Bump typescript from 6.0.3 to 7.0.2

Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
fix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time DoS) (#1599 )
2026-08-05 19:03:02 +08:00 · 2026-07-29 18:06:21 +00:00 · 2026-07-29 13:03:59 -05:00 · 2026-07-21 09:21:57 -05:00 · 2026-07-17 12:47:13 -05:00 · 2026-07-16 10:33:56 -05:00
152 changed files with 180047 additions and 181466 deletions
@@ -1,6 +0,0 @@
-# Ignore list
-/*
-
-# Do not ignore these folders:
-!__tests__/
-!src/
@@ -1,51 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports = {
-  extends: [
-    'eslint:recommended',
-    'plugin:@typescript-eslint/recommended',
-    'plugin:eslint-plugin-jest/recommended',
-    'eslint-config-prettier'
-  ],
-  parser: '@typescript-eslint/parser',
-  plugins: ['@typescript-eslint', 'eslint-plugin-node', 'eslint-plugin-jest'],
-  rules: {
-    '@typescript-eslint/no-require-imports': 'error',
-    '@typescript-eslint/no-non-null-assertion': 'off',
-    '@typescript-eslint/no-explicit-any': 'off',
-    '@typescript-eslint/no-empty-function': 'off',
-    '@typescript-eslint/ban-ts-comment': [
-      'error',
-      {
-        'ts-ignore': 'allow-with-description'
-      }
-    ],
-    'no-console': 'error',
-    'yoda': 'error',
-    'prefer-const': [
-      'error',
-      {
-        destructuring: 'all'
-      }
-    ],
-    'no-control-regex': 'off',
-    'no-constant-condition': ['error', {checkLoops: false}],
-    'node/no-extraneous-import': 'error'
-  },
-  overrides: [
-    {
-      files: ['**/*{test,spec}.ts'],
-      rules: {
-        '@typescript-eslint/no-unused-vars': 'off',
-        'jest/no-standalone-expect': 'off',
-        'jest/no-conditional-expect': 'off',
-        'no-console': 'off',
-
-      }
-    }
-  ],
-  env: {
-    node: true,
-    es6: true,
-    'jest/globals': true
-  }
-};
@@ -18,10 +18,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20, 22, 24]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Clean global cache
        run: npm cache clean --force
      - name: Setup Node
@@ -41,14 +41,14 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20, 22, 24]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
-          version: 6.10.0
+          version: 10
      - name: Generate pnpm file
        run: pnpm install
      - name: Remove dependencies
@@ -74,10 +74,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20, 22, 24]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Yarn version
        run: yarn --version
      - name: Generate yarn file
@@ -106,10 +106,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20, 22, 24]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Update yarn
        run: yarn set version 3.6.4
      - name: Yarn version
@@ -139,11 +139,11 @@ jobs:
    name: Test yarn subprojects
    strategy:
      matrix:
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: prepare sub-projects
        run: __tests__/prepare-yarn-subprojects.sh yarn1
@@ -166,11 +166,11 @@ jobs:
    name: Test yarn subprojects all locally managed
    strategy:
      matrix:
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: prepare sub-projects
        run: __tests__/prepare-yarn-subprojects.sh keepcache keepcache
@@ -193,11 +193,11 @@ jobs:
    name: Test yarn subprojects some locally managed
    strategy:
      matrix:
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: prepare sub-projects
        run: __tests__/prepare-yarn-subprojects.sh global
@@ -220,11 +220,11 @@ jobs:
    name: Test yarn subprojects managed by git
    strategy:
      matrix:
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: prepare sub-projects
        run: /bin/bash __tests__/prepare-yarn-subprojects.sh keepcache
@@ -250,10 +250,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20, 22, 24]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Create package.json with packageManager field
        run: |
          echo '{ "name": "test-project", "version": "1.0.0", "packageManager": "npm@8.0.0" }' > package.json
@@ -275,10 +275,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20, 22, 24]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Create package.json with devEngines field
        run: |
          echo '{
@@ -25,7 +25,7 @@ jobs:
    env:
      https_proxy: http://squid-proxy:3128
