Bump @actions/io to 3.0.2

@actions/exec: convert to ESM module
@actions/io: update lock file version
2026-01-28 14:44:07 -05:00 · 2026-01-28 14:44:07 -05:00 · 2026-01-28 14:36:03 -05:00 · 2026-01-28 14:08:19 -05:00 · 2026-01-28 13:33:17 -05:00 · 2026-01-28 13:33:17 -05:00
58 changed files with 495 additions and 498 deletions
@@ -4,18 +4,29 @@ module.exports = {
  roots: ['<rootDir>/packages'],
  testEnvironment: 'node',
  testMatch: ['**/__tests__/*.test.ts'],
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1',
+    '^@actions/io$': '<rootDir>/packages/io/lib/io.js',
+    '^@actions/io/lib/io-util$': '<rootDir>/packages/io/lib/io-util.js',
+    '^@actions/http-client$': '<rootDir>/packages/http-client/lib/index.js',
+    '^@actions/http-client/lib/auth$': '<rootDir>/packages/http-client/lib/auth.js',
+    '^@actions/github$': '<rootDir>/packages/github/lib/github.js',
+    '^@actions/github/lib/utils$': '<rootDir>/packages/github/lib/utils.js'
+  },
  transform: {
    '^.+\\.(ts|js)$': ['ts-jest', {
      isolatedModules: true,
      diagnostics: {warnOnly: true},
      tsconfig: {
        allowJs: true,
-        esModuleInterop: true
+        esModuleInterop: true,
+        module: 'commonjs',
+        moduleResolution: 'node'
      }
    }]
  },
  transformIgnorePatterns: [
-    '/node_modules/(?!(@octokit|universal-user-agent|before-after-hook)/)'
+    '/node_modules/(?!(@octokit|@actions/github|@actions/http-client|@actions/io|universal-user-agent|before-after-hook)/)'
  ],
  verbose: true
 }
@@ -1,5 +1,9 @@
 # @actions/artifact Releases

