Replace pnpm-lock.yaml with package-lock.json. Both overrides move to
package.json#overrides, including the request -> @cypress/request alias.
allowBuilds for es5-ext becomes package.json#allowScripts.
The deploy script chained "pnpm register", which would have failed once pnpm
was gone; it now calls npm run register.
- alias legacy request transitive to maintained @cypress/request fork
- pin undici to 7.28.0 for GHSA batch affecting < 7.28.0
- drop form-data/qs/tough-cookie overrides now satisfied upstream
- bump @vercel/functions to 3.7.5 and google-play-scraper to 10.1.3
- bump actions/checkout and actions/setup-node to v7
- pin form-data/qs/tough-cookie via package.json overrides; clears 3 of 4
Dependabot alerts (request SSRF risk-accepted, no upstream fix)
- add GitHub Actions CI (lint + syntax check) on push/PR
- add /settings and /setdayswarning to setMyCommands
- new npm run describe sets bot profile description via Bot API
- README: drop stale preview warning, add Operations section
tiennm99
