style: fix prettier formatting in list-artifacts test

chore(deps): upgrade root dev dependencies
- concurrently: 6.x → 9.x - eslint-plugin-prettier: 5.0.0 → 5.5.x - prettier: 3.0.0 → 3.8.x - ts-jest: 29.1.1 → 29.4.x - typescript: 5.2.2 → 5.9.x
2026-01-30 09:14:25 -05:00 · 2026-01-30 09:14:15 -05:00 · 2026-01-29 13:01:33 -08:00 · 2026-01-29 20:20:49 +00:00 · 2026-01-29 15:19:39 -05:00 · 2026-01-29 14:23:32 -05:00
155 changed files with 2190 additions and 2348 deletions
@@ -55,10 +55,8 @@ jobs:
      shell: bash
      run: packages/cache/__tests__/create-cache-files.sh ${{ runner.os }} ~/test-cache

-    # We're using node -e to call the functions directly available in the @actions/cache package
    - name: Save cache using saveCache()
-      run: |
-        node -e "Promise.resolve(require('./packages/cache/lib/cache').saveCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
+      run: node packages/cache/__tests__/save-cache.mjs ${{ runner.os }} ${{ github.run_id }}

    - name: Delete cache folders before restoring
      shell: bash
@@ -67,8 +65,7 @@ jobs:
        rm -rf ~/test-cache

    - name: Restore cache using restoreCache() with http-client
-      run: |
-        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}',[],{useAzureSdk: false}))"
+      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} false

    - name: Verify cache restored with http-client
      shell: bash
@@ -83,8 +80,7 @@ jobs:
        rm -rf ~/test-cache

    - name: Restore cache using restoreCache() with Azure SDK
-      run: |
-        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
+      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} true

    - name: Verify cache restored with Azure SDK
      shell: bash
@@ -52,10 +52,8 @@ jobs:
      shell: bash
      run: packages/cache/__tests__/create-cache-files.sh ${{ runner.os }} ~/test-cache

-    # We're using node -e to call the functions directly available in the @actions/cache package
    - name: Save cache using saveCache()
-      run: |
-        node -e "Promise.resolve(require('./packages/cache/lib/cache').saveCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
+      run: node packages/cache/__tests__/save-cache.mjs ${{ runner.os }} ${{ github.run_id }}

    - name: Delete cache folders before restoring
      shell: bash
@@ -64,8 +62,7 @@ jobs:
        rm -rf ~/test-cache

    - name: Restore cache using restoreCache() with http-client
-      run: |
-        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}',[],{useAzureSdk: false}))"
+      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} false

    - name: Verify cache restored with http-client
      shell: bash
@@ -80,8 +77,7 @@ jobs:
        rm -rf ~/test-cache

    - name: Restore cache using restoreCache() with Azure SDK
-      run: |
-        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
+      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} true

    - name: Verify cache restored with Azure SDK
      shell: bash
@@ -69,16 +69,16 @@ jobs:
      id-token: write
    steps:

+      - name: Set Node.js 24.x
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24.x
+
      - name: download artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ github.event.inputs.package }}

-      - name: setup authentication
-        run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> .npmrc
-        env:
-          NPM_TOKEN: ${{ secrets.TOKEN }}
-
      - name: publish
        run: npm publish --provenance *.tgz

@@ -4,8 +4,35 @@ module.exports = {
  roots: ['<rootDir>/packages'],
  testEnvironment: 'node',
  testMatch: ['**/__tests__/*.test.ts'],
-  transform: {
-    '^.+\\.ts$': ['ts-jest', {isolatedModules: true, diagnostics: {warnOnly: true}}]
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1',
+    '^@actions/core$': '<rootDir>/packages/core/lib/core.js',
+    '^@actions/exec$': '<rootDir>/packages/exec/lib/exec.js',
+    '^@actions/io$': '<rootDir>/packages/io/lib/io.js',
+    '^@actions/io/lib/io-util$': '<rootDir>/packages/io/lib/io-util.js',
+    '^@actions/http-client$': '<rootDir>/packages/http-client/lib/index.js',
+    '^@actions/http-client/lib/auth$': '<rootDir>/packages/http-client/lib/auth.js',
+    '^@actions/http-client/lib/interfaces$': '<rootDir>/packages/http-client/lib/interfaces.js',
+    '^@actions/github$': '<rootDir>/packages/github/lib/github.js',
+    '^@actions/github/lib/utils$': '<rootDir>/packages/github/lib/utils.js',
+    '^@actions/glob$': '<rootDir>/packages/glob/lib/glob.js',
+    '^@actions/tool-cache$': '<rootDir>/packages/tool-cache/lib/tool-cache.js',
+    '^@actions/cache$': '<rootDir>/packages/cache/lib/cache.js',
+    '^@actions/attest$': '<rootDir>/packages/attest/lib/index.js'
  },
+  transform: {
+    '^.+\\.(ts|js)$': ['ts-jest', {
+      diagnostics: {warnOnly: true},
+      tsconfig: {
+        allowJs: true,
+        esModuleInterop: true,
+        module: 'commonjs',
+        moduleResolution: 'node'
+      }
+    }]
+  },
+  transformIgnorePatterns: [
+    '/node_modules/(?!(@octokit|@actions/github|@actions/http-client|@actions/io|@actions/exec|@actions/core|@actions/glob|@actions/tool-cache|@actions/cache|@actions/attest|universal-user-agent|before-after-hook)/)'
+  ],
  verbose: true
 }
@@ -9,19 +9,19 @@
        "@types/jest": "^29.5.4",
        "@types/node": "^24.1.0",
        "@types/signale": "^1.4.1",
-        "concurrently": "^6.1.0",
+        "concurrently": "^9.0.0",
        "eslint": "^8.0.1",
        "eslint-config-prettier": "^8.9.0",
        "eslint-plugin-github": "^4.9.2",
        "eslint-plugin-jest": "^27.2.3",
-        "eslint-plugin-prettier": "^5.0.0",
+        "eslint-plugin-prettier": "^5.5.0",
        "flow-bin": "^0.115.0",
        "jest": "^29.6.4",
        "lerna": "^6.4.1",
        "nx": "16.6.0",
-        "prettier": "^3.0.0",
-        "ts-jest": "^29.1.1",
-        "typescript": "^5.2.2"
+        "prettier": "^3.8.0",
+        "ts-jest": "^29.4.0",
+        "typescript": "^5.9.0"
      }
    },
    "node_modules/@babel/code-frame": {
@@ -465,16 +465,6 @@
        "@babel/core": "^7.0.0-0"
      }
    },
-    "node_modules/@babel/runtime": {
-      "version": "7.28.4",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.4.tgz",
-      "integrity": "sha512-Q/N6JNWvIvPnLDvjlE1OUBLPQHH6l3CltCEsHIujp45zQUSSh8K+gHnaEX45yAT1nyngnINhvWtzN+Nb9D8RAQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
    "node_modules/@babel/template": {
      "version": "7.27.2",
      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.27.2.tgz",
@@ -1706,16 +1696,6 @@
        "node": ">=8"
      }
    },
-    "node_modules/@lerna/legacy-package-management/node_modules/rxjs": {
-      "version": "7.8.2",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
-      "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.1.0"
-      }
-    },
    "node_modules/@lerna/legacy-package-management/node_modules/supports-color": {
      "version": "7.2.0",
      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
@@ -2956,67 +2936,67 @@
      }
    },
    "node_modules/@octokit/auth-token": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
-      "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==",
      "dev": true,
      "license": "MIT",
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/core": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz",
-      "integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@octokit/auth-token": "^4.0.0",
-        "@octokit/graphql": "^7.1.0",
-        "@octokit/request": "^8.4.1",
-        "@octokit/request-error": "^5.1.1",
-        "@octokit/types": "^13.0.0",
-        "before-after-hook": "^2.2.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/auth-token": "^6.0.0",
+        "@octokit/graphql": "^9.0.3",
+        "@octokit/request": "^10.0.6",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "before-after-hook": "^4.0.0",
+        "universal-user-agent": "^7.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/endpoint": {
-      "version": "9.0.6",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
-      "integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
+      "version": "11.0.2",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz",
+      "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^13.1.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.2"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/graphql": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.1.1.tgz",
-      "integrity": "sha512-3mkDltSfcDUoa176nlGoA32RGjeWjl3K7F/BwHwRMJUW/IteSa4bnSV8p2ThNkcIcZU2umkZWxwETSSCJf2Q7g==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@octokit/request": "^8.4.1",
-        "@octokit/types": "^13.0.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/request": "^10.0.6",
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
      "dev": true,
      "license": "MIT"
    },
@@ -3028,36 +3008,19 @@
      "license": "MIT"
    },
    "node_modules/@octokit/plugin-paginate-rest": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
-      "integrity": "sha512-u3KYkGF7GcZnSD/3UP0S7K5XUFT2FkOQdcfXZGZQPGv3lm4F2Xbf71lvjldr8c1H3nNbF+33cLEkWYbokGWqiQ==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^12.6.0"
+        "@octokit/types": "^16.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      },
      "peerDependencies": {
-        "@octokit/core": "5"
-      }
-    },
-    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
+        "@octokit/core": ">=6"
      }
    },
    "node_modules/@octokit/plugin-request-log": {
@@ -3105,34 +3068,33 @@
      }
    },
    "node_modules/@octokit/request": {
-      "version": "8.4.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
-      "integrity": "sha512-qnB2+SY3hkCmBxZsR/MPCybNmbJe4KAlfWErXq+rBKkQJlbjdJeS85VI9r8UqeLYLvnAenU8Q1okM/0MBsAGXw==",
+      "version": "10.0.7",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz",
+      "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@octokit/endpoint": "^9.0.6",
-        "@octokit/request-error": "^5.1.1",
-        "@octokit/types": "^13.1.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/endpoint": "^11.0.2",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "fast-content-type-parse": "^3.0.0",
+        "universal-user-agent": "^7.0.2"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/request-error": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
-      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^13.1.0",
-        "deprecation": "^2.0.0",
-        "once": "^1.4.0"
+        "@octokit/types": "^16.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/rest": {
@@ -3152,13 +3114,13 @@
      }
    },
    "node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "version": "16.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
+        "@octokit/openapi-types": "^27.0.0"
      }
    },
    "node_modules/@parcel/watcher": {
@@ -4516,9 +4478,9 @@
      }
    },
    "node_modules/before-after-hook": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
-      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==",
      "dev": true,
      "license": "Apache-2.0"
    },
@@ -5239,26 +5201,90 @@
      }
    },
    "node_modules/concurrently": {
-      "version": "6.5.1",
-      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-6.5.1.tgz",
-      "integrity": "sha512-FlSwNpGjWQfRwPLXvJ/OgysbBxPkWpiVjy1042b0U7on7S7qwwMIILRj7WTN1mTgqa582bG6NFuScOoh6Zgdag==",
+      "version": "9.2.1",
+      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-9.2.1.tgz",
+      "integrity": "sha512-fsfrO0MxV64Znoy8/l1vVIjjHa29SZyyqPgQBwhiDcaW8wJc2W3XWVOGx4M3oJBnv/zdUZIIp1gDeS98GzP8Ng==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "chalk": "^4.1.0",
-        "date-fns": "^2.16.1",
-        "lodash": "^4.17.21",
-        "rxjs": "^6.6.3",
-        "spawn-command": "^0.0.2-1",
-        "supports-color": "^8.1.0",
-        "tree-kill": "^1.2.2",
-        "yargs": "^16.2.0"
+        "chalk": "4.1.2",
+        "rxjs": "7.8.2",
+        "shell-quote": "1.8.3",
+        "supports-color": "8.1.1",
+        "tree-kill": "1.2.2",
+        "yargs": "17.7.2"
      },
      "bin": {
-        "concurrently": "bin/concurrently.js"
+        "conc": "dist/bin/concurrently.js",
+        "concurrently": "dist/bin/concurrently.js"
      },
      "engines": {
-        "node": ">=10.0.0"
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/open-cli-tools/concurrently?sponsor=1"
+      }
+    },
+    "node_modules/concurrently/node_modules/cliui": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
+      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.1",
+        "wrap-ansi": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/concurrently/node_modules/wrap-ansi": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/concurrently/node_modules/yargs": {
+      "version": "17.7.2",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
+      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cliui": "^8.0.1",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.3",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^21.1.1"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/concurrently/node_modules/yargs-parser": {
+      "version": "21.1.1",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
+      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
      }
    },
    "node_modules/config-chain": {
@@ -5631,23 +5657,6 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
-    "node_modules/date-fns": {
-      "version": "2.30.0",
-      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-2.30.0.tgz",
-      "integrity": "sha512-fnULvOpxnC5/Vg3NCiWelDsLiUc9bRwAPs/+LfTLNvetFCtCTN+yQz15C/fs4AwX1R9K5GLtLfn8QW+dWisaAw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/runtime": "^7.21.0"
-      },
-      "engines": {
-        "node": ">=0.11"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/date-fns"
-      }
-    },
    "node_modules/dateformat": {
      "version": "3.0.3",
      "resolved": "https://registry.npmjs.org/dateformat/-/dateformat-3.0.3.tgz",
@@ -6986,6 +6995,23 @@
        "node": ">=0.10.0"
      }
    },
+    "node_modules/fast-content-type-parse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
+      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
    "node_modules/fast-deep-equal": {
      "version": "3.1.3",
      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -8354,16 +8380,6 @@
        "node": ">=12.0.0"
      }
    },
-    "node_modules/inquirer/node_modules/rxjs": {
-      "version": "7.8.2",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
-      "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.1.0"
-      }
-    },
    "node_modules/internal-slot": {
      "version": "1.1.0",
      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.1.0.tgz",
@@ -10762,9 +10778,9 @@
      }
    },
    "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.17.23",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
      "dev": true,
      "license": "MIT"
    },
@@ -13418,9 +13434,9 @@
      }
    },
    "node_modules/prettier": {
-      "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.6.2.tgz",
-      "integrity": "sha512-I7AIg5boAr5R0FFtJ6rCfD+LFsWHp81dolrFD8S79U9tb8Az2nGrJncnMSnys+bpQJfRUzqs9hnA81OAA3hCuQ==",
+      "version": "3.8.1",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz",
+      "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
      "dev": true,
      "license": "MIT",
      "bin": {
@@ -14204,25 +14220,15 @@
      }
    },
    "node_modules/rxjs": {
-      "version": "6.6.7",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.6.7.tgz",
-      "integrity": "sha512-hTdwr+7yYNIT5n4AMYp85KA6yw2Va0FLa3Rguvbpa4W3I5xynaBZo41cM3XM+4Q6fRMj3sBYIR1VAmZMXYJvRQ==",
+      "version": "7.8.2",
+      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
+      "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
-        "tslib": "^1.9.0"
-      },
-      "engines": {
-        "npm": ">=2.0.0"
+        "tslib": "^2.1.0"
      }
    },
-    "node_modules/rxjs/node_modules/tslib": {
-      "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
-      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
-      "dev": true,
-      "license": "0BSD"
-    },
    "node_modules/safe-array-concat": {
      "version": "1.1.3",
      "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.1.3.tgz",
@@ -14411,6 +14417,19 @@
        "node": ">=8"
      }
    },
+    "node_modules/shell-quote": {
+      "version": "1.8.3",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",
+      "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
    "node_modules/side-channel": {
      "version": "1.1.0",
      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
@@ -14704,12 +14723,6 @@
        "source-map": "^0.6.0"
      }
    },
-    "node_modules/spawn-command": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/spawn-command/-/spawn-command-0.0.2.tgz",
-      "integrity": "sha512-zC8zGoGkmc8J9ndvml8Xksr1Amk9qBujgbF0JAIWO7kXr43w0h/0GJNM/Vustixu+YE8N/MTrQ7N31FvHUACxQ==",
-      "dev": true
-    },
    "node_modules/spdx-correct": {
      "version": "3.2.0",
      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
@@ -15859,9 +15872,9 @@
      }
    },
    "node_modules/universal-user-agent": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.1.tgz",
-      "integrity": "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ==",
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
      "dev": true,
      "license": "ISC"
    },
@@ -19,27 +19,27 @@
    "@types/jest": "^29.5.4",
    "@types/node": "^24.1.0",
    "@types/signale": "^1.4.1",
-    "concurrently": "^6.1.0",
+    "concurrently": "^9.0.0",
    "eslint": "^8.0.1",
    "eslint-config-prettier": "^8.9.0",
    "eslint-plugin-github": "^4.9.2",
    "eslint-plugin-jest": "^27.2.3",
-    "eslint-plugin-prettier": "^5.0.0",
+    "eslint-plugin-prettier": "^5.5.0",
    "flow-bin": "^0.115.0",
    "jest": "^29.6.4",
    "lerna": "^6.4.1",
    "nx": "16.6.0",
-    "prettier": "^3.0.0",
-    "ts-jest": "^29.1.1",
-    "typescript": "^5.2.2"
+    "prettier": "^3.8.0",
+    "ts-jest": "^29.4.0",
+    "typescript": "^5.9.0"
  },
  "overrides": {
    "semver": "^7.6.0",
    "tar": "^6.2.1",
-    "@octokit/plugin-paginate-rest": "^9.2.2",
-    "@octokit/request": "^8.4.1",
-    "@octokit/request-error": "^5.1.1",
-    "@octokit/core": "^5.0.3",
+    "@octokit/plugin-paginate-rest": "^14.0.0",
+    "@octokit/request": "^10.0.7",
+    "@octokit/request-error": "^7.1.0",
+    "@octokit/core": "^7.0.6",
    "tmp": "^0.2.4",
    "@types/node": "^24.1.0",
    "brace-expansion": "^2.0.2",
@@ -4,7 +4,6 @@ Interact programmatically with [Actions Artifacts](https://docs.github.com/en/ac

 This is the core library that powers the [`@actions/upload-artifact`](https://github.com/actions/upload-artifact) and [`@actions/download-artifact`](https://github.com/actions/download-artifact) actions.

