fix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time DoS) (#1599 )

* Initial plan * fix: update brace-expansion to address GHSA-3jxr-9vmj-r5cp and rebuild dist - brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16) - brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2) - brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg) - Regenerated package-lock.json - Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency Closes #1596 * fix: eliminate remaining brace-expansion vulnerabilities and update license cache ## Basic validation CI fix Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages: - `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x) - `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x - `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x from the jest coverage instrumentation path `npm audit --audit-level=high` now reports 0 vulnerabilities. ## Licensed CI fix Update .licenses/npm/ cache to match the new dependency tree: - Add: brace-expansion-5.0.8.dep.yml - Add: minimatch-10.2.6.dep.yml - Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit) - Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit) - Remove stale: minimatch-3.1.5.dep.yml - Remove stale: @actions/glob-0.6.1.dep.yml - Remove stale: concat-map.dep.yml - Remove stale: balanced-match-1.0.2.dep.yml Rebuild dist artifacts to include updated brace-expansion. * fix: replace brace-expansion workarounds with single override --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change (#1593 )
2026-07-30 02:13:15 +08:00 · 2026-07-29 13:03:59 -05:00 · 2026-07-21 09:21:57 -05:00 · 2026-07-17 12:47:13 -05:00 · 2026-07-16 10:33:56 -05:00 · 2026-07-16 10:33:23 -05:00
19 changed files with 3761 additions and 3518 deletions
--- a/.github/workflows/e2e-cache.yml
+++ b/.github/workflows/e2e-cache.yml
@ -18,10 +18,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Clean global cache
        run: npm cache clean --force
      - name: Setup Node
@ -41,14 +41,14 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
-          version: 6.10.0
+          version: 10
      - name: Generate pnpm file
        run: pnpm install
      - name: Remove dependencies
@ -74,10 +74,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Yarn version
        run: yarn --version
      - name: Generate yarn file
@ -106,10 +106,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Update yarn
        run: yarn set version 3.6.4
      - name: Yarn version
@ -139,11 +139,11 @@ jobs:
    name: Test yarn subprojects
    strategy:
      matrix:
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: prepare sub-projects
        run: __tests__/prepare-yarn-subprojects.sh yarn1
@ -166,11 +166,11 @@ jobs:
    name: Test yarn subprojects all locally managed
    strategy:
      matrix:
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: prepare sub-projects
        run: __tests__/prepare-yarn-subprojects.sh keepcache keepcache
@ -193,11 +193,11 @@ jobs:
    name: Test yarn subprojects some locally managed
    strategy:
      matrix:
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: prepare sub-projects
        run: __tests__/prepare-yarn-subprojects.sh global
@ -220,11 +220,11 @@ jobs:
    name: Test yarn subprojects managed by git
    strategy:
      matrix:
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: prepare sub-projects
        run: /bin/bash __tests__/prepare-yarn-subprojects.sh keepcache
@ -250,10 +250,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Create package.json with packageManager field
        run: |
          echo '{ "name": "test-project", "version": "1.0.0", "packageManager": "npm@8.0.0" }' > package.json
@ -275,10 +275,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Create package.json with devEngines field
        run: |
          echo '{
--- a/.github/workflows/proxy.yml
+++ b/.github/workflows/proxy.yml
@ -25,7 +25,7 @@ jobs:
    env:
      https_proxy: http://squid-proxy:3128
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Clear tool cache
        run: rm -rf $RUNNER_TOOL_CACHE/*
      - name: Setup node 24
@ -41,7 +41,7 @@ jobs:
      https_proxy: http://no-such-proxy:3128
      no_proxy: api.github.com,github.com,nodejs.org,registry.npmjs.org,*.s3.amazonaws.com,s3.amazonaws.com
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Clear tool cache
        run: rm -rf $RUNNER_TOOL_CACHE/*
      - name: Setup node 24
--- a/.github/workflows/publish-immutable-actions.yml
+++ b/.github/workflows/publish-immutable-actions.yml
@ -14,7 +14,7 @@ jobs:
    steps:
      - name: Checking out
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Publish
        id: publish
-        uses: actions/publish-immutable-action@v0.0.4
+        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
--- a/.github/workflows/versions.yml
+++ b/.github/workflows/versions.yml
@ -17,10 +17,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@ -34,10 +34,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-15-intel]
-        node-version: [lts/dubnium, lts/erbium, lts/fermium, lts/*, lts/-1]
+        node-version: [lts/*, lts/-1]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@ -56,15 +56,15 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
        node-version:
          [
-            '20-v8-canary',
+            '26-v8-canary',
-            '20.0.0-v8-canary',
+            '26.0.0-v8-canary',
-            '20.0.0-v8-canary20221101e50e45c9f8'
+            '26.0.0-v8-canary20251016054584e5cf'
          ]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@ -81,10 +81,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20-nightly, 25-nightly, 24.0.0-nightly]
+        node-version: [26-nightly, 25-nightly, 24.0.0-nightly]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@ -101,10 +101,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20.0.0-rc.1, 22.14.0-rc.1, 24.0.0-rc.4]
+        node-version: [26.0.0-rc.1, 22.14.0-rc.1, 24.0.0-rc.4]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@ -121,10 +121,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20.10.0, 22.0.0, 24.9.0]
+        node-version: [26.5.0, 22.0.0, 24.9.0]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
@ -138,10 +138,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
-        node-version: [20, 22, 24]
+        node-version: [22, 24, 26]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node and check latest
        uses: ./
        with:
@ -156,11 +156,11 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
        node-version-file:
          [.nvmrc, .tool-versions, .tool-versions-node, package.json]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup node from node version file
        uses: ./
        with:
@ -175,22 +175,22 @@ jobs:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup node from node version file
        uses: ./
        with:
          node-version-file: '__tests__/data/package-dev-engines.json'
      - name: Verify node
-        run: __tests__/verify-node.sh 20
+        run: __tests__/verify-node.sh 26
  version-file-volta:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup node from node version file
        uses: ./
        with:
@ -203,9 +203,9 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup node from node version file
        uses: ./
        with:
@ -218,10 +218,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
        node-version: [21, 23]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node from dist
        uses: ./
        with:
@ -235,9 +235,9 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-15-intel]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      # test old versions which didn't have npm and layout different
      - name: Setup node 0.12.18 from dist
        uses: ./
@ -250,11 +250,11 @@ jobs:
  arch:
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Setup node 20 x86 from dist
+      - name: Setup node 22 x86 from dist
        uses: ./
        with:
-          node-version: '20'
+          node-version: '22'
          architecture: 'x86'
      - name: Verify node
        run: __tests__/verify-arch.sh "ia32"
@ -265,7 +265,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
        node-version: [current, latest, node]
    steps:
      - name: Get node version
@ -274,7 +274,7 @@ jobs:
          echo "LATEST_NODE_VERSION=$latestNodeVersion" >> $GITHUB_OUTPUT
        id: version
        shell: bash
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Setup Node
        uses: ./
        with:
--- a/.licenses/npm/@actions/cache.dep.yml
+++ b/.licenses/npm/@actions/cache.dep.yml
@ -1,6 +1,6 @@
 ---
 name: "@actions/cache"
-version: 6.1.0
+version: 6.2.0
 type: npm
 summary: Actions cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/cache
--- a/.licenses/npm/balanced-match-1.0.2.dep.yml
+++ b/.licenses/npm/balanced-match-1.0.2.dep.yml
@ -1,55 +0,0 @@
 ---
 name: balanced-match
 version: 1.0.2
 type: npm
 summary: Match balanced character pairs, like "{" and "}"
 homepage: https://github.com/juliangruber/balanced-match
 license: mit
 licenses:
 - sources: LICENSE.md
  text: |
    (MIT)
    Copyright (c) 2013 Julian Gruber &lt;julian@juliangruber.com&gt;
    Permission is hereby granted, free of charge, to any person obtaining a copy of
    this software and associated documentation files (the "Software"), to deal in
    the Software without restriction, including without limitation the rights to
    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
    of the Software, and to permit persons to whom the Software is furnished to do
    so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE.
