Background
The SPDX identifier for the GNU General Public License version 3, which is at least used in "package.json". has changed. For cases where the work is under that license without the "or later" option in the standard short copyright+license notice, then it went from "GPL-3.0" to "GPL-3.0-only"; as for the scenarios where the "or later" is present in that standard short copyright+license notice, then it goes from "GPL-3.0+" to "GPL-3.0-or-later".
What to change
This action can be replaced by #8 (closed) .
Assuming that all dependencies allow this, and that the project wants to license the result under GPL-3.0-only, then change mentions of "GPL-3.0" to the updated SPDX license identifier. However, if the project meant to release the work under GPL-3.0-or-later, then perhaps another issue might need to be opened.