-
 - [`@actions/artifact`](#actionsartifact)
  - [v2 - What's New](#v2---whats-new)
    - [Improvements](#improvements)
@@ -1,129 +1,144 @@
 # @actions/artifact Releases

-### 4.0.0
+## 5.0.3
+
+- Bump `@actions/http-client` to `3.0.2`
+
+## 5.0.1
+
+- Fix Node.js 24 punycode deprecation warning by updating `@azure/storage-blob` from `^12.15.0` to `^12.29.1` [#2211](https://github.com/actions/toolkit/pull/2211)
+- Removed direct `@azure/core-http` dependency (now uses `@azure/core-rest-pipeline` via storage-blob)
+
+## 5.0.0
+
+- Dependency updates for Node.js 24 runtime support
+- Update `@actions/core` to v2
+- Update `@actions/http-client` to v3
+
+## 4.0.0

 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Fix: artifact pagination bugs and configurable artifact count limits [#2165](https://github.com/actions/toolkit/pull/2165)
 - Fix: reject the promise on timeout [#2124](https://github.com/actions/toolkit/pull/2124)
 - Update dependency versions

-### 2.3.3
+## 2.3.3

 - Dependency updates [#2049](https://github.com/actions/toolkit/pull/2049)

-### 2.3.2
+## 2.3.2

 - Added masking for Shared Access Signature (SAS) artifact URLs [#1982](https://github.com/actions/toolkit/pull/1982)
- Change hash to digest for consistent terminology across runner logs [#1991](https://github.com/actions/toolkit/pull/1991) 
+- Change hash to digest for consistent terminology across runner logs [#1991](https://github.com/actions/toolkit/pull/1991)

-### 2.3.1
+## 2.3.1

 - Fix comment typo on expectedHash. [#1986](https://github.com/actions/toolkit/pull/1986)

-### 2.3.0
+## 2.3.0

 - Allow ArtifactClient to perform digest comparisons, if supplied. [#1975](https://github.com/actions/toolkit/pull/1975)

-### 2.2.2
+## 2.2.2

 - Default concurrency to 5 for uploading artifacts [#1962](https://github.com/actions/toolkit/pull/1962)

-### 2.2.1
+## 2.2.1

 - Add `ACTIONS_ARTIFACT_UPLOAD_CONCURRENCY` and `ACTIONS_ARTIFACT_UPLOAD_TIMEOUT_MS` environment variables [#1928](https://github.com/actions/toolkit/pull/1928)

-### 2.2.0
+## 2.2.0

 - Return artifact digest on upload [#1896](https://github.com/actions/toolkit/pull/1896)

-### 2.1.11
+## 2.1.11

 - Fixed a bug with relative symlinks resolution [#1844](https://github.com/actions/toolkit/pull/1844)
 - Use native `crypto` [#1815](https://github.com/actions/toolkit/pull/1815)

-### 2.1.10
+## 2.1.10

 - Fixed a regression with symlinks not being automatically resolved [#1830](https://github.com/actions/toolkit/pull/1830)
 - Fixed a regression with chunk timeout [#1786](https://github.com/actions/toolkit/pull/1786)

-### 2.1.9
+## 2.1.9

 - Fixed artifact upload chunk timeout logic [#1774](https://github.com/actions/toolkit/pull/1774)
 - Use lazy stream to prevent issues with open file limits [#1771](https://github.com/actions/toolkit/pull/1771)

-### 2.1.8
+## 2.1.8

 - Allows `*.localhost` domains for hostname checks for local development.

-### 2.1.7
+## 2.1.7

 - Update unzip-stream dependency and reverted to using `unzip.Extract()`

-### 2.1.6
+## 2.1.6

 - Will retry on invalid request responses.

-### 2.1.5
+## 2.1.5

 - Bumped `archiver` dependency to 7.0.1

-### 2.1.4
+## 2.1.4

 - Adds info-level logging for zip extraction

-### 2.1.3
+## 2.1.3

 - Fixes a bug in the extract logic updated in 2.1.2

-### 2.1.2
+## 2.1.2

 - Updated the stream extract functionality to use `unzip.Parse()` instead of `unzip.Extract()` for greater control of unzipping artifacts

-### 2.1.1
+## 2.1.1

 - Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts

-### 2.1.0
+## 2.1.0

 - Added `ArtifactClient#deleteArtifact` to delete artifacts by name [#1626](https://github.com/actions/toolkit/pull/1626)
 - Update error messaging to be more useful [#1628](https://github.com/actions/toolkit/pull/1628)

-### 2.0.1
+## 2.0.1

- Patch to fix transient request timeouts https://github.com/actions/download-artifact/issues/249
+- Patch to fix transient request timeouts <https://github.com/actions/download-artifact/issues/249>

-### 2.0.0
+## 2.0.0

 - Major release. Supports new Artifact backend for improved speed, reliability and behavior.
 - Numerous API changes, [some breaking](./README.md#breaking-changes).

 - [Blog post with more info](https://github.blog/2024-02-12-get-started-with-v4-of-github-actions-artifacts/)

-### 1.1.1
+## 1.1.1

 - Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet [#1278](https://github.com/actions/toolkit/pull/1278/commits/b9de68a590daf37c6747e38d3cb4f1dd2cfb791c)

-### 1.1.0
+## 1.1.0

 - Add `x-actions-results-crc64` and `x-actions-results-md5` checksum headers on upload [#1063](https://github.com/actions/toolkit/pull/1063)

-### 1.0.2
+## 1.0.2

 - Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)

-### 1.0.1
+## 1.0.1

 - Update to v2.0.0 of `@actions/http-client`

-### 1.0.0
+## 1.0.0

 - Update `lockfileVersion` to `v2` in `package-lock.json` [#1009](https://github.com/actions/toolkit/pull/1009)

-### 0.6.1
+## 0.6.1

 - Fix for failing 0 byte file uploads on Windows [#962](https://github.com/actions/toolkit/pull/962)

-### 0.6.0
+## 0.6.0

 - Support upload from named pipes [#748](https://github.com/actions/toolkit/pull/748)
 - Fixes to percentage values being greater than 100% when downloading all artifacts [#889](https://github.com/actions/toolkit/pull/889)
@@ -132,49 +147,49 @@
 - Faster upload speeds for certain types of large files by exempting gzip compression [#956](https://github.com/actions/toolkit/pull/956)
 - More detailed logging when dealing with chunked uploads [#957](https://github.com/actions/toolkit/pull/957)
  
-### 0.5.2
+## 0.5.2

 - Add HTTP 500 as a retryable status code for artifact upload and download.
  
-### 0.5.1
+## 0.5.1

 - Bump @actions/http-client to version 1.0.11 to fix proxy related issues during artifact upload and download

-### 0.5.0
+## 0.5.0

 - Improved retry-ability for all http calls during artifact upload and download if an error is encountered

-### 0.4.2
+## 0.4.2

 - Improved retry-ability when a partial artifact download is encountered

-### 0.4.1
+## 0.4.1

 - Update to latest @actions/core version

-### 0.4.0
+## 0.4.0

 - Add option to specify custom retentions on artifacts
- 
-### 0.3.5
+
+## 0.3.5

 - Retry in the event of a 413 response

-### 0.3.3
+## 0.3.3

 - Increase chunk size during upload from 4MB to 8MB
 - Improve user-agent strings during API calls to help internally diagnose issues

-### 0.3.2
+## 0.3.2

 - Fix to ensure readstreams get correctly reset in the event of a retry

-### 0.3.1
+## 0.3.1

 - Fix to ensure temporary gzip files get correctly deleted during artifact upload
 - Remove spaces as a forbidden character during upload

-### 0.3.0
+## 0.3.0

 - Fixes to gzip decompression when downloading artifacts
 - Support handling 429 response codes
@@ -183,13 +198,13 @@
 - Clearer error message if storage quota has been reached
 - Improved logging and output during artifact download

-### 0.2.0
+## 0.2.0

 - Fixes to TCP connections not closing
 - GZip file compression to speed up downloads
 - Improved logging and output
 - Extra documentation

-### 0.1.0
+## 0.1.0

 - Initial release
@@ -1,10 +1,10 @@
 import * as http from 'http'
 import * as net from 'net'
 import {HttpClient} from '@actions/http-client'
-import * as config from '../src/internal/shared/config'
-import {internalArtifactTwirpClient} from '../src/internal/shared/artifact-twirp-client'
-import {noopLogs} from './common'
-import {NetworkError, UsageError} from '../src/internal/shared/errors'
+import * as config from '../src/internal/shared/config.js'
+import {internalArtifactTwirpClient} from '../src/internal/shared/artifact-twirp-client.js'
+import {noopLogs} from './common.js'
+import {NetworkError, UsageError} from '../src/internal/shared/errors.js'

 jest.mock('@actions/http-client')

@@ -1,4 +1,4 @@
-import * as config from '../src/internal/shared/config'
+import * as config from '../src/internal/shared/config.js'
 import os from 'os'

 // Mock the `cpus()` function in the `os` module
@@ -4,11 +4,11 @@ import type {RequestInterface} from '@octokit/types'
 import {
  deleteArtifactInternal,
  deleteArtifactPublic
-} from '../src/internal/delete/delete-artifact'
-import * as config from '../src/internal/shared/config'
-import {ArtifactServiceClientJSON, Timestamp} from '../src/generated'
-import * as util from '../src/internal/shared/util'
-import {noopLogs} from './common'
+} from '../src/internal/delete/delete-artifact.js'
+import * as config from '../src/internal/shared/config.js'
+import {ArtifactServiceClientJSON, Timestamp} from '../src/generated/index.js'
+import * as util from '../src/internal/shared/util.js'
+import {noopLogs} from './common.js'

 type MockedRequest = jest.MockedFunction<RequestInterface<object>>

@@ -11,12 +11,12 @@ import {
  downloadArtifactInternal,
  downloadArtifactPublic,
  streamExtractExternal
-} from '../src/internal/download/download-artifact'
-import {getUserAgentString} from '../src/internal/shared/user-agent'
-import {noopLogs} from './common'
-import * as config from '../src/internal/shared/config'
-import {ArtifactServiceClientJSON} from '../src/generated'
-import * as util from '../src/internal/shared/util'
+} from '../src/internal/download/download-artifact.js'
+import {getUserAgentString} from '../src/internal/shared/user-agent.js'
+import {noopLogs} from './common.js'
+import * as config from '../src/internal/shared/config.js'
+import {ArtifactServiceClientJSON} from '../src/generated/index.js'
+import * as util from '../src/internal/shared/util.js'

 type MockedDownloadArtifact = jest.MockedFunction<
  RestEndpointMethods['actions']['downloadArtifact']
@@ -3,15 +3,15 @@ import type {RequestInterface} from '@octokit/types'
 import {
  getArtifactInternal,
  getArtifactPublic
-} from '../src/internal/find/get-artifact'
-import * as config from '../src/internal/shared/config'
-import {ArtifactServiceClientJSON, Timestamp} from '../src/generated'
-import * as util from '../src/internal/shared/util'
-import {noopLogs} from './common'
+} from '../src/internal/find/get-artifact.js'
+import * as config from '../src/internal/shared/config.js'
+import {ArtifactServiceClientJSON, Timestamp} from '../src/generated/index.js'
+import * as util from '../src/internal/shared/util.js'
+import {noopLogs} from './common.js'
 import {
  ArtifactNotFoundError,
  InvalidResponseError
-} from '../src/internal/shared/errors'
+} from '../src/internal/shared/errors.js'

 type MockedRequest = jest.MockedFunction<RequestInterface<object>>

@@ -3,12 +3,12 @@ import type {RestEndpointMethodTypes} from '@octokit/plugin-rest-endpoint-method
 import {
  listArtifactsInternal,
  listArtifactsPublic
-} from '../src/internal/find/list-artifacts'
-import * as config from '../src/internal/shared/config'
-import {ArtifactServiceClientJSON, Timestamp} from '../src/generated'
-import * as util from '../src/internal/shared/util'
-import {noopLogs} from './common'
-import {Artifact} from '../src/internal/shared/interfaces'
+} from '../src/internal/find/list-artifacts.js'
+import * as config from '../src/internal/shared/config.js'
+import {ArtifactServiceClientJSON, Timestamp} from '../src/generated/index.js'
+import * as util from '../src/internal/shared/util.js'
+import {noopLogs} from './common.js'
+import {Artifact} from '../src/internal/shared/interfaces.js'
 import {RequestInterface} from '@octokit/types'

 type MockedRequest = jest.MockedFunction<RequestInterface<object>>
@@ -230,9 +230,8 @@ describe('list-artifact', () => {
      jest.resetModules()

      try {
-        const {listArtifactsPublic: listArtifactsPublicReloaded} = await import(
-          '../src/internal/find/list-artifacts'
-        )
+        const {listArtifactsPublic: listArtifactsPublicReloaded} =
+          await import('../src/internal/find/list-artifacts')
        const githubReloaded = await import('@actions/github')

        const mockRequest = (githubReloaded.getOctokit as jest.Mock)(
@@ -1,9 +1,9 @@
 import {
  validateArtifactName,
  validateFilePath
-} from '../src/internal/upload/path-and-artifact-name-validation'
+} from '../src/internal/upload/path-and-artifact-name-validation.js'

-import {noopLogs} from './common'
+import {noopLogs} from './common.js'

 describe('Path and artifact name validation', () => {
  beforeAll(() => {
@@ -1,5 +1,5 @@
-import {Timestamp} from '../src/generated'
-import * as retention from '../src/internal/upload/retention'
+import {Timestamp} from '../src/generated/index.js'
+import * as retention from '../src/internal/upload/retention.js'

 describe('retention', () => {
  beforeEach(() => {
@@ -1,12 +1,12 @@
-import * as uploadZipSpecification from '../src/internal/upload/upload-zip-specification'
-import * as zip from '../src/internal/upload/zip'
-import * as util from '../src/internal/shared/util'
-import * as config from '../src/internal/shared/config'
-import {ArtifactServiceClientJSON} from '../src/generated'
-import * as blobUpload from '../src/internal/upload/blob-upload'
-import {uploadArtifact} from '../src/internal/upload/upload-artifact'
-import {noopLogs} from './common'
-import {FilesNotFoundError} from '../src/internal/shared/errors'
+import * as uploadZipSpecification from '../src/internal/upload/upload-zip-specification.js'
+import * as zip from '../src/internal/upload/zip.js'
+import * as util from '../src/internal/shared/util.js'
+import * as config from '../src/internal/shared/config.js'
+import {ArtifactServiceClientJSON} from '../src/generated/index.js'
+import * as blobUpload from '../src/internal/upload/blob-upload.js'
+import {uploadArtifact} from '../src/internal/upload/upload-artifact.js'
+import {noopLogs} from './common.js'
+import {FilesNotFoundError} from '../src/internal/shared/errors.js'
 import {BlockBlobUploadStreamOptions} from '@azure/storage-blob'
 import * as fs from 'fs'
 import * as path from 'path'
@@ -4,8 +4,8 @@ import {promises as fs} from 'fs'
 import {
  getUploadZipSpecification,
  validateRootDirectory
-} from '../src/internal/upload/upload-zip-specification'
-import {noopLogs} from './common'
+} from '../src/internal/upload/upload-zip-specification.js'
+import {noopLogs} from './common.js'

 const root = path.join(__dirname, '_temp', 'upload-specification')
 const goodItem1Path = path.join(
@@ -1,6 +1,6 @@
-import * as config from '../src/internal/shared/config'
-import * as util from '../src/internal/shared/util'
-import {maskSigUrl, maskSecretUrls} from '../src/internal/shared/util'
+import * as config from '../src/internal/shared/config.js'
+import * as util from '../src/internal/shared/util.js'
+import {maskSigUrl, maskSecretUrls} from '../src/internal/shared/util.js'
 import {setSecret, debug} from '@actions/core'

 export const testRuntimeToken =
@@ -1,6 +1,6 @@
 {
  "name": "@actions/artifact",
-  "version": "4.0.0",
+  "version": "6.0.0",
  "preview": true,
  "description": "Actions artifact lib",
  "keywords": [
@@ -10,8 +10,15 @@
  ],
  "homepage": "https://github.com/actions/toolkit/tree/main/packages/artifact",
  "license": "MIT",
+  "type": "module",
  "main": "lib/artifact.js",
  "types": "lib/artifact.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/artifact.d.ts",
+      "import": "./lib/artifact.js"
+    }
+  },
  "directories": {
    "lib": "lib",
    "test": "__tests__"
@@ -32,7 +39,7 @@
    "audit-moderate": "npm install && npm audit --json --audit-level=moderate > audit.json",
    "test": "cd ../../ && npm run test ./packages/artifact",
    "bootstrap": "cd ../../ && npm run bootstrap",
-    "tsc-run": "tsc",
+    "tsc-run": "tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/",
    "tsc": "npm run bootstrap && npm run tsc-run",
    "gen:docs": "typedoc --plugin typedoc-plugin-markdown --out docs/generated src/artifact.ts --githubPages false --readme none"
  },
@@ -40,27 +47,27 @@
    "url": "https://github.com/actions/toolkit/issues"
  },
  "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@actions/github": "^6.0.1",
-    "@actions/http-client": "^2.1.0",
-    "@azure/core-http": "^3.0.5",
-    "@azure/storage-blob": "^12.15.0",
-    "@octokit/core": "^5.2.1",
-    "@octokit/plugin-request-log": "^1.0.4",
-    "@octokit/plugin-retry": "^3.0.9",
-    "@octokit/request": "^8.4.1",
-    "@octokit/request-error": "^5.1.1",
+    "@actions/core": "^3.0.0",
+    "@actions/github": "^9.0.0",
+    "@actions/http-client": "^4.0.0",
+    "@azure/storage-blob": "^12.30.0",
+    "@octokit/core": "^7.0.6",
+    "@octokit/plugin-request-log": "^6.0.0",
+    "@octokit/plugin-retry": "^8.0.0",
+    "@octokit/request": "^10.0.7",
+    "@octokit/request-error": "^7.1.0",
    "@protobuf-ts/plugin": "^2.2.3-alpha.1",
+    "@protobuf-ts/runtime": "^2.9.4",
    "archiver": "^7.0.1",
-    "jwt-decode": "^3.1.2",
+    "jwt-decode": "^4.0.0",
    "unzip-stream": "^0.3.1"
  },
  "devDependencies": {
-    "@types/archiver": "^5.3.2",
+    "@types/archiver": "^7.0.0",
    "@types/unzip-stream": "^0.3.4",
-    "typedoc": "^0.28.13",
-    "typedoc-plugin-markdown": "^3.17.1",
-    "typescript": "^5.2.2"
+    "typedoc": "^0.28.16",
+    "typedoc-plugin-markdown": "^4.9.0",
+    "typescript": "^5.9.3"
  },
  "overrides": {
    "uri-js": "npm:uri-js-replace@^1.0.1",
@@ -1,8 +1,8 @@
-import {ArtifactClient, DefaultArtifactClient} from './internal/client'
+import {ArtifactClient, DefaultArtifactClient} from './internal/client.js'