 - sources: README.md
  text: |-
    (MIT)
    Copyright (c) 2013 Julian Gruber &lt;julian@juliangruber.com&gt;
    Permission is hereby granted, free of charge, to any person obtaining a copy of
    this software and associated documentation files (the "Software"), to deal in
    the Software without restriction, including without limitation the rights to
    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
    of the Software, and to permit persons to whom the Software is furnished to do
    so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE.
 notices: []
--- a/.licenses/npm/balanced-match-4.0.4.dep.yml
+++ b/.licenses/npm/balanced-match-4.0.4.dep.yml
--- a/.licenses/npm/brace-expansion-1.1.13.dep.yml
+++ b/.licenses/npm/brace-expansion-1.1.13.dep.yml
@ -1,55 +0,0 @@
 ---
 name: brace-expansion
 version: 1.1.13
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    MIT License
    Copyright (c) 2013 Julian Gruber <julian@juliangruber.com>
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE.
 - sources: README.md
  text: |-
    (MIT)
    Copyright (c) 2013 Julian Gruber &lt;julian@juliangruber.com&gt;
    Permission is hereby granted, free of charge, to any person obtaining a copy of
    this software and associated documentation files (the "Software"), to deal in
    the Software without restriction, including without limitation the rights to
    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
    of the Software, and to permit persons to whom the Software is furnished to do
    so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE.
 notices: []
--- a/.licenses/npm/brace-expansion-5.0.6.dep.yml
+++ b/.licenses/npm/brace-expansion-5.0.6.dep.yml
@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 5.0.6
+version: 5.0.8
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage:
--- a/.licenses/npm/concat-map.dep.yml
+++ b/.licenses/npm/concat-map.dep.yml
@ -1,31 +0,0 @@
 ---
 name: concat-map
 version: 0.0.1
 type: npm
 summary: concatenative mapdashery
 homepage: https://github.com/substack/node-concat-map#readme
 license: other
 licenses:
 - sources: LICENSE
  text: |
    This software is released under the MIT license:
    Permission is hereby granted, free of charge, to any person obtaining a copy of
    this software and associated documentation files (the "Software"), to deal in
    the Software without restriction, including without limitation the rights to
    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
    the Software, and to permit persons to whom the Software is furnished to do so,
    subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
    FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
    COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
    IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
    CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 - sources: README.markdown
  text: MIT
 notices: []
--- a/README.md
+++ b/README.md
@ -12,9 +12,13 @@ This action provides the following functionality for GitHub Actions users:
 - Registering problem matchers for error output
 - Configuring authentication for GPR or npm
-## Breaking changes in V7
+## What's new in V7
- **Migrated to ESM** to enable support for the latest `@actions/*` package versions.
+- Migrated action internals to ESM for compatibility with latest `@actions/*` packages. No changes to action inputs, outputs, or behavior.
 ### Breaking change
 - The dummy `NODE_AUTH_TOKEN` fallback has been removed, as it could unintentionally affect the generated `.npmrc` with a non-functional token. With this change, if `registry-url` is set without `NODE_AUTH_TOKEN`, legacy Yarn Classic (1.x) and older Node/npm versions may fail, and pnpm may warn. npm Trusted Publishing (OIDC) is not affected, since it does not use `NODE_AUTH_TOKEN`.
 ## Breaking changes in V6
@ -30,7 +34,7 @@ This action provides the following functionality for GitHub Actions users:
 - Upgraded action from node20 to node24.
  > Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. [See Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1)
-For more details, see the full release notes on the [releases page](https://github.com/actions/setup-node/releases/v5.0.0)
+For more details, see the full release notes on the [releases page](https://github.com/actions/setup-node/releases)
 ## Usage
@ -38,7 +42,7 @@ See [action.yml](action.yml)
 <!-- start usage -->
 ```yaml
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    # Version Spec of the version to use in SemVer notation.
