parser is unreachable. The upstream fix is apache/arrow-js#501.

Would you consider excluding apache-arrow from the bundle in build.mjs, or overriding to the fixed apache-arrow once it's released?