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Clear tool cache
        run: rm -rf $RUNNER_TOOL_CACHE/*
      - name: Setup node 24
@@ -41,7 +41,7 @@ jobs:
      https_proxy: http://no-such-proxy:3128
      no_proxy: api.github.com,github.com,nodejs.org,registry.npmjs.org,*.s3.amazonaws.com,s3.amazonaws.com
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Clear tool cache
        run: rm -rf $RUNNER_TOOL_CACHE/*
      - name: Setup node 24
@@ -14,7 +14,7 @@ jobs:

    steps:
      - name: Checking out
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Publish
        id: publish
-        uses: actions/publish-immutable-action@v0.0.4
+        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
@@ -17,10 +17,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20, 22, 24]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@@ -34,10 +34,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest-large]
-        node-version: [lts/dubnium, lts/erbium, lts/fermium, lts/*, lts/-1]
+        os: [ubuntu-latest, windows-latest, macos-15-intel]
+        node-version: [lts/*, lts/-1]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@@ -56,15 +56,15 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
        node-version:
          [
-            '20-v8-canary',
-            '20.0.0-v8-canary',
-            '20.0.0-v8-canary20221101e50e45c9f8'
+            '26-v8-canary',
+            '26.0.0-v8-canary',
+            '26.0.0-v8-canary20251016054584e5cf'
          ]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@@ -81,10 +81,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20-nightly, 25-nightly, 24.0.0-nightly]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [26-nightly, 25-nightly, 24.0.0-nightly]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@@ -101,10 +101,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20.0.0-rc.1, 22.14.0-rc.1, 24.0.0-rc.4]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [26.0.0-rc.1, 22.14.0-rc.1, 24.0.0-rc.4]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@@ -121,10 +121,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20.10.0, 22.0.0, 24.9.0]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [26.5.0, 22.0.0, 24.9.0]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@@ -138,10 +138,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [20, 22, 24]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node and check latest
        uses: ./
        with:
@@ -156,11 +156,11 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
        node-version-file:
          [.nvmrc, .tool-versions, .tool-versions-node, package.json]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup node from node version file
        uses: ./
        with:
@@ -168,14 +168,29 @@ jobs:
      - name: Verify node
        run: __tests__/verify-node.sh 24

+  version-file-dev-engines:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Setup node from node version file
+        uses: ./
+        with:
+          node-version-file: '__tests__/data/package-dev-engines.json'
+      - name: Verify node
+        run: __tests__/verify-node.sh 26
+
  version-file-volta:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup node from node version file
        uses: ./
        with:
@@ -188,9 +203,9 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup node from node version file
        uses: ./
        with:
@@ -203,10 +218,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [17, 19]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
+        node-version: [21, 23]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node from dist
        uses: ./
        with:
@@ -220,9 +235,9 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-15-intel]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      # test old versions which didn't have npm and layout different
      - name: Setup node 0.12.18 from dist
        uses: ./
@@ -235,11 +250,11 @@ jobs:
  arch:
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v6
-      - name: Setup node 20 x86 from dist
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Setup node 22 x86 from dist
        uses: ./
        with:
-          node-version: '20'
+          node-version: '22'
          architecture: 'x86'
