chore: bump undici to ^7.16.0

- @actions/http-client: ^5.28.5 → ^7.16.0
- @actions/github: ^5.28.5 → ^7.16.0
- @actions/attest: ^6.20.0 → ^7.16.0

Note: undici v7 requires Node.js 20+

.gitignore

@@ -5,4 +5,3 @@ packages/*/__tests__/_temp/
 .DS_Store
 *.xar
 packages/*/audit.json
-.nx/

packages/attest/package-lock.json

@@ -22,7 +22,7 @@
         "@sigstore/rekor-types": "^3.0.0",
         "@types/jsonwebtoken": "^9.0.6",
         "nock": "^13.5.1",
-        "undici": "^6.20.0"
+        "undici": "^7.16.0"
       }
     },
     "node_modules/@actions/core": {
@@ -1625,13 +1625,13 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.21.3",
+      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.21.3.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.16.0.tgz",
-      "integrity": "sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==",
+      "integrity": "sha512-QEg3HPMll0o3t2ourKwOeUAZ159Kn9mx5pnzHRQO8+Wixmh88YdZRiIwat0iNzNNXn0yoEtXJqFpyW7eM8BV7g==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=18.17"
+        "node": ">=20.18.1"
       }
     },
     "node_modules/undici-types": {

packages/attest/package.json

@@ -39,7 +39,7 @@
     "@sigstore/rekor-types": "^3.0.0",
     "@types/jsonwebtoken": "^9.0.6",
     "nock": "^13.5.1",
-    "undici": "^6.20.0"
+    "undici": "^7.16.0"
   },
   "dependencies": {
     "@actions/core": "^1.11.1",

packages/github/package-lock.json

@@ -15,7 +15,7 @@
         "@octokit/plugin-rest-endpoint-methods": "^10.4.0",
         "@octokit/request": "^8.4.1",
         "@octokit/request-error": "^5.1.1",
-        "undici": "^5.28.5"
+        "undici": "^7.16.0"
       },
       "devDependencies": {
         "proxy": "^2.1.1"
@@ -31,6 +31,18 @@
         "undici": "^5.25.4"
       }
     },
+    "node_modules/@actions/http-client/node_modules/undici": {
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.0"
+      }
+    },
     "node_modules/@fastify/busboy": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
@@ -402,15 +414,12 @@
       }
     },
     "node_modules/undici": {
-      "version": "5.29.0",
+      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.16.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "integrity": "sha512-QEg3HPMll0o3t2ourKwOeUAZ159Kn9mx5pnzHRQO8+Wixmh88YdZRiIwat0iNzNNXn0yoEtXJqFpyW7eM8BV7g==",
       "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
       "engines": {
-        "node": ">=14.0"
+        "node": ">=20.18.1"
       }
     },
     "node_modules/universal-user-agent": {

packages/github/package.json

@@ -44,7 +44,7 @@
     "@octokit/plugin-rest-endpoint-methods": "^10.4.0",
     "@octokit/request": "^8.4.1",
     "@octokit/request-error": "^5.1.1",
-    "undici": "^5.28.5"
+    "undici": "^7.16.0"
   },
   "devDependencies": {
     "proxy": "^2.1.1"