-export * from './internal/shared/interfaces'
-export * from './internal/shared/errors'
-export * from './internal/client'
+export * from './internal/shared/interfaces.js'
+export * from './internal/shared/errors.js'
+export * from './internal/client.js'

 const client: ArtifactClient = new DefaultArtifactClient()
 export default client
@@ -1,4 +1,4 @@
-export * from './google/protobuf/timestamp'
-export * from './google/protobuf/wrappers'
-export * from './results/api/v1/artifact'
-export * from './results/api/v1/artifact.twirp-client'
+export * from './google/protobuf/timestamp.js'
+export * from './google/protobuf/wrappers.js'
+export * from './results/api/v1/artifact.js'
+export * from './results/api/v1/artifact.twirp-client.js'
@@ -12,9 +12,9 @@ import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
-import { Int64Value } from "../../../google/protobuf/wrappers";
-import { StringValue } from "../../../google/protobuf/wrappers";
-import { Timestamp } from "../../../google/protobuf/timestamp";
+import { Int64Value } from "../../../google/protobuf/wrappers.js";
+import { StringValue } from "../../../google/protobuf/wrappers.js";
+import { Timestamp } from "../../../google/protobuf/timestamp.js";
 /**
 * @generated from protobuf message github.actions.results.api.v1.MigrateArtifactRequest
 */
@@ -9,7 +9,7 @@ import {
  GetSignedArtifactURLResponse,
  DeleteArtifactRequest,
  DeleteArtifactResponse,
-} from "./artifact";
+} from "./artifact.js";

 //==================================//
 //          Client Code             //
@@ -1,5 +1,5 @@
 import {warning} from '@actions/core'
-import {isGhes} from './shared/config'
+import {isGhes} from './shared/config.js'
 import {
  UploadArtifactOptions,
  UploadArtifactResponse,
@@ -10,19 +10,22 @@ import {
  DownloadArtifactResponse,
  FindOptions,
  DeleteArtifactResponse
-} from './shared/interfaces'
-import {uploadArtifact} from './upload/upload-artifact'
+} from './shared/interfaces.js'
+import {uploadArtifact} from './upload/upload-artifact.js'
 import {
  downloadArtifactPublic,
  downloadArtifactInternal
-} from './download/download-artifact'
+} from './download/download-artifact.js'
 import {
  deleteArtifactPublic,
  deleteArtifactInternal
-} from './delete/delete-artifact'
-import {getArtifactPublic, getArtifactInternal} from './find/get-artifact'
-import {listArtifactsPublic, listArtifactsInternal} from './find/list-artifacts'
-import {GHESNotSupportedError} from './shared/errors'
+} from './delete/delete-artifact.js'
+import {getArtifactPublic, getArtifactInternal} from './find/get-artifact.js'
+import {
+  listArtifactsPublic,
+  listArtifactsInternal
+} from './find/list-artifacts.js'
+import {GHESNotSupportedError} from './shared/errors.js'

 /**
 * Generic interface for the artifact client.
@@ -1,21 +1,21 @@
 import {info, debug} from '@actions/core'
 import {getOctokit} from '@actions/github'
-import {DeleteArtifactResponse} from '../shared/interfaces'
-import {getUserAgentString} from '../shared/user-agent'
-import {getRetryOptions} from '../find/retry-options'
+import {DeleteArtifactResponse} from '../shared/interfaces.js'
+import {getUserAgentString} from '../shared/user-agent.js'
+import {getRetryOptions} from '../find/retry-options.js'
 import {defaults as defaultGitHubOptions} from '@actions/github/lib/utils'
 import {requestLog} from '@octokit/plugin-request-log'
 import {retry} from '@octokit/plugin-retry'
-import {OctokitOptions} from '@octokit/core/dist-types/types'
-import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
-import {getBackendIdsFromToken} from '../shared/util'
+import type {OctokitOptions} from '@octokit/core/types'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client.js'
+import {getBackendIdsFromToken} from '../shared/util.js'
 import {
  DeleteArtifactRequest,
  ListArtifactsRequest,
  StringValue
-} from '../../generated'
-import {getArtifactPublic} from '../find/get-artifact'
-import {ArtifactNotFoundError, InvalidResponseError} from '../shared/errors'
+} from '../../generated/index.js'
+import {getArtifactPublic} from '../find/get-artifact.js'
+import {ArtifactNotFoundError, InvalidResponseError} from '../shared/errors.js'

 export async function deleteArtifactPublic(
  artifactName: string,
@@ -10,17 +10,17 @@ import {
  DownloadArtifactOptions,
  DownloadArtifactResponse,
  StreamExtractResponse
-} from '../shared/interfaces'
-import {getUserAgentString} from '../shared/user-agent'
-import {getGitHubWorkspaceDir} from '../shared/config'
-import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
+} from '../shared/interfaces.js'
+import {getUserAgentString} from '../shared/user-agent.js'
+import {getGitHubWorkspaceDir} from '../shared/config.js'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client.js'
 import {
  GetSignedArtifactURLRequest,
  Int64Value,
  ListArtifactsRequest
-} from '../../generated'
-import {getBackendIdsFromToken} from '../shared/util'
-import {ArtifactNotFoundError} from '../shared/errors'
+} from '../../generated/index.js'
+import {getBackendIdsFromToken} from '../shared/util.js'
+import {ArtifactNotFoundError} from '../shared/errors.js'

 const scrubQueryParameters = (url: string): string => {
  const parsed = new URL(url)
@@ -1,16 +1,20 @@
 import {getOctokit} from '@actions/github'
 import {retry} from '@octokit/plugin-retry'
 import * as core from '@actions/core'
-import {OctokitOptions} from '@octokit/core/dist-types/types'
+import type {OctokitOptions} from '@octokit/core/types'
 import {defaults as defaultGitHubOptions} from '@actions/github/lib/utils'
-import {getRetryOptions} from './retry-options'
+import {getRetryOptions} from './retry-options.js'
 import {requestLog} from '@octokit/plugin-request-log'
-import {GetArtifactResponse} from '../shared/interfaces'
-import {getBackendIdsFromToken} from '../shared/util'
-import {getUserAgentString} from '../shared/user-agent'
-import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
-import {ListArtifactsRequest, StringValue, Timestamp} from '../../generated'
-import {ArtifactNotFoundError, InvalidResponseError} from '../shared/errors'
+import {GetArtifactResponse} from '../shared/interfaces.js'
+import {getBackendIdsFromToken} from '../shared/util.js'
+import {getUserAgentString} from '../shared/user-agent.js'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client.js'
+import {
+  ListArtifactsRequest,
+  StringValue,
+  Timestamp
+} from '../../generated/index.js'
+import {ArtifactNotFoundError, InvalidResponseError} from '../shared/errors.js'

 export async function getArtifactPublic(
  artifactName: string,
@@ -1,16 +1,16 @@
 import {info, warning, debug} from '@actions/core'
 import {getOctokit} from '@actions/github'
-import {ListArtifactsResponse, Artifact} from '../shared/interfaces'
-import {getUserAgentString} from '../shared/user-agent'
-import {getRetryOptions} from './retry-options'
+import {ListArtifactsResponse, Artifact} from '../shared/interfaces.js'
+import {getUserAgentString} from '../shared/user-agent.js'
+import {getRetryOptions} from './retry-options.js'
 import {defaults as defaultGitHubOptions} from '@actions/github/lib/utils'
 import {requestLog} from '@octokit/plugin-request-log'
 import {retry} from '@octokit/plugin-retry'
-import {OctokitOptions} from '@octokit/core/dist-types/types'
-import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
-import {getBackendIdsFromToken} from '../shared/util'
-import {getMaxArtifactListCount} from '../shared/config'
-import {ListArtifactsRequest, Timestamp} from '../../generated'
+import type {OctokitOptions} from '@octokit/core/types'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client.js'
+import {getBackendIdsFromToken} from '../shared/util.js'
+import {getMaxArtifactListCount} from '../shared/config.js'
+import {ListArtifactsRequest, Timestamp} from '../../generated/index.js'

 const maximumArtifactCount = getMaxArtifactListCount()
 const paginationCount = 100
@@ -1,5 +1,5 @@
 import * as core from '@actions/core'
-import {OctokitOptions} from '@octokit/core/dist-types/types'
+import type {OctokitOptions} from '@octokit/core/types'
 import {RequestRequestOptions} from '@octokit/types'

 export type RetryOptions = {
@@ -1,11 +1,11 @@
 import {HttpClient, HttpClientResponse, HttpCodes} from '@actions/http-client'
 import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
 import {info, debug} from '@actions/core'
-import {ArtifactServiceClientJSON} from '../../generated'
-import {getResultsServiceUrl, getRuntimeToken} from './config'
-import {getUserAgentString} from './user-agent'
-import {NetworkError, UsageError} from './errors'
-import {maskSecretUrls} from './util'
+import {ArtifactServiceClientJSON} from '../../generated/index.js'
+import {getResultsServiceUrl, getRuntimeToken} from './config.js'
+import {getUserAgentString} from './user-agent.js'
+import {NetworkError, UsageError} from './errors.js'
+import {maskSecretUrls} from './util.js'

 // The twirp http client must implement this interface
 interface Rpc {
@@ -0,0 +1,7 @@
+// This file exists as a CommonJS module to read the version from package.json.
+// In an ESM package, using `require()` directly in .ts files requires disabling
+// ESLint rules and doesn't work reliably across all Node.js versions.
+// By keeping this as a .cjs file, we can use require() naturally and export
+// the version for the ESM modules to import.
+const packageJson = require('../../../package.json')
+module.exports = { version: packageJson.version }
@@ -1,9 +1,8 @@
-// eslint-disable-next-line @typescript-eslint/no-var-requires, @typescript-eslint/no-require-imports
-const packageJson = require('../../../package.json')
+import {version} from './package-version.cjs'

 /**
 * Ensure that this User Agent String is used in all HTTP calls so that we can monitor telemetry between different versions of this package
 */
 export function getUserAgentString(): string {
-  return `@actions/artifact-${packageJson.version}`
+  return `@actions/artifact-${version}`
 }
@@ -1,6 +1,6 @@
 import * as core from '@actions/core'
-import {getRuntimeToken} from './config'
-import jwt_decode from 'jwt-decode'
+import {getRuntimeToken} from './config.js'
+import {jwtDecode} from 'jwt-decode'
 import {debug, setSecret} from '@actions/core'

 export interface BackendIds {
@@ -20,7 +20,7 @@ const InvalidJwtError = new Error(
 // workflow run and workflow job run backend ids
 export function getBackendIdsFromToken(): BackendIds {
  const token = getRuntimeToken()
-  const decoded = jwt_decode<ActionsToken>(token)
+  const decoded = jwtDecode<ActionsToken>(token)
  if (!decoded.scp) {
    throw InvalidJwtError
  }
@@ -1,15 +1,15 @@
 import {BlobClient, BlockBlobUploadStreamOptions} from '@azure/storage-blob'
 import {TransferProgressEvent} from '@azure/core-http-compat'
-import {ZipUploadStream} from './zip'
+import {ZipUploadStream} from './zip.js'
 import {
  getUploadChunkSize,
  getConcurrency,
  getUploadChunkTimeout
-} from '../shared/config'
+} from '../shared/config.js'
 import * as core from '@actions/core'
 import * as crypto from 'crypto'
 import * as stream from 'stream'
-import {NetworkError} from '../shared/errors'
+import {NetworkError} from '../shared/errors.js'

 export interface BlobUploadResponse {
  /**
@@ -1,4 +1,4 @@
-import {Timestamp} from '../../generated'
+import {Timestamp} from '../../generated/index.js'
 import * as core from '@actions/core'

 export function getExpiration(retentionDays?: number): Timestamp | undefined {
@@ -2,24 +2,24 @@ import * as core from '@actions/core'
 import {
  UploadArtifactOptions,
  UploadArtifactResponse
-} from '../shared/interfaces'
-import {getExpiration} from './retention'
-import {validateArtifactName} from './path-and-artifact-name-validation'
-import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
+} from '../shared/interfaces.js'
+import {getExpiration} from './retention.js'
+import {validateArtifactName} from './path-and-artifact-name-validation.js'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client.js'
 import {
  UploadZipSpecification,
  getUploadZipSpecification,
  validateRootDirectory
-} from './upload-zip-specification'
-import {getBackendIdsFromToken} from '../shared/util'
-import {uploadZipToBlobStorage} from './blob-upload'
-import {createZipUploadStream} from './zip'
+} from './upload-zip-specification.js'
+import {getBackendIdsFromToken} from '../shared/util.js'
+import {uploadZipToBlobStorage} from './blob-upload.js'
+import {createZipUploadStream} from './zip.js'
 import {
  CreateArtifactRequest,
  FinalizeArtifactRequest,
  StringValue
-} from '../../generated'
-import {FilesNotFoundError, InvalidResponseError} from '../shared/errors'
+} from '../../generated/index.js'
+import {FilesNotFoundError, InvalidResponseError} from '../shared/errors.js'

 export async function uploadArtifact(
  name: string,
@@ -1,7 +1,7 @@
 import * as fs from 'fs'
 import {info} from '@actions/core'
 import {normalize, resolve} from 'path'
-import {validateFilePath} from './path-and-artifact-name-validation'
+import {validateFilePath} from './path-and-artifact-name-validation.js'

 export interface UploadZipSpecification {
  /**
@@ -1,9 +1,9 @@
 import * as stream from 'stream'
 import {realpath} from 'fs/promises'
-import * as archiver from 'archiver'
+import archiver from 'archiver'
 import * as core from '@actions/core'
-import {UploadZipSpecification} from './upload-zip-specification'
-import {getUploadChunkSize} from '../shared/config'
+import {UploadZipSpecification} from './upload-zip-specification.js'
+import {getUploadChunkSize} from '../shared/config.js'

 export const DEFAULT_COMPRESSION_LEVEL = 6

@@ -4,6 +4,8 @@
    "baseUrl": "./",
    "outDir": "./lib",
    "rootDir": "./src",
+    "module": "node16",
+    "moduleResolution": "node16",
    "paths": {
      "@actions/core": [
        "../core"
@@ -1,17 +1,35 @@
 # @actions/attest Releases

-### 2.0.0
+## 3.0.0
+
+- **Breaking change**: Package is now ESM-only
+  - CommonJS consumers must use dynamic `import()` instead of `require()`
+- Bump `@actions/core` to `^3.0.0`
+- Bump `@actions/http-client` to `^4.0.0`
+
+## 2.2.1
+
+- Bump `@actions/http-client` to `3.0.2`
+- Bump `undici` to `6.23.0`
+
+## 2.2.0
+
+- Bump @actions/core from 1.11.1 to 2.0.2
+- Bump @actions/github from 6.0.0 to 7.0.0
+- Bump @actions/http-client from 2.2.3 to 3.0.1
+
+## 2.0.0

 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Bump @sigstore/bundle from 3.0.0 to 3.1.0
 - Bump @sigstore/sign from 3.0.0 to 3.1.0
 - Bump jose from 5.2.3 to 5.10.0

-### 1.6.0
+## 1.6.0

 - Update `buildSLSAProvenancePredicate` to populate `workflow.ref` field from the `ref` claim in the OIDC token [#1969](https://github.com/actions/toolkit/pull/1969)

-### 1.5.0
+## 1.5.0

 - Bump @actions/core from 1.10.1 to 1.11.1 [#1847](https://github.com/actions/toolkit/pull/1847)
 - Bump @sigstore/bundle from 2.3.2 to 3.0.0 [#1846](https://github.com/actions/toolkit/pull/1846)
@@ -19,23 +37,24 @@
 - Support for generating multi-subject attestations [#1864](https://github.com/actions/toolkit/pull/1865)
 - Fix bug in `buildSLSAProvenancePredicate` related to `workflow_ref` OIDC token claims containing the "@" symbol in the tag name [#1863](https://github.com/actions/toolkit/pull/1863)

-### 1.4.2
+## 1.4.2

 - Fix bug in `buildSLSAProvenancePredicate`/`attestProvenance` when generating provenance statement for enterprise account using customized OIDC issuer value [#1823](https://github.com/actions/toolkit/pull/1823)

-### 1.4.1
+## 1.4.1

 - Bump @actions/http-client from 2.2.1 to 2.2.3 [#1805](https://github.com/actions/toolkit/pull/1805)

-### 1.4.0
+## 1.4.0

 - Add new `headers` parameter to the `attest` and `attestProvenance` functions [#1790](https://github.com/actions/toolkit/pull/1790)
 - Update `buildSLSAProvenancePredicate`/`attestProvenance` to automatically derive default OIDC issuer URL from current execution context [#1796](https://github.com/actions/toolkit/pull/1796)
-### 1.3.1
+
+## 1.3.1

 - Fix bug with proxy support when retrieving JWKS for OIDC issuer [#1776](https://github.com/actions/toolkit/pull/1776)

-### 1.3.0
+## 1.3.0

 - Dynamic construction of Sigstore API URLs [#1735](https://github.com/actions/toolkit/pull/1735)
 - Switch to new GH provenance build type [#1745](https://github.com/actions/toolkit/pull/1745)
@@ -43,21 +62,21 @@
 - Bump @sigstore/bundle from 2.3.0 to 2.3.2 [#1738](https://github.com/actions/toolkit/pull/1738)
 - Bump @sigstore/sign from 2.3.0 to 2.3.2 [#1738](https://github.com/actions/toolkit/pull/1738)

-### 1.2.1
+## 1.2.1

 - Retry request on attestation persistence failure [#1725](https://github.com/actions/toolkit/pull/1725)

-### 1.2.0
+## 1.2.0

 - Generate attestations using the v0.3 Sigstore bundle format [#1701](https://github.com/actions/toolkit/pull/1701)
 - Bump @sigstore/bundle from 2.2.0 to 2.3.0 [#1701](https://github.com/actions/toolkit/pull/1701)
 - Bump @sigstore/sign from 2.2.3 to 2.3.0 [#1701](https://github.com/actions/toolkit/pull/1701)
 - Remove dependency on make-fetch-happen [#1714](https://github.com/actions/toolkit/pull/1714)

-### 1.1.0
+## 1.1.0

 - Updates the `attestProvenance` function to retrieve a token from the GitHub OIDC provider and use the token claims to populate the provenance statement [#1693](https://github.com/actions/toolkit/pull/1693)