    # It also admits such aliases as lts/*, latest, nightly and canary builds
@ -119,8 +123,8 @@ See [action.yml](action.yml)
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: 24
    package-manager-cache: false # Disable automatic npm caching if not required
@ -169,8 +173,8 @@ See the examples of using cache for `yarn`/`pnpm` and `cache-dependency-path` in
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: 24
    cache: 'npm'
@ -182,8 +186,8 @@ steps:
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: 24
    cache: 'npm'
@ -198,8 +202,8 @@ This behavior is controlled by the `package-manager-cache` input, which defaults
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    package-manager-cache: false
 - run: npm ci
@ -217,9 +221,9 @@ jobs:
        node: [ 20, 22, 24 ]
    name: Node ${{ matrix.node }} sample
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node }}
          package-manager-cache: false # Disable automatic npm caching if not required
@ -234,7 +238,7 @@ jobs:
 To get a higher rate limit, you can [generate a personal access token on github.com](https://github.com/settings/tokens/new) and pass it as the `token` input for the action:
 ```yaml
-uses: actions/setup-node@v6
+uses: actions/setup-node@v7
 with:
  token: ${{ secrets.GH_DOTCOM_TOKEN }}
  node-version: 24
--- a/tests/data/package-dev-engines.json
+++ b/tests/data/package-dev-engines.json
@ -5,7 +5,7 @@
  "devEngines": {
    "runtime": {
      "name": "node",
-      "version": "^20"
+      "version": "^26"
    }
  }
 }
--- a/tests/official-installer.test.ts
+++ b/tests/official-installer.test.ts
@ -258,7 +258,11 @@ describe('setup-node', () => {
    // @actions/exec
    getExecOutputSpy = exec.getExecOutput as jest.Mock;
-    getExecOutputSpy.mockImplementation(() => 'v16.15.0');
+    getExecOutputSpy.mockImplementation(async () => ({
      stdout: 'v16.15.0',
      stderr: '',
      exitCode: 0
    }));
  });
  afterEach(() => {
@ -379,6 +383,16 @@ describe('setup-node', () => {
    whichSpy.mockImplementation((cmd: any) => {
      return `some/${cmd}/path`;
    });
    getExecOutputSpy.mockImplementation(async (cmd: string) => ({
      stdout:
        cmd === 'node'
          ? `v${resolvedVersion}`
          : cmd === 'npm'
            ? '11.12.1'
            : '4.17.1',
      stderr: '',
      exitCode: 0
    }));
    await main.run();
@ -756,7 +770,7 @@ describe('setup-node', () => {
        `Attempting to download ${versionSpec}...`
      );
      expect(addPathSpy).toHaveBeenCalledWith(expPath);
-    });
+    }, 10000);
  });
  describe('LTS version', () => {
@ -924,8 +938,10 @@ describe('setup-node', () => {
      expect(dbgSpy).toHaveBeenCalledWith(
        'Getting manifest from actions/node-versions@main'
      );
-      expect(setFailedSpy).toHaveBeenCalledWith('Unable to download manifest');
+      expect(setFailedSpy).toHaveBeenCalledWith(
-    });
+        `Failed to fetch a valid manifest after 3 attempts. Last error: Unable to download manifest`
      );
    }, 10000);
  });
  describe('latest alias syntax', () => {
@ -947,10 +963,13 @@ describe('setup-node', () => {
        await main.run();
        // assert
-        expect(logSpy).toHaveBeenCalledWith('Unable to download manifest');
+        expect(logSpy).toHaveBeenCalledWith(
          'Failed to fetch a valid manifest after 3 attempts. Last error: Unable to download manifest'
        );
        expect(logSpy).toHaveBeenCalledWith('getting latest node version...');
-      }
+      },
      10000
    );
  });
@ -1020,4 +1039,91 @@ describe('setup-node', () => {
      );
    }
  }, 100000);
  describe('manifest retry and validation', () => {
    beforeEach(() => {
      os.platform = 'linux';
      os.arch = 'x64';
      inputs['node-version'] = 'lts/erbium';
      findSpy.mockImplementation(() => '');
    });
    it('retries fetching the manifest and succeeds on a later attempt', async () => {
      let calls = 0;
      getManifestSpy.mockImplementation(() => {
        calls++;
        if (calls < 2) {
          throw new Error('transient network failure');
        }
        return <tc.IToolRelease[]>nodeTestManifest;
      });
      dlSpy.mockImplementation(async () => '/some/temp/path');
      const toolPath = path.normalize('/cache/node/12.16.2/x64');
      exSpy.mockImplementation(async () => '/some/other/temp/path');
      cacheSpy.mockImplementation(async () => toolPath);
      getExecOutputSpy.mockImplementation(async () => ({
        stdout: `v${path.basename(path.dirname(toolPath))}\n`,
        stderr: '',
        exitCode: 0
      }));
      await main.run();
      expect(calls).toBe(2);
      expect(logSpy).toHaveBeenCalledWith('Retrying to fetch the manifest...');
      expect(dbgSpy).toHaveBeenCalledWith(
        `Found LTS release '12.16.2' for Node version 'lts/erbium'`
      );
    }, 10000);
    it('rejects an empty manifest as invalid and retries', async () => {
      getManifestSpy.mockImplementation(() => []);
      await main.run();
      expect(getManifestSpy).toHaveBeenCalledTimes(3);
      expect(setFailedSpy).toHaveBeenCalledWith(
        `Failed to fetch a valid manifest after 3 attempts. Last error: The manifest fetched is empty, truncated, or does not contain any valid tool release entries.`
      );
    }, 10000);
  });
  describe('node version verification', () => {
    beforeEach(() => {
      os.platform = 'linux';
      os.arch = 'x64';
      inputs['node-version'] = '12';
    });
    it('fails when the installed node version does not match the expected version', async () => {
      const toolPath = path.normalize('/cache/node/12.16.1/x64');
      findSpy.mockReturnValue(toolPath);
      getExecOutputSpy.mockImplementation(async () => ({
        stdout: 'v22.22.3\n',
        stderr: '',
        exitCode: 0
      }));
      await main.run();
      expect(setFailedSpy).toHaveBeenCalledWith(
        `Node v12.16.1 installation failed, likely due to an incomplete or corrupted download.`
      );
    });
    it('fails when the node executable cannot be invoked', async () => {
      const toolPath = path.normalize('/cache/node/12.16.1/x64');
      findSpy.mockReturnValue(toolPath);
      getExecOutputSpy.mockImplementation(async () => {
        throw new Error('node not found');
      });
      await main.run();
      expect(setFailedSpy).toHaveBeenCalledWith(
        `Node installation failed. Node may not be installed or not on PATH: node not found`