+### 5.0.3
+
+- Bump `@actions/http-client` to `3.0.2`
+
 ### 5.0.1

 - Fix Node.js 24 punycode deprecation warning by updating `@azure/storage-blob` from `^12.15.0` to `^12.29.1` [#2211](https://github.com/actions/toolkit/pull/2211)
@@ -1,17 +1,17 @@
 {
  "name": "@actions/artifact",
-  "version": "5.0.2",
+  "version": "5.0.3",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/artifact",
-      "version": "5.0.2",
+      "version": "5.0.3",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^2.0.0",
        "@actions/github": "^6.0.1",
-        "@actions/http-client": "^3.0.1",
+        "@actions/http-client": "^3.0.2",
        "@azure/storage-blob": "^12.29.1",
        "@octokit/core": "^5.2.1",
        "@octokit/plugin-request-log": "^1.0.4",
@@ -75,14 +75,26 @@
        "undici": "^5.25.4"
      }
    },
+    "node_modules/@actions/github/node_modules/undici": {
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.0"
+      }
+    },
    "node_modules/@actions/http-client": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.1.tgz",
-      "integrity": "sha512-SbGS8c/vySbNO3kjFgSW77n83C4MQx/Yoe+b1hAdpuvfHxnkHzDq2pWljUpAA56Si1Gae/7zjeZsV0CYjmLo/w==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/io": {
@@ -91,6 +103,18 @@
      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
      "license": "MIT"
    },
+    "node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
    "node_modules/@azure/core-auth": {
      "version": "1.10.1",
      "resolved": "https://registry.npmjs.org/@azure/core-auth/-/core-auth-1.10.1.tgz",
@@ -105,18 +129,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/core-auth/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/core-client": {
      "version": "1.10.1",
      "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.10.1.tgz",
@@ -135,30 +147,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/core-client/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@azure/core-client/node_modules/@azure/core-tracing": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.3.1.tgz",
-      "integrity": "sha512-9MWKevR7Hz8kNzzPLfX4EAtGM2b8mr50HPDBvio96bURP/9C+HjdH3sBlLSNNrvRAr5/k/svoH457gB5IKpmwQ==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
    "node_modules/@azure/core-http-compat": {
      "version": "2.3.1",
      "resolved": "https://registry.npmjs.org/@azure/core-http-compat/-/core-http-compat-2.3.1.tgz",
@@ -173,18 +161,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/core-http-compat/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/core-lro": {
      "version": "2.7.2",
      "resolved": "https://registry.npmjs.org/@azure/core-lro/-/core-lro-2.7.2.tgz",
@@ -200,18 +176,6 @@
        "node": ">=18.0.0"
      }
    },
-    "node_modules/@azure/core-lro/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/core-paging": {
      "version": "1.6.2",
      "resolved": "https://registry.npmjs.org/@azure/core-paging/-/core-paging-1.6.2.tgz",
@@ -242,19 +206,7 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/core-rest-pipeline/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@azure/core-rest-pipeline/node_modules/@azure/core-tracing": {
+    "node_modules/@azure/core-tracing": {
      "version": "1.3.1",
      "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.3.1.tgz",
      "integrity": "sha512-9MWKevR7Hz8kNzzPLfX4EAtGM2b8mr50HPDBvio96bURP/9C+HjdH3sBlLSNNrvRAr5/k/svoH457gB5IKpmwQ==",
@@ -280,18 +232,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/core-util/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
    "node_modules/@azure/core-xml": {
      "version": "1.5.0",
      "resolved": "https://registry.npmjs.org/@azure/core-xml/-/core-xml-1.5.0.tgz",
@@ -343,30 +283,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/storage-blob/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@azure/storage-blob/node_modules/@azure/core-tracing": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.3.1.tgz",
-      "integrity": "sha512-9MWKevR7Hz8kNzzPLfX4EAtGM2b8mr50HPDBvio96bURP/9C+HjdH3sBlLSNNrvRAr5/k/svoH457gB5IKpmwQ==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
    "node_modules/@azure/storage-common": {
      "version": "12.1.1",
      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.1.1.tgz",
@@ -387,30 +303,6 @@
        "node": ">=20.0.0"
      }
    },
-    "node_modules/@azure/storage-common/node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@azure/storage-common/node_modules/@azure/core-tracing": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.3.1.tgz",
-      "integrity": "sha512-9MWKevR7Hz8kNzzPLfX4EAtGM2b8mr50HPDBvio96bURP/9C+HjdH3sBlLSNNrvRAr5/k/svoH457gB5IKpmwQ==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
    "node_modules/@bufbuild/protobuf": {
      "version": "2.9.0",
      "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.9.0.tgz",
@@ -428,19 +320,6 @@
        "typescript": "5.4.5"
      }
    },
-    "node_modules/@bufbuild/protoplugin/node_modules/typescript": {
-      "version": "5.4.5",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.5.tgz",
-      "integrity": "sha512-vcI4UpRgg81oIRUFwR0WSIHKt11nJ7SAVlYNIu+QpqeyXP+gpQJy/Z4+F0aGxSE4MqwjyXvW/TzgkLAx2AGHwQ==",
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
    "node_modules/@fastify/busboy": {
      "version": "2.1.1",
      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
@@ -1983,9 +1862,9 @@
      }
    },
    "node_modules/typescript": {
-      "version": "5.9.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz",
-      "integrity": "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==",
+      "version": "5.4.5",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.5.tgz",
+      "integrity": "sha512-vcI4UpRgg81oIRUFwR0WSIHKt11nJ7SAVlYNIu+QpqeyXP+gpQJy/Z4+F0aGxSE4MqwjyXvW/TzgkLAx2AGHwQ==",
      "license": "Apache-2.0",
      "bin": {
        "tsc": "bin/tsc",
@@ -2017,15 +1896,12 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
      "engines": {
-        "node": ">=14.0"
+        "node": ">=18.17"
      }
    },
    "node_modules/undici-types": {
@@ -1,6 +1,6 @@
 {
  "name": "@actions/artifact",
-  "version": "5.0.2",
+  "version": "5.0.3",
  "preview": true,
  "description": "Actions artifact lib",
  "keywords": [
@@ -42,7 +42,7 @@
  "dependencies": {
    "@actions/core": "^2.0.0",
    "@actions/github": "^6.0.1",
-    "@actions/http-client": "^3.0.1",
+    "@actions/http-client": "^3.0.2",
    "@azure/storage-blob": "^12.29.1",
    "@octokit/core": "^5.2.1",
    "@octokit/plugin-request-log": "^1.0.4",
@@ -1,5 +1,10 @@
 # @actions/attest Releases

