Release @actions/github v8.0.1

.github/workflows/cache-tests.yml

@@ -55,8 +55,10 @@ jobs:
       shell: bash
       run: packages/cache/__tests__/create-cache-files.sh ${{ runner.os }} ~/test-cache
 
+    # We're using node -e to call the functions directly available in the @actions/cache package
     - name: Save cache using saveCache()
-      run: node packages/cache/__tests__/save-cache.mjs ${{ runner.os }} ${{ github.run_id }}
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').saveCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
 
     - name: Delete cache folders before restoring
       shell: bash
@@ -65,7 +67,8 @@ jobs:
         rm -rf ~/test-cache
 
     - name: Restore cache using restoreCache() with http-client
-      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} false
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}',[],{useAzureSdk: false}))"
 
     - name: Verify cache restored with http-client
       shell: bash
@@ -80,7 +83,8 @@ jobs:
         rm -rf ~/test-cache
 
     - name: Restore cache using restoreCache() with Azure SDK
-      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} true
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
 
     - name: Verify cache restored with Azure SDK
       shell: bash

.github/workflows/cache-windows-test.yml

@@ -52,8 +52,10 @@ jobs:
       shell: bash
       run: packages/cache/__tests__/create-cache-files.sh ${{ runner.os }} ~/test-cache
 
+    # We're using node -e to call the functions directly available in the @actions/cache package
     - name: Save cache using saveCache()
-      run: node packages/cache/__tests__/save-cache.mjs ${{ runner.os }} ${{ github.run_id }}
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').saveCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
 
     - name: Delete cache folders before restoring
       shell: bash
@@ -62,7 +64,8 @@ jobs:
         rm -rf ~/test-cache
 
     - name: Restore cache using restoreCache() with http-client
-      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} false
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}',[],{useAzureSdk: false}))"
 
     - name: Verify cache restored with http-client
       shell: bash
@@ -77,7 +80,8 @@ jobs:
         rm -rf ~/test-cache
 
     - name: Restore cache using restoreCache() with Azure SDK
-      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} true
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
 
     - name: Verify cache restored with Azure SDK
       shell: bash

jest.config.js

@@ -4,34 +4,18 @@ module.exports = {
   roots: ['<rootDir>/packages'],
   testEnvironment: 'node',
   testMatch: ['**/__tests__/*.test.ts'],
-  moduleNameMapper: {
-    '^(\\.{1,2}/.*)\\.js$': '$1',
-    '^@actions/core$': '<rootDir>/packages/core/lib/core.js',
-    '^@actions/exec$': '<rootDir>/packages/exec/lib/exec.js',
-    '^@actions/io$': '<rootDir>/packages/io/lib/io.js',
-    '^@actions/io/lib/io-util$': '<rootDir>/packages/io/lib/io-util.js',
-    '^@actions/http-client$': '<rootDir>/packages/http-client/lib/index.js',
-    '^@actions/http-client/lib/auth$': '<rootDir>/packages/http-client/lib/auth.js',
-    '^@actions/http-client/lib/interfaces$': '<rootDir>/packages/http-client/lib/interfaces.js',
-    '^@actions/github$': '<rootDir>/packages/github/lib/github.js',
-    '^@actions/github/lib/utils$': '<rootDir>/packages/github/lib/utils.js',
-    '^@actions/glob$': '<rootDir>/packages/glob/lib/glob.js',
-    '^@actions/tool-cache$': '<rootDir>/packages/tool-cache/lib/tool-cache.js',
-    '^@actions/cache$': '<rootDir>/packages/cache/lib/cache.js'
-  },
   transform: {
     '^.+\\.(ts|js)$': ['ts-jest', {
+      isolatedModules: true,
       diagnostics: {warnOnly: true},
       tsconfig: {
         allowJs: true,
-        esModuleInterop: true,
-        module: 'commonjs',
-        moduleResolution: 'node'
+        esModuleInterop: true
       }
     }]
   },
   transformIgnorePatterns: [
-    '/node_modules/(?!(@octokit|@actions/github|@actions/http-client|@actions/io|@actions/exec|@actions/core|@actions/glob|@actions/tool-cache|@actions/cache|universal-user-agent|before-after-hook)/)'
+    '/node_modules/(?!(@octokit|universal-user-agent|before-after-hook)/)'
   ],
   verbose: true
 }

packages/artifact/README.md

@@ -4,6 +4,7 @@ Interact programmatically with [Actions Artifacts](https://docs.github.com/en/ac
 
 This is the core library that powers the [`@actions/upload-artifact`](https://github.com/actions/upload-artifact) and [`@actions/download-artifact`](https://github.com/actions/download-artifact) actions.
 
+
 - [`@actions/artifact`](#actionsartifact)
   - [v2 - What's New](#v2---whats-new)
     - [Improvements](#improvements)

packages/artifact/RELEASES.md

@@ -1,144 +1,140 @@
 # @actions/artifact Releases
 
-## 5.0.3
-
-- Bump `@actions/http-client` to `3.0.2`
-
-## 5.0.1
+### 5.0.1
 
 - Fix Node.js 24 punycode deprecation warning by updating `@azure/storage-blob` from `^12.15.0` to `^12.29.1` [#2211](https://github.com/actions/toolkit/pull/2211)
 - Removed direct `@azure/core-http` dependency (now uses `@azure/core-rest-pipeline` via storage-blob)
 
-## 5.0.0
+### 5.0.0
 
 - Dependency updates for Node.js 24 runtime support
 - Update `@actions/core` to v2
 - Update `@actions/http-client` to v3
 
-## 4.0.0
+### 4.0.0
 
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Fix: artifact pagination bugs and configurable artifact count limits [#2165](https://github.com/actions/toolkit/pull/2165)
 - Fix: reject the promise on timeout [#2124](https://github.com/actions/toolkit/pull/2124)
 - Update dependency versions
 
-## 2.3.3
+### 2.3.3
 
 - Dependency updates [#2049](https://github.com/actions/toolkit/pull/2049)
 
-## 2.3.2
+### 2.3.2
 
 - Added masking for Shared Access Signature (SAS) artifact URLs [#1982](https://github.com/actions/toolkit/pull/1982)
-- Change hash to digest for consistent terminology across runner logs [#1991](https://github.com/actions/toolkit/pull/1991)
+- Change hash to digest for consistent terminology across runner logs [#1991](https://github.com/actions/toolkit/pull/1991) 
 
-## 2.3.1
+### 2.3.1
 
 - Fix comment typo on expectedHash. [#1986](https://github.com/actions/toolkit/pull/1986)
 
-## 2.3.0
+### 2.3.0
 
 - Allow ArtifactClient to perform digest comparisons, if supplied. [#1975](https://github.com/actions/toolkit/pull/1975)
 
-## 2.2.2
+### 2.2.2
 
 - Default concurrency to 5 for uploading artifacts [#1962](https://github.com/actions/toolkit/pull/1962)
 
-## 2.2.1
+### 2.2.1
 
 - Add `ACTIONS_ARTIFACT_UPLOAD_CONCURRENCY` and `ACTIONS_ARTIFACT_UPLOAD_TIMEOUT_MS` environment variables [#1928](https://github.com/actions/toolkit/pull/1928)
 
-## 2.2.0
+### 2.2.0
 
 - Return artifact digest on upload [#1896](https://github.com/actions/toolkit/pull/1896)
 
-## 2.1.11
+### 2.1.11
 
 - Fixed a bug with relative symlinks resolution [#1844](https://github.com/actions/toolkit/pull/1844)
 - Use native `crypto` [#1815](https://github.com/actions/toolkit/pull/1815)
 
-## 2.1.10
+### 2.1.10
 
 - Fixed a regression with symlinks not being automatically resolved [#1830](https://github.com/actions/toolkit/pull/1830)
 - Fixed a regression with chunk timeout [#1786](https://github.com/actions/toolkit/pull/1786)
 
-## 2.1.9
+### 2.1.9
 
 - Fixed artifact upload chunk timeout logic [#1774](https://github.com/actions/toolkit/pull/1774)
 - Use lazy stream to prevent issues with open file limits [#1771](https://github.com/actions/toolkit/pull/1771)
 
-## 2.1.8
+### 2.1.8
 
 - Allows `*.localhost` domains for hostname checks for local development.
 
-## 2.1.7
+### 2.1.7
 
 - Update unzip-stream dependency and reverted to using `unzip.Extract()`
 
-## 2.1.6
+### 2.1.6
 
 - Will retry on invalid request responses.
 
-## 2.1.5
+### 2.1.5
 
 - Bumped `archiver` dependency to 7.0.1
 
-## 2.1.4
+### 2.1.4
 
 - Adds info-level logging for zip extraction
 
-## 2.1.3
+### 2.1.3
 
 - Fixes a bug in the extract logic updated in 2.1.2
 
-## 2.1.2
+### 2.1.2
 
 - Updated the stream extract functionality to use `unzip.Parse()` instead of `unzip.Extract()` for greater control of unzipping artifacts
 
-## 2.1.1
+### 2.1.1
 
 - Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
 
-## 2.1.0
+### 2.1.0
 
 - Added `ArtifactClient#deleteArtifact` to delete artifacts by name [#1626](https://github.com/actions/toolkit/pull/1626)
 - Update error messaging to be more useful [#1628](https://github.com/actions/toolkit/pull/1628)
 
-## 2.0.1
+### 2.0.1
 
-- Patch to fix transient request timeouts <https://github.com/actions/download-artifact/issues/249>
+- Patch to fix transient request timeouts https://github.com/actions/download-artifact/issues/249
 
-## 2.0.0
+### 2.0.0
 
 - Major release. Supports new Artifact backend for improved speed, reliability and behavior.
 - Numerous API changes, [some breaking](./README.md#breaking-changes).
 
 - [Blog post with more info](https://github.blog/2024-02-12-get-started-with-v4-of-github-actions-artifacts/)
 
-## 1.1.1
+### 1.1.1
 
 - Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet [#1278](https://github.com/actions/toolkit/pull/1278/commits/b9de68a590daf37c6747e38d3cb4f1dd2cfb791c)
 
-## 1.1.0
+### 1.1.0
 
 - Add `x-actions-results-crc64` and `x-actions-results-md5` checksum headers on upload [#1063](https://github.com/actions/toolkit/pull/1063)
 
-## 1.0.2
+### 1.0.2
 
 - Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
 
-## 1.0.1
+### 1.0.1
 
 - Update to v2.0.0 of `@actions/http-client`
 
-## 1.0.0
+### 1.0.0
 
 - Update `lockfileVersion` to `v2` in `package-lock.json` [#1009](https://github.com/actions/toolkit/pull/1009)
 
-## 0.6.1
+### 0.6.1
 
 - Fix for failing 0 byte file uploads on Windows [#962](https://github.com/actions/toolkit/pull/962)
 
-## 0.6.0
+### 0.6.0
 
 - Support upload from named pipes [#748](https://github.com/actions/toolkit/pull/748)
 - Fixes to percentage values being greater than 100% when downloading all artifacts [#889](https://github.com/actions/toolkit/pull/889)
@@ -147,49 +143,49 @@
 - Faster upload speeds for certain types of large files by exempting gzip compression [#956](https://github.com/actions/toolkit/pull/956)
 - More detailed logging when dealing with chunked uploads [#957](https://github.com/actions/toolkit/pull/957)
   
-## 0.5.2
+### 0.5.2
 
 - Add HTTP 500 as a retryable status code for artifact upload and download.
   