      );
    });
  });
 });
--- a/dist/cache-save/index.js
+++ b/dist/cache-save/index.js
--- a/dist/setup/index.js
+++ b/dist/setup/index.js
--- a/docs/advanced-usage.md
+++ b/docs/advanced-usage.md
@ -45,8 +45,8 @@ To run without a lockfile:
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24'
    package-manager-cache: false # Explicitly disable caching if you don't have a lockfile
@ -64,8 +64,8 @@ If `check-latest` is set to `true`, the action first checks if the cached versio
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24'
    check-latest: true
@ -83,8 +83,8 @@ See [supported version syntax](https://github.com/actions/setup-node#supported-v
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version-file: '.nvmrc'
    package-manager-cache: false # Disable automatic npm caching if not required
@ -128,8 +128,8 @@ jobs:
    runs-on: windows-latest
    name: Node sample
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
          node-version: '24'
          architecture: 'x64' # optional, x64 or x86. If not specified, x64 will be used by default
@ -150,8 +150,8 @@ jobs:
    runs-on: ubuntu-latest
    name: Node sample
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
          node-version: '24.0.0-v8-canary' # it will install the latest v8 canary release for node 24.0.0
          package-manager-cache: false # Disable automatic npm caching if not required
@ -166,8 +166,8 @@ jobs:
    runs-on: ubuntu-latest
    name: Node sample
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
          node-version: '24-v8-canary' # it will install the latest v8 canary release for node 24
          package-manager-cache: false # Disable automatic npm caching if not required
@ -183,8 +183,8 @@ jobs:
    runs-on: ubuntu-latest
    name: Node sample
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
          node-version: 'v24.0.0-v8-canary2025030537242e55ac'
          package-manager-cache: false # Disable automatic npm caching if not required
@ -204,8 +204,8 @@ jobs:
    runs-on: ubuntu-latest
    name: Node sample
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
          node-version: '24-nightly' # it will install the latest nightly release for node 24
          package-manager-cache: false # Disable automatic npm caching if not required
@ -221,8 +221,8 @@ jobs:
    runs-on: ubuntu-latest
    name: Node sample
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
          node-version: '24.0.0-nightly' # it will install the latest nightly release for node 24.0.0
          package-manager-cache: false # Disable automatic npm caching if not required
@ -238,8 +238,8 @@ jobs:
    runs-on: ubuntu-latest
    name: Node sample
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
          node-version: '24.0.0-nightly202505066102159fa1'
          package-manager-cache: false # Disable automatic npm caching if not required
@ -257,8 +257,8 @@ jobs:
    runs-on: ubuntu-latest
    name: Node sample
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
          node-version: '24.0.0-rc.4'
          package-manager-cache: false # Disable automatic npm caching if not required
@ -276,8 +276,8 @@ Yarn caching handles both Yarn Classic (v1) and Yarn Berry (v2, v3, v4+).
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24'
    cache: 'yarn'
@ -295,11 +295,11 @@ steps:
 # NOTE: pnpm caching support requires pnpm version >= 6.10.0
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: pnpm/action-setup@v4
+- uses: pnpm/action-setup@v6
  with:
    version: 10
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24'
    cache: 'pnpm'
@ -314,8 +314,8 @@ steps:
 **Using wildcard patterns to cache dependencies**
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24'
    cache: 'npm'
@ -327,8 +327,8 @@ steps:
 **Using a list of file paths to cache dependencies**
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24'
    cache: 'npm'
@ -345,13 +345,13 @@ You can restore caches without saving new entries, which helps reduce cache writ
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
 # - uses: pnpm/action-setup@v6 
 #   with:
 #     version: 10
 - name: Setup Node.js
-  uses: actions/setup-node@v6
+  uses: actions/setup-node@v7
  with:
    node-version: '24'
    package-manager-cache: false # Disable automatic npm caching if not required
@ -397,9 +397,9 @@ jobs:
          - macos-latest
          - windows-latest
        node_version:
          - 20
          - 22
          - 24
          - 26
        architecture:
          - x64
        # an extra windows-x86 run:
@ -409,9 +409,9 @@ jobs:
            architecture: x86
    name: Node ${{ matrix.node_version }} - ${{ matrix.architecture }} on ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node_version }}
          architecture: ${{ matrix.architecture }}
@ -423,8 +423,8 @@ jobs:
 ## Publish to npmjs and GPR with npm
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24.x'
    registry-url: 'https://registry.npmjs.org'
@ -433,7 +433,7 @@ steps:
 - run: npm publish
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    registry-url: 'https://npm.pkg.github.com'
    package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
@ -445,8 +445,8 @@ steps:
 ## Publish to npmjs and GPR with yarn
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24.x'
    registry-url: <registry url>
@ -455,7 +455,7 @@ steps:
 - run: yarn publish
  env:
    NODE_AUTH_TOKEN: ${{ secrets.YARN_TOKEN }}
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    registry-url: 'https://npm.pkg.github.com'
    package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
@ -467,8 +467,8 @@ steps:
 ## Use private packages
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24.x'
    registry-url: 'https://registry.npmjs.org'
@ -488,8 +488,8 @@ Below you can find a sample "Setup .yarnrc.yml" step, that is going to allow you
 ```yaml
 steps:
- uses: actions/checkout@v6
+- uses: actions/checkout@v7
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24.x'
    package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
@ -533,9 +533,9 @@ You must also configure a **Trusted Publisher** in npm for your package/scope th
      id-token: write  # Required for OIDC
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
@ -558,7 +558,7 @@ It is possible to specify a token to authenticate with the mirror using the `mir
 The token will be passed in the `Authorization` header.