-### 1.0.0
+## 1.0.0

 - Initial release
@@ -1,18 +1,18 @@
 {
  "name": "@actions/attest",
-  "version": "2.1.0",
+  "version": "3.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/attest",
-      "version": "2.1.0",
+      "version": "3.0.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^1.11.1",
-        "@actions/github": "^6.0.0",
-        "@actions/http-client": "^2.2.3",
-        "@octokit/plugin-retry": "^6.0.1",
+        "@actions/core": "^3.0.0",
+        "@actions/github": "^9.0.0",
+        "@actions/http-client": "^4.0.0",
+        "@octokit/plugin-retry": "^8.0.3",
        "@sigstore/bundle": "^3.1.0",
        "@sigstore/sign": "^3.1.0",
        "jose": "^5.10.0"
@@ -22,92 +22,78 @@
        "@sigstore/rekor-types": "^3.0.0",
        "@types/jsonwebtoken": "^9.0.6",
        "nock": "^13.5.1",
-        "undici": "^6.20.0"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.0.tgz",
+      "integrity": "sha512-zYt6cz+ivnTmiT/ksRVriMBOiuoUpDCJJlZ5KPl2/FRdvwU3f7MPh9qftvbkXJThragzUZieit2nyHUyw53Seg==",
      "license": "MIT",
      "dependencies": {
-        "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1"
+        "@actions/exec": "^3.0.0",
+        "@actions/http-client": "^4.0.0"
      }
    },
    "node_modules/@actions/exec": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
-      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-3.0.0.tgz",
+      "integrity": "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==",
      "license": "MIT",
      "dependencies": {
-        "@actions/io": "^1.0.1"
+        "@actions/io": "^3.0.2"
      }
    },
    "node_modules/@actions/github": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.1.tgz",
-      "integrity": "sha512-xbZVcaqD4XnQAe35qSQqskb3SqIAfRyLBrHMd/8TuL7hJSz2QtbDwnNM8zWx4zO5l2fnGtseNE3MbEvD7BxVMw==",
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-9.0.0.tgz",
+      "integrity": "sha512-yJ0RoswsAaKcvkmpCE4XxBRiy/whH2SdTBHWzs0gi4wkqTDhXMChjSdqBz/F4AeiDlP28rQqL33iHb+kjAMX6w==",
      "license": "MIT",
      "dependencies": {
-        "@actions/http-client": "^2.2.0",
-        "@octokit/core": "^5.0.1",
-        "@octokit/plugin-paginate-rest": "^9.2.2",
-        "@octokit/plugin-rest-endpoint-methods": "^10.4.0",
-        "@octokit/request": "^8.4.1",
-        "@octokit/request-error": "^5.1.1",
-        "undici": "^5.28.5"
+        "@actions/http-client": "^3.0.2",
+        "@octokit/core": "^7.0.6",
+        "@octokit/plugin-paginate-rest": "^14.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
+        "@octokit/request": "^10.0.7",
+        "@octokit/request-error": "^7.1.0",
+        "undici": "^6.23.0"
      }
    },
-    "node_modules/@actions/github/node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
-      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=14.0"
-      }
-    },
-    "node_modules/@actions/http-client": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
-      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
+    "node_modules/@actions/github/node_modules/@actions/http-client": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.25.4"
+        "undici": "^6.23.0"
      }
    },
-    "node_modules/@actions/http-client/node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+    "node_modules/@actions/github/node_modules/@actions/http-client/node_modules/undici": {
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
+    "node_modules/@actions/http-client": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.0.tgz",
+      "integrity": "sha512-QuwPsgVMsD6qaPD57GLZi9sqzAZCtiJT8kVBCDpLtxhL5MydQ4gS+DrejtZZPdIYyB1e95uCK9Luyds7ybHI3g==",
      "license": "MIT",
      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=14.0"
+        "tunnel": "^0.0.6",
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/io": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
-      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
+      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
      "license": "MIT"
    },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
    "node_modules/@isaacs/cliui": {
      "version": "8.0.2",
      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
@@ -179,178 +165,147 @@
      }
    },
    "node_modules/@octokit/auth-token": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
-      "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==",
      "license": "MIT",
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/core": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz",
-      "integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/auth-token": "^4.0.0",
-        "@octokit/graphql": "^7.1.0",
-        "@octokit/request": "^8.4.1",
-        "@octokit/request-error": "^5.1.1",
-        "@octokit/types": "^13.0.0",
-        "before-after-hook": "^2.2.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/auth-token": "^6.0.0",
+        "@octokit/graphql": "^9.0.3",
+        "@octokit/request": "^10.0.6",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "before-after-hook": "^4.0.0",
+        "universal-user-agent": "^7.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/endpoint": {
-      "version": "9.0.6",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
-      "integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
+      "version": "11.0.2",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz",
+      "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^13.1.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.2"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/graphql": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.1.1.tgz",
-      "integrity": "sha512-3mkDltSfcDUoa176nlGoA32RGjeWjl3K7F/BwHwRMJUW/IteSa4bnSV8p2ThNkcIcZU2umkZWxwETSSCJf2Q7g==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/request": "^8.4.1",
-        "@octokit/types": "^13.0.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/request": "^10.0.6",
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
      "license": "MIT"
    },
    "node_modules/@octokit/plugin-paginate-rest": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
-      "integrity": "sha512-u3KYkGF7GcZnSD/3UP0S7K5XUFT2FkOQdcfXZGZQPGv3lm4F2Xbf71lvjldr8c1H3nNbF+33cLEkWYbokGWqiQ==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^12.6.0"
+        "@octokit/types": "^16.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      },
      "peerDependencies": {
-        "@octokit/core": "5"
-      }
-    },
-    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
+        "@octokit/core": ">=6"
      }
    },
    "node_modules/@octokit/plugin-rest-endpoint-methods": {
-      "version": "10.4.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
-      "integrity": "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg==",
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+      "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^12.6.0"
+        "@octokit/types": "^16.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      },
      "peerDependencies": {
-        "@octokit/core": "5"
-      }
-    },
-    "node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
+        "@octokit/core": ">=6"
      }
    },
    "node_modules/@octokit/plugin-retry": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-6.1.0.tgz",
-      "integrity": "sha512-WrO3bvq4E1Xh1r2mT9w6SDFg01gFmP81nIG77+p/MqW1JeXXgL++6umim3t6x0Zj5pZm3rXAN+0HEjmmdhIRig==",
+      "version": "8.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.0.3.tgz",
+      "integrity": "sha512-vKGx1i3MC0za53IzYBSBXcrhmd+daQDzuZfYDd52X5S0M2otf3kVZTVP8bLA3EkU0lTvd1WEC2OlNNa4G+dohA==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^13.0.0",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
        "bottleneck": "^2.15.3"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      },
      "peerDependencies": {
-        "@octokit/core": "5"
+        "@octokit/core": ">=7"
      }
    },
    "node_modules/@octokit/request": {
-      "version": "8.4.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
-      "integrity": "sha512-qnB2+SY3hkCmBxZsR/MPCybNmbJe4KAlfWErXq+rBKkQJlbjdJeS85VI9r8UqeLYLvnAenU8Q1okM/0MBsAGXw==",
+      "version": "10.0.7",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz",
+      "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/endpoint": "^9.0.6",
-        "@octokit/request-error": "^5.1.1",
-        "@octokit/types": "^13.1.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/endpoint": "^11.0.2",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "fast-content-type-parse": "^3.0.0",
+        "universal-user-agent": "^7.0.2"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/request-error": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
-      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^13.1.0",
-        "deprecation": "^2.0.0",
-        "once": "^1.4.0"
+        "@octokit/types": "^16.0.0"
      },
      "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
      }
    },
    "node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "version": "16.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
+        "@octokit/openapi-types": "^27.0.0"
      }
    },
    "node_modules/@peculiar/asn1-cms": {
@@ -711,9 +666,9 @@
      "license": "MIT"
    },
    "node_modules/before-after-hook": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
-      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==",
      "license": "Apache-2.0"
    },
    "node_modules/bottleneck": {
@@ -832,12 +787,6 @@
        }
      }
    },
-    "node_modules/deprecation": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
-      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ==",
-      "license": "ISC"
-    },
    "node_modules/eastasianwidth": {
      "version": "0.2.0",
      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
@@ -866,6 +815,22 @@
      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
      "license": "MIT"
    },
+    "node_modules/fast-content-type-parse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
+      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
    "node_modules/foreground-child": {
      "version": "3.3.1",
      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
@@ -1236,15 +1201,6 @@
        "node": ">= 10.13"
      }
    },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "license": "ISC",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
    "node_modules/p-map": {
      "version": "7.0.3",
      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.3.tgz",
@@ -1573,9 +1529,9 @@
      }
    },
    "node_modules/tar": {
-      "version": "7.5.2",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.2.tgz",
-      "integrity": "sha512-7NyxrTE4Anh8km8iEy7o0QYPs+0JKBTj5ZaqHg6B39erLg0qYXN3BijtShwbsNSvQ+LN75+KV+C4QR/f6Gwnpg==",
+      "version": "7.5.7",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.7.tgz",
+      "integrity": "sha512-fov56fJiRuThVFXD6o6/Q354S7pnWMJIVlDBYijsTNx6jKSE4pvrDTs6lUnmGvNyfJwFQQwWy3owKz1ucIhveQ==",
      "license": "BlueOak-1.0.0",
      "dependencies": {
        "@isaacs/fs-minipass": "^4.0.0",
@@ -1625,10 +1581,9 @@
      }
    },
    "node_modules/undici": {
-      "version": "6.21.3",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.21.3.tgz",
-      "integrity": "sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==",
-      "dev": true,
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
      "license": "MIT",
      "engines": {
        "node": ">=18.17"
@@ -1666,9 +1621,9 @@
      }
    },
    "node_modules/universal-user-agent": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.1.tgz",
-      "integrity": "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ==",
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
      "license": "ISC"
    },
    "node_modules/webcrypto-core": {
@@ -1791,12 +1746,6 @@
        "node": ">=8"
      }
    },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "license": "ISC"
-    },
    "node_modules/yallist": {
      "version": "5.0.0",
      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
@@ -1,6 +1,6 @@
 {
  "name": "@actions/attest",
-  "version": "2.1.0",
+  "version": "3.0.0",
  "description": "Actions attestation lib",
  "keywords": [
    "github",
@@ -9,8 +9,15 @@
  ],
  "homepage": "https://github.com/actions/toolkit/tree/main/packages/attest",
  "license": "MIT",
+  "type": "module",
  "main": "lib/index.js",
  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "import": "./lib/index.js"
+    }
+  },
  "directories": {
    "lib": "lib",
    "test": "__tests__"
@@ -39,20 +46,15 @@
    "@sigstore/rekor-types": "^3.0.0",
    "@types/jsonwebtoken": "^9.0.6",
    "nock": "^13.5.1",
-    "undici": "^6.20.0"
+    "undici": "^6.23.0"
  },
  "dependencies": {
-    "@actions/core": "^1.11.1",
-    "@actions/github": "^6.0.0",
-    "@actions/http-client": "^2.2.3",
-    "@octokit/plugin-retry": "^6.0.1",
+    "@actions/core": "^3.0.0",
+    "@actions/github": "^9.0.0",
+    "@actions/http-client": "^4.0.0",
+    "@octokit/plugin-retry": "^8.0.3",
    "@sigstore/bundle": "^3.1.0",
    "@sigstore/sign": "^3.1.0",
    "jose": "^5.10.0"
-  },
-  "overrides": {
-    "@octokit/plugin-retry": {
-      "@octokit/core": "^5.2.0"
-    }
  }
 }
@@ -1,12 +1,12 @@
 import {bundleToJSON} from '@sigstore/bundle'
 import {X509Certificate} from 'crypto'
-import {SigstoreInstance, signingEndpoints} from './endpoints'
-import {buildIntotoStatement} from './intoto'
-import {Payload, signPayload} from './sign'
-import {writeAttestation} from './store'
+import {SigstoreInstance, signingEndpoints} from './endpoints.js'
+import {buildIntotoStatement} from './intoto.js'
+import {Payload, signPayload} from './sign.js'
+import {writeAttestation} from './store.js'

 import type {Bundle} from '@sigstore/sign'
-import type {Attestation, Predicate, Subject} from './shared.types'
+import type {Attestation, Predicate, Subject} from './shared.types.js'

 const INTOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json'

@@ -1,10 +1,15 @@
-export {createStorageRecord} from './artifactMetadata'
-export {AttestOptions, attest} from './attest'
+export {
+  createStorageRecord,
+  ArtifactOptions,
+  PackageRegistryOptions
+} from './artifactMetadata.js'
+export {AttestOptions, attest} from './attest.js'
 export {
  AttestProvenanceOptions,
  attestProvenance,
  buildSLSAProvenancePredicate
-} from './provenance'
+} from './provenance.js'

 export type {SerializedBundle} from '@sigstore/bundle'
-export type {Attestation, Predicate, Subject} from './shared.types'
+export type {Attestation, Predicate, Subject} from './shared.types.js'
+export type {SigstoreInstance} from './endpoints.js'
@@ -1,4 +1,4 @@
-import {Predicate, Subject} from './shared.types'
+import {Predicate, Subject} from './shared.types.js'

 const INTOTO_STATEMENT_V1_TYPE = 'https://in-toto.io/Statement/v1'

@@ -1,6 +1,6 @@
-import {attest, AttestOptions} from './attest'
-import {getIDTokenClaims} from './oidc'
-import type {Attestation, Predicate} from './shared.types'
+import {attest, AttestOptions} from './attest.js'
+import {getIDTokenClaims} from './oidc.js'
+import type {Attestation, Predicate} from './shared.types.js'

 const SLSA_PREDICATE_V1_TYPE = 'https://slsa.dev/provenance/v1'
 const GITHUB_BUILD_TYPE = 'https://actions.github.io/buildtypes/workflow/v1'
@@ -4,7 +4,9 @@
    "baseUrl": "./",
    "outDir": "./lib",
    "declaration": true,
-    "rootDir": "./src"
+    "rootDir": "./src",
+    "module": "node16",
+    "moduleResolution": "node16"
  },
  "include": [
    "./src"
@@ -1,14 +1,48 @@
 # @actions/cache Releases

-### 4.1.0
+## 6.0.0
+
+- **Breaking change**: Package is now ESM-only
+  - CommonJS consumers must use dynamic `import()` instead of `require()`
+
+## 5.0.5
+
+- Bump `@actions/glob` to `0.5.1`
+
+## 5.0.4
+
+- Bump `@actions/http-client` to `3.0.2`
+
+## 5.0.3
+
+Prevent retries for rate limited cache operations [2243](https://github.com/actions/toolkit/pull/2243).
+
+## 5.0.1
+
+- Fix Node.js 24 punycode deprecation warning by updating `@azure/storage-blob` from `^12.13.0` to `^12.29.1` [#2213](https://github.com/actions/toolkit/pull/2213)
+- Newer storage-blob uses `@azure/core-rest-pipeline` instead of deprecated `@azure/core-http`, which eliminates the transitive dependency on `node-fetch@2` → `whatwg-url@5` → `tr46@0.0.3` that used the deprecated punycode module
+
+## 5.0.0
+
+- Remove `@azure/ms-rest-js` dependency [#2197](https://github.com/actions/toolkit/pull/2197)
+  - The `TransferProgressEvent` type is now imported from `@azure/core-rest-pipeline` instead of `@azure/ms-rest-js`
+- Bump `@actions/core` from `^1.11.1` to `^2.0.0` [#2198](https://github.com/actions/toolkit/pull/2198)
+- Bump `@actions/exec` from `^1.0.1` to `^2.0.0` [#2198](https://github.com/actions/toolkit/pull/2198)
+- Bump `@actions/glob` from `^0.1.0` to `^0.5.0` [#2198](https://github.com/actions/toolkit/pull/2198)
+- Bump `@actions/http-client` from `^2.1.1` to `^3.0.0` [#2198](https://github.com/actions/toolkit/pull/2198)
+- Bump `@actions/io` from `^1.0.1` to `^2.0.0` [#2198](https://github.com/actions/toolkit/pull/2198)
+- Add support for Node.js 24 [#2110](https://github.com/actions/toolkit/pull/2110)
+- Add `node-fetch` override to resolve audit vulnerabilities [#2110](https://github.com/actions/toolkit/pull/2110)
+
+## 4.1.0

 - Remove client side 10GiB cache size limit check & update twirp client [#2118](https://github.com/actions/toolkit/pull/2118)

-### 4.0.5
+## 4.0.5

 - Reintroduce @protobuf-ts/runtime-rpc as a runtime dependency [#2113](https://github.com/actions/toolkit/pull/2113)

-### 4.0.4
+## 4.0.4

 ⚠️ Faulty patch release. Upgrade to 4.0.5 instead.

@@ -17,23 +51,23 @@
 - Enhanced server error handling: 5xx HTTP errors are now logged as errors instead of warnings [#2099](https://github.com/actions/toolkit/pull/2099)
 - Fixed cache hit logging to properly distinguish between exact key matches and restore key matches [#2101](https://github.com/actions/toolkit/pull/2101)

-### 4.0.3
+## 4.0.3

 - Added masking for Shared Access Signature (SAS) cache entry URLs [#1982](https://github.com/actions/toolkit/pull/1982)
 - Improved debugging by logging both the cache version alongside the keys requested when a cache restore fails [#1994](https://github.com/actions/toolkit/pull/1994)

-### 4.0.2
+## 4.0.2

 - Wrap create failures in ReserveCacheError [#1966](https://github.com/actions/toolkit/pull/1966)

-### 4.0.1
+## 4.0.1

 - Remove runtime dependency on `twirp-ts` [#1947](https://github.com/actions/toolkit/pull/1947)
 - Cache miss as debug, not warning annotation [#1954](https://github.com/actions/toolkit/pull/1954)

-### 4.0.0
+## 4.0.0

-#### Important changes
+### Important changes

 The cache backend service has been rewritten from the ground up for improved performance and reliability. The [@actions/cache](https://github.com/actions/toolkit/tree/main/packages/cache) package now integrates with the new cache service (v2) APIs.

@@ -47,182 +81,182 @@ Upgrading to the recommended version should not break or require any changes to

 Read more about the change & access the migration guide: [reference to the announcement](https://github.com/actions/toolkit/discussions/1890).

-#### Minor changes
+### Minor changes

 - Update `@actions/core` to `1.11.0`
 - Update `semver` `6.3.1`
 - Add `twirp-ts` `2.5.0` to dependencies

-### 3.3.0
+## 3.3.0

 - Update `@actions/core` to `1.11.1`
 - Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824), [#1842](https://github.com/actions/toolkit/pull/1842)

-### 3.2.4
+## 3.2.4

 - Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts

-### 3.2.3
+## 3.2.3

 - Fixed a bug that mutated path arguments to `getCacheVersion` [#1378](https://github.com/actions/toolkit/pull/1378)

-### 3.2.2
+## 3.2.2

 - Add new default cache download method to improve performance and reduce hangs [#1484](https://github.com/actions/toolkit/pull/1484)

-### 3.2.1
+## 3.2.1

 - Updated @azure/storage-blob to `v12.13.0`

-### 3.2.0
+## 3.2.0

 - Add `lookupOnly` to cache restore `DownloadOptions`.

