## Basic validation CI fix
Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x
from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages:
- `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the
root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead
of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x)
- `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use
minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x
- `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that
natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x
from the jest coverage instrumentation path
`npm audit --audit-level=high` now reports 0 vulnerabilities.
## Licensed CI fix
Update .licenses/npm/ cache to match the new dependency tree:
- Add: brace-expansion-5.0.8.dep.yml
- Add: minimatch-10.2.6.dep.yml
- Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit)
- Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit)
- Remove stale: minimatch-3.1.5.dep.yml
- Remove stale: @actions/glob-0.6.1.dep.yml
- Remove stale: concat-map.dep.yml
- Remove stale: balanced-match-1.0.2.dep.yml
Rebuild dist artifacts to include updated brace-expansion.
* Update workflow action pins and move Node 20 to 26
* fix: correct node version in v8-canary and update setup for node 22 x86
* chore: update setup-node action version from v6 to v7 in documentation
* fix: update pnpm/action-setup version to v6 in advanced usage documentation
Bump @actions/cache from ^6.1.0 to ^6.2.0 and rebuild the vendored dist
bundles (dist/setup, dist/cache-save) via ncc. Update the licensed cache
record for @actions/cache to 6.2.0.
6.2.0 ships two transparent client behaviors: honor ACTIONS_CACHE_MODE to
skip restore/save when the effective cache-mode disallows it, and surface a
core.warning (not a run failure) when the cache service denies a read/write
due to token scopes.
Copilot-Session: 0acd1380-0102-4f9d-b613-192a6ddef737
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add Node version validation and manifest fetch retry
* Add debug logs for expected and actual Node versions
* chore: rebuild dist
* refactor: enhance debug logging for Node installation failure
* update test cases
* Improve formatting of test cases
* revert package-lock.json
* Migrate to ESM
* updated package.json version
* Update README for v6 and clean up dev dependencies
* Remove unused ts-node
* fix audit issue
---------
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
* Only use `mirrorToken` in `getManifest` if it's provided
Signed-off-by: Timo Sand <timo.sand@f-secure.com>
* `npm run build`
Signed-off-by: Timo Sand <timo.sand@f-secure.com>
---------
Signed-off-by: Timo Sand <timo.sand@f-secure.com>
* Bump @actions/cache to v5.0.0
This update removes the punycode deprecation warning by updating to a version of @actions/cache that no longer depends on packages using the deprecated punycode module.
* Update license cache for @actions/cache v5.0.0 dependencies
Regenerated license files to reflect the updated dependency tree after bumping @actions/cache to v5.0.0. This includes license information for new transitive dependencies and removes licenses for dependencies that are no longer used.
* Update license metadata for @actions/http-client
Mark @actions/http-client v2.2.1 and v3.0.0 as MIT license (correctly identified from LICENSE file content)
* prepare release 6.0.1
* Bump version to 6.1.1 in package.json and package-lock.json
* fix: update @actions/cache with storage-blob fix for Node.js 24 punycode deprecation
* fix: update @actions/cache to ^5.0.1 for Node.js 24 punycode fix
Updates @actions/cache to version 5.0.1 which includes the @azure/storage-blob
update that fixes the punycode deprecation warning on Node.js 24.
* fix: update @actions/cache to ^5.0.1 for Node.js 24 punycode fix
Updates @actions/cache to version 5.0.1 which includes the @azure/storage-blob
update that fixes the punycode deprecation warning on Node.js 24.
* Remove always-auth configuration handling from setup-node
* docs: update README to note always-auth removal
Update README to mention removal of always-auth input
* Clarify removal of 'always-auth' input in README
Updated the description of the 'always-auth' input removal for clarity.
* default to auto-caching only for npm package manager and documentation update
* refactor: enhance package manager detection for auto-caching
* add devEngines.packageManager detection logic for npm auto-caching
* chore: bump version to 6.0.0 and update documentation
* docs: update README and action.yml for npm caching logic clarification
* chore: update Node.js version in workflows
* chore: update Node.js versions in versions.yml
* chore: update rc Node.js version in versions.yml
* chore: switch macos-13 runner to macos-latest-large in workflow
* docs: update README and advanced usage documentation
* Change Node.js version to 24
Update Node.js version from 20 to 24 in action.yml
* update and vulnerability fixes
* update node version check
* update licences
* node version check update
* update version for test
* node version
* update node version to 24.0.0 in tool-versions and package-volta.json
* node 24
* update to 24
* update to specify engines
* check failures fix
* update package-lock.json
* licensed update
* check failure fix
* documentation update
---------
Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>