 ```yaml
- uses: actions/setup-node@v6
+- uses: actions/setup-node@v7
  with:
    node-version: '24.x'
    mirror: 'https://nodejs.org/dist'
--- a/package-lock.json
+++ b/package-lock.json
@ -9,7 +9,7 @@
      "version": "7.0.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/cache": "^6.1.0",
+        "@actions/cache": "^6.2.0",
        "@actions/core": "^3.0.1",
        "@actions/exec": "^3.0.0",
        "@actions/github": "^9.1.1",
@ -22,7 +22,7 @@
      "devDependencies": {
        "@eslint/js": "^10.0.1",
        "@jest/globals": "^30.4.1",
-        "@types/node": "^26.0.0",
+        "@types/node": "^24.1.0",
        "@types/semver": "^7.7.0",
        "@typescript-eslint/eslint-plugin": "^8.62.0",
        "@typescript-eslint/parser": "^8.62.0",
@ -43,9 +43,9 @@
      }
    },
    "node_modules/@actions/cache": {
-      "version": "6.1.0",
+      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-6.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-6.2.0.tgz",
-      "integrity": "sha512-LVqybSbzhBp2uAETOQ3HnVjXA4AcjavgMH+LCr+cjgO+PZfciv/1QAgoW+esXBaAhvDid+vXeV70GGJpAh4V5Q==",
+      "integrity": "sha512-Nv0xWRmbxfDbAn/70flO/F6tj2Nv4XTYMAsQHiDFSojCDfso/Zni+fRKa14ToI9hnmOW/rQcY1WYb6wsM7Pgwg==",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^3.0.1",
@ -69,6 +69,18 @@
        "minimatch": "^3.0.4"
      }
    },
    "node_modules/@actions/cache/node_modules/minimatch": {
      "version": "3.1.5",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
      "license": "ISC",
      "dependencies": {
        "brace-expansion": "^1.1.7"
      },
      "engines": {
        "node": "*"
      }
    },
    "node_modules/@actions/core": {
      "version": "3.0.1",
      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.1.tgz",
@ -123,27 +135,6 @@
        "minimatch": "^10.2.5"
      }
    },
    "node_modules/@actions/glob/node_modules/balanced-match": {
      "version": "4.0.4",
      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
      "license": "MIT",
      "engines": {
        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/@actions/glob/node_modules/brace-expansion": {
      "version": "5.0.6",
      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^4.0.2"
      },
      "engines": {
        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/@actions/glob/node_modules/minimatch": {
      "version": "10.2.5",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
@ -906,64 +897,39 @@
      "dev": true,
      "license": "MIT"
    },
    "node_modules/@cspotcode/source-map-support": {
      "version": "0.8.1",
      "resolved": "https://registry.npmjs.org/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz",
      "integrity": "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true,
      "dependencies": {
        "@jridgewell/trace-mapping": "0.3.9"
      },
      "engines": {
        "node": ">=12"
      }
    },
    "node_modules/@cspotcode/source-map-support/node_modules/@jridgewell/trace-mapping": {
      "version": "0.3.9",
      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.9.tgz",
      "integrity": "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true,
      "dependencies": {
        "@jridgewell/resolve-uri": "^3.0.3",
        "@jridgewell/sourcemap-codec": "^1.4.10"
      }
    },
    "node_modules/@emnapi/core": {
-      "version": "1.10.0",
+      "version": "2.0.0-alpha.3",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-2.0.0-alpha.3.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "integrity": "sha512-AZypUeJ/yByuxyS7BlSNRDOMLMlROYtjYdIAuBmJssVz1UJDSeYxLrdizhXCFYhedC5bqd/ASy8EuNXbVVXp9g==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true,
      "dependencies": {
-        "@emnapi/wasi-threads": "1.2.1",
+        "@emnapi/wasi-threads": "2.0.1",
        "tslib": "^2.4.0"
      }
    },
    "node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
+      "version": "2.0.0-alpha.3",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-2.0.0-alpha.3.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "integrity": "sha512-hFPAhMUjJD9BSyCANEISPOogeXC9Zo9ZQl7L6vKnaVsMkCtzznaW/naYypeyl0Gv5rYfWYsZbpixTMpjDJzQeA==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true,
      "dependencies": {
        "tslib": "^2.4.0"
      }
    },
    "node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.1",
+      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-2.0.1.tgz",
-      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
+      "integrity": "sha512-9DsSk+o5NBX0CCJT8s0EROGSGxjR/tKu6aBTaVyq+SjAEQH4XcdcRxPBRzsBLizTTJ49MJjF+jgu3qnO9GLQcQ==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true,
      "dependencies": {
        "tslib": "^2.4.0"
      }
@ -1012,29 +978,6 @@
        "node": "^20.19.0 || ^22.13.0 || >=24"
      }
    },
    "node_modules/@eslint/config-array/node_modules/balanced-match": {
      "version": "4.0.4",
      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/@eslint/config-array/node_modules/brace-expansion": {
      "version": "5.0.6",
      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^4.0.2"
      },
      "engines": {
        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/@eslint/config-array/node_modules/minimatch": {
      "version": "10.2.5",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
@ -1681,22 +1624,25 @@
      }
    },
    "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.5",
+      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.5.tgz",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.0.tgz",
-      "integrity": "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==",
+      "integrity": "sha512-kDoONqMa+VnZ4vvvu/ZUurpJ4gkZU57e7g69qpNgWhYcZFPUHZM2CEMKm+cG6ufDVALbjMvfmMjFVqaK7uEMnA==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "dependencies": {
-        "@tybys/wasm-util": "^0.10.2"
+        "@tybys/wasm-util": "^0.10.3"
      },
      "engines": {
        "node": "^20.19.0 || ^22.13.0 || >=23.5.0"
      },
      "funding": {
        "type": "github",
        "url": "https://github.com/sponsors/Brooooooklyn"
      },
      "peerDependencies": {
-        "@emnapi/core": "^1.7.1",
+        "@emnapi/core": "^2.0.0-alpha.3",
-        "@emnapi/runtime": "^1.7.1"
+        "@emnapi/runtime": "^2.0.0-alpha.3"
      }
    },
    "node_modules/@nodable/entities": {
@ -1905,42 +1851,6 @@
        "@sinonjs/commons": "^3.0.1"
      }
    },
    "node_modules/@tsconfig/node10": {
      "version": "1.0.12",
      "resolved": "https://registry.npmjs.org/@tsconfig/node10/-/node10-1.0.12.tgz",
      "integrity": "sha512-UCYBaeFvM11aU2y3YPZ//O5Rhj+xKyzy7mvcIoAjASbigy8mHMryP5cK7dgjlz2hWxh1g5pLw084E0a/wlUSFQ==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true
    },
    "node_modules/@tsconfig/node12": {
      "version": "1.0.11",
      "resolved": "https://registry.npmjs.org/@tsconfig/node12/-/node12-1.0.11.tgz",