-## 0.5.1
+### 0.5.1
 
 - Bump @actions/http-client to version 1.0.11 to fix proxy related issues during artifact upload and download
 
-## 0.5.0
+### 0.5.0
 
 - Improved retry-ability for all http calls during artifact upload and download if an error is encountered
 
-## 0.4.2
+### 0.4.2
 
 - Improved retry-ability when a partial artifact download is encountered
 
-## 0.4.1
+### 0.4.1
 
 - Update to latest @actions/core version
 
-## 0.4.0
+### 0.4.0
 
 - Add option to specify custom retentions on artifacts
-
-## 0.3.5
+- 
+### 0.3.5
 
 - Retry in the event of a 413 response
 
-## 0.3.3
+### 0.3.3
 
 - Increase chunk size during upload from 4MB to 8MB
 - Improve user-agent strings during API calls to help internally diagnose issues
 
-## 0.3.2
+### 0.3.2
 
 - Fix to ensure readstreams get correctly reset in the event of a retry
 
-## 0.3.1
+### 0.3.1
 
 - Fix to ensure temporary gzip files get correctly deleted during artifact upload
 - Remove spaces as a forbidden character during upload
 
-## 0.3.0
+### 0.3.0
 
 - Fixes to gzip decompression when downloading artifacts
 - Support handling 429 response codes
@@ -198,13 +194,13 @@
 - Clearer error message if storage quota has been reached
 - Improved logging and output during artifact download
 
-## 0.2.0
+### 0.2.0
 
 - Fixes to TCP connections not closing
 - GZip file compression to speed up downloads
 - Improved logging and output
 - Extra documentation
 
-## 0.1.0
+### 0.1.0
 
 - Initial release

packages/artifact/__tests__/artifact-http-client.test.ts

@@ -1,10 +1,10 @@
 import * as http from 'http'
 import * as net from 'net'
 import {HttpClient} from '@actions/http-client'
-import * as config from '../src/internal/shared/config.js'
-import {internalArtifactTwirpClient} from '../src/internal/shared/artifact-twirp-client.js'
-import {noopLogs} from './common.js'
-import {NetworkError, UsageError} from '../src/internal/shared/errors.js'
+import * as config from '../src/internal/shared/config'
+import {internalArtifactTwirpClient} from '../src/internal/shared/artifact-twirp-client'
+import {noopLogs} from './common'
+import {NetworkError, UsageError} from '../src/internal/shared/errors'
 
 jest.mock('@actions/http-client')
 

packages/artifact/__tests__/config.test.ts

@@ -1,4 +1,4 @@
-import * as config from '../src/internal/shared/config.js'
+import * as config from '../src/internal/shared/config'
 import os from 'os'
 
 // Mock the `cpus()` function in the `os` module

packages/artifact/__tests__/delete-artifacts.test.ts

@@ -4,11 +4,11 @@ import type {RequestInterface} from '@octokit/types'
 import {
   deleteArtifactInternal,
   deleteArtifactPublic
-} from '../src/internal/delete/delete-artifact.js'
-import * as config from '../src/internal/shared/config.js'
-import {ArtifactServiceClientJSON, Timestamp} from '../src/generated/index.js'
-import * as util from '../src/internal/shared/util.js'
-import {noopLogs} from './common.js'
+} from '../src/internal/delete/delete-artifact'
+import * as config from '../src/internal/shared/config'
+import {ArtifactServiceClientJSON, Timestamp} from '../src/generated'
+import * as util from '../src/internal/shared/util'
+import {noopLogs} from './common'
 
 type MockedRequest = jest.MockedFunction<RequestInterface<object>>
 

packages/artifact/__tests__/download-artifact.test.ts

@@ -11,12 +11,12 @@ import {
   downloadArtifactInternal,
   downloadArtifactPublic,
   streamExtractExternal
-} from '../src/internal/download/download-artifact.js'
-import {getUserAgentString} from '../src/internal/shared/user-agent.js'
-import {noopLogs} from './common.js'
-import * as config from '../src/internal/shared/config.js'
-import {ArtifactServiceClientJSON} from '../src/generated/index.js'
-import * as util from '../src/internal/shared/util.js'
+} from '../src/internal/download/download-artifact'
+import {getUserAgentString} from '../src/internal/shared/user-agent'
+import {noopLogs} from './common'
+import * as config from '../src/internal/shared/config'
+import {ArtifactServiceClientJSON} from '../src/generated'
+import * as util from '../src/internal/shared/util'
 
 type MockedDownloadArtifact = jest.MockedFunction<
   RestEndpointMethods['actions']['downloadArtifact']

packages/artifact/__tests__/get-artifact.test.ts

@@ -3,15 +3,15 @@ import type {RequestInterface} from '@octokit/types'
 import {
   getArtifactInternal,
   getArtifactPublic
-} from '../src/internal/find/get-artifact.js'
-import * as config from '../src/internal/shared/config.js'
-import {ArtifactServiceClientJSON, Timestamp} from '../src/generated/index.js'
-import * as util from '../src/internal/shared/util.js'
-import {noopLogs} from './common.js'
+} from '../src/internal/find/get-artifact'
+import * as config from '../src/internal/shared/config'
+import {ArtifactServiceClientJSON, Timestamp} from '../src/generated'
+import * as util from '../src/internal/shared/util'
+import {noopLogs} from './common'
 import {
   ArtifactNotFoundError,
   InvalidResponseError
-} from '../src/internal/shared/errors.js'
+} from '../src/internal/shared/errors'
 
 type MockedRequest = jest.MockedFunction<RequestInterface<object>>
 

packages/artifact/__tests__/list-artifacts.test.ts

@@ -3,12 +3,12 @@ import type {RestEndpointMethodTypes} from '@octokit/plugin-rest-endpoint-method
 import {
   listArtifactsInternal,
   listArtifactsPublic
-} from '../src/internal/find/list-artifacts.js'
-import * as config from '../src/internal/shared/config.js'
-import {ArtifactServiceClientJSON, Timestamp} from '../src/generated/index.js'
-import * as util from '../src/internal/shared/util.js'
-import {noopLogs} from './common.js'
-import {Artifact} from '../src/internal/shared/interfaces.js'
+} from '../src/internal/find/list-artifacts'
+import * as config from '../src/internal/shared/config'
+import {ArtifactServiceClientJSON, Timestamp} from '../src/generated'
+import * as util from '../src/internal/shared/util'
+import {noopLogs} from './common'
+import {Artifact} from '../src/internal/shared/interfaces'
 import {RequestInterface} from '@octokit/types'
 
 type MockedRequest = jest.MockedFunction<RequestInterface<object>>

packages/artifact/__tests__/path-and-artifact-name-validation.test.ts

@@ -1,9 +1,9 @@
 import {
   validateArtifactName,
   validateFilePath
-} from '../src/internal/upload/path-and-artifact-name-validation.js'
+} from '../src/internal/upload/path-and-artifact-name-validation'
 
-import {noopLogs} from './common.js'
+import {noopLogs} from './common'
 
 describe('Path and artifact name validation', () => {
   beforeAll(() => {

packages/artifact/__tests__/retention.test.ts

@@ -1,5 +1,5 @@
-import {Timestamp} from '../src/generated/index.js'
-import * as retention from '../src/internal/upload/retention.js'
+import {Timestamp} from '../src/generated'
+import * as retention from '../src/internal/upload/retention'
 
 describe('retention', () => {
   beforeEach(() => {

packages/artifact/__tests__/upload-artifact.test.ts

@@ -1,12 +1,12 @@
-import * as uploadZipSpecification from '../src/internal/upload/upload-zip-specification.js'
-import * as zip from '../src/internal/upload/zip.js'
-import * as util from '../src/internal/shared/util.js'
-import * as config from '../src/internal/shared/config.js'
-import {ArtifactServiceClientJSON} from '../src/generated/index.js'
-import * as blobUpload from '../src/internal/upload/blob-upload.js'
-import {uploadArtifact} from '../src/internal/upload/upload-artifact.js'
-import {noopLogs} from './common.js'
-import {FilesNotFoundError} from '../src/internal/shared/errors.js'
+import * as uploadZipSpecification from '../src/internal/upload/upload-zip-specification'
+import * as zip from '../src/internal/upload/zip'
+import * as util from '../src/internal/shared/util'
+import * as config from '../src/internal/shared/config'
+import {ArtifactServiceClientJSON} from '../src/generated'
+import * as blobUpload from '../src/internal/upload/blob-upload'
+import {uploadArtifact} from '../src/internal/upload/upload-artifact'
+import {noopLogs} from './common'
+import {FilesNotFoundError} from '../src/internal/shared/errors'
 import {BlockBlobUploadStreamOptions} from '@azure/storage-blob'
 import * as fs from 'fs'
 import * as path from 'path'

packages/artifact/__tests__/upload-zip-specification.test.ts

@@ -4,8 +4,8 @@ import {promises as fs} from 'fs'
 import {
   getUploadZipSpecification,
   validateRootDirectory
-} from '../src/internal/upload/upload-zip-specification.js'
-import {noopLogs} from './common.js'
+} from '../src/internal/upload/upload-zip-specification'
+import {noopLogs} from './common'
 
 const root = path.join(__dirname, '_temp', 'upload-specification')
 const goodItem1Path = path.join(

packages/artifact/__tests__/util.test.ts

@@ -1,6 +1,6 @@
-import * as config from '../src/internal/shared/config.js'
-import * as util from '../src/internal/shared/util.js'
-import {maskSigUrl, maskSecretUrls} from '../src/internal/shared/util.js'
+import * as config from '../src/internal/shared/config'
+import * as util from '../src/internal/shared/util'
+import {maskSigUrl, maskSecretUrls} from '../src/internal/shared/util'
 import {setSecret, debug} from '@actions/core'
 
 export const testRuntimeToken =

packages/artifact/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/artifact",
-  "version": "6.0.0",
+  "version": "5.0.2",
   "preview": true,
   "description": "Actions artifact lib",
   "keywords": [
@@ -10,15 +10,8 @@
   ],
   "homepage": "https://github.com/actions/toolkit/tree/main/packages/artifact",
   "license": "MIT",
-  "type": "module",
   "main": "lib/artifact.js",
   "types": "lib/artifact.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/artifact.d.ts",
-      "import": "./lib/artifact.js"
-    }
-  },
   "directories": {
     "lib": "lib",
     "test": "__tests__"
@@ -39,7 +32,7 @@
     "audit-moderate": "npm install && npm audit --json --audit-level=moderate > audit.json",
     "test": "cd ../../ && npm run test ./packages/artifact",
     "bootstrap": "cd ../../ && npm run bootstrap",
-    "tsc-run": "tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/",
+    "tsc-run": "tsc",
     "tsc": "npm run bootstrap && npm run tsc-run",
     "gen:docs": "typedoc --plugin typedoc-plugin-markdown --out docs/generated src/artifact.ts --githubPages false --readme none"
   },
@@ -47,27 +40,26 @@
     "url": "https://github.com/actions/toolkit/issues"
   },
   "dependencies": {
-    "@actions/core": "^3.0.0",
-    "@actions/github": "^9.0.0",
-    "@actions/http-client": "^4.0.0",
-    "@azure/storage-blob": "^12.30.0",
-    "@octokit/core": "^7.0.6",
-    "@octokit/plugin-request-log": "^6.0.0",
-    "@octokit/plugin-retry": "^8.0.0",
-    "@octokit/request": "^10.0.7",
-    "@octokit/request-error": "^7.1.0",
+    "@actions/core": "^2.0.0",
+    "@actions/github": "^6.0.1",
+    "@actions/http-client": "^3.0.1",
+    "@azure/storage-blob": "^12.29.1",
+    "@octokit/core": "^5.2.1",
+    "@octokit/plugin-request-log": "^1.0.4",
+    "@octokit/plugin-retry": "^3.0.9",
+    "@octokit/request": "^8.4.1",
+    "@octokit/request-error": "^5.1.1",
     "@protobuf-ts/plugin": "^2.2.3-alpha.1",
-    "@protobuf-ts/runtime": "^2.9.4",
     "archiver": "^7.0.1",
-    "jwt-decode": "^4.0.0",
+    "jwt-decode": "^3.1.2",
     "unzip-stream": "^0.3.1"
   },
   "devDependencies": {
-    "@types/archiver": "^7.0.0",
+    "@types/archiver": "^5.3.2",
     "@types/unzip-stream": "^0.3.4",
-    "typedoc": "^0.28.16",
-    "typedoc-plugin-markdown": "^4.9.0",
-    "typescript": "^5.9.3"
+    "typedoc": "^0.28.13",
+    "typedoc-plugin-markdown": "^3.17.1",
+    "typescript": "^5.2.2"
   },
   "overrides": {
     "uri-js": "npm:uri-js-replace@^1.0.1",

packages/artifact/src/artifact.ts

@@ -1,8 +1,8 @@
-import {ArtifactClient, DefaultArtifactClient} from './internal/client.js'
+import {ArtifactClient, DefaultArtifactClient} from './internal/client'
 
-export * from './internal/shared/interfaces.js'
-export * from './internal/shared/errors.js'
-export * from './internal/client.js'
+export * from './internal/shared/interfaces'
+export * from './internal/shared/errors'
+export * from './internal/client'
 
 const client: ArtifactClient = new DefaultArtifactClient()
 export default client

packages/artifact/src/generated/index.ts

@@ -1,4 +1,4 @@
-export * from './google/protobuf/timestamp.js'
-export * from './google/protobuf/wrappers.js'
-export * from './results/api/v1/artifact.js'
-export * from './results/api/v1/artifact.twirp-client.js'
+export * from './google/protobuf/timestamp'
+export * from './google/protobuf/wrappers'
+export * from './results/api/v1/artifact'
+export * from './results/api/v1/artifact.twirp-client'

packages/artifact/src/generated/results/api/v1/artifact.ts

@@ -12,9 +12,9 @@ import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
-import { Int64Value } from "../../../google/protobuf/wrappers.js";
-import { StringValue } from "../../../google/protobuf/wrappers.js";
-import { Timestamp } from "../../../google/protobuf/timestamp.js";
+import { Int64Value } from "../../../google/protobuf/wrappers";
+import { StringValue } from "../../../google/protobuf/wrappers";
+import { Timestamp } from "../../../google/protobuf/timestamp";
 /**
  * @generated from protobuf message github.actions.results.api.v1.MigrateArtifactRequest
  */

packages/artifact/src/generated/results/api/v1/artifact.twirp-client.ts

@@ -9,7 +9,7 @@ import {
   GetSignedArtifactURLResponse,
   DeleteArtifactRequest,
   DeleteArtifactResponse,
-} from "./artifact.js";
+} from "./artifact";
 