+### 2.2.1
+
+- Bump `@actions/http-client` to `3.0.2`
+- Bump `undici` to `6.23.0`
+
 ### 2.2.0

 - Bump @actions/core from 1.11.1 to 2.0.2
@@ -1,17 +1,17 @@
 {
  "name": "@actions/attest",
-  "version": "2.2.0",
+  "version": "2.2.1",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/attest",
-      "version": "2.2.0",
+      "version": "2.2.1",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^2.0.2",
        "@actions/github": "^7.0.0",
-        "@actions/http-client": "^3.0.1",
+        "@actions/http-client": "^3.0.2",
        "@octokit/plugin-retry": "^6.0.1",
        "@sigstore/bundle": "^3.1.0",
        "@sigstore/sign": "^3.1.0",
@@ -22,7 +22,7 @@
        "@sigstore/rekor-types": "^3.0.0",
        "@types/jsonwebtoken": "^9.0.6",
        "nock": "^13.5.1",
-        "undici": "^6.20.0"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/core": {
@@ -72,25 +72,13 @@
      }
    },
    "node_modules/@actions/http-client": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.1.tgz",
-      "integrity": "sha512-SbGS8c/vySbNO3kjFgSW77n83C4MQx/Yoe+b1hAdpuvfHxnkHzDq2pWljUpAA56Si1Gae/7zjeZsV0CYjmLo/w==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
-      }
-    },
-    "node_modules/@actions/http-client/node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
-      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=14.0"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/io": {
@@ -205,6 +193,21 @@
        "node": ">= 18"
      }
    },
+    "node_modules/@octokit/core/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/core/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
    "node_modules/@octokit/endpoint": {
      "version": "9.0.6",
      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
@@ -218,6 +221,21 @@
        "node": ">= 18"
      }
    },
+    "node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/endpoint/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
    "node_modules/@octokit/graphql": {
      "version": "7.1.1",
      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.1.1.tgz",
@@ -232,12 +250,27 @@
        "node": ">= 18"
      }
    },
-    "node_modules/@octokit/openapi-types": {
+    "node_modules/@octokit/graphql/node_modules/@octokit/openapi-types": {
      "version": "24.2.0",
      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
      "license": "MIT"
    },
+    "node_modules/@octokit/graphql/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
+    "node_modules/@octokit/openapi-types": {
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
+      "license": "MIT"
+    },
    "node_modules/@octokit/plugin-paginate-rest": {
      "version": "9.2.2",
      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
@@ -253,21 +286,6 @@
        "@octokit/core": "5"
      }
    },
-    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
-      }
-    },
    "node_modules/@octokit/plugin-rest-endpoint-methods": {
      "version": "10.4.1",
      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
@@ -283,21 +301,6 @@
        "@octokit/core": "5"
      }
    },
-    "node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
-      }
-    },
    "node_modules/@octokit/plugin-retry": {
      "version": "6.1.0",
      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-6.1.0.tgz",
@@ -315,6 +318,21 @@
        "@octokit/core": "5"
      }
    },
+    "node_modules/@octokit/plugin-retry/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-retry/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
    "node_modules/@octokit/request": {
      "version": "8.4.1",
      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
@@ -344,7 +362,13 @@
        "node": ">= 18"
      }
    },
-    "node_modules/@octokit/types": {
+    "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/request-error/node_modules/@octokit/types": {
      "version": "13.10.0",
      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
@@ -353,6 +377,30 @@
        "@octokit/openapi-types": "^24.2.0"
      }
    },
+    "node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/request/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
+    "node_modules/@octokit/types": {
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^20.0.0"
+      }
+    },
    "node_modules/@peculiar/asn1-cms": {
      "version": "2.5.0",
      "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.5.0.tgz",
@@ -1625,10 +1673,9 @@
      }
    },
    "node_modules/undici": {
-      "version": "6.21.3",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.21.3.tgz",
-      "integrity": "sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==",
-      "dev": true,
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
      "license": "MIT",
      "engines": {
        "node": ">=18.17"
@@ -1,6 +1,6 @@
 {
  "name": "@actions/attest",
-  "version": "2.2.0",
+  "version": "2.2.1",
  "description": "Actions attestation lib",
  "keywords": [
    "github",
@@ -39,12 +39,12 @@
    "@sigstore/rekor-types": "^3.0.0",
    "@types/jsonwebtoken": "^9.0.6",
    "nock": "^13.5.1",
-    "undici": "^6.20.0"
+    "undici": "^6.23.0"
  },
  "dependencies": {
    "@actions/core": "^2.0.2",
    "@actions/github": "^7.0.0",
-    "@actions/http-client": "^3.0.1",
+    "@actions/http-client": "^3.0.2",
    "@octokit/plugin-retry": "^6.0.1",
    "@sigstore/bundle": "^3.1.0",
    "@sigstore/sign": "^3.1.0",
@@ -1,5 +1,13 @@
 # @actions/cache Releases