      - name: Verify node
        run: __tests__/verify-arch.sh "ia32"
@@ -250,7 +265,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
        node-version: [current, latest, node]
    steps:
      - name: Get node version
@@ -259,7 +274,7 @@ jobs:
          echo "LATEST_NODE_VERSION=$latestNodeVersion" >> $GITHUB_OUTPUT
        id: version
        shell: bash
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@@ -93,3 +93,18 @@ typings/

 # DynamoDB Local files
 .dynamodb/
+
+# Ignore everything inside fixture package-manager folders
+__tests__/data/npm/**
+__tests__/data/pnpm/**
+__tests__/data/yarn/**
+
+# Keep only fixture manifests + lockfiles
+!__tests__/data/npm/package.json
+!__tests__/data/npm/package-lock.json
+
+!__tests__/data/pnpm/package.json
+!__tests__/data/pnpm/pnpm-lock.yaml
+
+!__tests__/data/yarn/package.json
+!__tests__/data/yarn/yarn.lock
@@ -10,6 +10,11 @@ allowed:
  - mit
  - cc0-1.0
  - unlicense
+  - blueoak-1.0.0

 reviewed:
-  npm:
+  npm:
+     - "@actions/http-client"
+     - balanced-match
+     - brace-expansion
+     - fast-content-type-parse
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
dependabot[bot]	8b9e2b91a5	Bump typescript from 6.0.3 to 7.0.2 Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-07-29 18:06:21 +00:00
Copilot	e51e5fe84f	fix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time DoS) (#1599 ) * Initial plan * fix: update brace-expansion to address GHSA-3jxr-9vmj-r5cp and rebuild dist - brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16) - brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2) - brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg) - Regenerated package-lock.json - Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency Closes #1596 * fix: eliminate remaining brace-expansion vulnerabilities and update license cache ## Basic validation CI fix Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages: - `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x) - `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x - `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x from the jest coverage instrumentation path `npm audit --audit-level=high` now reports 0 vulnerabilities. ## Licensed CI fix Update .licenses/npm/ cache to match the new dependency tree: - Add: brace-expansion-5.0.8.dep.yml - Add: minimatch-10.2.6.dep.yml - Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit) - Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit) - Remove stale: minimatch-3.1.5.dep.yml - Remove stale: @actions/glob-0.6.1.dep.yml - Remove stale: concat-map.dep.yml - Remove stale: balanced-match-1.0.2.dep.yml Rebuild dist artifacts to include updated brace-expansion. * fix: replace brace-expansion workarounds with single override --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-29 13:03:59 -05:00
gowridurgad	32f57ac043	docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change (#1593 ) Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-07-21 09:21:57 -05:00
Andreas Deininger	b789df37d6	README.md: bump actions/checkout to latest version 7 (#1578 ) Co-authored-by: Haritha <73516759+HarithaVattikuti@users.noreply.github.com>	2026-07-17 12:47:13 -05:00
Haritha	1b7c366466	Update workflow pins and migrate Node matrices to modern versions (#1583 ) * Update workflow action pins and move Node 20 to 26 * fix: correct node version in v8-canary and update setup for node 22 x86 * chore: update setup-node action version from v6 to v7 in documentation * fix: update pnpm/action-setup version to v6 in advanced usage documentation	2026-07-16 10:33:56 -05:00
Priya Gupta	05e62e6009	pin @types/node to v24 (#1585 )	2026-07-16 10:33:23 -05:00
Philip Gai	391b8c7809	chore(deps): bump @actions/cache to 6.2.0 (#1584 ) Bump @actions/cache from ^6.1.0 to ^6.2.0 and rebuild the vendored dist bundles (dist/setup, dist/cache-save) via ncc. Update the licensed cache record for @actions/cache to 6.2.0. 6.2.0 ships two transparent client behaviors: honor ACTIONS_CACHE_MODE to skip restore/save when the effective cache-mode disallows it, and surface a core.warning (not a run failure) when the cache service denies a read/write due to token scopes. Copilot-Session: 0acd1380-0102-4f9d-b613-192a6ddef737 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-16 10:32:50 -05:00
