Lift tsup and tn-forms to clear 21 Dependabot alerts

[whusterj]

What This Does

Clears all 21 open Dependabot alerts. Every one was development scope, and they arrived through two separate chains.

The larger chain was not this repo's doing. The lockfile held @thinknimble/tn-forms@3.3.4, which declares babel-loader as a runtime dependency and therefore drags webpack, ajv, browserslist, serialize-javascript and terser into every install of this package. tn-forms@3.4.0 dropped babel-loader (along with install, another placeholder package), so moving the lock to 3.4.0 removes that branch entirely. That single change accounts for 16 of the 21 alerts.

The smaller chain is tsup's own: sucrase → glob → minimatch → brace-expansion, plus esbuild. Going from tsup 6.5.0 to 8.5.1 does not lift those far enough by itself, so four pnpm.overrides finish the job. Three of them sit comfortably inside their depender's range. The fourth does not: tsup 8.5.1 asks for esbuild ^0.27.0 and the patched version is 0.28.1, so that override deliberately steps outside. It is a low-severity dev-server advisory, and this package never starts a dev server, so I verified the override by comparing build output rather than by trusting the range.

The workflow file is new because this repo had no CI at all.

pnpm audit reports no known vulnerabilities.

Note for reviewers

There is no test suite here, so the build output is the evidence. dist/index.js and dist/index.mjs export the same two names as before, FormProvider and useTnForm, both still functions. The rest of the diff against the previous build is newer-esbuild formatting (if (x) return; collapsed onto one line) and one internal variable rename, tn_forms_react_exports to index_exports. The type declaration moves by exactly one line: ConvertToFieldTuple now carries the type modifier, which needs TypeScript 4.5 or later in a consumer.

The decision I did not make for you: peerDependencies still reads @thinknimble/tn-forms: >=3.3.3. A consumer who installs this package alongside tn-forms 3.3.4 still pulls the whole webpack tree into their own project, and their own Dependabot will say so. Raising that floor to >=3.4.0 would protect them, but it narrows the supported range for everyone, so it is your call rather than mine.

Two pre-existing problems I left alone. npx tsc --noEmit reports three errors in src/form-provider.tsx line 99 (Object.entries needs lib at es2017 or later, and two implicit any bindings). They are identical on main before this change, which is why the new workflow runs the build and not tsc. Also, tsup 8 now emits dist/index.d.mts next to index.d.ts; nothing references it, and it improves type resolution for ESM consumers.