 //==================================//
 //          Client Code             //

packages/artifact/src/internal/client.ts

@@ -1,5 +1,5 @@
 import {warning} from '@actions/core'
-import {isGhes} from './shared/config.js'
+import {isGhes} from './shared/config'
 import {
   UploadArtifactOptions,
   UploadArtifactResponse,
@@ -10,22 +10,19 @@ import {
   DownloadArtifactResponse,
   FindOptions,
   DeleteArtifactResponse
-} from './shared/interfaces.js'
-import {uploadArtifact} from './upload/upload-artifact.js'
+} from './shared/interfaces'
+import {uploadArtifact} from './upload/upload-artifact'
 import {
   downloadArtifactPublic,
   downloadArtifactInternal
-} from './download/download-artifact.js'
+} from './download/download-artifact'
 import {
   deleteArtifactPublic,
   deleteArtifactInternal
-} from './delete/delete-artifact.js'
-import {getArtifactPublic, getArtifactInternal} from './find/get-artifact.js'
-import {
-  listArtifactsPublic,
-  listArtifactsInternal
-} from './find/list-artifacts.js'
-import {GHESNotSupportedError} from './shared/errors.js'
+} from './delete/delete-artifact'
+import {getArtifactPublic, getArtifactInternal} from './find/get-artifact'
+import {listArtifactsPublic, listArtifactsInternal} from './find/list-artifacts'
+import {GHESNotSupportedError} from './shared/errors'
 
 /**
  * Generic interface for the artifact client.

packages/artifact/src/internal/delete/delete-artifact.ts

@@ -1,21 +1,21 @@
 import {info, debug} from '@actions/core'
 import {getOctokit} from '@actions/github'
-import {DeleteArtifactResponse} from '../shared/interfaces.js'
-import {getUserAgentString} from '../shared/user-agent.js'
-import {getRetryOptions} from '../find/retry-options.js'
+import {DeleteArtifactResponse} from '../shared/interfaces'
+import {getUserAgentString} from '../shared/user-agent'
+import {getRetryOptions} from '../find/retry-options'
 import {defaults as defaultGitHubOptions} from '@actions/github/lib/utils'
 import {requestLog} from '@octokit/plugin-request-log'
 import {retry} from '@octokit/plugin-retry'
-import type {OctokitOptions} from '@octokit/core/types'
-import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client.js'
-import {getBackendIdsFromToken} from '../shared/util.js'
+import {OctokitOptions} from '@octokit/core/dist-types/types'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
+import {getBackendIdsFromToken} from '../shared/util'
 import {
   DeleteArtifactRequest,
   ListArtifactsRequest,
   StringValue
-} from '../../generated/index.js'
-import {getArtifactPublic} from '../find/get-artifact.js'
-import {ArtifactNotFoundError, InvalidResponseError} from '../shared/errors.js'
+} from '../../generated'
+import {getArtifactPublic} from '../find/get-artifact'
+import {ArtifactNotFoundError, InvalidResponseError} from '../shared/errors'
 
 export async function deleteArtifactPublic(
   artifactName: string,

packages/artifact/src/internal/download/download-artifact.ts

@@ -10,17 +10,17 @@ import {
   DownloadArtifactOptions,
   DownloadArtifactResponse,
   StreamExtractResponse
-} from '../shared/interfaces.js'
-import {getUserAgentString} from '../shared/user-agent.js'
-import {getGitHubWorkspaceDir} from '../shared/config.js'
-import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client.js'
+} from '../shared/interfaces'
+import {getUserAgentString} from '../shared/user-agent'
+import {getGitHubWorkspaceDir} from '../shared/config'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
 import {
   GetSignedArtifactURLRequest,
   Int64Value,
   ListArtifactsRequest
-} from '../../generated/index.js'
-import {getBackendIdsFromToken} from '../shared/util.js'
-import {ArtifactNotFoundError} from '../shared/errors.js'
+} from '../../generated'
+import {getBackendIdsFromToken} from '../shared/util'
+import {ArtifactNotFoundError} from '../shared/errors'
 
 const scrubQueryParameters = (url: string): string => {
   const parsed = new URL(url)

packages/artifact/src/internal/find/get-artifact.ts

@@ -1,20 +1,16 @@
 import {getOctokit} from '@actions/github'
 import {retry} from '@octokit/plugin-retry'
 import * as core from '@actions/core'
-import type {OctokitOptions} from '@octokit/core/types'
+import {OctokitOptions} from '@octokit/core/dist-types/types'
 import {defaults as defaultGitHubOptions} from '@actions/github/lib/utils'
-import {getRetryOptions} from './retry-options.js'
+import {getRetryOptions} from './retry-options'
 import {requestLog} from '@octokit/plugin-request-log'
-import {GetArtifactResponse} from '../shared/interfaces.js'
-import {getBackendIdsFromToken} from '../shared/util.js'
-import {getUserAgentString} from '../shared/user-agent.js'
-import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client.js'
-import {
-  ListArtifactsRequest,
-  StringValue,
-  Timestamp
-} from '../../generated/index.js'
-import {ArtifactNotFoundError, InvalidResponseError} from '../shared/errors.js'
+import {GetArtifactResponse} from '../shared/interfaces'
+import {getBackendIdsFromToken} from '../shared/util'
+import {getUserAgentString} from '../shared/user-agent'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
+import {ListArtifactsRequest, StringValue, Timestamp} from '../../generated'
+import {ArtifactNotFoundError, InvalidResponseError} from '../shared/errors'
 
 export async function getArtifactPublic(
   artifactName: string,

packages/artifact/src/internal/find/list-artifacts.ts

@@ -1,16 +1,16 @@
 import {info, warning, debug} from '@actions/core'
 import {getOctokit} from '@actions/github'
-import {ListArtifactsResponse, Artifact} from '../shared/interfaces.js'
-import {getUserAgentString} from '../shared/user-agent.js'
-import {getRetryOptions} from './retry-options.js'
+import {ListArtifactsResponse, Artifact} from '../shared/interfaces'
+import {getUserAgentString} from '../shared/user-agent'
+import {getRetryOptions} from './retry-options'
 import {defaults as defaultGitHubOptions} from '@actions/github/lib/utils'
 import {requestLog} from '@octokit/plugin-request-log'
 import {retry} from '@octokit/plugin-retry'
-import type {OctokitOptions} from '@octokit/core/types'
-import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client.js'
-import {getBackendIdsFromToken} from '../shared/util.js'
-import {getMaxArtifactListCount} from '../shared/config.js'
-import {ListArtifactsRequest, Timestamp} from '../../generated/index.js'
+import {OctokitOptions} from '@octokit/core/dist-types/types'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
+import {getBackendIdsFromToken} from '../shared/util'
+import {getMaxArtifactListCount} from '../shared/config'
+import {ListArtifactsRequest, Timestamp} from '../../generated'
 
 const maximumArtifactCount = getMaxArtifactListCount()
 const paginationCount = 100

packages/artifact/src/internal/find/retry-options.ts

@@ -1,5 +1,5 @@
 import * as core from '@actions/core'
-import type {OctokitOptions} from '@octokit/core/types'
+import {OctokitOptions} from '@octokit/core/dist-types/types'
 import {RequestRequestOptions} from '@octokit/types'
 
 export type RetryOptions = {

packages/artifact/src/internal/shared/artifact-twirp-client.ts

@@ -1,11 +1,11 @@
 import {HttpClient, HttpClientResponse, HttpCodes} from '@actions/http-client'
 import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
 import {info, debug} from '@actions/core'
-import {ArtifactServiceClientJSON} from '../../generated/index.js'
-import {getResultsServiceUrl, getRuntimeToken} from './config.js'
-import {getUserAgentString} from './user-agent.js'
-import {NetworkError, UsageError} from './errors.js'
-import {maskSecretUrls} from './util.js'
+import {ArtifactServiceClientJSON} from '../../generated'
+import {getResultsServiceUrl, getRuntimeToken} from './config'
+import {getUserAgentString} from './user-agent'
+import {NetworkError, UsageError} from './errors'
+import {maskSecretUrls} from './util'
 
 // The twirp http client must implement this interface
 interface Rpc {

packages/artifact/src/internal/shared/package-version.cjs

@@ -1,7 +0,0 @@
-// This file exists as a CommonJS module to read the version from package.json.
-// In an ESM package, using `require()` directly in .ts files requires disabling
-// ESLint rules and doesn't work reliably across all Node.js versions.
-// By keeping this as a .cjs file, we can use require() naturally and export
-// the version for the ESM modules to import.
-const packageJson = require('../../../package.json')
-module.exports = { version: packageJson.version }

packages/artifact/src/internal/shared/user-agent.ts

@@ -1,8 +1,9 @@
-import {version} from './package-version.cjs'
+// eslint-disable-next-line @typescript-eslint/no-var-requires, @typescript-eslint/no-require-imports
+const packageJson = require('../../../package.json')
 
 /**
  * Ensure that this User Agent String is used in all HTTP calls so that we can monitor telemetry between different versions of this package
  */
 export function getUserAgentString(): string {
-  return `@actions/artifact-${version}`
+  return `@actions/artifact-${packageJson.version}`
 }

packages/artifact/src/internal/shared/util.ts

@@ -1,6 +1,6 @@
 import * as core from '@actions/core'
-import {getRuntimeToken} from './config.js'
-import {jwtDecode} from 'jwt-decode'
+import {getRuntimeToken} from './config'
+import jwt_decode from 'jwt-decode'
 import {debug, setSecret} from '@actions/core'
 
 export interface BackendIds {
@@ -20,7 +20,7 @@ const InvalidJwtError = new Error(
 // workflow run and workflow job run backend ids
 export function getBackendIdsFromToken(): BackendIds {
   const token = getRuntimeToken()
-  const decoded = jwtDecode<ActionsToken>(token)
+  const decoded = jwt_decode<ActionsToken>(token)
   if (!decoded.scp) {
     throw InvalidJwtError
   }

packages/artifact/src/internal/upload/blob-upload.ts

@@ -1,15 +1,15 @@
 import {BlobClient, BlockBlobUploadStreamOptions} from '@azure/storage-blob'
 import {TransferProgressEvent} from '@azure/core-http-compat'
-import {ZipUploadStream} from './zip.js'
+import {ZipUploadStream} from './zip'
 import {
   getUploadChunkSize,
   getConcurrency,
   getUploadChunkTimeout
-} from '../shared/config.js'
+} from '../shared/config'
 import * as core from '@actions/core'
 import * as crypto from 'crypto'
 import * as stream from 'stream'
-import {NetworkError} from '../shared/errors.js'
+import {NetworkError} from '../shared/errors'
 
 export interface BlobUploadResponse {
   /**

packages/artifact/src/internal/upload/retention.ts

@@ -1,4 +1,4 @@
-import {Timestamp} from '../../generated/index.js'
+import {Timestamp} from '../../generated'
 import * as core from '@actions/core'
 
 export function getExpiration(retentionDays?: number): Timestamp | undefined {

packages/artifact/src/internal/upload/upload-artifact.ts

@@ -2,24 +2,24 @@ import * as core from '@actions/core'
 import {
   UploadArtifactOptions,
   UploadArtifactResponse
-} from '../shared/interfaces.js'
-import {getExpiration} from './retention.js'
-import {validateArtifactName} from './path-and-artifact-name-validation.js'
-import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client.js'
+} from '../shared/interfaces'
+import {getExpiration} from './retention'
+import {validateArtifactName} from './path-and-artifact-name-validation'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
 import {
   UploadZipSpecification,
   getUploadZipSpecification,
   validateRootDirectory
-} from './upload-zip-specification.js'
-import {getBackendIdsFromToken} from '../shared/util.js'
-import {uploadZipToBlobStorage} from './blob-upload.js'
-import {createZipUploadStream} from './zip.js'
+} from './upload-zip-specification'
+import {getBackendIdsFromToken} from '../shared/util'
+import {uploadZipToBlobStorage} from './blob-upload'
+import {createZipUploadStream} from './zip'
 import {
   CreateArtifactRequest,
   FinalizeArtifactRequest,
   StringValue
-} from '../../generated/index.js'
-import {FilesNotFoundError, InvalidResponseError} from '../shared/errors.js'
+} from '../../generated'
+import {FilesNotFoundError, InvalidResponseError} from '../shared/errors'
 
 export async function uploadArtifact(
   name: string,

packages/artifact/src/internal/upload/upload-zip-specification.ts

@@ -1,7 +1,7 @@
 import * as fs from 'fs'
 import {info} from '@actions/core'
 import {normalize, resolve} from 'path'
-import {validateFilePath} from './path-and-artifact-name-validation.js'
+import {validateFilePath} from './path-and-artifact-name-validation'
 
 export interface UploadZipSpecification {
   /**

packages/artifact/src/internal/upload/zip.ts

@@ -1,9 +1,9 @@
 import * as stream from 'stream'
 import {realpath} from 'fs/promises'
-import archiver from 'archiver'
+import * as archiver from 'archiver'
 import * as core from '@actions/core'
-import {UploadZipSpecification} from './upload-zip-specification.js'
-import {getUploadChunkSize} from '../shared/config.js'
+import {UploadZipSpecification} from './upload-zip-specification'
+import {getUploadChunkSize} from '../shared/config'
 
 export const DEFAULT_COMPRESSION_LEVEL = 6
 

packages/artifact/tsconfig.json

@@ -4,8 +4,6 @@
     "baseUrl": "./",
     "outDir": "./lib",
     "rootDir": "./src",
-    "module": "node16",
-    "moduleResolution": "node16",
     "paths": {
       "@actions/core": [
         "../core"

packages/attest/RELEASES.md

@@ -1,10 +1,5 @@
 # @actions/attest Releases
 
-### 2.2.1
-
-- Bump `@actions/http-client` to `3.0.2`
-- Bump `undici` to `6.23.0`
-
 ### 2.2.0
 