packages/glob/__tests__/windows-path-matching.test.ts

@@ -1,83 +0,0 @@
-/**
- * Test to validate that glob works correctly on Windows with backslash paths
- * This test validates the fix for glob not working on GitHub's Windows runners
- */
-
-import {MatchKind} from '../src/internal-match-kind'
-import {Pattern} from '../src/internal-pattern'
-
-const IS_WINDOWS = process.platform === 'win32'
-
-describe('Windows path matching', () => {
-  it('matches paths with backslashes on Windows', () => {
-    if (!IS_WINDOWS) {
-      // This test is only relevant on Windows
-      return
-    }
-
-    // Test basic pattern matching with Windows paths
-    const pattern = new Pattern('C:\\Users\\test\\*')
-
-    // The itemPath would come from fs.readdir with backslashes on Windows
-    const itemPath = 'C:\\Users\\test\\file.txt'
-
-    // This should match because the pattern and path both refer to the same file
-    expect(pattern.match(itemPath)).toBe(MatchKind.All)
-  })
-
-  it('partial matches work with backslashes on Windows', () => {
-    if (!IS_WINDOWS) {
-      return
-    }
-
-    // Test partial matching with Windows paths
-    const pattern = new Pattern('C:\\Users\\test\\**')
-
-    // Should partially match parent directory
-    expect(pattern.partialMatch('C:\\Users')).toBe(true)
-    expect(pattern.partialMatch('C:\\Users\\test')).toBe(true)
-  })
-
-  it('matches globstar patterns with backslashes on Windows', () => {
-    if (!IS_WINDOWS) {
-      return
-    }
-
-    const pattern = new Pattern('C:\\foo\\**')
-
-    // Should match the directory itself and descendants
-    expect(pattern.match('C:\\foo')).toBe(MatchKind.All)
-    expect(pattern.match('C:\\foo\\bar')).toBe(MatchKind.All)
-    expect(pattern.match('C:\\foo\\bar\\baz.txt')).toBe(MatchKind.All)
-  })
-
-  it('matches wildcard patterns with mixed separators on Windows', () => {
-    if (!IS_WINDOWS) {
-      return
-    }
-
-    // Pattern might be specified with forward slashes by user
-    const pattern = new Pattern('C:/Users/*/file.txt')
-
-    // But the actual path from filesystem will have backslashes
-    expect(pattern.match('C:\\Users\\test\\file.txt')).toBe(MatchKind.All)
-  })
-
-  it('handles complex patterns with backslashes on Windows', () => {
-    if (!IS_WINDOWS) {
-      return
-    }
-
-    const currentDrive = process.cwd().substring(0, 2)
-    const pattern = new Pattern(`${currentDrive}\\**\\*.txt`)
-
-    // Should match .txt files at any depth
-    expect(pattern.match(`${currentDrive}\\file.txt`)).toBe(MatchKind.All)
-    expect(pattern.match(`${currentDrive}\\foo\\bar\\test.txt`)).toBe(
-      MatchKind.All
-    )
-    expect(pattern.match(`${currentDrive}\\foo\\bar\\test.js`)).toBe(
-      MatchKind.None
-    )
-  })
-})

packages/glob/src/internal-pattern.ts

@@ -156,10 +156,6 @@ export class Pattern {
       itemPath = pathHelper.safeTrimTrailingSeparator(itemPath)
     }
 
-    // Convert to forward slashes on Windows before matching with minimatch
-    // since the pattern was converted to forward slashes in the constructor
-    itemPath = Pattern.convertToMinimatchPath(itemPath)
-
     // Match
     if (this.minimatch.match(itemPath)) {
       return this.trailingSeparator ? MatchKind.Directory : MatchKind.All
@@ -180,11 +176,8 @@ export class Pattern {
       return this.rootRegExp.test(itemPath)
     }
 
-    // Convert to forward slashes on Windows to match the pattern format used by minimatch
-    itemPath = Pattern.convertToMinimatchPath(itemPath)
-
     return this.minimatch.matchOne(
-      itemPath.split(/\/+/),
+      itemPath.split(IS_WINDOWS ? /\\+/ : /\/+/),
       this.minimatch.set[0],
       true
     )
@@ -200,18 +193,6 @@ export class Pattern {
       .replace(/\*/g, '[*]') // escape '*'
   }
 
-  /**
-   * Converts path to forward slashes on Windows for compatibility with minimatch.
-   * On Windows, minimatch patterns use forward slashes, so paths must be converted
-   * to match the same format.
-   */
-  private static convertToMinimatchPath(itemPath: string): string {
-    if (IS_WINDOWS) {
-      return itemPath.replace(/\\/g, '/')
-    }
-    return itemPath
-  }
-
   /**
    * Normalizes slashes and ensures absolute root
    */

packages/http-client/package-lock.json

@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
+        "undici": "^7.16.0"
       },
       "devDependencies": {
         "@types/node": "24.1.0",
@@ -19,15 +19,6 @@
         "proxy": "^2.1.1"
       }
     },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
     "node_modules/@types/node": {
       "version": "24.1.0",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.1.0.tgz",
@@ -241,15 +232,12 @@
       }
     },
     "node_modules/undici": {
-      "version": "5.29.0",
+      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.16.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "integrity": "sha512-QEg3HPMll0o3t2ourKwOeUAZ159Kn9mx5pnzHRQO8+Wixmh88YdZRiIwat0iNzNNXn0yoEtXJqFpyW7eM8BV7g==",
       "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
       "engines": {
-        "node": ">=14.0"
+        "node": ">=20.18.1"
       }
     },
     "node_modules/undici-types": {

packages/http-client/package.json

@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "tunnel": "^0.0.6",
-    "undici": "^5.28.5"
+    "undici": "^7.16.0"
   },
   "overrides": {
     "uri-js": "npm:uri-js-replace@^1.0.1"