Merge pull request #1738 from actions/prepare-v5.0.4

Update dependencies & patch security vulnerabilities
Update RELEASES
2026-03-24 05:09:09 +08:00 · 2026-03-18 16:03:49 +01:00 · 2026-03-18 07:03:52 -07:00 · 2026-03-18 06:34:30 -07:00 · 2026-03-18 06:29:24 -07:00
12 changed files with 1376 additions and 5754 deletions
--- a/.licenses/npm/fast-xml-builder.dep.yml
+++ b/.licenses/npm/fast-xml-builder.dep.yml
--- a/.licenses/npm/fast-xml-parser.dep.yml
+++ b/.licenses/npm/fast-xml-parser.dep.yml
--- a/.licenses/npm/minimatch.dep.yml
+++ b/.licenses/npm/minimatch.dep.yml
--- a/.licenses/npm/path-expression-matcher.dep.yml
+++ b/.licenses/npm/path-expression-matcher.dep.yml
--- a/.licenses/npm/undici.dep.yml
+++ b/.licenses/npm/undici.dep.yml
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -25,6 +25,12 @@

 ## Changelog

+### 5.0.4
+
+- Bump `minimatch` to v3.1.5 (fixes ReDoS via globstar patterns)
+- Bump `undici` to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
+- Bump `fast-xml-parser` to v5.5.6
+
 ### 5.0.3

 - Bump `@actions/cache` to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
--- a/dist/restore-only/index.js
+++ b/dist/restore-only/index.js
--- a/dist/restore/index.js
+++ b/dist/restore/index.js
--- a/dist/save-only/index.js
+++ b/dist/save-only/index.js
--- a/dist/save/index.js
+++ b/dist/save/index.js
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "cache",
-  "version": "5.0.3",
+  "version": "5.0.4",
  "private": true,
  "description": "Cache dependencies and build outputs",
  "main": "dist/restore/index.js",
@@ -29,7 +29,7 @@
    "@actions/io": "^2.0.0"
  },
  "devDependencies": {
-    "@types/jest": "^30.0.0",
+    "@types/jest": "^29.5.14",
    "@types/nock": "^11.1.0",
    "@types/node": "^24.1.0",
    "@typescript-eslint/eslint-plugin": "^7.2.0",
@@ -41,7 +41,7 @@
    "eslint-plugin-jest": "^27.9.0",
    "eslint-plugin-prettier": "^5.5.3",
    "eslint-plugin-simple-import-sort": "^12.1.1",
-    "jest": "^30.2.0",
+    "jest": "^29.7.0",
    "jest-circus": "^29.7.0",
    "nock": "^13.2.9",
    "prettier": "^3.6.2",
Author	SHA1	Message	Date
Bassem Dghaidi	668228422a	Merge pull request #1738 from actions/prepare-v5.0.4 Update dependencies & patch security vulnerabilities	2026-03-18 16:03:49 +01:00
Bassem Dghaidi	e34039626f	Update RELEASES	2026-03-18 07:03:52 -07:00
Bassem Dghaidi	8a67110529	Add licenses	2026-03-18 06:34:30 -07:00
Bassem Dghaidi	1865903e1b	Update dependencies & patch security vulnerabilities	2026-03-18 06:29:24 -07:00