 - Bump @actions/core from 1.11.1 to 2.0.2

packages/attest/package-lock.json

@@ -1,17 +1,17 @@
 {
   "name": "@actions/attest",
-  "version": "2.2.1",
+  "version": "2.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/attest",
-      "version": "2.2.1",
+      "version": "2.2.0",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^2.0.2",
         "@actions/github": "^7.0.0",
-        "@actions/http-client": "^3.0.2",
+        "@actions/http-client": "^3.0.1",
         "@octokit/plugin-retry": "^6.0.1",
         "@sigstore/bundle": "^3.1.0",
         "@sigstore/sign": "^3.1.0",
@@ -22,7 +22,7 @@
         "@sigstore/rekor-types": "^3.0.0",
         "@types/jsonwebtoken": "^9.0.6",
         "nock": "^13.5.1",
-        "undici": "^6.23.0"
+        "undici": "^6.20.0"
       }
     },
     "node_modules/@actions/core": {
@@ -72,13 +72,25 @@
       }
     },
     "node_modules/@actions/http-client": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
-      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.1.tgz",
+      "integrity": "sha512-SbGS8c/vySbNO3kjFgSW77n83C4MQx/Yoe+b1hAdpuvfHxnkHzDq2pWljUpAA56Si1Gae/7zjeZsV0CYjmLo/w==",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",
-        "undici": "^6.23.0"
+        "undici": "^5.28.5"
+      }
+    },
+    "node_modules/@actions/http-client/node_modules/undici": {
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.0"
       }
     },
     "node_modules/@actions/io": {
@@ -193,21 +205,6 @@
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/core/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/core/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
-      }
-    },
     "node_modules/@octokit/endpoint": {
       "version": "9.0.6",
       "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
@@ -221,21 +218,6 @@
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/endpoint/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
-      }
-    },
     "node_modules/@octokit/graphql": {
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.1.1.tgz",
@@ -250,27 +232,12 @@
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/graphql/node_modules/@octokit/openapi-types": {
+    "node_modules/@octokit/openapi-types": {
       "version": "24.2.0",
       "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
       "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
       "license": "MIT"
     },
-    "node_modules/@octokit/graphql/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
-      }
-    },
-    "node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
-      "license": "MIT"
-    },
     "node_modules/@octokit/plugin-paginate-rest": {
       "version": "9.2.2",
       "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
@@ -286,6 +253,21 @@
         "@octokit/core": "5"
       }
     },
+    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^20.0.0"
+      }
+    },
     "node_modules/@octokit/plugin-rest-endpoint-methods": {
       "version": "10.4.1",
       "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
@@ -301,6 +283,21 @@
         "@octokit/core": "5"
       }
     },
+    "node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^20.0.0"
+      }
+    },
     "node_modules/@octokit/plugin-retry": {
       "version": "6.1.0",
       "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-6.1.0.tgz",
@@ -318,21 +315,6 @@
         "@octokit/core": "5"
       }
     },
-    "node_modules/@octokit/plugin-retry/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/plugin-retry/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
-      }
-    },
     "node_modules/@octokit/request": {
       "version": "8.4.1",
       "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
@@ -362,43 +344,13 @@
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
-      }
-    },
-    "node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/request/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
-      }
-    },
     "node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
+        "@octokit/openapi-types": "^24.2.0"
       }
     },
     "node_modules/@peculiar/asn1-cms": {
@@ -1673,9 +1625,10 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.23.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
-      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "version": "6.21.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.21.3.tgz",
+      "integrity": "sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=18.17"

packages/attest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/attest",
-  "version": "2.2.1",
+  "version": "2.2.0",
   "description": "Actions attestation lib",
   "keywords": [
     "github",
@@ -39,12 +39,12 @@
     "@sigstore/rekor-types": "^3.0.0",
     "@types/jsonwebtoken": "^9.0.6",
     "nock": "^13.5.1",
-    "undici": "^6.23.0"
+    "undici": "^6.20.0"
   },
   "dependencies": {
     "@actions/core": "^2.0.2",
     "@actions/github": "^7.0.0",
-    "@actions/http-client": "^3.0.2",
+    "@actions/http-client": "^3.0.1",
     "@octokit/plugin-retry": "^6.0.1",
     "@sigstore/bundle": "^3.1.0",
     "@sigstore/sign": "^3.1.0",

packages/cache/RELEASES.md

@@ -1,28 +1,15 @@
 # @actions/cache Releases
 
-## 6.0.0
-
-- **Breaking change**: Package is now ESM-only
-  - CommonJS consumers must use dynamic `import()` instead of `require()`
-
-## 5.0.5
-
-- Bump `@actions/glob` to `0.5.1`
-
-## 5.0.4
-
-- Bump `@actions/http-client` to `3.0.2`
-
-## 5.0.3
+### 5.0.3
 
 Prevent retries for rate limited cache operations [2243](https://github.com/actions/toolkit/pull/2243).
 
-## 5.0.1
+### 5.0.1
 
 - Fix Node.js 24 punycode deprecation warning by updating `@azure/storage-blob` from `^12.13.0` to `^12.29.1` [#2213](https://github.com/actions/toolkit/pull/2213)
 - Newer storage-blob uses `@azure/core-rest-pipeline` instead of deprecated `@azure/core-http`, which eliminates the transitive dependency on `node-fetch@2` → `whatwg-url@5` → `tr46@0.0.3` that used the deprecated punycode module
 
-## 5.0.0
+### 5.0.0
 
 - Remove `@azure/ms-rest-js` dependency [#2197](https://github.com/actions/toolkit/pull/2197)
   - The `TransferProgressEvent` type is now imported from `@azure/core-rest-pipeline` instead of `@azure/ms-rest-js`
@@ -34,15 +21,15 @@ Prevent retries for rate limited cache operations [2243](https://github.com/acti
 - Add support for Node.js 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Add `node-fetch` override to resolve audit vulnerabilities [#2110](https://github.com/actions/toolkit/pull/2110)
 
-## 4.1.0
+### 4.1.0
 
 - Remove client side 10GiB cache size limit check & update twirp client [#2118](https://github.com/actions/toolkit/pull/2118)
 
-## 4.0.5
+### 4.0.5
 
 - Reintroduce @protobuf-ts/runtime-rpc as a runtime dependency [#2113](https://github.com/actions/toolkit/pull/2113)
 
-## 4.0.4
+### 4.0.4
 
 ⚠️ Faulty patch release. Upgrade to 4.0.5 instead.
 
@@ -51,23 +38,23 @@ Prevent retries for rate limited cache operations [2243](https://github.com/acti
 - Enhanced server error handling: 5xx HTTP errors are now logged as errors instead of warnings [#2099](https://github.com/actions/toolkit/pull/2099)
 - Fixed cache hit logging to properly distinguish between exact key matches and restore key matches [#2101](https://github.com/actions/toolkit/pull/2101)
 
-## 4.0.3
+### 4.0.3
 
 - Added masking for Shared Access Signature (SAS) cache entry URLs [#1982](https://github.com/actions/toolkit/pull/1982)
 - Improved debugging by logging both the cache version alongside the keys requested when a cache restore fails [#1994](https://github.com/actions/toolkit/pull/1994)
 
-## 4.0.2
+### 4.0.2
 
 - Wrap create failures in ReserveCacheError [#1966](https://github.com/actions/toolkit/pull/1966)
 
-## 4.0.1
+### 4.0.1
 
 - Remove runtime dependency on `twirp-ts` [#1947](https://github.com/actions/toolkit/pull/1947)
 - Cache miss as debug, not warning annotation [#1954](https://github.com/actions/toolkit/pull/1954)
 
-## 4.0.0
+### 4.0.0
 
-### Important changes
+#### Important changes
 
 The cache backend service has been rewritten from the ground up for improved performance and reliability. The [@actions/cache](https://github.com/actions/toolkit/tree/main/packages/cache) package now integrates with the new cache service (v2) APIs.
 
@@ -81,182 +68,182 @@ Upgrading to the recommended version should not break or require any changes to
 
 Read more about the change & access the migration guide: [reference to the announcement](https://github.com/actions/toolkit/discussions/1890).
 
-### Minor changes
+#### Minor changes
 
 - Update `@actions/core` to `1.11.0`
 - Update `semver` `6.3.1`
 - Add `twirp-ts` `2.5.0` to dependencies
 
-## 3.3.0
+### 3.3.0
 
 - Update `@actions/core` to `1.11.1`
 - Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824), [#1842](https://github.com/actions/toolkit/pull/1842)
 
-## 3.2.4
+### 3.2.4
 
 - Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
 
-## 3.2.3
+### 3.2.3
 
 - Fixed a bug that mutated path arguments to `getCacheVersion` [#1378](https://github.com/actions/toolkit/pull/1378)
 
-## 3.2.2
+### 3.2.2
 
 - Add new default cache download method to improve performance and reduce hangs [#1484](https://github.com/actions/toolkit/pull/1484)
 
-## 3.2.1
+### 3.2.1
 
 - Updated @azure/storage-blob to `v12.13.0`
 
-## 3.2.0
+### 3.2.0
 
 - Add `lookupOnly` to cache restore `DownloadOptions`.
 
-## 3.1.4
+### 3.1.4
 
 - Fix zstd not being used due to `zstd --version` output change in zstd 1.5.4 release. See [#1353](https://github.com/actions/toolkit/pull/1353).
 
-## 3.1.3
+### 3.1.3
 
 - Fix to prevent from setting MYSYS environement variable globally [#1329](https://github.com/actions/toolkit/pull/1329).
 
-## 3.1.2
+### 3.1.2
 
 - Fix issue with symlink restoration on windows.
 
-## 3.1.1
+### 3.1.1
 
 - Reverted changes in 3.1.0 to fix issue with symlink restoration on windows.
 - Added support for verbose logging about cache version during cache miss.
 
-## 3.1.0
+### 3.1.0
 
 - Update actions/cache on windows to use gnu tar and zstd by default
 - Update actions/cache on windows to fallback to bsdtar and zstd if gnu tar is not available.
 - Added support for fallback to gzip to restore old caches on windows.
 
-## 3.1.0-beta.3
+### 3.1.0-beta.3
 
 - Bug Fixes for fallback to gzip to restore old caches on windows and bsdtar if gnutar is not available.
 
-## 3.1.0-beta.2
+### 3.1.0-beta.2
 
 - Added support for fallback to gzip to restore old caches on windows.
 
-## 3.0.6
+### 3.0.6
 
 - Added `@azure/abort-controller` to dependencies to fix compatibility issue with ESM [#1208](https://github.com/actions/toolkit/issues/1208)
 
-## 3.0.5
+### 3.0.5
 
 - Update `@actions/cache` to use `@actions/core@^1.10.0`
 
-## 3.0.4
+### 3.0.4
 
 - Fix zstd not working for windows on gnu tar in issues [#888](https://github.com/actions/cache/issues/888) and [#891](https://github.com/actions/cache/issues/891).
 - Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable `SEGMENT_DOWNLOAD_TIMEOUT_MINS`. Default is 60 minutes.
 
-## 3.0.3
+### 3.0.3
 
 - Bug fixes for download stuck issue [#810](https://github.com/actions/cache/issues/810).
 
-## 3.0.2
+### 3.0.2
 
 - Added 1 hour timeout for the download stuck issue [#810](https://github.com/actions/cache/issues/810).
 
-## 3.0.1
+### 3.0.1
 
 - Fix [#833](https://github.com/actions/cache/issues/833) - cache doesn't work with github workspace directory.
 - Fix [#809](https://github.com/actions/cache/issues/809) `zstd -d: no such file or directory` error on AWS self-hosted runners.
 