-### 3.1.4
+## 3.1.4

 - Fix zstd not being used due to `zstd --version` output change in zstd 1.5.4 release. See [#1353](https://github.com/actions/toolkit/pull/1353).

-### 3.1.3
+## 3.1.3

 - Fix to prevent from setting MYSYS environement variable globally [#1329](https://github.com/actions/toolkit/pull/1329).

-### 3.1.2
+## 3.1.2

 - Fix issue with symlink restoration on windows.

-### 3.1.1
+## 3.1.1

 - Reverted changes in 3.1.0 to fix issue with symlink restoration on windows.
 - Added support for verbose logging about cache version during cache miss.

-### 3.1.0
+## 3.1.0

 - Update actions/cache on windows to use gnu tar and zstd by default
 - Update actions/cache on windows to fallback to bsdtar and zstd if gnu tar is not available.
 - Added support for fallback to gzip to restore old caches on windows.

-### 3.1.0-beta.3
+## 3.1.0-beta.3

 - Bug Fixes for fallback to gzip to restore old caches on windows and bsdtar if gnutar is not available.

-### 3.1.0-beta.2
+## 3.1.0-beta.2

 - Added support for fallback to gzip to restore old caches on windows.

-### 3.0.6
+## 3.0.6

 - Added `@azure/abort-controller` to dependencies to fix compatibility issue with ESM [#1208](https://github.com/actions/toolkit/issues/1208)

-### 3.0.5
+## 3.0.5

 - Update `@actions/cache` to use `@actions/core@^1.10.0`

-### 3.0.4
+## 3.0.4

 - Fix zstd not working for windows on gnu tar in issues [#888](https://github.com/actions/cache/issues/888) and [#891](https://github.com/actions/cache/issues/891).
 - Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable `SEGMENT_DOWNLOAD_TIMEOUT_MINS`. Default is 60 minutes.

-### 3.0.3
+## 3.0.3

 - Bug fixes for download stuck issue [#810](https://github.com/actions/cache/issues/810).

-### 3.0.2
+## 3.0.2

 - Added 1 hour timeout for the download stuck issue [#810](https://github.com/actions/cache/issues/810).

-### 3.0.1
+## 3.0.1

 - Fix [#833](https://github.com/actions/cache/issues/833) - cache doesn't work with github workspace directory.
 - Fix [#809](https://github.com/actions/cache/issues/809) `zstd -d: no such file or directory` error on AWS self-hosted runners.

-### 3.0.0
+## 3.0.0

 - Updated actions/cache to suppress Actions cache server error and log warning for those error  [#1122](https://github.com/actions/toolkit/pull/1122)

-### 2.0.6
+## 2.0.6

 - Fix `Tar failed with error: The process '/usr/bin/tar' failed with exit code 1` issue when temp directory where tar is getting created is actually the subdirectory of the path mentioned by the user for caching. ([issue](https://github.com/actions/cache/issues/689))

-### 2.0.5
+## 2.0.5

 - Fix to avoid saving empty cache when no files are available for caching. ([issue](https://github.com/actions/cache/issues/624))

-### 2.0.4
+## 2.0.4

 - Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)

-### 2.0.3
+## 2.0.3

 - Update to v2.0.0 of `@actions/http-client`

-### 2.0.0
+## 2.0.0

 - Added support to check if Actions cache service feature is available or not [#1028](https://github.com/actions/toolkit/pull/1028)

-### 1.0.11
+## 1.0.11

 - Fix file downloads > 2GB([issue](https://github.com/actions/cache/issues/773))

-### 1.0.10
+## 1.0.10

 - Update `lockfileVersion` to `v2` in `package-lock.json [#1022](https://github.com/actions/toolkit/pull/1022)

-### 1.0.9
+## 1.0.9

 - Use @azure/ms-rest-js v2.6.0
 - Use @azure/storage-blob v12.8.0

-### 1.0.8
+## 1.0.8

 - Increase the allowed artifact cache size from 5GB to 10GB ([issue](https://github.com/actions/cache/discussions/497))

-### 1.0.7
+## 1.0.7

 - Fixes permissions issue extracting archives with GNU tar on macOS ([issue](https://github.com/actions/cache/issues/527))

-### 1.0.6
+## 1.0.6

 - Make caching more verbose [#650](https://github.com/actions/toolkit/pull/650)
 - Use GNU tar on macOS if available [#701](https://github.com/actions/toolkit/pull/701)

-### 1.0.5
+## 1.0.5

 - Fix to ensure Windows cache paths get resolved correctly

-### 1.0.4
+## 1.0.4

 - Use @actions/core v1.2.6
 - Fixes uploadChunk to throw an error if any unsuccessful response code is received

-### 1.0.3
+## 1.0.3

 - Use http-client v1.0.9
 - Fixes error handling so retries are not attempted on non-retryable errors (409 Conflict, for example)
 - Adds 5 second delay between retry attempts

-### 1.0.2
+## 1.0.2

 - Use posix archive format to add support for some tools

-### 1.0.1
+## 1.0.1

 - Fix bug in downloading large files (> 2 GBs) with the Azure SDK

-### 1.0.0
+## 1.0.0

 - Downloads Azure-hosted caches using the Azure SDK for speed and reliability
 - Displays download progress
 - Includes changes that break compatibility with earlier versions, including:
  - `retry`, `retryTypedResponse`, and `retryHttpClientResponse` moved from `cacheHttpClient` to `requestUtils`

-### 0.2.1
+## 0.2.1

 - Fix to await async function getCompressionMethod
  
-### 0.2.0
+## 0.2.0

 - Fixes issues with the zstd compression algorithm on Windows and Ubuntu 16.04 [#469](https://github.com/actions/toolkit/pull/469)
  
-### 0.1.0
+## 0.1.0

 - Initial release
@@ -1,5 +1,5 @@
 name: 'Set env variables'
 description: 'Sets certain env variables so that e2e restore and save cache can be tested in a shell'
 runs:
-  using: 'node12'
+  using: 'node20'
  main: 'index.js'
@@ -1,8 +1,9 @@
 // Certain env variables are not set by default in a shell context and are only available in a node context from a running action
 // In order to be able to restore and save cache e2e in a shell when running CI tests, we need these env variables set
-const fs = require('fs');
-const os = require('os');
-const filePath = process.env[`GITHUB_ENV`]
+import fs from 'fs'
+import os from 'os'
+
+const filePath = process.env['GITHUB_ENV']
 fs.appendFileSync(filePath, `ACTIONS_CACHE_SERVICE_V2=true${os.EOL}`, {
    encoding: 'utf8'
 })
@@ -0,0 +1,174 @@
+import * as http from 'http'
+import * as net from 'net'
+import {HttpClient} from '@actions/http-client'
+import * as core from '@actions/core'
+import * as config from '../src/internal/config'
+import * as cacheUtils from '../src/internal/cacheUtils'
+import {internalCacheTwirpClient} from '../src/internal/shared/cacheTwirpClient'
+
+jest.mock('@actions/http-client')
+
+const clientOptions = {
+  maxAttempts: 5,
+  retryIntervalMs: 1,
+  retryMultiplier: 1.5
+}
+
+// noopLogs mocks the console.log and core.* functions to prevent output in the console while testing
+const noopLogs = (): void => {
+  jest.spyOn(console, 'log').mockImplementation(() => {})
+  jest.spyOn(core, 'debug').mockImplementation(() => {})
+  jest.spyOn(core, 'info').mockImplementation(() => {})
+  jest.spyOn(core, 'warning').mockImplementation(() => {})
+}
+
+describe('cacheTwirpClient', () => {
+  beforeAll(() => {
+    noopLogs()
+    jest
+      .spyOn(config, 'getCacheServiceURL')
+      .mockReturnValue('http://localhost:8080')
+    jest.spyOn(cacheUtils, 'getRuntimeToken').mockReturnValue('token')
+  })
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('should fail immediately on 429 rate limit without retrying', async () => {
+    const mockPost = jest.fn(() => {
+      const msg = new http.IncomingMessage(new net.Socket())
+      msg.statusCode = 429
+      msg.statusMessage = 'Too Many Requests'
+      return {
+        message: msg,
+        readBody: async () => {
+          return Promise.resolve(`{"ok": false}`)
+        }
+      }
+    })
+
+    ;(HttpClient as unknown as jest.Mock).mockImplementation(() => {
+      return {
+        post: mockPost
+      }
+    })
+
+    const client = internalCacheTwirpClient(clientOptions)
+    await expect(
+      client.CreateCacheEntry({
+        key: 'test-key',
+        version: 'test-version'
+      })
+    ).rejects.toThrow(
+      'Failed to CreateCacheEntry: Rate limited: Failed request: (429) Too Many Requests'
+    )
+
+    // Should only be called once - no retries for 429
+    expect(mockPost).toHaveBeenCalledTimes(1)
+  })
+
+  it('should log warning with retry-after header on 429', async () => {
+    const warningSpy = jest.spyOn(core, 'warning')
+
+    const mockPost = jest.fn(() => {
+      const msg = new http.IncomingMessage(new net.Socket())
+      msg.statusCode = 429
+      msg.statusMessage = 'Too Many Requests'
+      msg.headers = {'retry-after': '60'}
+      return {
+        message: msg,
+        readBody: async () => {
+          return Promise.resolve(`{"ok": false}`)
+        }
+      }
+    })
+
+    ;(HttpClient as unknown as jest.Mock).mockImplementation(() => {
+      return {
+        post: mockPost
+      }
+    })
+
+    const client = internalCacheTwirpClient(clientOptions)
+    await expect(
+      client.CreateCacheEntry({
+        key: 'test-key',
+        version: 'test-version'
+      })
+    ).rejects.toThrow('Rate limited')
+
+    expect(mockPost).toHaveBeenCalledTimes(1)
+    expect(warningSpy).toHaveBeenCalledWith(
+      "You've hit a rate limit, your rate limit will reset in 60 seconds"
+    )
+  })
+
+  it('should not log warning if retry-after header is missing on 429', async () => {
+    const warningSpy = jest.spyOn(core, 'warning')
+
+    const mockPost = jest.fn(() => {
+      const msg = new http.IncomingMessage(new net.Socket())
+      msg.statusCode = 429
+      msg.statusMessage = 'Too Many Requests'
+      // No retry-after header
+      return {
+        message: msg,
+        readBody: async () => {
+          return Promise.resolve(`{"ok": false}`)
+        }
+      }
+    })
+
+    ;(HttpClient as unknown as jest.Mock).mockImplementation(() => {
+      return {
+        post: mockPost
+      }
+    })
+
+    const client = internalCacheTwirpClient(clientOptions)
+    await expect(
+      client.CreateCacheEntry({
+        key: 'test-key',
+        version: 'test-version'
+      })
+    ).rejects.toThrow('Rate limited')
+
+    expect(mockPost).toHaveBeenCalledTimes(1)
+    expect(warningSpy).not.toHaveBeenCalled()
+  })
+
+  it('should not log warning if retry-after header is invalid on 429', async () => {
+    const warningSpy = jest.spyOn(core, 'warning')
+
+    const mockPost = jest.fn(() => {
+      const msg = new http.IncomingMessage(new net.Socket())
+      msg.statusCode = 429
+      msg.statusMessage = 'Too Many Requests'
+      msg.headers = {'retry-after': 'invalid'}
+      return {
+        message: msg,
+        readBody: async () => {
+          return Promise.resolve(`{"ok": false}`)
+        }
+      }
+    })
+
+    ;(HttpClient as unknown as jest.Mock).mockImplementation(() => {
+      return {
+        post: mockPost
+      }
+    })
+
+    const client = internalCacheTwirpClient(clientOptions)
+    await expect(
+      client.CreateCacheEntry({
+        key: 'test-key',
+        version: 'test-version'
+      })
+    ).rejects.toThrow('Rate limited')
+
+    expect(mockPost).toHaveBeenCalledTimes(1)
+    expect(warningSpy).not.toHaveBeenCalled()
+  })
+})
@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+// Helper script to restore cache for e2e testing
+import * as cache from '../lib/cache.js'
+
+const [prefix, runId, useAzureSdk] = process.argv.slice(2)
+
+if (!prefix || !runId) {
+  console.error('Usage: restore-cache.mjs <prefix> <runId> [useAzureSdk]')
+  process.exit(1)
+}
+
+const key = `test-${prefix}-${runId}`
+const paths = ['test-cache', '~/test-cache']
+const options = {useAzureSdk: useAzureSdk !== 'false'}
+
+console.log(`Restoring cache with key: ${key}`)
+console.log(`Paths: ${paths.join(', ')}`)
+console.log(`Using Azure SDK: ${options.useAzureSdk}`)
+
+const maxRetries = 3
+const retryDelayMs = 5000
+
+for (let attempt = 1; attempt <= maxRetries; attempt++) {
+  try {
+    console.log(`Attempt ${attempt} of ${maxRetries}`)
+    const restoredKey = await cache.restoreCache(paths, key, [], options)
+
+    if (restoredKey) {
+      console.log(`Cache restored with key: ${restoredKey}`)
+      process.exit(0)
+    } else {
+      console.log('Cache not found on this attempt')
+    }
+  } catch (error) {
+    console.error(`Error on attempt ${attempt}:`, error.message)
+  }
+
+  if (attempt < maxRetries) {
+    console.log(`Waiting ${retryDelayMs / 1000}s before retry...`)
+    await new Promise(resolve => setTimeout(resolve, retryDelayMs))
+  }
+}
+
+console.error(`Failed to restore cache after ${maxRetries} attempts`)
+process.exit(1)
@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+// Helper script to save cache for e2e testing
+import * as cache from '../lib/cache.js'
+
+const [prefix, runId] = process.argv.slice(2)
+
+if (!prefix || !runId) {
+  console.error('Usage: save-cache.mjs <prefix> <runId>')
+  process.exit(1)
+}
+
+const key = `test-${prefix}-${runId}`
+const paths = ['test-cache', '~/test-cache']
+
+console.log(`Saving cache with key: ${key}`)
+console.log(`Paths: ${paths.join(', ')}`)
+
+try {
+  const cacheId = await cache.saveCache(paths, key)
+  console.log(`Cache saved with ID: ${cacheId}`)
+} catch (error) {
+  console.error('Error saving cache:', error)
+  process.exit(1)
+}
@@ -1,87 +1,86 @@
 {
  "name": "@actions/cache",
-  "version": "5.0.0",
+  "version": "6.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/cache",
-      "version": "5.0.0",
+      "version": "6.0.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^1.11.1",
-        "@actions/exec": "^1.0.1",
-        "@actions/glob": "^0.1.0",
-        "@actions/http-client": "^2.1.1",
-        "@actions/io": "^1.0.1",
-        "@azure/abort-controller": "^1.1.0",
+        "@actions/core": "^3.0.0",
+        "@actions/exec": "^3.0.0",
+        "@actions/glob": "^0.6.1",
+        "@actions/http-client": "^4.0.0",
+        "@actions/io": "^3.0.0",
        "@azure/core-rest-pipeline": "^1.22.0",
-        "@azure/storage-blob": "^12.13.0",
+        "@azure/storage-blob": "^12.30.0",
        "@protobuf-ts/runtime-rpc": "^2.11.1",
-        "semver": "^6.3.1"
+        "semver": "^7.7.3"
      },
      "devDependencies": {
        "@protobuf-ts/plugin": "^2.9.4",
-        "@types/node": "^24.1.0",
-        "@types/semver": "^6.0.0",
+        "@types/node": "^25.1.0",
+        "@types/semver": "^7.7.1",
        "typescript": "^5.2.2"
      }
    },
    "node_modules/@actions/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.0.tgz",
+      "integrity": "sha512-zYt6cz+ivnTmiT/ksRVriMBOiuoUpDCJJlZ5KPl2/FRdvwU3f7MPh9qftvbkXJThragzUZieit2nyHUyw53Seg==",
      "license": "MIT",
      "dependencies": {
-        "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1"
+        "@actions/exec": "^3.0.0",
+        "@actions/http-client": "^4.0.0"
      }
    },
    "node_modules/@actions/exec": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
-      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-3.0.0.tgz",
+      "integrity": "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==",
      "license": "MIT",
      "dependencies": {
-        "@actions/io": "^1.0.1"
+        "@actions/io": "^3.0.2"
      }
    },
    "node_modules/@actions/glob": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.1.2.tgz",
-      "integrity": "sha512-SclLR7Ia5sEqjkJTPs7Sd86maMDw43p769YxBOxvPvEWuPEhpAnBsQfENOpXjFYMmhCqd127bmf+YdvJqVqR4A==",
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.6.1.tgz",
+      "integrity": "sha512-K4+2Ac5ILcf2ySdJCha+Pop9NcKjxqCL4xL4zI50dgB2PbXgC0+AcP011xfH4Of6b4QEJJg8dyZYv7zl4byTsw==",
      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^1.2.6",
+        "@actions/core": "^3.0.0",
        "minimatch": "^3.0.4"
      }
    },
    "node_modules/@actions/http-client": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
-      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.0.tgz",
+      "integrity": "sha512-QuwPsgVMsD6qaPD57GLZi9sqzAZCtiJT8kVBCDpLtxhL5MydQ4gS+DrejtZZPdIYyB1e95uCK9Luyds7ybHI3g==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.25.4"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/io": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
-      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
+      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
      "license": "MIT"
    },
    "node_modules/@azure/abort-controller": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-1.1.0.tgz",
-      "integrity": "sha512-TrRLIoSQVzfAJX9H1JeFjzAoDGcoK1IYX1UImfceTZpsyYfWr09Ss1aHW1y5TrrR3iq6RZLBwJ3E24uwPhwahw==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
      "license": "MIT",
      "dependencies": {
-        "tslib": "^2.2.0"
+        "tslib": "^2.6.2"
      },
      "engines": {
-        "node": ">=12.0.0"
+        "node": ">=18.0.0"
      }
    },
    "node_modules/@azure/core-auth": {
@@ -98,18 +97,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/core-auth/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/core-client": {
      "version": "1.10.1",
      "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.10.1.tgz",
@@ -128,18 +115,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/core-client/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/core-http-compat": {
      "version": "2.3.1",
      "resolved": "https://registry.npmjs.org/@azure/core-http-compat/-/core-http-compat-2.3.1.tgz",
@@ -154,18 +129,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/core-http-compat/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/core-lro": {
      "version": "2.7.2",
      "resolved": "https://registry.npmjs.org/@azure/core-lro/-/core-lro-2.7.2.tgz",
@@ -181,18 +144,6 @@
        "node": ">=18.0.0"
      }
    },
-    "node_modules/@azure/core-lro/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/core-paging": {
      "version": "1.6.2",
      "resolved": "https://registry.npmjs.org/@azure/core-paging/-/core-paging-1.6.2.tgz",
@@ -223,18 +174,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/core-rest-pipeline/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/core-tracing": {
      "version": "1.3.1",
      "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.3.1.tgz",
@@ -261,18 +200,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/core-util/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/core-xml": {
      "version": "1.5.0",
      "resolved": "https://registry.npmjs.org/@azure/core-xml/-/core-xml-1.5.0.tgz",
@@ -300,9 +227,9 @@
      }
    },
    "node_modules/@azure/storage-blob": {
-      "version": "12.29.1",
-      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.29.1.tgz",
-      "integrity": "sha512-7ktyY0rfTM0vo7HvtK6E3UvYnI9qfd6Oz6z/+92VhGRveWng3kJwMKeUpqmW/NmwcDNbxHpSlldG+vsUnRFnBg==",
+      "version": "12.30.0",
+      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.30.0.tgz",
+      "integrity": "sha512-peDCR8blSqhsAKDbpSP/o55S4sheNwSrblvCaHUZ5xUI73XA7ieUGGwrONgD/Fng0EoDe1VOa3fAQ7+WGB3Ocg==",
      "license": "MIT",
      "dependencies": {
        "@azure/abort-controller": "^2.1.2",
@@ -316,7 +243,7 @@
        "@azure/core-util": "^1.11.0",
        "@azure/core-xml": "^1.4.5",
        "@azure/logger": "^1.1.4",
-        "@azure/storage-common": "^12.1.1",
+        "@azure/storage-common": "^12.2.0",
        "events": "^3.0.0",
        "tslib": "^2.8.1"
      },
@@ -324,22 +251,10 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/storage-blob/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/storage-common": {
-      "version": "12.1.1",
-      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.1.1.tgz",
-      "integrity": "sha512-eIOH1pqFwI6UmVNnDQvmFeSg0XppuzDLFeUNO/Xht7ODAzRLgGDh7h550pSxoA+lPDxBl1+D2m/KG3jWzCUjTg==",
+      "version": "12.2.0",
+      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.2.0.tgz",
+      "integrity": "sha512-YZLxiJ3vBAAnFbG3TFuAMUlxZRexjQX5JDQxOkFGb6e2TpoxH3xyHI6idsMe/QrWtj41U/KoqBxlayzhS+LlwA==",
      "license": "MIT",
      "dependencies": {
        "@azure/abort-controller": "^2.1.2",
@@ -356,18 +271,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/storage-common/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@bufbuild/protobuf": {
      "version": "2.10.1",
      "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.10.1.tgz",
@@ -401,15 +304,6 @@
        "node": ">=14.17"
      }
    },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
    "node_modules/@protobuf-ts/plugin": {
      "version": "2.11.1",
      "resolved": "https://registry.npmjs.org/@protobuf-ts/plugin/-/plugin-2.11.1.tgz",
@@ -469,9 +363,9 @@
      }
    },
    "node_modules/@types/node": {
-      "version": "24.10.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.2.tgz",
-      "integrity": "sha512-WOhQTZ4G8xZ1tjJTvKOpyEVSGgOTvJAfDK3FNFgELyaTpzhdgHVHeqW8V+UJvzF5BT+/B54T/1S2K6gd9c7bbA==",
+      "version": "25.1.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.1.0.tgz",
+      "integrity": "sha512-t7frlewr6+cbx+9Ohpl0NOTKXZNV9xHRmNOvql47BFJKcEG1CxtxlPEEe+gR9uhVWM4DwhnvTF110mIL4yP9RA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -479,9 +373,9 @@
      }
    },
    "node_modules/@types/semver": {
-      "version": "6.2.7",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-6.2.7.tgz",
-      "integrity": "sha512-blctEWbzUFzQx799RZjzzIdBJOXmE37YYEyDtKkx5Dg+V7o/zyyAxLPiI98A2jdTtDgxZleMdfV+7p8WbRJ1OQ==",
+      "version": "7.7.1",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.1.tgz",
+      "integrity": "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==",
      "dev": true,
      "license": "MIT"
    },
@@ -632,12 +526,15 @@
      "license": "MIT"
    },
    "node_modules/semver": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "version": "7.7.3",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
+      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
      "license": "ISC",
      "bin": {
        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
      }
    },
    "node_modules/strnum": {
@@ -673,7 +570,6 @@
      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "dev": true,
      "license": "Apache-2.0",
-      "peer": true,
      "bin": {
        "tsc": "bin/tsc",
        "tsserver": "bin/tsserver"
@@ -683,15 +579,12 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
      "engines": {
-        "node": ">=14.0"
+        "node": ">=18.17"
      }
    },
    "node_modules/undici-types": {
@@ -1,7 +1,6 @@
 {
  "name": "@actions/cache",
-  "version": "5.0.0",
-  "preview": true,
+  "version": "6.0.0",
  "description": "Actions cache lib",
  "keywords": [
    "github",
@@ -10,8 +9,15 @@
  ],
  "homepage": "https://github.com/actions/toolkit/tree/main/packages/cache",
  "license": "MIT",
+  "type": "module",
  "main": "lib/cache.js",
  "types": "lib/cache.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/cache.d.ts",
+      "import": "./lib/cache.js"
+    }
+  },
  "directories": {
    "lib": "lib",
    "test": "__tests__"
@@ -31,31 +37,30 @@
  "scripts": {
    "audit-moderate": "npm install && npm audit --json --audit-level=moderate > audit.json",
    "test": "echo \"Error: run tests from root\" && exit 1",
-    "tsc": "tsc"
+    "tsc": "tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/"
  },
  "bugs": {
    "url": "https://github.com/actions/toolkit/issues"
  },
  "dependencies": {
-    "@actions/core": "^1.11.1",
-    "@actions/exec": "^1.0.1",
-    "@actions/glob": "^0.1.0",
-    "@protobuf-ts/runtime-rpc": "^2.11.1",
-    "@actions/http-client": "^2.1.1",
-    "@actions/io": "^1.0.1",
-    "@azure/abort-controller": "^1.1.0",
+    "@actions/core": "^3.0.0",
+    "@actions/exec": "^3.0.0",
+    "@actions/glob": "^0.6.1",
+    "@actions/http-client": "^4.0.0",
+    "@actions/io": "^3.0.0",
    "@azure/core-rest-pipeline": "^1.22.0",
-    "@azure/storage-blob": "^12.13.0",
-    "semver": "^6.3.1"
+    "@azure/storage-blob": "^12.30.0",
+    "@protobuf-ts/runtime-rpc": "^2.11.1",
+    "semver": "^7.7.3"
  },
  "devDependencies": {
-    "@types/node": "^24.1.0",
-    "@types/semver": "^6.0.0",
    "@protobuf-ts/plugin": "^2.9.4",
+    "@types/node": "^25.1.0",
+    "@types/semver": "^7.7.1",
    "typescript": "^5.2.2"
  },
  "overrides": {
    "uri-js": "npm:uri-js-replace@^1.0.1",
    "node-fetch": "^3.3.2"
  }
-}
+}
@@ -1,18 +1,20 @@
 import * as core from '@actions/core'
 import * as path from 'path'
-import * as utils from './internal/cacheUtils'
-import * as cacheHttpClient from './internal/cacheHttpClient'
-import * as cacheTwirpClient from './internal/shared/cacheTwirpClient'
-import {getCacheServiceVersion, isGhes} from './internal/config'
-import {DownloadOptions, UploadOptions} from './options'
-import {createTar, extractTar, listTar} from './internal/tar'
+import * as utils from './internal/cacheUtils.js'
+import * as cacheHttpClient from './internal/cacheHttpClient.js'
+import * as cacheTwirpClient from './internal/shared/cacheTwirpClient.js'
+import {getCacheServiceVersion, isGhes} from './internal/config.js'
+import {DownloadOptions, UploadOptions} from './options.js'
+import {createTar, extractTar, listTar} from './internal/tar.js'
 import {
  CreateCacheEntryRequest,
  FinalizeCacheEntryUploadRequest,
  FinalizeCacheEntryUploadResponse,
  GetCacheEntryDownloadURLRequest
-} from './generated/results/api/v1/cache'
+} from './generated/results/api/v1/cache.js'
 import {HttpClientError} from '@actions/http-client'
+
+export type {DownloadOptions, UploadOptions}
 export class ValidationError extends Error {
  constructor(message: string) {
    super(message)
@@ -12,7 +12,7 @@ import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
-import { CacheMetadata } from "../../entities/v1/cachemetadata";
+import { CacheMetadata } from "../../entities/v1/cachemetadata.js";
 /**
 * @generated from protobuf message github.actions.results.api.v1.CreateCacheEntryRequest
 */
@@ -5,7 +5,7 @@ import {
    FinalizeCacheEntryUploadResponse,
    GetCacheEntryDownloadURLRequest,
    GetCacheEntryDownloadURLResponse,
-  } from "./cache";
+  } from "./cache.js";
  