      "integrity": "sha512-cqefuRsh12pWyGsIoBKJA9luFu3mRxCA+ORZvA4ktLSzIuCUtWVxGIuXigEwO5/ywWFMZ2QEGKWvkZG1zDMTag==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true
    },
    "node_modules/@tsconfig/node14": {
      "version": "1.0.3",
      "resolved": "https://registry.npmjs.org/@tsconfig/node14/-/node14-1.0.3.tgz",
      "integrity": "sha512-ysT8mhdixWK6Hw3i1V2AeRqZ5WfXg1G43mqoYlM2nc6388Fq5jcXyr5mRsqViLx/GJYdoL0bfXD8nmF+Zn/Iow==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true
    },
    "node_modules/@tsconfig/node16": {
      "version": "1.0.4",
      "resolved": "https://registry.npmjs.org/@tsconfig/node16/-/node16-1.0.4.tgz",
      "integrity": "sha512-vxhUy4J8lyeyinH7Azl1pdd43GJhZH/tP2weN8TntQblOY+A0XbT8DJk1/oCPuOOyg/Ja757rG0CgHcWC8OfMA==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true
    },
    "node_modules/@tybys/wasm-util": {
      "version": "0.10.3",
      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
@ -2046,13 +1956,13 @@
      "license": "MIT"
    },
    "node_modules/@types/node": {
-      "version": "26.0.0",
+      "version": "24.13.3",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
-      "integrity": "sha512-vf2YFi1iY9lHGwNJMs01biZFbKJkrZR1T6/MlzjhJLPdntOHLhTrDSnSVcdtvjihi4VQNlrFRIxLsDBlQpAipA==",
+      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "undici-types": "~8.3.0"
+        "undici-types": "~7.18.0"
      }
    },
    "node_modules/@types/semver": {
@ -2274,29 +2184,6 @@
        "typescript": ">=4.8.4 <6.1.0"
      }
    },
    "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
      "version": "4.0.4",
      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
      "version": "5.0.6",
      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^4.0.2"
      },
      "engines": {
        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
      "version": "10.2.5",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
@ -2495,6 +2382,9 @@
        "arm64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@ -2509,6 +2399,9 @@
        "arm64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@ -2523,6 +2416,9 @@
        "loong64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@ -2537,6 +2433,9 @@
        "loong64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@ -2551,6 +2450,9 @@
        "ppc64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@ -2565,6 +2467,9 @@
        "riscv64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@ -2579,6 +2484,9 @@
        "riscv64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@ -2593,6 +2501,9 @@
        "s390x"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@ -2660,6 +2571,40 @@
        "node": ">=14.0.0"
      }
    },
    "node_modules/@unrs/resolver-binding-wasm32-wasi/node_modules/@emnapi/core": {
      "version": "1.10.0",
      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "dependencies": {
        "@emnapi/wasi-threads": "1.2.1",
        "tslib": "^2.4.0"
      }
    },
    "node_modules/@unrs/resolver-binding-wasm32-wasi/node_modules/@emnapi/runtime": {
      "version": "1.10.0",
      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "dependencies": {
        "tslib": "^2.4.0"
      }
    },
    "node_modules/@unrs/resolver-binding-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "dependencies": {
        "tslib": "^2.4.0"
      }
    },
    "node_modules/@unrs/resolver-binding-win32-arm64-msvc": {
      "version": "1.12.2",
      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.12.2.tgz",
@ -2735,21 +2680,6 @@
        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
      }
    },
    "node_modules/acorn-walk": {
      "version": "8.3.5",
      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.5.tgz",
      "integrity": "sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true,
      "dependencies": {
        "acorn": "^8.11.0"
      },
      "engines": {
        "node": ">=0.4.0"
      }
    },
    "node_modules/agent-base": {
      "version": "7.1.4",
      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
@ -2835,15 +2765,6 @@
        "node": ">= 8"
      }
    },
    "node_modules/arg": {
      "version": "4.1.3",
      "resolved": "https://registry.npmjs.org/arg/-/arg-4.1.3.tgz",
      "integrity": "sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true
    },
    "node_modules/argparse": {
      "version": "1.0.10",
      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
@ -2896,6 +2817,56 @@
        "node": ">=12"
      }
    },
    "node_modules/babel-plugin-istanbul/node_modules/glob": {
      "version": "7.2.3",
      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
      "dev": true,
      "license": "ISC",
      "dependencies": {
        "fs.realpath": "^1.0.0",
        "inflight": "^1.0.4",
        "inherits": "2",
        "minimatch": "^3.1.1",
        "once": "^1.3.0",
        "path-is-absolute": "^1.0.0"
      },
      "engines": {
        "node": "*"
      },
      "funding": {
        "url": "https://github.com/sponsors/isaacs"
      }
    },
    "node_modules/babel-plugin-istanbul/node_modules/minimatch": {
      "version": "3.1.5",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
        "brace-expansion": "^1.1.7"
      },
      "engines": {
        "node": "*"
      }
    },
    "node_modules/babel-plugin-istanbul/node_modules/test-exclude": {
      "version": "6.0.0",
      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
        "@istanbuljs/schema": "^0.1.2",
        "glob": "^7.1.4",
        "minimatch": "^3.0.4"
      },
      "engines": {
        "node": ">=8"
      }
    },
    "node_modules/babel-plugin-jest-hoist": {
      "version": "30.4.0",
      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.4.0.tgz",
@ -2954,10 +2925,13 @@
      }
    },
    "node_modules/balanced-match": {
-      "version": "1.0.2",
+      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "license": "MIT"
+      "license": "MIT",
      "engines": {
        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/baseline-browser-mapping": {
      "version": "2.10.38",
@ -2979,13 +2953,15 @@
      "license": "Apache-2.0"
    },
    "node_modules/brace-expansion": {
-      "version": "1.1.13",
+      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
      "license": "MIT",
      "dependencies": {
-        "balanced-match": "^1.0.0",
+        "balanced-match": "^4.0.2"
-        "concat-map": "0.0.1"
+      },
      "engines": {
        "node": "20 || >=22"
      }
    },
    "node_modules/browserslist": {
@ -3259,12 +3235,6 @@
      "dev": true,
      "license": "MIT"
    },
    "node_modules/concat-map": {
      "version": "0.0.1",
      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
      "license": "MIT"
    },
    "node_modules/convert-source-map": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
@ -3272,15 +3242,6 @@
      "dev": true,
      "license": "MIT"
    },
    "node_modules/create-require": {