-## 3.0.0
+### 3.0.0
 
 - Updated actions/cache to suppress Actions cache server error and log warning for those error  [#1122](https://github.com/actions/toolkit/pull/1122)
 
-## 2.0.6
+### 2.0.6
 
 - Fix `Tar failed with error: The process '/usr/bin/tar' failed with exit code 1` issue when temp directory where tar is getting created is actually the subdirectory of the path mentioned by the user for caching. ([issue](https://github.com/actions/cache/issues/689))
 
-## 2.0.5
+### 2.0.5
 
 - Fix to avoid saving empty cache when no files are available for caching. ([issue](https://github.com/actions/cache/issues/624))
 
-## 2.0.4
+### 2.0.4
 
 - Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
 
-## 2.0.3
+### 2.0.3
 
 - Update to v2.0.0 of `@actions/http-client`
 
-## 2.0.0
+### 2.0.0
 
 - Added support to check if Actions cache service feature is available or not [#1028](https://github.com/actions/toolkit/pull/1028)
 
-## 1.0.11
+### 1.0.11
 
 - Fix file downloads > 2GB([issue](https://github.com/actions/cache/issues/773))
 
-## 1.0.10
+### 1.0.10
 
 - Update `lockfileVersion` to `v2` in `package-lock.json [#1022](https://github.com/actions/toolkit/pull/1022)
 
-## 1.0.9
+### 1.0.9
 
 - Use @azure/ms-rest-js v2.6.0
 - Use @azure/storage-blob v12.8.0
 
-## 1.0.8
+### 1.0.8
 
 - Increase the allowed artifact cache size from 5GB to 10GB ([issue](https://github.com/actions/cache/discussions/497))
 
-## 1.0.7
+### 1.0.7
 
 - Fixes permissions issue extracting archives with GNU tar on macOS ([issue](https://github.com/actions/cache/issues/527))
 
-## 1.0.6
+### 1.0.6
 
 - Make caching more verbose [#650](https://github.com/actions/toolkit/pull/650)
 - Use GNU tar on macOS if available [#701](https://github.com/actions/toolkit/pull/701)
 
-## 1.0.5
+### 1.0.5
 
 - Fix to ensure Windows cache paths get resolved correctly
 
-## 1.0.4
+### 1.0.4
 
 - Use @actions/core v1.2.6
 - Fixes uploadChunk to throw an error if any unsuccessful response code is received
 
-## 1.0.3
+### 1.0.3
 
 - Use http-client v1.0.9
 - Fixes error handling so retries are not attempted on non-retryable errors (409 Conflict, for example)
 - Adds 5 second delay between retry attempts
 
-## 1.0.2
+### 1.0.2
 
 - Use posix archive format to add support for some tools
 
-## 1.0.1
+### 1.0.1
 
 - Fix bug in downloading large files (> 2 GBs) with the Azure SDK
 
-## 1.0.0
+### 1.0.0
 
 - Downloads Azure-hosted caches using the Azure SDK for speed and reliability
 - Displays download progress
 - Includes changes that break compatibility with earlier versions, including:
   - `retry`, `retryTypedResponse`, and `retryHttpClientResponse` moved from `cacheHttpClient` to `requestUtils`
 
-## 0.2.1
+### 0.2.1
 
 - Fix to await async function getCompressionMethod
   
-## 0.2.0
+### 0.2.0
 
 - Fixes issues with the zstd compression algorithm on Windows and Ubuntu 16.04 [#469](https://github.com/actions/toolkit/pull/469)
   
-## 0.1.0
+### 0.1.0
 
 - Initial release

packages/cache/__tests__/__fixtures__/action.yml

@@ -1,5 +1,5 @@
 name: 'Set env variables'
 description: 'Sets certain env variables so that e2e restore and save cache can be tested in a shell'
 runs:
-  using: 'node20'
+  using: 'node12'
   main: 'index.js'

packages/cache/__tests__/__fixtures__/index.js

@@ -1,9 +1,8 @@
 // Certain env variables are not set by default in a shell context and are only available in a node context from a running action
 // In order to be able to restore and save cache e2e in a shell when running CI tests, we need these env variables set
-import fs from 'fs'
-import os from 'os'
-
-const filePath = process.env['GITHUB_ENV']
+const fs = require('fs');
+const os = require('os');
+const filePath = process.env[`GITHUB_ENV`]
 fs.appendFileSync(filePath, `ACTIONS_CACHE_SERVICE_V2=true${os.EOL}`, {
     encoding: 'utf8'
 })

packages/cache/__tests__/restore-cache.mjs

@@ -1,45 +0,0 @@
-#!/usr/bin/env node
-// Helper script to restore cache for e2e testing
-import * as cache from '../lib/cache.js'
-
-const [prefix, runId, useAzureSdk] = process.argv.slice(2)
-
-if (!prefix || !runId) {
-  console.error('Usage: restore-cache.mjs <prefix> <runId> [useAzureSdk]')
-  process.exit(1)
-}
-
-const key = `test-${prefix}-${runId}`
-const paths = ['test-cache', '~/test-cache']
-const options = {useAzureSdk: useAzureSdk !== 'false'}
-
-console.log(`Restoring cache with key: ${key}`)
-console.log(`Paths: ${paths.join(', ')}`)
-console.log(`Using Azure SDK: ${options.useAzureSdk}`)
-
-const maxRetries = 3
-const retryDelayMs = 5000
-
-for (let attempt = 1; attempt <= maxRetries; attempt++) {
-  try {
-    console.log(`Attempt ${attempt} of ${maxRetries}`)
-    const restoredKey = await cache.restoreCache(paths, key, [], options)
-
-    if (restoredKey) {
-      console.log(`Cache restored with key: ${restoredKey}`)
-      process.exit(0)
-    } else {
-      console.log('Cache not found on this attempt')
-    }
-  } catch (error) {
-    console.error(`Error on attempt ${attempt}:`, error.message)
-  }
-
-  if (attempt < maxRetries) {
-    console.log(`Waiting ${retryDelayMs / 1000}s before retry...`)
-    await new Promise(resolve => setTimeout(resolve, retryDelayMs))
-  }
-}
-
-console.error(`Failed to restore cache after ${maxRetries} attempts`)
-process.exit(1)

packages/cache/__tests__/save-cache.mjs

@@ -1,24 +0,0 @@
-#!/usr/bin/env node
-// Helper script to save cache for e2e testing
-import * as cache from '../lib/cache.js'
-
-const [prefix, runId] = process.argv.slice(2)
-
-if (!prefix || !runId) {
-  console.error('Usage: save-cache.mjs <prefix> <runId>')
-  process.exit(1)
-}
-
-const key = `test-${prefix}-${runId}`
-const paths = ['test-cache', '~/test-cache']
-
-console.log(`Saving cache with key: ${key}`)
-console.log(`Paths: ${paths.join(', ')}`)
-
-try {
-  const cacheId = await cache.saveCache(paths, key)
-  console.log(`Cache saved with ID: ${cacheId}`)
-} catch (error) {
-  console.error('Error saving cache:', error)
-  process.exit(1)
-}

packages/cache/package-lock.json

@@ -1,86 +1,122 @@
 {
   "name": "@actions/cache",
-  "version": "6.0.0",
+  "version": "5.0.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/cache",
-      "version": "6.0.0",
+      "version": "5.0.2",
       "license": "MIT",
       "dependencies": {
-        "@actions/core": "^3.0.0",
-        "@actions/exec": "^3.0.0",
-        "@actions/glob": "^0.6.1",
-        "@actions/http-client": "^4.0.0",
-        "@actions/io": "^3.0.0",
+        "@actions/core": "^2.0.0",
+        "@actions/exec": "^2.0.0",
+        "@actions/glob": "^0.5.0",
+        "@actions/http-client": "^3.0.1",
+        "@actions/io": "^2.0.0",
+        "@azure/abort-controller": "^1.1.0",
         "@azure/core-rest-pipeline": "^1.22.0",
-        "@azure/storage-blob": "^12.30.0",
+        "@azure/storage-blob": "^12.29.1",
         "@protobuf-ts/runtime-rpc": "^2.11.1",
-        "semver": "^7.7.3"
+        "semver": "^6.3.1"
       },
       "devDependencies": {
         "@protobuf-ts/plugin": "^2.9.4",
-        "@types/node": "^25.1.0",
-        "@types/semver": "^7.7.1",
+        "@types/node": "^24.1.0",
+        "@types/semver": "^6.0.0",
         "typescript": "^5.2.2"
       }
     },
     "node_modules/@actions/core": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.0.tgz",
-      "integrity": "sha512-zYt6cz+ivnTmiT/ksRVriMBOiuoUpDCJJlZ5KPl2/FRdvwU3f7MPh9qftvbkXJThragzUZieit2nyHUyw53Seg==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.1.tgz",
+      "integrity": "sha512-oBfqT3GwkvLlo1fjvhQLQxuwZCGTarTE5OuZ2Wg10hvhBj7LRIlF611WT4aZS6fDhO5ZKlY7lCAZTlpmyaHaeg==",
       "license": "MIT",
       "dependencies": {
-        "@actions/exec": "^3.0.0",
-        "@actions/http-client": "^4.0.0"
+        "@actions/exec": "^2.0.0",
+        "@actions/http-client": "^3.0.0"
       }
     },
     "node_modules/@actions/exec": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-3.0.0.tgz",
-      "integrity": "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz",
+      "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==",
       "license": "MIT",
       "dependencies": {
-        "@actions/io": "^3.0.2"
+        "@actions/io": "^2.0.0"
       }
     },
     "node_modules/@actions/glob": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.6.1.tgz",
-      "integrity": "sha512-K4+2Ac5ILcf2ySdJCha+Pop9NcKjxqCL4xL4zI50dgB2PbXgC0+AcP011xfH4Of6b4QEJJg8dyZYv7zl4byTsw==",
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.5.0.tgz",
+      "integrity": "sha512-tST2rjPvJLRZLuT9NMUtyBjvj9Yo0MiJS3ow004slMvm8GFM+Zv9HvMJ7HWzfUyJnGrJvDsYkWBaaG3YKXRtCw==",
       "license": "MIT",
       "dependencies": {
-        "@actions/core": "^3.0.0",
+        "@actions/core": "^1.9.1",
         "minimatch": "^3.0.4"
       }
     },
-    "node_modules/@actions/http-client": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.0.tgz",
-      "integrity": "sha512-QuwPsgVMsD6qaPD57GLZi9sqzAZCtiJT8kVBCDpLtxhL5MydQ4gS+DrejtZZPdIYyB1e95uCK9Luyds7ybHI3g==",
+    "node_modules/@actions/glob/node_modules/@actions/core": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "license": "MIT",
+      "dependencies": {
+        "@actions/exec": "^1.1.1",
+        "@actions/http-client": "^2.0.1"
+      }
+    },
+    "node_modules/@actions/glob/node_modules/@actions/exec": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
+      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
+      "license": "MIT",
+      "dependencies": {
+        "@actions/io": "^1.0.1"
+      }
+    },
+    "node_modules/@actions/glob/node_modules/@actions/http-client": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
+      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",
-        "undici": "^6.23.0"
+        "undici": "^5.25.4"
+      }
+    },
+    "node_modules/@actions/glob/node_modules/@actions/io": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
+      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
+      "license": "MIT"
+    },
+    "node_modules/@actions/http-client": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.1.tgz",
+      "integrity": "sha512-SbGS8c/vySbNO3kjFgSW77n83C4MQx/Yoe+b1hAdpuvfHxnkHzDq2pWljUpAA56Si1Gae/7zjeZsV0CYjmLo/w==",
+      "license": "MIT",
+      "dependencies": {
+        "tunnel": "^0.0.6",
+        "undici": "^5.28.5"
       }
     },
     "node_modules/@actions/io": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
-      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
+      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
       "license": "MIT"
     },
     "node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-1.1.0.tgz",
+      "integrity": "sha512-TrRLIoSQVzfAJX9H1JeFjzAoDGcoK1IYX1UImfceTZpsyYfWr09Ss1aHW1y5TrrR3iq6RZLBwJ3E24uwPhwahw==",
       "license": "MIT",
       "dependencies": {
-        "tslib": "^2.6.2"
+        "tslib": "^2.2.0"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=12.0.0"
       }
     },
     "node_modules/@azure/core-auth": {
@@ -97,6 +133,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/core-auth/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-client": {
       "version": "1.10.1",
       "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.10.1.tgz",
@@ -115,6 +163,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/core-client/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-http-compat": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/@azure/core-http-compat/-/core-http-compat-2.3.1.tgz",
@@ -129,6 +189,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/core-http-compat/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-lro": {
       "version": "2.7.2",
       "resolved": "https://registry.npmjs.org/@azure/core-lro/-/core-lro-2.7.2.tgz",
@@ -144,6 +216,18 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@azure/core-lro/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-paging": {
       "version": "1.6.2",
       "resolved": "https://registry.npmjs.org/@azure/core-paging/-/core-paging-1.6.2.tgz",
@@ -174,6 +258,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/core-rest-pipeline/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-tracing": {
       "version": "1.3.1",
       "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.3.1.tgz",
@@ -200,6 +296,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/core-util/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-xml": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/@azure/core-xml/-/core-xml-1.5.0.tgz",
@@ -227,9 +335,9 @@
       }
     },
     "node_modules/@azure/storage-blob": {
-      "version": "12.30.0",
-      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.30.0.tgz",
-      "integrity": "sha512-peDCR8blSqhsAKDbpSP/o55S4sheNwSrblvCaHUZ5xUI73XA7ieUGGwrONgD/Fng0EoDe1VOa3fAQ7+WGB3Ocg==",
+      "version": "12.29.1",
+      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.29.1.tgz",
+      "integrity": "sha512-7ktyY0rfTM0vo7HvtK6E3UvYnI9qfd6Oz6z/+92VhGRveWng3kJwMKeUpqmW/NmwcDNbxHpSlldG+vsUnRFnBg==",
       "license": "MIT",
       "dependencies": {
         "@azure/abort-controller": "^2.1.2",
@@ -243,7 +351,7 @@
         "@azure/core-util": "^1.11.0",
         "@azure/core-xml": "^1.4.5",
         "@azure/logger": "^1.1.4",
-        "@azure/storage-common": "^12.2.0",
+        "@azure/storage-common": "^12.1.1",
         "events": "^3.0.0",
         "tslib": "^2.8.1"
       },
@@ -251,10 +359,22 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/storage-blob/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/storage-common": {
-      "version": "12.2.0",
-      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.2.0.tgz",
-      "integrity": "sha512-YZLxiJ3vBAAnFbG3TFuAMUlxZRexjQX5JDQxOkFGb6e2TpoxH3xyHI6idsMe/QrWtj41U/KoqBxlayzhS+LlwA==",
+      "version": "12.1.1",
+      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.1.1.tgz",
+      "integrity": "sha512-eIOH1pqFwI6UmVNnDQvmFeSg0XppuzDLFeUNO/Xht7ODAzRLgGDh7h550pSxoA+lPDxBl1+D2m/KG3jWzCUjTg==",
       "license": "MIT",
       "dependencies": {
         "@azure/abort-controller": "^2.1.2",
@@ -271,6 +391,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/storage-common/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@bufbuild/protobuf": {
       "version": "2.10.1",
       "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.10.1.tgz",
@@ -304,6 +436,15 @@
         "node": ">=14.17"
       }
     },
+    "node_modules/@fastify/busboy": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
+      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@protobuf-ts/plugin": {
       "version": "2.11.1",
       "resolved": "https://registry.npmjs.org/@protobuf-ts/plugin/-/plugin-2.11.1.tgz",
@@ -363,9 +504,9 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "25.1.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.1.0.tgz",
-      "integrity": "sha512-t7frlewr6+cbx+9Ohpl0NOTKXZNV9xHRmNOvql47BFJKcEG1CxtxlPEEe+gR9uhVWM4DwhnvTF110mIL4yP9RA==",
+      "version": "24.10.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.2.tgz",
+      "integrity": "sha512-WOhQTZ4G8xZ1tjJTvKOpyEVSGgOTvJAfDK3FNFgELyaTpzhdgHVHeqW8V+UJvzF5BT+/B54T/1S2K6gd9c7bbA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -373,9 +514,9 @@
       }
     },
     "node_modules/@types/semver": {
-      "version": "7.7.1",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.1.tgz",
-      "integrity": "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==",
+      "version": "6.2.7",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-6.2.7.tgz",
+      "integrity": "sha512-blctEWbzUFzQx799RZjzzIdBJOXmE37YYEyDtKkx5Dg+V7o/zyyAxLPiI98A2jdTtDgxZleMdfV+7p8WbRJ1OQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -526,15 +667,12 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
       }
     },
     "node_modules/strnum": {
@@ -579,12 +717,15 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.23.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
-      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
       "license": "MIT",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
       "engines": {
-        "node": ">=18.17"
+        "node": ">=14.0"
       }
     },
     "node_modules/undici-types": {