  //==================================//
  //          Client Code             //
@@ -11,7 +11,7 @@ import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
-import { CacheScope } from "./cachescope";
+import { CacheScope } from "./cachescope.js";
 /**
 * @generated from protobuf message github.actions.results.entities.v1.CacheMetadata
 */
@@ -7,8 +7,8 @@ import {
 } from '@actions/http-client/lib/interfaces'
 import * as fs from 'fs'
 import {URL} from 'url'
-import * as utils from './cacheUtils'
-import {uploadCacheArchiveSDK} from './uploadUtils'
+import * as utils from './cacheUtils.js'
+import {uploadCacheArchiveSDK} from './uploadUtils.js'
 import {
  ArtifactCacheEntry,
  InternalCacheOptions,
@@ -17,25 +17,25 @@ import {
  ReserveCacheResponse,
  ITypedResponseWithError,
  ArtifactCacheList
-} from './contracts'
+} from './contracts.js'
 import {
  downloadCacheHttpClient,
  downloadCacheHttpClientConcurrent,
  downloadCacheStorageSDK
-} from './downloadUtils'
+} from './downloadUtils.js'
 import {
  DownloadOptions,
  UploadOptions,
  getDownloadOptions,
  getUploadOptions
-} from '../options'
+} from '../options.js'
 import {
  isSuccessStatusCode,
  retryHttpClientResponse,
  retryTypedResponse
-} from './requestUtils'
-import {getCacheServiceURL} from './config'
-import {getUserAgentString} from './shared/user-agent'
+} from './requestUtils.js'
+import {getCacheServiceURL} from './config.js'
+import {getUserAgentString} from './shared/user-agent.js'

 function getCacheApiUrl(resource: string): string {
  const baseUrl: string = getCacheServiceURL()
@@ -11,7 +11,7 @@ import {
  CacheFilename,
  CompressionMethod,
  GnuTarPathOnWindows
-} from './constants'
+} from './constants.js'

 const versionSalt = '1.0'

@@ -1,4 +1,4 @@
-import {CompressionMethod} from './constants'
+import {CompressionMethod} from './constants.js'
 import {TypedResponse} from '@actions/http-client/lib/interfaces'
 import {HttpClientError} from '@actions/http-client'

@@ -7,12 +7,10 @@ import * as fs from 'fs'
 import * as stream from 'stream'
 import * as util from 'util'

-import * as utils from './cacheUtils'
-import {SocketTimeout} from './constants'
-import {DownloadOptions} from '../options'
-import {retryHttpClientResponse} from './requestUtils'
-
-import {AbortController} from '@azure/abort-controller'
+import * as utils from './cacheUtils.js'
+import {SocketTimeout} from './constants.js'
+import {DownloadOptions} from '../options.js'
+import {retryHttpClientResponse} from './requestUtils.js'

 /**
 * Pipes the body of a HTTP response to a stream
@@ -4,8 +4,8 @@ import {
  HttpClientError,
  HttpClientResponse
 } from '@actions/http-client'
-import {DefaultRetryDelay, DefaultRetryAttempts} from './constants'
-import {ITypedResponseWithError} from './contracts'
+import {DefaultRetryDelay, DefaultRetryAttempts} from './constants.js'
+import {ITypedResponseWithError} from './contracts.js'

 export function isSuccessStatusCode(statusCode?: number): boolean {
  if (!statusCode) {
@@ -1,12 +1,12 @@
-import {info, debug} from '@actions/core'
-import {getUserAgentString} from './user-agent'
-import {NetworkError, UsageError} from './errors'
-import {getCacheServiceURL} from '../config'
-import {getRuntimeToken} from '../cacheUtils'
+import {info, debug, warning} from '@actions/core'
+import {getUserAgentString} from './user-agent.js'
+import {NetworkError, RateLimitError, UsageError} from './errors.js'
+import {getCacheServiceURL} from '../config.js'
+import {getRuntimeToken} from '../cacheUtils.js'
 import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
 import {HttpClient, HttpClientResponse, HttpCodes} from '@actions/http-client'
-import {CacheServiceClientJSON} from '../../generated/results/api/v1/cache.twirp-client'
-import {maskSecretUrls} from './util'
+import {CacheServiceClientJSON} from '../../generated/results/api/v1/cache.twirp-client.js'
+import {maskSecretUrls} from './util.js'

 // The twirp http client must implement this interface
 interface Rpc {
@@ -109,6 +109,21 @@ class CacheServiceClient implements Rpc {

          errorMessage = `${errorMessage}: ${body.msg}`
        }
+
+        // Handle rate limiting - don't retry, just warn and exit
+        // For more info, see https://docs.github.com/en/actions/reference/limits
+        if (statusCode === HttpCodes.TooManyRequests) {
+          const retryAfterHeader = response.message.headers['retry-after']
+          if (retryAfterHeader) {
+            const parsedSeconds = parseInt(retryAfterHeader, 10)
+            if (!isNaN(parsedSeconds) && parsedSeconds > 0) {
+              warning(
+                `You've hit a rate limit, your rate limit will reset in ${parsedSeconds} seconds`
+              )
+            }
+          }
+          throw new RateLimitError(`Rate limited: ${errorMessage}`)
+        }
      } catch (error) {
        if (error instanceof SyntaxError) {
          debug(`Raw Body: ${rawBody}`)
@@ -118,6 +133,10 @@ class CacheServiceClient implements Rpc {
          throw error
        }

+        if (error instanceof RateLimitError) {
+          throw error
+        }
+
        if (NetworkError.isNetworkErrorCode(error?.code)) {
          throw new NetworkError(error?.code)
        }
@@ -162,8 +181,7 @@ class CacheServiceClient implements Rpc {
      HttpCodes.BadGateway,
      HttpCodes.GatewayTimeout,
      HttpCodes.InternalServerError,
-      HttpCodes.ServiceUnavailable,
-      HttpCodes.TooManyRequests
+      HttpCodes.ServiceUnavailable
    ]

    return retryableStatusCodes.includes(statusCode)
@@ -70,3 +70,10 @@ export class UsageError extends Error {
    return msg.includes('insufficient usage')
  }
 }
+
+export class RateLimitError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'RateLimitError'
+  }
+}
@@ -0,0 +1,7 @@
+// This file exists as a CommonJS module to read the version from package.json.
+// In an ESM package, using `require()` directly in .ts files requires disabling
+// ESLint rules and doesn't work reliably across all Node.js versions.
+// By keeping this as a .cjs file, we can use require() naturally and export
+// the version for the ESM modules to import.
+const packageJson = require('../../../package.json')
+module.exports = { version: packageJson.version }
@@ -1,9 +1,8 @@
-// eslint-disable-next-line @typescript-eslint/no-var-requires, @typescript-eslint/no-require-imports
-const packageJson = require('../../../package.json')
+import {version} from './package-version.cjs'

 /**
 * Ensure that this User Agent String is used in all HTTP calls so that we can monitor telemetry between different versions of this package
 */
 export function getUserAgentString(): string {
-  return `@actions/cache-${packageJson.version}`
+  return `@actions/cache-${version}`
 }
@@ -2,15 +2,15 @@ import {exec} from '@actions/exec'
 import * as io from '@actions/io'
 import {existsSync, writeFileSync} from 'fs'
 import * as path from 'path'
-import * as utils from './cacheUtils'
-import {ArchiveTool} from './contracts'
+import * as utils from './cacheUtils.js'
+import {ArchiveTool} from './contracts.js'
 import {
  CompressionMethod,
  SystemTarPathOnWindows,
  ArchiveToolType,
  TarFilename,
  ManifestFilename
-} from './constants'
+} from './constants.js'

 const IS_WINDOWS = process.platform === 'win32'

@@ -6,8 +6,8 @@ import {
  BlockBlobParallelUploadOptions
 } from '@azure/storage-blob'
 import {TransferProgressEvent} from '@azure/core-rest-pipeline'
-import {InvalidResponseError} from './shared/errors'
-import {UploadOptions} from '../options'
+import {InvalidResponseError} from './shared/errors.js'
+import {UploadOptions} from '../options.js'

 /**
 * Class for tracking the upload state and displaying stats.
@@ -4,6 +4,8 @@
    "baseUrl": "./",
    "outDir": "./lib",
    "rootDir": "./src",
+    "module": "node16",
+    "moduleResolution": "node16",
    "lib": [
      "es6",
      "dom"
@@ -1,70 +1,99 @@
 # @actions/core Releases

+## 3.0.0
+
+- **Breaking change**: Package is now ESM-only
+  - CommonJS consumers must use dynamic `import()` instead of `require()`
+
+## 2.0.3
+
+- Bump `@actions/http-client` to `3.0.2`
+
 ## 2.0.1
+
 - Bump @actions/exec from 1.1.1 to 2.0.0 [#2199](https://github.com/actions/toolkit/pull/2199)

 ## 2.0.0
+
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Bump @actions/http-client from 2.0.1 to 3.0.0

 ## 1.11.1
+
 - Fix uses of `crypto.randomUUID` on Node 18 and earlier [#1842](https://github.com/actions/toolkit/pull/1842)

 ### 1.11.0
+
 - Add platform info utilities [#1551](https://github.com/actions/toolkit/pull/1551)
 - Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824)

 ### 1.10.1
+
 - Fix error message reference in oidc utils [#1511](https://github.com/actions/toolkit/pull/1511)

 ### 1.10.0
+
 - `saveState` and `setOutput` now use environment files if available [#1178](https://github.com/actions/toolkit/pull/1178)
 - `getMultilineInput` now correctly trims whitespace by default [#1185](https://github.com/actions/toolkit/pull/1185)