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/create-require/-/create-require-1.1.1.tgz",
      "integrity": "sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true
    },
    "node_modules/cross-spawn": {
      "version": "7.0.6",
      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
@ -3355,18 +3316,6 @@
        "node": ">=8"
      }
    },
    "node_modules/diff": {
      "version": "4.0.4",
      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.4.tgz",
      "integrity": "sha512-X07nttJQkwkfKfvTPG/KSnE2OMdcUCao6+eXF3wmnIQRn2aPAHH3VxDbDOdegkd6JbPsXqShpvEOHfAT+nCNwQ==",
      "dev": true,
      "license": "BSD-3-Clause",
      "optional": true,
      "peer": true,
      "engines": {
        "node": ">=0.3.1"
      }
    },
    "node_modules/eastasianwidth": {
      "version": "0.2.0",
      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
@ -3672,29 +3621,6 @@
        "url": "https://opencollective.com/eslint"
      }
    },
    "node_modules/eslint/node_modules/balanced-match": {
      "version": "4.0.4",
      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/eslint/node_modules/brace-expansion": {
      "version": "5.0.6",
      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^4.0.2"
      },
      "engines": {
        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/eslint/node_modules/eslint-visitor-keys": {
      "version": "5.0.1",
      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
@ -4148,16 +4074,6 @@
        "node": ">=10.13.0"
      }
    },
    "node_modules/glob/node_modules/brace-expansion": {
      "version": "2.1.1",
      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^1.0.0"
      }
    },
    "node_modules/glob/node_modules/minimatch": {
      "version": "9.0.9",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
@ -5316,18 +5232,6 @@
        "node": ">=6"
      }
    },
    "node_modules/minimatch": {
      "version": "3.1.5",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
      "license": "ISC",
      "dependencies": {
        "brace-expansion": "^1.1.7"
      },
      "engines": {
        "node": "*"
      }
    },
    "node_modules/minimist": {
      "version": "1.2.8",
      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@ -6183,43 +6087,6 @@
        "url": "https://opencollective.com/webpack"
      }
    },
    "node_modules/test-exclude": {
      "version": "6.0.0",
      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
        "@istanbuljs/schema": "^0.1.2",
        "glob": "^7.1.4",
        "minimatch": "^3.0.4"
      },
      "engines": {
        "node": ">=8"
      }
    },
    "node_modules/test-exclude/node_modules/glob": {
      "version": "7.2.3",
      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
      "dev": true,
      "license": "ISC",
      "dependencies": {
        "fs.realpath": "^1.0.0",
        "inflight": "^1.0.4",
        "inherits": "2",
        "minimatch": "^3.1.1",
        "once": "^1.3.0",
        "path-is-absolute": "^1.0.0"
      },
      "engines": {
        "node": "*"
      },
      "funding": {
        "url": "https://github.com/sponsors/isaacs"
      }
    },
    "node_modules/tinyglobby": {
      "version": "0.2.17",
      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
@ -6354,52 +6221,6 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
    "node_modules/ts-node": {
      "version": "10.9.2",
      "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-10.9.2.tgz",
      "integrity": "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true,
      "dependencies": {
        "@cspotcode/source-map-support": "^0.8.0",
        "@tsconfig/node10": "^1.0.7",
        "@tsconfig/node12": "^1.0.7",
        "@tsconfig/node14": "^1.0.0",
        "@tsconfig/node16": "^1.0.2",
        "acorn": "^8.4.1",
        "acorn-walk": "^8.1.1",
        "arg": "^4.1.0",
        "create-require": "^1.1.0",
        "diff": "^4.0.1",
        "make-error": "^1.1.1",
        "v8-compile-cache-lib": "^3.0.1",
        "yn": "3.1.1"
      },
      "bin": {
        "ts-node": "dist/bin.js",
        "ts-node-cwd": "dist/bin-cwd.js",
        "ts-node-esm": "dist/bin-esm.js",
        "ts-node-script": "dist/bin-script.js",
        "ts-node-transpile-only": "dist/bin-transpile.js",
        "ts-script": "dist/bin-script-deprecated.js"
      },
      "peerDependencies": {
        "@swc/core": ">=1.2.50",
        "@swc/wasm": ">=1.2.50",
        "@types/node": "*",
        "typescript": ">=2.7"
      },
      "peerDependenciesMeta": {
        "@swc/core": {
          "optional": true
        },
        "@swc/wasm": {
          "optional": true
        }
      }
    },
    "node_modules/tslib": {
      "version": "2.8.1",
      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
@ -6489,9 +6310,9 @@
      }
    },
    "node_modules/undici-types": {
-      "version": "8.3.0",
+      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
      "dev": true,
      "license": "MIT"
    },
@ -6580,15 +6401,6 @@
        "punycode": "^2.1.0"
      }
    },
    "node_modules/v8-compile-cache-lib": {
      "version": "3.0.1",
      "resolved": "https://registry.npmjs.org/v8-compile-cache-lib/-/v8-compile-cache-lib-3.0.1.tgz",
      "integrity": "sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true
    },
    "node_modules/v8-to-istanbul": {
      "version": "9.3.0",
      "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz",
@ -6869,18 +6681,6 @@
        "node": ">=8"
      }
    },
    "node_modules/yn": {
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz",
      "integrity": "sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "peer": true,
      "engines": {
        "node": ">=6"
      }
    },
    "node_modules/yocto-queue": {
      "version": "0.1.0",
      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
--- a/package.json
+++ b/package.json
@ -29,7 +29,7 @@
  "author": "GitHub",
  "license": "MIT",
  "dependencies": {
-    "@actions/cache": "^6.1.0",
+    "@actions/cache": "^6.2.0",
    "@actions/core": "^3.0.1",
    "@actions/exec": "^3.0.0",
    "@actions/github": "^9.1.1",
@ -39,10 +39,13 @@
    "@actions/tool-cache": "^4.0.0",
    "semver": "^7.8.5"
  },
  "overrides": {
    "brace-expansion": "5.0.8"
  },
  "devDependencies": {
    "@eslint/js": "^10.0.1",
    "@jest/globals": "^30.4.1",
-    "@types/node": "^26.0.0",
+    "@types/node": "^24.1.0",
    "@types/semver": "^7.7.0",
    "@typescript-eslint/eslint-plugin": "^8.62.0",
    "@typescript-eslint/parser": "^8.62.0",
--- a/src/distributions/official_builds/official_builds.ts
+++ b/src/distributions/official_builds/official_builds.ts
@ -1,6 +1,7 @@
 import * as core from '@actions/core';
 import * as tc from '@actions/tool-cache';
 import path from 'path';
 import * as exec from '@actions/exec';
 import BaseDistribution from '../base-distribution.js';
 import {NodeInputs, INodeVersion, INodeVersionInfo} from '../base-models.js';