packages/cache/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@actions/cache",
-  "version": "6.0.0",
+  "version": "5.0.3",
+  "preview": true,
   "description": "Actions cache lib",
   "keywords": [
     "github",
@@ -9,15 +10,8 @@
   ],
   "homepage": "https://github.com/actions/toolkit/tree/main/packages/cache",
   "license": "MIT",
-  "type": "module",
   "main": "lib/cache.js",
   "types": "lib/cache.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/cache.d.ts",
-      "import": "./lib/cache.js"
-    }
-  },
   "directories": {
     "lib": "lib",
     "test": "__tests__"
@@ -37,30 +31,31 @@
   "scripts": {
     "audit-moderate": "npm install && npm audit --json --audit-level=moderate > audit.json",
     "test": "echo \"Error: run tests from root\" && exit 1",
-    "tsc": "tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/"
+    "tsc": "tsc"
   },
   "bugs": {
     "url": "https://github.com/actions/toolkit/issues"
   },
   "dependencies": {
-    "@actions/core": "^3.0.0",
-    "@actions/exec": "^3.0.0",
-    "@actions/glob": "^0.6.1",
-    "@actions/http-client": "^4.0.0",
-    "@actions/io": "^3.0.0",
-    "@azure/core-rest-pipeline": "^1.22.0",
-    "@azure/storage-blob": "^12.30.0",
+    "@actions/core": "^2.0.0",
+    "@actions/exec": "^2.0.0",
+    "@actions/glob": "^0.5.0",
     "@protobuf-ts/runtime-rpc": "^2.11.1",
-    "semver": "^7.7.3"
+    "@actions/http-client": "^3.0.1",
+    "@actions/io": "^2.0.0",
+    "@azure/abort-controller": "^1.1.0",
+    "@azure/core-rest-pipeline": "^1.22.0",
+    "@azure/storage-blob": "^12.29.1",
+    "semver": "^6.3.1"
   },
   "devDependencies": {
+    "@types/node": "^24.1.0",
+    "@types/semver": "^6.0.0",
     "@protobuf-ts/plugin": "^2.9.4",
-    "@types/node": "^25.1.0",
-    "@types/semver": "^7.7.1",
     "typescript": "^5.2.2"
   },
   "overrides": {
     "uri-js": "npm:uri-js-replace@^1.0.1",
     "node-fetch": "^3.3.2"
   }
-}
+}

packages/cache/src/cache.ts

@@ -1,20 +1,18 @@
 import * as core from '@actions/core'
 import * as path from 'path'
-import * as utils from './internal/cacheUtils.js'
-import * as cacheHttpClient from './internal/cacheHttpClient.js'
-import * as cacheTwirpClient from './internal/shared/cacheTwirpClient.js'
-import {getCacheServiceVersion, isGhes} from './internal/config.js'
-import {DownloadOptions, UploadOptions} from './options.js'
-import {createTar, extractTar, listTar} from './internal/tar.js'
+import * as utils from './internal/cacheUtils'
+import * as cacheHttpClient from './internal/cacheHttpClient'
+import * as cacheTwirpClient from './internal/shared/cacheTwirpClient'
+import {getCacheServiceVersion, isGhes} from './internal/config'
+import {DownloadOptions, UploadOptions} from './options'
+import {createTar, extractTar, listTar} from './internal/tar'
 import {
   CreateCacheEntryRequest,
   FinalizeCacheEntryUploadRequest,
   FinalizeCacheEntryUploadResponse,
   GetCacheEntryDownloadURLRequest
-} from './generated/results/api/v1/cache.js'
+} from './generated/results/api/v1/cache'
 import {HttpClientError} from '@actions/http-client'
-
-export type {DownloadOptions, UploadOptions}
 export class ValidationError extends Error {
   constructor(message: string) {
     super(message)

packages/cache/src/generated/results/api/v1/cache.ts

@@ -12,7 +12,7 @@ import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
-import { CacheMetadata } from "../../entities/v1/cachemetadata.js";
+import { CacheMetadata } from "../../entities/v1/cachemetadata";
 /**
  * @generated from protobuf message github.actions.results.api.v1.CreateCacheEntryRequest
  */

packages/cache/src/generated/results/api/v1/cache.twirp-client.ts

@@ -5,7 +5,7 @@ import {
     FinalizeCacheEntryUploadResponse,
     GetCacheEntryDownloadURLRequest,
     GetCacheEntryDownloadURLResponse,
-  } from "./cache.js";
+  } from "./cache";
   
   //==================================//
   //          Client Code             //

packages/cache/src/generated/results/entities/v1/cachemetadata.ts

@@ -11,7 +11,7 @@ import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
-import { CacheScope } from "./cachescope.js";
+import { CacheScope } from "./cachescope";
 /**
  * @generated from protobuf message github.actions.results.entities.v1.CacheMetadata
  */

packages/cache/src/internal/cacheHttpClient.ts

@@ -7,8 +7,8 @@ import {
 } from '@actions/http-client/lib/interfaces'
 import * as fs from 'fs'
 import {URL} from 'url'
-import * as utils from './cacheUtils.js'
-import {uploadCacheArchiveSDK} from './uploadUtils.js'
+import * as utils from './cacheUtils'
+import {uploadCacheArchiveSDK} from './uploadUtils'
 import {
   ArtifactCacheEntry,
   InternalCacheOptions,
@@ -17,25 +17,25 @@ import {
   ReserveCacheResponse,
   ITypedResponseWithError,
   ArtifactCacheList
-} from './contracts.js'
+} from './contracts'
 import {
   downloadCacheHttpClient,
   downloadCacheHttpClientConcurrent,
   downloadCacheStorageSDK
-} from './downloadUtils.js'
+} from './downloadUtils'
 import {
   DownloadOptions,
   UploadOptions,
   getDownloadOptions,
   getUploadOptions
-} from '../options.js'
+} from '../options'
 import {
   isSuccessStatusCode,
   retryHttpClientResponse,
   retryTypedResponse
-} from './requestUtils.js'
-import {getCacheServiceURL} from './config.js'
-import {getUserAgentString} from './shared/user-agent.js'
+} from './requestUtils'
+import {getCacheServiceURL} from './config'
+import {getUserAgentString} from './shared/user-agent'
 
 function getCacheApiUrl(resource: string): string {
   const baseUrl: string = getCacheServiceURL()

packages/cache/src/internal/cacheUtils.ts

@@ -11,7 +11,7 @@ import {
   CacheFilename,
   CompressionMethod,
   GnuTarPathOnWindows
-} from './constants.js'
+} from './constants'
 
 const versionSalt = '1.0'
 

packages/cache/src/internal/contracts.d.ts

@@ -1,4 +1,4 @@
-import {CompressionMethod} from './constants.js'
+import {CompressionMethod} from './constants'
 import {TypedResponse} from '@actions/http-client/lib/interfaces'
 import {HttpClientError} from '@actions/http-client'
 

packages/cache/src/internal/downloadUtils.ts

@@ -7,10 +7,12 @@ import * as fs from 'fs'
 import * as stream from 'stream'
 import * as util from 'util'
 
-import * as utils from './cacheUtils.js'
-import {SocketTimeout} from './constants.js'
-import {DownloadOptions} from '../options.js'
-import {retryHttpClientResponse} from './requestUtils.js'
+import * as utils from './cacheUtils'
+import {SocketTimeout} from './constants'
+import {DownloadOptions} from '../options'
+import {retryHttpClientResponse} from './requestUtils'
+
+import {AbortController} from '@azure/abort-controller'
 
 /**
  * Pipes the body of a HTTP response to a stream

packages/cache/src/internal/requestUtils.ts

@@ -4,8 +4,8 @@ import {
   HttpClientError,
   HttpClientResponse
 } from '@actions/http-client'
-import {DefaultRetryDelay, DefaultRetryAttempts} from './constants.js'
-import {ITypedResponseWithError} from './contracts.js'
+import {DefaultRetryDelay, DefaultRetryAttempts} from './constants'
+import {ITypedResponseWithError} from './contracts'
 
 export function isSuccessStatusCode(statusCode?: number): boolean {
   if (!statusCode) {

packages/cache/src/internal/shared/cacheTwirpClient.ts

@@ -1,12 +1,12 @@
 import {info, debug, warning} from '@actions/core'
-import {getUserAgentString} from './user-agent.js'
-import {NetworkError, RateLimitError, UsageError} from './errors.js'
-import {getCacheServiceURL} from '../config.js'
-import {getRuntimeToken} from '../cacheUtils.js'
+import {getUserAgentString} from './user-agent'
+import {NetworkError, RateLimitError, UsageError} from './errors'
+import {getCacheServiceURL} from '../config'
+import {getRuntimeToken} from '../cacheUtils'
 import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
 import {HttpClient, HttpClientResponse, HttpCodes} from '@actions/http-client'
-import {CacheServiceClientJSON} from '../../generated/results/api/v1/cache.twirp-client.js'
-import {maskSecretUrls} from './util.js'
+import {CacheServiceClientJSON} from '../../generated/results/api/v1/cache.twirp-client'
+import {maskSecretUrls} from './util'
 
 // The twirp http client must implement this interface
 interface Rpc {

packages/cache/src/internal/shared/package-version.cjs

@@ -1,7 +0,0 @@
-// This file exists as a CommonJS module to read the version from package.json.
-// In an ESM package, using `require()` directly in .ts files requires disabling
-// ESLint rules and doesn't work reliably across all Node.js versions.
-// By keeping this as a .cjs file, we can use require() naturally and export
-// the version for the ESM modules to import.
-const packageJson = require('../../../package.json')
-module.exports = { version: packageJson.version }

packages/cache/src/internal/shared/user-agent.ts

@@ -1,8 +1,9 @@
-import {version} from './package-version.cjs'
+// eslint-disable-next-line @typescript-eslint/no-var-requires, @typescript-eslint/no-require-imports
+const packageJson = require('../../../package.json')
 