 ### 1.9.1
+
 - Randomize delimiter when calling `core.exportVariable`

 ### 1.9.0
+
 - Added `toPosixPath`, `toWin32Path` and `toPlatformPath` utilities [#1102](https://github.com/actions/toolkit/pull/1102)

 ### 1.8.2
+
 - Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)

 ### 1.8.1
+
 - Update to v2.0.0 of `@actions/http-client`

 ### 1.8.0
+
 - Deprecate `markdownSummary` extension export in favor of `summary`
-  - https://github.com/actions/toolkit/pull/1072
-  - https://github.com/actions/toolkit/pull/1073
+  - <https://github.com/actions/toolkit/pull/1072>
+  - <https://github.com/actions/toolkit/pull/1073>

 ### 1.7.0
+
 - [Added `markdownSummary` extension](https://github.com/actions/toolkit/pull/1014)

 ### 1.6.0
+
 - [Added OIDC Client function `getIDToken`](https://github.com/actions/toolkit/pull/919)
- [Added `file` parameter to `AnnotationProperties`](https://github.com/actions/toolkit/pull/896) 
+- [Added `file` parameter to `AnnotationProperties`](https://github.com/actions/toolkit/pull/896)

 ### 1.5.0
+
 - [Added support for notice annotations and more annotation fields](https://github.com/actions/toolkit/pull/855)

 ### 1.4.0
+
 - [Added the `getMultilineInput` function](https://github.com/actions/toolkit/pull/829)

 ### 1.3.0
+
 - [Added the trimWhitespace option to getInput](https://github.com/actions/toolkit/pull/802)
 - [Added the getBooleanInput function](https://github.com/actions/toolkit/pull/725)

 ### 1.2.7
+
 - [Prepend newline for set-output](https://github.com/actions/toolkit/pull/772)

 ### 1.2.6
+
 - [Update `exportVariable` and `addPath` to use environment files](https://github.com/actions/toolkit/pull/571)

 ### 1.2.5
+
 - [Correctly bundle License File with package](https://github.com/actions/toolkit/pull/548)

 ### 1.2.4
+
 - [Be more lenient in accepting non-string command inputs](https://github.com/actions/toolkit/pull/405)
 - [Add Echo commands](https://github.com/actions/toolkit/pull/411)

@@ -85,7 +114,7 @@

 - saveState and getState functions for wrapper tasks (on finally entry points that run post job)

-### 1.1.3 
+### 1.1.3

 - setSecret added to register a secret with the runner to be masked from the logs
 - exportSecret which was not implemented and never worked was removed after clarification from product.
@@ -1,4 +1,4 @@
-import * as command from '../src/command'
+import * as command from '../src/command.js'
 import * as os from 'os'

 /* eslint-disable @typescript-eslint/unbound-method */
@@ -1,9 +1,9 @@
 import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
-import * as core from '../src/core'
+import * as core from '../src/core.js'
 import {HttpClient} from '@actions/http-client'
-import {toCommandProperties} from '../src/utils'
+import {toCommandProperties} from '../src/utils.js'

 /* eslint-disable @typescript-eslint/unbound-method */

@@ -1,6 +1,6 @@
 import * as path from 'path'

-import {toPlatformPath, toPosixPath, toWin32Path} from '../src/path-utils'
+import {toPlatformPath, toPosixPath, toWin32Path} from '../src/path-utils.js'

 describe('#toPosixPath', () => {
  const cases: {
@@ -1,5 +1,5 @@
 import os from 'os'
-import {platform} from '../src/core'
+import {platform} from '../src/core.js'

 describe('getInfo', () => {
  it('returns the platform info', async () => {
@@ -1,7 +1,7 @@
 import * as fs from 'fs'
 import * as os from 'os'
 import path from 'path'
-import {summary, SUMMARY_ENV_VAR} from '../src/summary'
+import {summary, SUMMARY_ENV_VAR} from '../src/summary.js'

 const testDirectoryPath = path.join(__dirname, 'test')
 const testFilePath = path.join(testDirectoryPath, 'test-summary.md')
@@ -1,61 +1,55 @@
 {
  "name": "@actions/core",
-  "version": "2.0.1",
+  "version": "3.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/core",
-      "version": "2.0.1",
+      "version": "3.0.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/exec": "^2.0.0",
-        "@actions/http-client": "^3.0.0"
+        "@actions/exec": "^3.0.0",
+        "@actions/http-client": "^4.0.0"
      },
      "devDependencies": {
-        "@types/node": "^16.18.112"
+        "@types/node": "^25.1.0"
      }
    },
    "node_modules/@actions/exec": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz",
-      "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-3.0.0.tgz",
+      "integrity": "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==",
      "license": "MIT",
      "dependencies": {
-        "@actions/io": "^2.0.0"
+        "@actions/io": "^3.0.2"
      }
    },
    "node_modules/@actions/http-client": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.0.tgz",
-      "integrity": "sha512-1s3tXAfVMSz9a4ZEBkXXRQD4QhY3+GAsWSbaYpeknPOKEeyRiU3lH+bHiLMZdo2x/fIeQ/hscL1wCkDLVM2DZQ==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.0.tgz",
+      "integrity": "sha512-QuwPsgVMsD6qaPD57GLZi9sqzAZCtiJT8kVBCDpLtxhL5MydQ4gS+DrejtZZPdIYyB1e95uCK9Luyds7ybHI3g==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/io": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
-      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
+      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
      "license": "MIT"
    },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
    "node_modules/@types/node": {
-      "version": "16.18.126",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.126.tgz",
-      "integrity": "sha512-OTcgaiwfGFBKacvfwuHzzn1KLxH/er8mluiy8/uM3sGXHaRe73RrSIj01jow9t4kJEW633Ov+cOexXeiApTyAw==",
+      "version": "25.1.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.1.0.tgz",
+      "integrity": "sha512-t7frlewr6+cbx+9Ohpl0NOTKXZNV9xHRmNOvql47BFJKcEG1CxtxlPEEe+gR9uhVWM4DwhnvTF110mIL4yP9RA==",
      "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~7.16.0"
+      }
    },
    "node_modules/tunnel": {
      "version": "0.0.6",
@@ -67,16 +61,20 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
      "engines": {
-        "node": ">=14.0"
+        "node": ">=18.17"
      }
+    },
+    "node_modules/undici-types": {
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
+      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
+      "dev": true,
+      "license": "MIT"
    }
  }
 }
@@ -1,6 +1,6 @@
 {
  "name": "@actions/core",
-  "version": "2.0.1",
+  "version": "3.0.0",
  "description": "Actions core lib",
  "keywords": [
    "github",
@@ -9,8 +9,15 @@
  ],
  "homepage": "https://github.com/actions/toolkit/tree/main/packages/core",
  "license": "MIT",
+  "type": "module",
  "main": "lib/core.js",
  "types": "lib/core.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/core.d.ts",
+      "import": "./lib/core.js"
+    }
+  },
  "directories": {
    "lib": "lib",
    "test": "__tests__"
@@ -36,10 +43,10 @@
    "url": "https://github.com/actions/toolkit/issues"
  },
  "dependencies": {
-    "@actions/exec": "^2.0.0",
-    "@actions/http-client": "^3.0.0"
+    "@actions/exec": "^3.0.0",
+    "@actions/http-client": "^4.0.0"
  },
  "devDependencies": {
-    "@types/node": "^16.18.112"
+    "@types/node": "^25.1.0"
  }
 }
@@ -1,5 +1,5 @@
 import * as os from 'os'
-import {toCommandValue} from './utils'
+import {toCommandValue} from './utils.js'

 // For internal use, subject to change.

@@ -1,11 +1,11 @@
-import {issue, issueCommand} from './command'
-import {issueFileCommand, prepareKeyValueMessage} from './file-command'
-import {toCommandProperties, toCommandValue} from './utils'
+import {issue, issueCommand} from './command.js'
+import {issueFileCommand, prepareKeyValueMessage} from './file-command.js'
+import {toCommandProperties, toCommandValue} from './utils.js'

 import * as os from 'os'
 import * as path from 'path'

-import {OidcClient} from './oidc-utils'
+import {OidcClient} from './oidc-utils.js'

 /**
 * Interface for getInput options
@@ -400,19 +400,19 @@ export async function getIDToken(aud?: string): Promise<string> {
 /**
 * Summary exports
 */
-export {summary} from './summary'
+export {summary} from './summary.js'

 /**
 * @deprecated use core.summary
 */
-export {markdownSummary} from './summary'
+export {markdownSummary} from './summary.js'

 /**
 * Path exports
 */
-export {toPosixPath, toWin32Path, toPlatformPath} from './path-utils'
+export {toPosixPath, toWin32Path, toPlatformPath} from './path-utils.js'

 /**
 * Platform utilities exports
 */
-export * as platform from './platform'
+export * as platform from './platform.js'
@@ -6,7 +6,7 @@
 import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as os from 'os'
-import {toCommandValue} from './utils'
+import {toCommandValue} from './utils.js'

 export function issueFileCommand(command: string, message: any): void {
  const filePath = process.env[`GITHUB_${command}`]
@@ -3,7 +3,7 @@ import * as actions_http_client from '@actions/http-client'
 import {RequestOptions} from '@actions/http-client/lib/interfaces'
 import {HttpClient} from '@actions/http-client'
 import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
-import {debug, setSecret} from './core'
+import {debug, setSecret} from './core.js'
 interface TokenResponse {
  value?: string
 }
@@ -1,8 +1,8 @@
 // We use any as a valid input type
 /* eslint-disable @typescript-eslint/no-explicit-any */

-import {AnnotationProperties} from './core'
-import {CommandProperties} from './command'
+import {AnnotationProperties} from './core.js'
+import {CommandProperties} from './command.js'

 /**
 * Sanitizes an input into a string so it can be passed into issueCommand safely
@@ -4,7 +4,9 @@
    "baseUrl": "./",
    "outDir": "./lib",
    "declaration": true,
-    "rootDir": "./src"
+    "rootDir": "./src",
+    "module": "node16",
+    "moduleResolution": "node16"
  },
  "include": [
    "./src"
@@ -1,13 +1,20 @@
 # @actions/exec Releases

-### 2.0.0
+## 3.0.0
+
+- **Breaking change**: Package is now ESM-only
+  - CommonJS consumers must use dynamic `import()` instead of `require()`
+
+## 2.0.0
+
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Bump @actions/io dependency from ^1.0.1 to ^2.0.0

-### 1.1.1
- Update `lockfileVersion` to `v2` in `package-lock.json [#1024](https://github.com/actions/toolkit/pull/1024) 
+## 1.1.1

-### 1.1.0
+- Update `lockfileVersion` to `v2` in `package-lock.json` [#1024](https://github.com/actions/toolkit/pull/1024)
+
+## 1.1.0

 - [Fix stdline dropping large output](https://github.com/actions/toolkit/pull/773)
 - [Add getExecOutput function](https://github.com/actions/toolkit/pull/814)
@@ -23,4 +30,4 @@

 ### 1.0.0

- Initial release
+- Initial release
@@ -1,5 +1,5 @@
-import * as exec from '../src/exec'
-import * as im from '../src/interfaces'
+import * as exec from '../src/exec.js'
+import * as im from '../src/interfaces.js'

 import * as childProcess from 'child_process'
 import * as fs from 'fs'
@@ -14,7 +14,7 @@ const IS_WINDOWS = process.platform === 'win32'
 const SPAWN_WAIT_SCRIPT = path.join(
  __dirname,
  'scripts',
-  'spawn-wait-for-file.js'
+  'spawn-wait-for-file.cjs'
 )

 let outstream: stream.Writable
@@ -196,7 +196,7 @@ describe('@actions/exec', () => {
    const scriptPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const nodePath: string = await io.which('node', true)

@@ -218,7 +218,7 @@ describe('@actions/exec', () => {
    const scriptPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const nodePath: string = await io.which('node', true)

@@ -255,12 +255,12 @@ describe('@actions/exec', () => {
    const stdErrPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const stdOutPath: string = path.join(
      __dirname,
      'scripts',
-      'stdoutoutput.js'
+      'stdoutoutput.cjs'
    )
    const nodePath: string = await io.which('node', true)
    let stdoutCalled = false
@@ -295,7 +295,7 @@ describe('@actions/exec', () => {
    const stdlinePath: string = path.join(
      __dirname,
      'scripts',
-      'stdlineoutput.js'
+      'stdlineoutput.cjs'
    )
    const nodePath: string = await io.which('node', true)

@@ -344,7 +344,7 @@ describe('@actions/exec', () => {
    const waitForInput: string = path.join(
      __dirname,
      'scripts',
-      'wait-for-input.js'
+      'wait-for-input.cjs'
    )

    const _testExecOptions = getExecOptions()
@@ -622,12 +622,12 @@ describe('@actions/exec', () => {
    const stdErrPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const stdOutPath: string = path.join(
      __dirname,
      'scripts',
-      'stdoutoutput.js'
+      'stdoutoutput.cjs'
    )
    const nodePath: string = await io.which('node', true)

@@ -653,12 +653,12 @@ describe('@actions/exec', () => {
    const stdErrPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const stdOutPath: string = path.join(
      __dirname,
      'scripts',
-      'stdoutoutput.js'
+      'stdoutoutput.cjs'
    )

    const nodePath: string = await io.which('node', true)
@@ -703,12 +703,12 @@ describe('@actions/exec', () => {
    const stdErrPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const stdOutPath: string = path.join(
      __dirname,
      'scripts',
-      'stdoutoutputlarge.js'
+      'stdoutoutputlarge.cjs'
    )

    const nodePath: string = await io.which('node', true)
@@ -753,7 +753,7 @@ describe('@actions/exec', () => {
    const stdOutPath: string = path.join(
      __dirname,
      'scripts',
-      'stdoutputspecial.js'
+      'stdoutputspecial.cjs'
    )

    const nodePath: string = await io.which('node', true)
@@ -15,10 +15,10 @@ if (!filePath) {
  throw new Error('file is not specified')
 }

-// Spawn wait-for-file.js with inherited stdio
+// Spawn wait-for-file.cjs with inherited stdio
 // This creates a grandchild process that holds the stdio handles open
 // after this process (the child) exits
-const waitScript = path.join(__dirname, 'wait-for-file.js')
+const waitScript = path.join(__dirname, 'wait-for-file.cjs')
 const isWindows = process.platform === 'win32'

 // On Windows, use detached:true to properly keep streams open
@@ -1,21 +1,21 @@
 {
  "name": "@actions/exec",
-  "version": "2.0.0",
+  "version": "3.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/exec",
-      "version": "2.0.0",
+      "version": "3.0.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/io": "^2.0.0"
+        "@actions/io": "^3.0.2"
      }
    },
    "node_modules/@actions/io": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
-      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
+      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
      "license": "MIT"
    }
  }
@@ -1,6 +1,6 @@
 {
  "name": "@actions/exec",
-  "version": "2.0.0",
+  "version": "3.0.0",
  "description": "Actions exec lib",
  "keywords": [
    "github",
@@ -9,8 +9,15 @@
  ],
  "homepage": "https://github.com/actions/toolkit/tree/main/packages/exec",
  "license": "MIT",
+  "type": "module",
  "main": "lib/exec.js",
  "types": "lib/exec.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/exec.d.ts",
+      "import": "./lib/exec.js"
+    }
+  },
  "directories": {
    "lib": "lib",
    "test": "__tests__"
@@ -36,6 +43,6 @@
    "url": "https://github.com/actions/toolkit/issues"
  },
  "dependencies": {
-    "@actions/io": "^2.0.0"
+    "@actions/io": "^3.0.2"
  }
 }
@@ -1,6 +1,6 @@
 import {StringDecoder} from 'string_decoder'
-import {ExecOptions, ExecOutput, ExecListeners} from './interfaces'
-import * as tr from './toolrunner'
+import {ExecOptions, ExecOutput, ExecListeners} from './interfaces.js'
+import * as tr from './toolrunner.js'