v-jitenderpalsingh	363be39a57	Add Node version validation and manifest fetch retry (#1580 ) * Add Node version validation and manifest fetch retry * Add debug logs for expected and actual Node versions * chore: rebuild dist * refactor: enhance debug logging for Node installation failure * update test cases * Improve formatting of test cases * revert package-lock.json	2026-07-14 17:55:44 -05:00
gowridurgad	8207627860	Migrate to ESM and upgrade dependencies (#1574 ) * Migrate to ESM * updated package.json version * Update README for v6 and clean up dev dependencies * Remove unused ts-node * fix audit issue --------- Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-07-13 21:38:27 -05:00
gowridurgad	04be95cf35	Add cache-primary-key and cache-matched-key as outputs (#1577 ) * Add cache-primary-key and cache-matched-key as outputs * Refine cache output descriptions --------- Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-07-07 13:57:48 -05:00
Chiranjib Swain	7c2c68d20d	docs: Update caching recommendations to mitigate cache poisoning risks (#1567 ) * docs: Update caching recommendations to mitigate cache poisoning risks * docs: Disable automatic npm caching to mitigate cache poisoning risks	2026-07-02 13:14:10 -05:00
Bassem Dghaidi	6a61c0375d	Merge pull request #1569 from jasongin/update-actions-cache-5.1.0 Bump @actions/cache to 5.1.0, log cache write denied	2026-06-23 11:19:27 +02:00
Jason Ginchereau	30eb73b41d	Resolve high-severity audit issues	2026-06-18 17:59:56 -07:00
Jason Ginchereau	4e1a87a501	Update dist	2026-06-18 15:55:36 -07:00
Jason Ginchereau	360237f0c0	Strict equality	2026-06-18 15:46:26 -07:00
Jason Ginchereau	4f8aac5beb	Bump @actions/cache to 5.1.0, log cache write denied	2026-06-18 15:18:53 -07:00
Timo Sand	f4a67bbeca	Only use `mirrorToken` in `getManifest` if it's provided (#1548 ) * Only use `mirrorToken` in `getManifest` if it's provided Signed-off-by: Timo Sand <timo.sand@f-secure.com> * `npm run build` Signed-off-by: Timo Sand <timo.sand@f-secure.com> --------- Signed-off-by: Timo Sand <timo.sand@f-secure.com>	2026-06-09 11:03:18 -05:00
gowridurgad	0355742c94	Remove dummy NODE_AUTH_TOKEN export (#1558 ) Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-05-27 21:56:31 -05:00
priya-kinthali	ad1b57eb81	docs: Update restore-only cache documentation (#1550 ) * update restore-only cache example in advanced-usage.md * fix copilot suggestion * update naming	2026-05-26 17:51:36 -05:00
Chiranjib Swain	670825a89d	Add documentation for publishing to npm with Trusted Publisher (OIDC) (#1536 )	2026-04-22 21:58:57 -05:00
priya-kinthali	48b55a011b	Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533 ) * setup node in local * update workflows to remove EOL versions * update node-dist versions in versions.yml	2026-04-19 21:54:55 -05:00
Copilot	ab72c7e7eb	Upgrade @actions dependencies (#1525 ) * chore: upgrade @actions dependencies and update licenses - @actions/core: ^1.11.1 → ^2.0.3 - @actions/cache: ^5.0.1 → ^5.0.5 - @actions/glob: ^0.5.0 → ^0.5.1 - @actions/http-client: ^2.2.1 → ^3.0.2 - @actions/tool-cache: ^2.0.2 → ^3.0.1 - @actions/io: ^1.0.2 → ^2.0.0 - Run npm audit fix - Update license files for new versions - Rebuild dist files Agent-Logs-Url: https://github.com/actions/setup-node/sessions/872a3dbf-9b85-446b-963b-9127718d9560 Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com> * fix: update license files to fix Licensed CI failures Update 5 license records that were out of date after the dependency upgrade: - brace-expansion: 1.1.12 → 1.1.13 - fast-xml-builder: 1.0.0 → 1.1.4 - fast-xml-parser: 5.4.1 → 5.5.11 - strnum: 2.1.2 → 2.2.3 - path-expression-matcher: add new record (version 1.4.0, new transitive dep) Rebuild dist/ files to reflect updated lock file Agent-Logs-Url: https://github.com/actions/setup-node/sessions/fb0e70ce-ad19-48df-88a4-97f3bdc896cb Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com> * feat: upgrade @actions/exec to ^2.0.0 and fix license records - Upgrade @actions/exec from ^1.1.1 to ^2.0.0 in package.json - Update package-lock.json via npm install - Run `licensed cache` to regenerate license records: - Remove exec-1.1.1.dep.yml and exec-2.0.0.dep.yml (replaced by exec.dep.yml) - Remove io-1.1.3.dep.yml and io-2.0.0.dep.yml (replaced by io.dep.yml) - Create exec.dep.yml (v2.0.0) - single version now in tree - Create io.dep.yml (v2.0.0) - @actions/exec@1.1.1's nested io@1.1.3 removed - Rebuild dist/ files Agent-Logs-Url: https://github.com/actions/setup-node/sessions/24a1a530-6840-4445-8262-8342ec739e6d Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com>	2026-04-16 12:06:31 -05:00