 /**
  * Ensure that this User Agent String is used in all HTTP calls so that we can monitor telemetry between different versions of this package
  */
 export function getUserAgentString(): string {
-  return `@actions/cache-${version}`
+  return `@actions/cache-${packageJson.version}`
 }

packages/cache/src/internal/tar.ts

@@ -2,15 +2,15 @@ import {exec} from '@actions/exec'
 import * as io from '@actions/io'
 import {existsSync, writeFileSync} from 'fs'
 import * as path from 'path'
-import * as utils from './cacheUtils.js'
-import {ArchiveTool} from './contracts.js'
+import * as utils from './cacheUtils'
+import {ArchiveTool} from './contracts'
 import {
   CompressionMethod,
   SystemTarPathOnWindows,
   ArchiveToolType,
   TarFilename,
   ManifestFilename
-} from './constants.js'
+} from './constants'
 
 const IS_WINDOWS = process.platform === 'win32'
 

packages/cache/src/internal/uploadUtils.ts

@@ -6,8 +6,8 @@ import {
   BlockBlobParallelUploadOptions
 } from '@azure/storage-blob'
 import {TransferProgressEvent} from '@azure/core-rest-pipeline'
-import {InvalidResponseError} from './shared/errors.js'
-import {UploadOptions} from '../options.js'
+import {InvalidResponseError} from './shared/errors'
+import {UploadOptions} from '../options'
 
 /**
  * Class for tracking the upload state and displaying stats.

packages/cache/tsconfig.json

@@ -4,8 +4,6 @@
     "baseUrl": "./",
     "outDir": "./lib",
     "rootDir": "./src",
-    "module": "node16",
-    "moduleResolution": "node16",
     "lib": [
       "es6",
       "dom"

packages/core/RELEASES.md

@@ -1,99 +1,70 @@
 # @actions/core Releases
 
-## 3.0.0
-
-- **Breaking change**: Package is now ESM-only
-  - CommonJS consumers must use dynamic `import()` instead of `require()`
-
-## 2.0.3
-
-- Bump `@actions/http-client` to `3.0.2`
-
 ## 2.0.1
-
 - Bump @actions/exec from 1.1.1 to 2.0.0 [#2199](https://github.com/actions/toolkit/pull/2199)
 
 ## 2.0.0
-
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Bump @actions/http-client from 2.0.1 to 3.0.0
 
 ## 1.11.1
-
 - Fix uses of `crypto.randomUUID` on Node 18 and earlier [#1842](https://github.com/actions/toolkit/pull/1842)
 
 ### 1.11.0
-
 - Add platform info utilities [#1551](https://github.com/actions/toolkit/pull/1551)
 - Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824)
 
 ### 1.10.1
-
 - Fix error message reference in oidc utils [#1511](https://github.com/actions/toolkit/pull/1511)
 
 ### 1.10.0
-
 - `saveState` and `setOutput` now use environment files if available [#1178](https://github.com/actions/toolkit/pull/1178)
 - `getMultilineInput` now correctly trims whitespace by default [#1185](https://github.com/actions/toolkit/pull/1185)
 
 ### 1.9.1
-
 - Randomize delimiter when calling `core.exportVariable`
 
 ### 1.9.0
-
 - Added `toPosixPath`, `toWin32Path` and `toPlatformPath` utilities [#1102](https://github.com/actions/toolkit/pull/1102)
 
 ### 1.8.2
-
 - Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
 
 ### 1.8.1
-
 - Update to v2.0.0 of `@actions/http-client`
 
 ### 1.8.0
-
 - Deprecate `markdownSummary` extension export in favor of `summary`
-  - <https://github.com/actions/toolkit/pull/1072>
-  - <https://github.com/actions/toolkit/pull/1073>
+  - https://github.com/actions/toolkit/pull/1072
+  - https://github.com/actions/toolkit/pull/1073
 
 ### 1.7.0
-
 - [Added `markdownSummary` extension](https://github.com/actions/toolkit/pull/1014)
 
 ### 1.6.0
-
 - [Added OIDC Client function `getIDToken`](https://github.com/actions/toolkit/pull/919)
-- [Added `file` parameter to `AnnotationProperties`](https://github.com/actions/toolkit/pull/896)
+- [Added `file` parameter to `AnnotationProperties`](https://github.com/actions/toolkit/pull/896) 
 
 ### 1.5.0
-
 - [Added support for notice annotations and more annotation fields](https://github.com/actions/toolkit/pull/855)
 
 ### 1.4.0
-
 - [Added the `getMultilineInput` function](https://github.com/actions/toolkit/pull/829)
 
 ### 1.3.0
-
 - [Added the trimWhitespace option to getInput](https://github.com/actions/toolkit/pull/802)
 - [Added the getBooleanInput function](https://github.com/actions/toolkit/pull/725)
 
 ### 1.2.7
-
 - [Prepend newline for set-output](https://github.com/actions/toolkit/pull/772)
 
 ### 1.2.6
-
 - [Update `exportVariable` and `addPath` to use environment files](https://github.com/actions/toolkit/pull/571)
 
 ### 1.2.5
-
 - [Correctly bundle License File with package](https://github.com/actions/toolkit/pull/548)
 
 ### 1.2.4
-
 - [Be more lenient in accepting non-string command inputs](https://github.com/actions/toolkit/pull/405)
 - [Add Echo commands](https://github.com/actions/toolkit/pull/411)
 
@@ -114,7 +85,7 @@
 
 - saveState and getState functions for wrapper tasks (on finally entry points that run post job)
 
-### 1.1.3
+### 1.1.3 
 
 - setSecret added to register a secret with the runner to be masked from the logs
 - exportSecret which was not implemented and never worked was removed after clarification from product.

packages/core/__tests__/command.test.ts

@@ -1,4 +1,4 @@
-import * as command from '../src/command.js'
+import * as command from '../src/command'
 import * as os from 'os'
 
 /* eslint-disable @typescript-eslint/unbound-method */

packages/core/__tests__/core.test.ts

@@ -1,9 +1,9 @@
 import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
-import * as core from '../src/core.js'
+import * as core from '../src/core'
 import {HttpClient} from '@actions/http-client'
-import {toCommandProperties} from '../src/utils.js'
+import {toCommandProperties} from '../src/utils'
 
 /* eslint-disable @typescript-eslint/unbound-method */
 

packages/core/__tests__/path-utils.test.ts

@@ -1,6 +1,6 @@
 import * as path from 'path'
 
-import {toPlatformPath, toPosixPath, toWin32Path} from '../src/path-utils.js'
+import {toPlatformPath, toPosixPath, toWin32Path} from '../src/path-utils'
 
 describe('#toPosixPath', () => {
   const cases: {

packages/core/__tests__/platform.test.ts

@@ -1,5 +1,5 @@
 import os from 'os'
-import {platform} from '../src/core.js'
+import {platform} from '../src/core'
 
 describe('getInfo', () => {
   it('returns the platform info', async () => {

packages/core/__tests__/summary.test.ts

@@ -1,7 +1,7 @@
 import * as fs from 'fs'
 import * as os from 'os'
 import path from 'path'
-import {summary, SUMMARY_ENV_VAR} from '../src/summary.js'
+import {summary, SUMMARY_ENV_VAR} from '../src/summary'
 
 const testDirectoryPath = path.join(__dirname, 'test')
 const testFilePath = path.join(testDirectoryPath, 'test-summary.md')

packages/core/package-lock.json

@@ -1,56 +1,62 @@
 {
   "name": "@actions/core",
-  "version": "3.0.0",
+  "version": "2.0.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/core",
-      "version": "3.0.0",
+      "version": "2.0.2",
       "license": "MIT",
       "dependencies": {
-        "@actions/exec": "^3.0.0",
-        "@actions/http-client": "^4.0.0"
+        "@actions/exec": "^2.0.0",
+        "@actions/http-client": "^3.0.1"
       },
       "devDependencies": {
-        "@types/node": "^25.1.0"
+        "@types/node": "^16.18.112"
       }
     },
     "node_modules/@actions/exec": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-3.0.0.tgz",
-      "integrity": "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz",
+      "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==",
       "license": "MIT",
       "dependencies": {
-        "@actions/io": "^3.0.2"
+        "@actions/io": "^2.0.0"
       }
     },
     "node_modules/@actions/http-client": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.0.tgz",
-      "integrity": "sha512-QuwPsgVMsD6qaPD57GLZi9sqzAZCtiJT8kVBCDpLtxhL5MydQ4gS+DrejtZZPdIYyB1e95uCK9Luyds7ybHI3g==",
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.1.tgz",
+      "integrity": "sha512-SbGS8c/vySbNO3kjFgSW77n83C4MQx/Yoe+b1hAdpuvfHxnkHzDq2pWljUpAA56Si1Gae/7zjeZsV0CYjmLo/w==",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",
-        "undici": "^6.23.0"
+        "undici": "^5.28.5"
       }
     },
     "node_modules/@actions/io": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
-      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
+      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
       "license": "MIT"
     },
-    "node_modules/@types/node": {
-      "version": "25.1.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.1.0.tgz",
-      "integrity": "sha512-t7frlewr6+cbx+9Ohpl0NOTKXZNV9xHRmNOvql47BFJKcEG1CxtxlPEEe+gR9uhVWM4DwhnvTF110mIL4yP9RA==",
-      "dev": true,
+    "node_modules/@fastify/busboy": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
+      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
       "license": "MIT",
-      "dependencies": {
-        "undici-types": "~7.16.0"
+      "engines": {
+        "node": ">=14"
       }
     },
+    "node_modules/@types/node": {
+      "version": "16.18.126",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.126.tgz",
+      "integrity": "sha512-OTcgaiwfGFBKacvfwuHzzn1KLxH/er8mluiy8/uM3sGXHaRe73RrSIj01jow9t4kJEW633Ov+cOexXeiApTyAw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/tunnel": {
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
@@ -61,20 +67,16 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.23.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
-      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
       "license": "MIT",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
       "engines": {
-        "node": ">=18.17"
+        "node": ">=14.0"
       }
-    },
-    "node_modules/undici-types": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
-      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "dev": true,
-      "license": "MIT"
     }
   }
 }

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/core",
-  "version": "3.0.0",
+  "version": "2.0.2",
   "description": "Actions core lib",
   "keywords": [
     "github",
@@ -9,15 +9,8 @@
   ],
   "homepage": "https://github.com/actions/toolkit/tree/main/packages/core",
   "license": "MIT",
-  "type": "module",
   "main": "lib/core.js",
   "types": "lib/core.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/core.d.ts",
-      "import": "./lib/core.js"
-    }
-  },
   "directories": {
     "lib": "lib",
     "test": "__tests__"
@@ -43,10 +36,10 @@
     "url": "https://github.com/actions/toolkit/issues"
   },
   "dependencies": {
-    "@actions/exec": "^3.0.0",
-    "@actions/http-client": "^4.0.0"
+    "@actions/exec": "^2.0.0",
+    "@actions/http-client": "^3.0.1"
   },
   "devDependencies": {
-    "@types/node": "^25.1.0"
+    "@types/node": "^16.18.112"
   }
 }

packages/core/src/command.ts

@@ -1,5 +1,5 @@
 import * as os from 'os'
-import {toCommandValue} from './utils.js'
+import {toCommandValue} from './utils'
 
 // For internal use, subject to change.
 

packages/core/src/core.ts

@@ -1,11 +1,11 @@
-import {issue, issueCommand} from './command.js'
-import {issueFileCommand, prepareKeyValueMessage} from './file-command.js'
-import {toCommandProperties, toCommandValue} from './utils.js'
+import {issue, issueCommand} from './command'
+import {issueFileCommand, prepareKeyValueMessage} from './file-command'
+import {toCommandProperties, toCommandValue} from './utils'
 
 import * as os from 'os'
 import * as path from 'path'
 
-import {OidcClient} from './oidc-utils.js'
+import {OidcClient} from './oidc-utils'
 
 /**
  * Interface for getInput options
@@ -400,19 +400,19 @@ export async function getIDToken(aud?: string): Promise<string> {
 /**
  * Summary exports
  */
-export {summary} from './summary.js'
+export {summary} from './summary'
 
 /**
  * @deprecated use core.summary
  */
-export {markdownSummary} from './summary.js'
+export {markdownSummary} from './summary'
 
 /**
  * Path exports
  */
-export {toPosixPath, toWin32Path, toPlatformPath} from './path-utils.js'
+export {toPosixPath, toWin32Path, toPlatformPath} from './path-utils'
 
 /**
  * Platform utilities exports
  */
-export * as platform from './platform.js'
+export * as platform from './platform'

packages/core/src/file-command.ts

@@ -6,7 +6,7 @@
 import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as os from 'os'
-import {toCommandValue} from './utils.js'
+import {toCommandValue} from './utils'
 
 export function issueFileCommand(command: string, message: any): void {
   const filePath = process.env[`GITHUB_${command}`]

packages/core/src/oidc-utils.ts

@@ -3,7 +3,7 @@ import * as actions_http_client from '@actions/http-client'
 import {RequestOptions} from '@actions/http-client/lib/interfaces'
 import {HttpClient} from '@actions/http-client'
 import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
-import {debug, setSecret} from './core.js'
+import {debug, setSecret} from './core'
 interface TokenResponse {
   value?: string
 }

packages/core/src/utils.ts

@@ -1,8 +1,8 @@
 // We use any as a valid input type
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
-import {AnnotationProperties} from './core.js'
-import {CommandProperties} from './command.js'
+import {AnnotationProperties} from './core'
+import {CommandProperties} from './command'
 