 export {ExecOptions, ExecOutput, ExecListeners}

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Daniel Kennedy	cf5677ba88	style: fix prettier formatting in list-artifacts test	2026-01-30 09:14:25 -05:00
Daniel Kennedy	830c827471	chore(deps): upgrade root dev dependencies - concurrently: 6.x → 9.x - eslint-plugin-prettier: 5.0.0 → 5.5.x - prettier: 3.0.0 → 3.8.x - ts-jest: 29.1.1 → 29.4.x - typescript: 5.2.2 → 5.9.x	2026-01-30 09:14:15 -05:00
Tingting Wang	ffae274475	Merge pull request #2268 from actions/dependabot/npm_and_yarn/packages/attest/tar-7.5.7 chore(deps): bump tar from 7.5.6 to 7.5.7 in /packages/attest	2026-01-29 13:01:33 -08:00
dependabot[bot]	1c20378379	chore(deps): bump tar from 7.5.6 to 7.5.7 in /packages/attest Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.6 to 7.5.7. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](https://github.com/isaacs/node-tar/compare/v7.5.6...v7.5.7) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-29 20:20:49 +00:00
Daniel Kennedy	0be0a6ef89	`@actions/attest`: convert to an ESM module (#2278 )	2026-01-29 15:19:39 -05:00
Daniel Kennedy	ae29a2751b	`@actions/cache`: convert to an ESM module (#2275 ) * `@actions/cache`: convert to an ESM module * Update the fixture to ESM syntax * Update the cache workflows * Bump `@actions/glob` to `0.6.1` * Fix awaiting in the cache unit tests * Fix a type issues in contracts * Export the `DownloadOptions`/`UploadOptions` like before * More cache test fixes * Make the cache units tests better * Add some more logging * Add retries to restore-cache.mjs	2026-01-29 14:23:32 -05:00
Daniel Kennedy	b48854e1ac	`@actions/glob`: fix `minimatch` imports (#2276 )	2026-01-29 13:30:54 -05:00
Daniel Kennedy	9d912b1840	`@actions/tool-cache`: convert to an ESM module (#2274 ) * `@actions/tool-cache`: convert to an ESM module * Fix jest config * Downgrade `nock` since it's conflicting with `@actions/attest`'s version	2026-01-29 11:26:14 -05:00
Daniel Kennedy	7a0147b5c6	`@actions/glob`: convert to an ESM module (#2273 ) * `@actions/glob`: convert to an ESM module * Update packages/glob/RELEASES.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-01-29 10:41:33 -05:00
Daniel Kennedy	5793b08cd9	`@actions/artifact`: convert to an ESM module (#2266 ) * `@actions/artifact`: convert to an ESM module * Update the package-lock.json * Undo the GHES ignores * Fix the reference to `@actions/http-client` in the lock file * Bump `@actions/core` to `3.0.0` * Remove `jest.config.cjs` * Import `OctoKitOptions` from `@octokit/core/types` * Pull the package version from `package.json` * Workaround getting the package version for the user-agent * Fix the `archiver` import * Fix linting	2026-01-29 09:52:09 -05:00
Daniel Kennedy	ed3ea3b5ba	`@actions/core`: convert to ESM module	2026-01-28 20:50:58 -05:00
Daniel Kennedy	c9c663babe	Bump `@actions/io` to `3.0.2`	2026-01-28 15:59:40 -05:00
Daniel Kennedy	0fc1805b46	`@actions/exec`: convert to ESM module	2026-01-28 15:59:40 -05:00
Daniel Kennedy	a6e9f4bab2	`@actions/io`: update lock file version	2026-01-28 14:36:03 -05:00
Daniel Kennedy	758b556388	`@actions/io`: export `lib/io-util`	2026-01-28 14:08:19 -05:00
Daniel Kennedy	9e060cb3e1	Add release notes	2026-01-28 13:33:17 -05:00
Daniel Kennedy	5501ba08b7	`@actions/io`: convert to ESM module	2026-01-28 13:33:17 -05:00
Daniel Kennedy	4446f00fc7	Add a release entry for `4.0.0`	2026-01-28 10:27:09 -05:00
Daniel Kennedy	965dcc7493	Fix a JSON lint issue	2026-01-28 10:27:09 -05:00
Daniel Kennedy	d464f9dd60	Add proxy/interfaces exports	2026-01-28 10:27:09 -05:00
Daniel Kennedy	c9ab4f9548	http-client: convert to ESM	2026-01-28 10:27:09 -05:00
Lokesh Gopu	a2986ee511	Merge pull request #2260 from actions/lokesh755-actions-github-v9-esm ESM-only with updated @octokit dependencies	2026-01-27 15:58:18 -05:00
Daniel Kennedy	e827417593	Bump `@actions/glob` to `0.5.1` in `@actions/cache`	2026-01-27 15:43:44 -05:00
Lokesh Gopu	b05d26b3fa	ESM-only with updated @octokit dependencies	2026-01-27 15:35:32 -05:00
Daniel Kennedy	ecdfc18bf2	Bump `@actions/glob` version to `0.5.1`	2026-01-27 14:55:56 -05:00
Daniel Kennedy	e8e0ce7ad8	Bump `@actions/core` to `2.0.3` on `@actions/glob`	2026-01-27 14:55:56 -05:00
Daniel Kennedy	dc6427f3c3	Attest: undo the `@actions/github`/`@octokit` bumps	2026-01-27 13:31:31 -05:00
Daniel Kennedy	76339b5f68	Bump `@actions/http-client` and `@actions/github` on all packages	2026-01-27 13:31:31 -05:00
Daniel Kennedy	c0ef67ec49	Release @actions/github `v8.0.1`	2026-01-27 10:29:06 -05:00
Daniel Kennedy	968fd7f8d3	Bump `undici` to `v6.23.0` and `@actions/http-client` to `v3.0.2` in `@actions/github`	2026-01-27 10:29:06 -05:00
Daniel Kennedy	9b27fa97f9	Release `@actions/http-client` version `3.0.2`	2026-01-27 09:53:50 -05:00
Daniel Kennedy	065cf9f0b1	Bump `undici` to `v6.23.0` in `@actions/http-client`	2026-01-27 09:38:40 -05:00
Lokesh Gopu	b77f226465	Merge pull request #2249 from actions/fix/upgrade-octokit-dependencies upgrade octokit dependencies	2026-01-22 14:46:12 -05:00
Lokesh Gopu	f61ae48376	upgrade octokit dependencies	2026-01-22 11:59:59 -05:00
Salman Chishti	4236fc3e78	Merge pull request #2246 from actions/dependabot/npm_and_yarn/packages/attest/tar-7.5.6 chore(deps): bump tar from 7.5.2 to 7.5.6 in /packages/attest	2026-01-22 15:53:06 +00:00
Salman Chishti	f366966232	Merge pull request #2248 from actions/dependabot/npm_and_yarn/lodash-4.17.23 chore(deps): bump lodash from 4.17.21 to 4.17.23	2026-01-22 14:48:46 +00:00
dependabot[bot]	bd561a6765	chore(deps): bump lodash from 4.17.21 to 4.17.23 Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-22 00:03:54 +00:00
dependabot[bot]	26490f0d3b	chore(deps): bump tar from 7.5.2 to 7.5.6 in /packages/attest Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.2 to 7.5.6. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](https://github.com/isaacs/node-tar/compare/v7.5.2...v7.5.6) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-21 21:04:00 +00:00
Ryan Ghadimi	ee91adfbc4	Merge pull request #2243 from GhadimiR/main Don't retry 429s returned from the cache service	2026-01-16 10:43:35 +00:00
Ryan Ghadimi	a039cff4a1	Add comment for rate limiting handling Added a comment regarding rate limiting and retry behavior.	2026-01-16 10:26:45 +00:00
Ryan Ghadimi	9dd77993e7	Update packages/cache/RELEASES.md Co-authored-by: Bassem Dghaidi <568794+Link-@users.noreply.github.com>	2026-01-16 10:25:44 +00:00
Ryan Ghadimi	dd1bb93c72	New error type for cache RL	2026-01-16 10:00:15 +00:00
Ryan Ghadimi	7292b3508f	update release doc	2026-01-16 09:51:21 +00:00
Ryan Ghadimi	4a47af6481	bump pkg	2026-01-16 09:46:28 +00:00
Ryan Ghadimi	a68693e20a	tests & releases	2026-01-16 09:44:57 +00:00
Ryan Ghadimi	acf4bd70fb	Add handling for 429s from cache service	2026-01-14 17:01:59 +00:00
Tingluo Huang	7ae5c2f423	Merge pull request #2237 from actions/users/tihuang/bump Bump version to 2.2.0 and update dependencies for @actions/core, @actions/github, and @actions/http-client	2026-01-08 11:41:34 -05:00
Tingluo Huang	d5470e6023	.	2026-01-08 16:19:53 +00:00
Tingluo Huang	e68ab4b91a	Bump version to 3.0.0 and update dependencies for @actions/core, @actions/github, and @actions/http-client	2026-01-08 14:34:05 +00:00
Tingluo Huang	d3a48dd52f	Merge pull request #2233 from actions/copilot/update-http-client-dependency Update selected packages to consume @actions/http-client@3.0.1	2026-01-08 09:04:43 -05:00
Tingluo Huang	c4d47c1922	Merge pull request #2236 from actions/users/tihuang/bump Bump dependency version for actions/github and actions/tool-cache.	2026-01-08 08:38:35 -05:00
Tingluo Huang	5fc5cdde44	Bump dependency version for actions/github and actions/tool-cache.	2026-01-08 04:58:48 +00:00
copilot-swe-agent[bot]	2a9d836b08	Revert @actions/attest http-client dependency to ^2.2.3 Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 23:17:02 +00:00
copilot-swe-agent[bot]	3a3b073ef2	Revert changes to github, tool-cache packages and .gitignore Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 22:38:20 +00:00
copilot-swe-agent[bot]	d3a0fb260e	Revert @actions/attest version to 2.1.0 - no new release needed Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 22:33:05 +00:00
copilot-swe-agent[bot]	be4fdc505f	Fix package-lock.json to mark typescript as dev dependency Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 22:10:30 +00:00
copilot-swe-agent[bot]	6be37922c5	Add .nx/ to .gitignore and remove cached build artifacts Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 22:04:45 +00:00
copilot-swe-agent[bot]	dfc20acda2	Verify changes with tests - all package-specific tests passing Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 22:03:56 +00:00
copilot-swe-agent[bot]	dc1fec82a6	Update all packages to use @actions/http-client@^3.0.1 and bump patch versions Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 21:55:41 +00:00
copilot-swe-agent[bot]	9339b3573b	Initial plan	2026-01-07 21:51:58 +00:00
Tingluo Huang	67a08de5c7	Merge pull request #2231 from actions/copilot/prepare-http-client-release Release @actions/http-client v3.0.1	2026-01-07 15:35:32 -05:00
copilot-swe-agent[bot]	d73fffceed	Combine duplicate RELEASES.md entries into single line Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 18:44:34 +00:00
copilot-swe-agent[bot]	16f0b3d28e	Revert .gitignore change as requested Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 18:40:39 +00:00
copilot-swe-agent[bot]	398e2cb68b	Change version from 3.1.0 to 3.0.1 as requested Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 18:31:01 +00:00
copilot-swe-agent[bot]	4b9031fa77	Bump http-client version to 3.1.0 and update RELEASES.md Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-07 18:13:07 +00:00
copilot-swe-agent[bot]	959cb66bd5	Initial plan	2026-01-07 18:02:29 +00:00
Tingluo Huang	3e0b611f99	Merge pull request #2229 from actions/copilot/extend-user-agent-http-requests Extend user-agent with orchestration ID and add default user-agent	2026-01-07 10:42:56 -05:00
copilot-swe-agent[bot]	83c13c81ba	Improve test cleanup and add missing test coverage Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 19:19:35 +00:00
copilot-swe-agent[bot]	bccbba401a	Fix lint error: remove unnecessary escape in regex Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 18:30:18 +00:00
copilot-swe-agent[bot]	3a191eecf6	Add default user-agent 'actions/http-client' when none provided Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 18:10:12 +00:00
copilot-swe-agent[bot]	97f5a6f0dc	Simplify constructor by handling undefined in helper method Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 18:03:26 +00:00
copilot-swe-agent[bot]	48a7cdbf9c	Remove .gitignore change for .nx/ directory Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 17:54:40 +00:00
copilot-swe-agent[bot]	3f1933edf9	Revert unrelated version bumps in package-lock.json files Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 17:50:28 +00:00
copilot-swe-agent[bot]	2215c8e5aa	Restrict sanitization to only allow 0-9, a-z, _, -, . Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 17:37:28 +00:00
copilot-swe-agent[bot]	af6de2cb95	Move orchestration ID logic to constructor for efficiency Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 17:30:28 +00:00
copilot-swe-agent[bot]	1dc58e3080	Rename github_orchestration_id to actions_orchestration_id Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 17:20:43 +00:00
copilot-swe-agent[bot]	20596c1d96	Move hyphen to end of character class for cleaner regex Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 16:30:09 +00:00
copilot-swe-agent[bot]	557f80fd03	Fix regex to properly escape hyphen in character class Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 16:28:52 +00:00
copilot-swe-agent[bot]	32c52bb78a	Use product/version format and sanitize orchestration ID Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 16:26:29 +00:00
copilot-swe-agent[bot]	6d9a3fe547	Format code and update .gitignore to exclude .nx cache Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 15:36:15 +00:00
copilot-swe-agent[bot]	4e1c194b34	Add ACTIONS_ORCHESTRATION_ID support to http-client user-agent Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 15:32:55 +00:00
copilot-swe-agent[bot]	09cb71a033	Initial plan	2026-01-06 15:22:42 +00:00
Salman Chishti	2506e78e82	Merge pull request #2212 from actions/artifact-v5.0.1-release docs(artifact): release @actions/artifact v5.0.1	2025-12-12 15:39:59 +00:00
Salman Muin Kayser Chishti	f8003d52ff	docs: add PR reference to artifact v5.0.1 release notes	2025-12-12 15:33:41 +00:00
Salman Muin Kayser Chishti	e263dfb89d	Merge remote-tracking branch 'origin/main' into artifact-v5.0.1-release	2025-12-12 15:33:18 +00:00
Salman Chishti	2e53bd8485	Merge pull request #2214 from actions/cache-v5.0.1-release docs(cache): release @actions/cache v5.0.1	2025-12-12 15:30:16 +00:00
Salman Chishti	b5e3b25b34	Merge pull request #2211 from actions/fix-artifact-storage-blob fix(artifact): update @azure/storage-blob to fix Node.js 24 punycode deprecation	2025-12-12 15:29:23 +00:00
Salman Muin Kayser Chishti	b71834a510	fix(artifact): update @azure/storage-blob to ^12.29.1 and remove deprecated packages	2025-12-12 15:01:31 +00:00
Salman Muin Kayser Chishti	c6f0239e63	Merge remote-tracking branch 'origin/main' into fix-artifact-storage-blob	2025-12-12 14:59:31 +00:00
Salman Muin Kayser Chishti	c655f38a0f	docs(cache): add PR reference to v5.0.1 release notes	2025-12-12 14:53:26 +00:00
Salman Muin Kayser Chishti	cf8caa4e0d	Merge remote-tracking branch 'origin/main' into cache-v5.0.1-release	2025-12-12 14:50:27 +00:00
Salman Chishti	8734e578c6	Merge pull request #2213 from actions/fix-cache-storage-blob fix(cache): update @azure/storage-blob to fix Node.js 24 punycode deprecation	2025-12-12 14:40:41 +00:00
Salman Muin Kayser Chishti	74ac6db523	fix(cache): update @azure/storage-blob to ^12.29.1 to address punycode deprecation	2025-12-12 14:05:14 +00:00
Salman Muin Kayser Chishti	6fc2f678c8	docs(cache): bump to v5.0.1 and add release notes	2025-12-12 13:42:58 +00:00
Salman Muin Kayser Chishti	5ef62e14dd	fix(cache): update @azure/storage-blob to ^12.29.1 to fix punycode deprecation - Updated @azure/storage-blob from ^12.13.0 to ^12.29.1 - Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http - Fixes Node.js 24 deprecation warning for punycode module	2025-12-12 13:41:31 +00:00
Salman Muin Kayser Chishti	7b29e67278	docs(artifact): bump to v5.0.1 and add release notes	2025-12-12 13:40:07 +00:00
Salman Muin Kayser Chishti	9d2227dbb0	fix(artifact): update @azure/storage-blob to ^12.29.1 to fix punycode deprecation - Removed direct @azure/core-http dependency - Updated @azure/storage-blob from ^12.15.0 to ^12.29.1 - Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http - Fixes Node.js 24 deprecation warning for punycode module	2025-12-12 13:38:13 +00:00
Salman Chishti	5a8462ec27	Merge pull request #2210 from actions/prepare-artifact-release docs(artifact): add v5.0.0 release notes	2025-12-11 21:42:59 +00:00
Salman Muin Kayser Chishti	fcaf488df6	chore(artifact): bump version to v5.0.0	2025-12-11 20:45:49 +00:00
Salman Muin Kayser Chishti	2b48e40e62	docs(artifact): add v5.0.0 release notes	2025-12-11 20:37:18 +00:00
Salman Chishti	44ec738e27	Merge pull request #2209 from actions/version-bumps chore(artifact): bump dependencies for Node.js 24 support	2025-12-11 20:23:43 +00:00
Salman Muin Kayser Chishti	3af0128b01	chore(artifact): bump dependencies for Node.js 24 support	2025-12-11 19:20:51 +00:00
Salman Chishti	e74405f68c	Merge pull request #2194 from actions/prepare-cache-release-v5.0.0 Prepare cache v5 release	2025-12-11 16:00:48 +00:00
Salman Muin Kayser Chishti	cc6abe3c3a	chore(releases): update release notes for v5.0.0 to remove punycode deprecation warning	2025-12-11 14:43:23 +00:00
Salman Muin Kayser Chishti	c6502bc679	PR number update in releases	2025-12-11 14:33:30 +00:00
Salman Muin Kayser Chishti	bdd6eb4293	update releases	2025-12-11 14:32:58 +00:00
Salman Muin Kayser Chishti	6785788751	Merge remote-tracking branch 'origin/main' into prepare-cache-release-v5.0.0	2025-12-11 14:27:41 +00:00
Salman Chishti	ddf2d52556	Merge pull request #2198 from actions/cache-bump-deps chore(cache): bump @actions/* dependencies to v2/v3	2025-12-11 14:25:35 +00:00
Salman Muin Kayser Chishti	7c1b12a15e	chore(cache): update @actions/core to 2.0.1	2025-12-11 13:57:58 +00:00
Salman Muin Kayser Chishti	fdbf9e3ec2	Merge remote-tracking branch 'origin/main' into cache-bump-deps	2025-12-11 13:54:20 +00:00
Salman Muin Kayser Chishti	369aa55cdc	update to core 2.0.1 which has exec 2.0.0	2025-12-11 13:54:17 +00:00
Brian DeHamer	e1191599bb	Merge pull request #2203 from actions/node-update-for-publish Use node24 for publishing	2025-12-10 14:19:00 -08:00
Brian DeHamer	c043714a35	use node24 for publishing Signed-off-by: Brian DeHamer <bdehamer@github.com>	2025-12-10 14:14:15 -08:00
Brian DeHamer	3ac6e0fdf2	Merge pull request #2201 from actions/npm-trusted-publishing Enable npm trusted publishing	2025-12-10 13:32:35 -08:00
Brian DeHamer	d9f9074fee	npm trusted publishing Signed-off-by: Brian DeHamer <bdehamer@github.com>	2025-12-10 13:27:16 -08:00
Salman Chishti	2c52220624	Merge pull request #2199 from actions/core-bump-exec prepare @actions/exec 2.0.1 relesae + chore(core): bump @actions/exec from ^1.1.1 to ^2.0.0	2025-12-10 12:08:47 +00:00
Salman Muin Kayser Chishti	e48877e66c	chore(cache): bump @actions/* dependencies to v2/v3 - @actions/core: ^1.11.1 → ^2.0.0 - @actions/exec: ^1.0.1 → ^2.0.0 - @actions/glob: ^0.1.0 → ^0.5.0 - @actions/http-client: ^2.1.1 → ^3.0.0 - @actions/io: ^1.0.1 → ^2.0.0	2025-12-10 11:38:25 +00:00
Salman Muin Kayser Chishti	eb7ff8401e	chore(cache): regenerate package-lock.json with Node 24	2025-12-10 11:09:56 +00:00
Salman Muin Kayser Chishti	45ec4a2087	chore: update dependencies and remove deprecated package - Removed `@azure/ms-rest-js` dependency to fix Node.js 24+ punycode deprecation warning. - The `TransferProgressEvent` type is now imported from `@azure/core-rest-pipeline`. - Updated `package.json` to reflect the new dependency. - Updated tests to import `TransferProgressEvent` from the new package. - Updated `package-lock.json` to remove `@azure/ms-rest-js` and include `@azure/core-rest-pipeline`. - Bumped versions of several dependencies including `@azure/storage-blob` and `@azure/storage-common`.	2025-12-10 11:04:34 +00:00
Salman Muin Kayser Chishti	b0464628c0	Prepare cache v5 release	2025-12-09 16:11:32 +00:00