@ -62,7 +63,9 @@ export default class OfficialBuilds extends BaseDistribution {
    if (toolPath) {
      core.info(`Found in cache @ ${toolPath}`);
      const installedDir = toolPath;
      this.addToolPath(toolPath);
      await this.verifyNodeVersion(installedDir);
      return;
    }
@ -123,11 +126,13 @@ export default class OfficialBuilds extends BaseDistribution {
      toolPath = await this.downloadDirectlyFromNode();
    }
    const installedDir = toolPath;
    if (this.osPlat != 'win32') {
      toolPath = path.join(toolPath, 'bin');
    }
    core.addPath(toolPath);
    await this.verifyNodeVersion(installedDir);
  }
  protected addToolPath(toolPath: string) {
@ -185,9 +190,13 @@ export default class OfficialBuilds extends BaseDistribution {
    return `${url}/dist`;
  }
-  private getManifest(): Promise<tc.IToolRelease[]> {
+  private async getManifest(): Promise<tc.IToolRelease[]> {
-    core.debug('Getting manifest from actions/node-versions@main');
+    let lastError: Error | undefined;
-    return tc.getManifestFromRepo(
+    const maxAttempts = 3;
    core.debug(`Getting manifest from actions/node-versions@main`);
    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
      try {
        const manifest = await tc.getManifestFromRepo(
          'actions',
          'node-versions',
          this.nodeInfo.mirror && this.nodeInfo.mirrorToken
@ -195,6 +204,28 @@ export default class OfficialBuilds extends BaseDistribution {
            : this.nodeInfo.auth,
          'main'
        );
        if (Array.isArray(manifest) && manifest.length > 0) {
          return manifest;
        }
        lastError = new Error(
          `The manifest fetched is empty, truncated, or does not contain any valid tool release entries.`
        );
      } catch (err) {
        lastError = err instanceof Error ? err : new Error(String(err));
      }
      core.debug(
        `Attempt ${attempt}/${maxAttempts} to fetch the manifest failed: ${lastError.message}`
      );
      if (attempt < maxAttempts) {
        core.info(`Retrying to fetch the manifest...`);
        await new Promise(resolve =>
          setTimeout(resolve, 1000 * 2 ** (attempt - 1))
        ); // Retry after a delay
      }
    }
    throw new Error(
      `Failed to fetch a valid manifest after ${maxAttempts} attempts. Last error: ${lastError?.message}`
    );
  }
  private resolveLtsAliasFromManifest(
@ -298,4 +329,30 @@ export default class OfficialBuilds extends BaseDistribution {
  private isLatestSyntax(versionSpec): boolean {
    return ['current', 'latest', 'node'].includes(versionSpec);
  }
  private async verifyNodeVersion(installedDir: string) {
    // tool-cache layout: <root>/node/<version>/<arch>
    const expectedVersion = 'v' + path.basename(path.dirname(installedDir));
    let actualVersion = '';
    try {
      const {stdout} = await exec.getExecOutput('node', ['--version'], {
        silent: true
      });
      actualVersion = stdout.trim();
    } catch (err) {
      throw new Error(
        `Node installation failed. Node may not be installed or not on PATH: ${(err as Error).message}`,
        {cause: err}
      );
    }
    if (actualVersion !== expectedVersion) {
      core.debug(
        `Node installation failed: expected ${expectedVersion} but "node --version" reported ${actualVersion || '(empty)'} (installedDir: ${installedDir}).`
      );
      throw new Error(
        `Node ${expectedVersion} installation failed, likely due to an incomplete or corrupted download.`
      );
    }
  }
 }
Author	SHA1	Message	Date
Copilot	e51e5fe84f	fix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time DoS) (#1599 ) * Initial plan * fix: update brace-expansion to address GHSA-3jxr-9vmj-r5cp and rebuild dist - brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16) - brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2) - brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg) - Regenerated package-lock.json - Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency Closes #1596 * fix: eliminate remaining brace-expansion vulnerabilities and update license cache ## Basic validation CI fix Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages: - `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x) - `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x - `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x from the jest coverage instrumentation path `npm audit --audit-level=high` now reports 0 vulnerabilities. ## Licensed CI fix Update .licenses/npm/ cache to match the new dependency tree: - Add: brace-expansion-5.0.8.dep.yml - Add: minimatch-10.2.6.dep.yml - Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit) - Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit) - Remove stale: minimatch-3.1.5.dep.yml - Remove stale: @actions/glob-0.6.1.dep.yml - Remove stale: concat-map.dep.yml - Remove stale: balanced-match-1.0.2.dep.yml Rebuild dist artifacts to include updated brace-expansion. * fix: replace brace-expansion workarounds with single override --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-29 13:03:59 -05:00
gowridurgad	32f57ac043	docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change (#1593 ) Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-07-21 09:21:57 -05:00
Andreas Deininger	b789df37d6	README.md: bump actions/checkout to latest version 7 (#1578 ) Co-authored-by: Haritha <73516759+HarithaVattikuti@users.noreply.github.com>	2026-07-17 12:47:13 -05:00
Haritha	1b7c366466	Update workflow pins and migrate Node matrices to modern versions (#1583 ) * Update workflow action pins and move Node 20 to 26 * fix: correct node version in v8-canary and update setup for node 22 x86 * chore: update setup-node action version from v6 to v7 in documentation * fix: update pnpm/action-setup version to v6 in advanced usage documentation	2026-07-16 10:33:56 -05:00
Priya Gupta	05e62e6009	pin @types/node to v24 (#1585 )	2026-07-16 10:33:23 -05:00
Philip Gai	391b8c7809	chore(deps): bump @actions/cache to 6.2.0 (#1584 ) Bump @actions/cache from ^6.1.0 to ^6.2.0 and rebuild the vendored dist bundles (dist/setup, dist/cache-save) via ncc. Update the licensed cache record for @actions/cache to 6.2.0. 6.2.0 ships two transparent client behaviors: honor ACTIONS_CACHE_MODE to skip restore/save when the effective cache-mode disallows it, and surface a core.warning (not a run failure) when the cache service denies a read/write due to token scopes. Copilot-Session: 0acd1380-0102-4f9d-b613-192a6ddef737 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-16 10:32:50 -05:00
v-jitenderpalsingh	363be39a57	Add Node version validation and manifest fetch retry (#1580 ) * Add Node version validation and manifest fetch retry * Add debug logs for expected and actual Node versions * chore: rebuild dist * refactor: enhance debug logging for Node installation failure * update test cases * Improve formatting of test cases * revert package-lock.json	2026-07-14 17:55:44 -05:00