 /**
  * Sanitizes an input into a string so it can be passed into issueCommand safely

packages/core/tsconfig.json

@@ -4,9 +4,7 @@
     "baseUrl": "./",
     "outDir": "./lib",
     "declaration": true,
-    "rootDir": "./src",
-    "module": "node16",
-    "moduleResolution": "node16"
+    "rootDir": "./src"
   },
   "include": [
     "./src"

packages/exec/RELEASES.md

@@ -1,20 +1,13 @@
 # @actions/exec Releases
 
-## 3.0.0
-
-- **Breaking change**: Package is now ESM-only
-  - CommonJS consumers must use dynamic `import()` instead of `require()`
-
-## 2.0.0
-
+### 2.0.0
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Bump @actions/io dependency from ^1.0.1 to ^2.0.0
 
-## 1.1.1
+### 1.1.1
+- Update `lockfileVersion` to `v2` in `package-lock.json [#1024](https://github.com/actions/toolkit/pull/1024) 
 
-- Update `lockfileVersion` to `v2` in `package-lock.json` [#1024](https://github.com/actions/toolkit/pull/1024)
-
-## 1.1.0
+### 1.1.0
 
 - [Fix stdline dropping large output](https://github.com/actions/toolkit/pull/773)
 - [Add getExecOutput function](https://github.com/actions/toolkit/pull/814)
@@ -30,4 +23,4 @@
 
 ### 1.0.0
 
-- Initial release
+- Initial release

packages/exec/__tests__/exec.test.ts

@@ -1,5 +1,5 @@
-import * as exec from '../src/exec.js'
-import * as im from '../src/interfaces.js'
+import * as exec from '../src/exec'
+import * as im from '../src/interfaces'
 
 import * as childProcess from 'child_process'
 import * as fs from 'fs'
@@ -14,7 +14,7 @@ const IS_WINDOWS = process.platform === 'win32'
 const SPAWN_WAIT_SCRIPT = path.join(
   __dirname,
   'scripts',
-  'spawn-wait-for-file.cjs'
+  'spawn-wait-for-file.js'
 )
 
 let outstream: stream.Writable
@@ -196,7 +196,7 @@ describe('@actions/exec', () => {
     const scriptPath: string = path.join(
       __dirname,
       'scripts',
-      'stderroutput.cjs'
+      'stderroutput.js'
     )
     const nodePath: string = await io.which('node', true)
 
@@ -218,7 +218,7 @@ describe('@actions/exec', () => {
     const scriptPath: string = path.join(
       __dirname,
       'scripts',
-      'stderroutput.cjs'
+      'stderroutput.js'
     )
     const nodePath: string = await io.which('node', true)
 
@@ -255,12 +255,12 @@ describe('@actions/exec', () => {
     const stdErrPath: string = path.join(
       __dirname,
       'scripts',
-      'stderroutput.cjs'
+      'stderroutput.js'
     )
     const stdOutPath: string = path.join(
       __dirname,
       'scripts',
-      'stdoutoutput.cjs'
+      'stdoutoutput.js'
     )
     const nodePath: string = await io.which('node', true)
     let stdoutCalled = false
@@ -295,7 +295,7 @@ describe('@actions/exec', () => {
     const stdlinePath: string = path.join(
       __dirname,
       'scripts',
-      'stdlineoutput.cjs'
+      'stdlineoutput.js'
     )
     const nodePath: string = await io.which('node', true)
 
@@ -344,7 +344,7 @@ describe('@actions/exec', () => {
     const waitForInput: string = path.join(
       __dirname,
       'scripts',
-      'wait-for-input.cjs'
+      'wait-for-input.js'
     )
 
     const _testExecOptions = getExecOptions()
@@ -622,12 +622,12 @@ describe('@actions/exec', () => {
     const stdErrPath: string = path.join(
       __dirname,
       'scripts',
-      'stderroutput.cjs'
+      'stderroutput.js'
     )
     const stdOutPath: string = path.join(
       __dirname,
       'scripts',
-      'stdoutoutput.cjs'
+      'stdoutoutput.js'
     )
     const nodePath: string = await io.which('node', true)
 
@@ -653,12 +653,12 @@ describe('@actions/exec', () => {
     const stdErrPath: string = path.join(
       __dirname,
       'scripts',
-      'stderroutput.cjs'
+      'stderroutput.js'
     )
     const stdOutPath: string = path.join(
       __dirname,
       'scripts',
-      'stdoutoutput.cjs'
+      'stdoutoutput.js'
     )
 
     const nodePath: string = await io.which('node', true)
@@ -703,12 +703,12 @@ describe('@actions/exec', () => {
     const stdErrPath: string = path.join(
       __dirname,
       'scripts',
-      'stderroutput.cjs'
+      'stderroutput.js'
     )
     const stdOutPath: string = path.join(
       __dirname,
       'scripts',
-      'stdoutoutputlarge.cjs'
+      'stdoutoutputlarge.js'
     )
 
     const nodePath: string = await io.which('node', true)
@@ -753,7 +753,7 @@ describe('@actions/exec', () => {
     const stdOutPath: string = path.join(
       __dirname,
       'scripts',
-      'stdoutputspecial.cjs'
+      'stdoutputspecial.js'
     )
 
     const nodePath: string = await io.which('node', true)

packages/exec/__tests__/scripts/spawn-wait-for-file.js

@@ -15,10 +15,10 @@ if (!filePath) {
   throw new Error('file is not specified')
 }
 
-// Spawn wait-for-file.cjs with inherited stdio
+// Spawn wait-for-file.js with inherited stdio
 // This creates a grandchild process that holds the stdio handles open
 // after this process (the child) exits
-const waitScript = path.join(__dirname, 'wait-for-file.cjs')
+const waitScript = path.join(__dirname, 'wait-for-file.js')
 const isWindows = process.platform === 'win32'
 
 // On Windows, use detached:true to properly keep streams open

packages/exec/package-lock.json

@@ -1,21 +1,21 @@
 {
   "name": "@actions/exec",
-  "version": "3.0.0",
+  "version": "2.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/exec",
-      "version": "3.0.0",
+      "version": "2.0.0",
       "license": "MIT",
       "dependencies": {
-        "@actions/io": "^3.0.2"
+        "@actions/io": "^2.0.0"
       }
     },
     "node_modules/@actions/io": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
-      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
+      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
       "license": "MIT"
     }
   }

packages/exec/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/exec",
-  "version": "3.0.0",
+  "version": "2.0.0",
   "description": "Actions exec lib",
   "keywords": [
     "github",
@@ -9,15 +9,8 @@
   ],
   "homepage": "https://github.com/actions/toolkit/tree/main/packages/exec",
   "license": "MIT",
-  "type": "module",
   "main": "lib/exec.js",
   "types": "lib/exec.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/exec.d.ts",
-      "import": "./lib/exec.js"
-    }
-  },
   "directories": {
     "lib": "lib",
     "test": "__tests__"
@@ -43,6 +36,6 @@
     "url": "https://github.com/actions/toolkit/issues"
   },
   "dependencies": {
-    "@actions/io": "^3.0.2"
+    "@actions/io": "^2.0.0"
   }
 }

packages/exec/src/exec.ts

@@ -1,6 +1,6 @@
 import {StringDecoder} from 'string_decoder'
-import {ExecOptions, ExecOutput, ExecListeners} from './interfaces.js'
-import * as tr from './toolrunner.js'
+import {ExecOptions, ExecOutput, ExecListeners} from './interfaces'
+import * as tr from './toolrunner'
 
 export {ExecOptions, ExecOutput, ExecListeners}
 

packages/exec/src/toolrunner.ts

@@ -3,7 +3,7 @@ import * as events from 'events'
 import * as child from 'child_process'
 import * as path from 'path'
 import * as stream from 'stream'
-import * as im from './interfaces.js'
+import * as im from './interfaces'
 import * as io from '@actions/io'
 import * as ioUtil from '@actions/io/lib/io-util'
 import {setTimeout} from 'timers'

packages/exec/tsconfig.json

@@ -3,9 +3,7 @@
   "compilerOptions": {
     "baseUrl": "./",
     "outDir": "./lib",
-    "rootDir": "./src",
-    "module": "node16",
-    "moduleResolution": "node16"
+    "rootDir": "./src"
   },
   "include": [
     "./src"

packages/github/README.md

@@ -6,20 +6,9 @@
 
 Returns an authenticated Octokit client that follows the machine [proxy settings](https://help.github.com/en/actions/hosting-your-own-runners/using-a-proxy-server-with-self-hosted-runners) and correctly sets GHES base urls. See https://octokit.github.io/rest.js for the API.
 
-**Note:** This package is ESM-only starting from v9.0.0. For CommonJS projects, use dynamic import:
 ```js
-async function main() {
-    const { getOctokit, context } = await import('@actions/github');
-    // ... your code here
-}
-main();
-```
-
-For bundled actions (recommended), most bundlers like esbuild, webpack, and rollup handle ESM imports automatically.
-
-```js
-import * as github from '@actions/github';
-import * as core from '@actions/core';
+const github = require('@actions/github');
+const core = require('@actions/core');
 
 async function run() {
     // This should be a token with access to your repository scoped in as a secret.
@@ -57,7 +46,7 @@ const result = await octokit.graphql(query, variables);
 Finally, you can get the context of the current action:
 
 ```js
-import * as github from '@actions/github';
+const github = require('@actions/github');
 
 const context = github.context;
 

packages/github/RELEASES.md

@@ -1,12 +1,5 @@
 # @actions/github Releases
 
-### 9.0.0
-
-- **Breaking change**: Package is now ESM-only
-  - CommonJS consumers must use dynamic `import()` instead of `require()`
-  - Example: `const { getOctokit, context } = await import('@actions/github')`
-- Fix TypeScript compilation by migrating to ESM, enabling proper imports from `@octokit/core/types`
-
 ### 8.0.1
 
 - Update `undici` to `6.23.0`

packages/github/__tests__/lib.test.ts

@@ -1,6 +1,8 @@
 import * as path from 'path'
-import {readFileSync} from 'fs'
-import {Context} from '../src/context.js'
+import {Context} from '../src/context'
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+/* eslint-disable @typescript-eslint/no-var-requires */
 
 describe('@actions/context', () => {
   let context: Context
@@ -12,10 +14,7 @@ describe('@actions/context', () => {
   })
 
   it('returns the payload object', () => {
-    const payload = JSON.parse(
-      readFileSync(path.join(__dirname, 'payload.json'), 'utf8')
-    )
-    expect(context.payload).toEqual(payload)
+    expect(context.payload).toEqual(require('./payload.json'))
   })
 
   it('returns an empty payload if the GITHUB_EVENT_PATH environment variable is falsey', () => {

packages/github/jest.config.js

@@ -1,19 +1,14 @@
-/** @type {import('jest').Config} */
 module.exports = {
   clearMocks: true,
   moduleFileExtensions: ['js', 'ts'],
   testEnvironment: 'node',
   testMatch: ['**/*.test.ts'],
-  moduleNameMapper: {
-    '^(\\.{1,2}/.*)\\.js$': '$1'
-  },
   transform: {
     '^.+\\.(ts|js)$': ['ts-jest', {
+      useESM: false,
       tsconfig: {
         allowJs: true,
-        esModuleInterop: true,
-        module: 'node16',
-        moduleResolution: 'node16'
+        esModuleInterop: true
       }
     }]
   },

packages/github/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/github",
-  "version": "9.0.0",
+  "version": "8.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/github",
-      "version": "9.0.0",
+      "version": "8.0.1",
       "license": "MIT",
       "dependencies": {
         "@actions/http-client": "^3.0.2",

packages/github/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/github",
-  "version": "9.0.0",
+  "version": "8.0.1",
   "description": "Actions github lib",
   "keywords": [
     "github",
@@ -8,19 +8,8 @@
   ],
   "homepage": "https://github.com/actions/toolkit/tree/main/packages/github",
   "license": "MIT",
-  "type": "module",
   "main": "lib/github.js",
   "types": "lib/github.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/github.d.ts",
-      "import": "./lib/github.js"
-    },
-    "./lib/utils": {
-      "types": "./lib/utils.d.ts",
-      "import": "./lib/utils.js"
-    }
-  },
   "directories": {
     "lib": "lib",
     "test": "__tests__"

packages/github/src/context.ts

@@ -1,5 +1,5 @@
 // Originally pulled from https://github.com/JasonEtco/actions-toolkit/blob/main/src/context.ts
-import {WebhookPayload} from './interfaces.js'
+import {WebhookPayload} from './interfaces'
 import {readFileSync, existsSync} from 'fs'
 import {EOL} from 'os'
 

packages/github/src/github.ts

@@ -1,7 +1,8 @@
-import * as Context from './context.js'
-import {GitHub, getOctokitOptions} from './utils.js'
+import * as Context from './context'
+import {GitHub, getOctokitOptions} from './utils'
+
 // octokit + plugins
-import type {OctokitOptions, OctokitPlugin} from '@octokit/core/types'
+import {OctokitOptions, OctokitPlugin} from '@octokit/core/dist-types/types'
 
 export const context = new Context.Context()