dependabot[bot]	53b83947a5	Bump minimatch from 3.1.2 to 3.1.5 (#1498 ) * Bump minimatch from 3.1.2 to 3.1.3 Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.3. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.3) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Check failure fix --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-03-02 15:21:49 -06:00
gowridurgad	54045abd5d	Scope test lockfiles by package manager and update cache tests (#1495 ) * fix security alerts * fix security alerts * address Copilot suggestions --------- Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-02-26 13:18:58 -06:00
Trivikram Kamat	c882bffdbd	Replace uuid with crypto.randomUUID() (#1378 ) * Replace uuid with crypto.randomUUID() * chore: license cache * chore: update files in dist * fix: edits during resolve	2026-02-26 13:09:52 -06:00
Ferdinand Thiessen	774c1d6296	feat(node-version-file): support parsing `devEngines` field (#1283 ) * feat(node-version-file): support parsing `devEngines` field Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> * test: adjust for array like `devEngines` Co-authored-by: Grigory <grigory.orlov.set@gmail.com> Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> * ci(versions.yml): update actions and reduce duplicated tests Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> * docs: consolidate advanced usage Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> * chore: compile assets Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> --------- Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> Co-authored-by: Grigory <grigory.orlov.set@gmail.com>	2026-02-23 12:10:57 -06:00
Marco Ippolito	efcb663fc6	fix: remove hardcoded bearer (#1467 )	2026-02-19 11:58:14 -06:00
gowridurgad	d02c89dce7	Fix npm audit issues (#1491 ) Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-02-10 09:37:41 -06:00
aparnajyothi-y	6044e13b5d	Docs: bump actions/checkout from v5 to v6 (#1468 ) * Update versions.yml * Update versions.yml * doc update * revert vesrions.yml	2026-01-14 21:04:21 -06:00
Panashe Fundira	8e494633d0	Fix README typo (#1226 )	2026-01-14 17:08:53 -06:00
Andreas Deininger	621ac41091	README.md: bump to latest released checkout version v6 (#1446 )	2026-01-14 17:06:36 -06:00
Salman Chishti	2951748f4c	Bump @actions/cache to v5.0.1 (#1449 ) * Bump @actions/cache to v5.0.0 This update removes the punycode deprecation warning by updating to a version of @actions/cache that no longer depends on packages using the deprecated punycode module. * Update license cache for @actions/cache v5.0.0 dependencies Regenerated license files to reflect the updated dependency tree after bumping @actions/cache to v5.0.0. This includes license information for new transitive dependencies and removes licenses for dependencies that are no longer used. * Update license metadata for @actions/http-client Mark @actions/http-client v2.2.1 and v3.0.0 as MIT license (correctly identified from LICENSE file content) * prepare release 6.0.1 * Bump version to 6.1.1 in package.json and package-lock.json * fix: update @actions/cache with storage-blob fix for Node.js 24 punycode deprecation * fix: update @actions/cache to ^5.0.1 for Node.js 24 punycode fix Updates @actions/cache to version 5.0.1 which includes the @azure/storage-blob update that fixes the punycode deprecation warning on Node.js 24. * fix: update @actions/cache to ^5.0.1 for Node.js 24 punycode fix Updates @actions/cache to version 5.0.1 which includes the @azure/storage-blob update that fixes the punycode deprecation warning on Node.js 24.	2026-01-13 17:06:04 -06:00
Mike McCready	21ddc7bc1f	Correct mirror option typos (#1442 )	2026-01-13 10:46:12 -06:00
mahabaleshwars	65d868f8d4	Update Documentation for Lockfile (#1454 ) * update documentation for lockfile * Update adavance usage in README.md * Documentation update * Update lockfile documenation * fix coplilot suggestion	2025-12-18 10:49:55 -06:00