+### 5.0.5
+
+- Bump `@actions/glob` to `0.5.1`
+
+### 5.0.4
+
+- Bump `@actions/http-client` to `3.0.2`
+
 ### 5.0.3

 Prevent retries for rate limited cache operations [2243](https://github.com/actions/toolkit/pull/2243).
@@ -1,18 +1,18 @@
 {
  "name": "@actions/cache",
-  "version": "5.0.2",
+  "version": "5.0.5",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/cache",
-      "version": "5.0.2",
+      "version": "5.0.5",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^2.0.0",
        "@actions/exec": "^2.0.0",
-        "@actions/glob": "^0.5.0",
-        "@actions/http-client": "^3.0.1",
+        "@actions/glob": "^0.5.1",
+        "@actions/http-client": "^3.0.2",
        "@actions/io": "^2.0.0",
        "@azure/abort-controller": "^1.1.0",
        "@azure/core-rest-pipeline": "^1.22.0",
@@ -28,13 +28,13 @@
      }
    },
    "node_modules/@actions/core": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.1.tgz",
-      "integrity": "sha512-oBfqT3GwkvLlo1fjvhQLQxuwZCGTarTE5OuZ2Wg10hvhBj7LRIlF611WT4aZS6fDhO5ZKlY7lCAZTlpmyaHaeg==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.3.tgz",
+      "integrity": "sha512-Od9Thc3T1mQJYddvVPM4QGiLUewdh+3txmDYHHxoNdkqysR1MbCT+rFOtNUxYAz+7+6RIsqipVahY2GJqGPyxA==",
      "license": "MIT",
      "dependencies": {
        "@actions/exec": "^2.0.0",
-        "@actions/http-client": "^3.0.0"
+        "@actions/http-client": "^3.0.2"
      }
    },
    "node_modules/@actions/exec": {
@@ -47,58 +47,32 @@
      }
    },
    "node_modules/@actions/glob": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.5.0.tgz",
-      "integrity": "sha512-tST2rjPvJLRZLuT9NMUtyBjvj9Yo0MiJS3ow004slMvm8GFM+Zv9HvMJ7HWzfUyJnGrJvDsYkWBaaG3YKXRtCw==",
+      "version": "0.5.1",
+      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.5.1.tgz",
+      "integrity": "sha512-+dv/t2aKQdKp9WWSp+1yIXVJzH5Q38M0Mta26pzIbeec14EcIleMB7UU6N7sNgbEuYfyuVGpE5pOKjl6j1WXkA==",
      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^1.9.1",
+        "@actions/core": "^2.0.3",
        "minimatch": "^3.0.4"
      }
    },
-    "node_modules/@actions/glob/node_modules/@actions/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
-      "license": "MIT",
-      "dependencies": {
-        "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1"
-      }
-    },
-    "node_modules/@actions/glob/node_modules/@actions/exec": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
-      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
-      "license": "MIT",
-      "dependencies": {
-        "@actions/io": "^1.0.1"
-      }
-    },
-    "node_modules/@actions/glob/node_modules/@actions/http-client": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
-      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
-      "license": "MIT",
-      "dependencies": {
-        "tunnel": "^0.0.6",
-        "undici": "^5.25.4"
-      }
-    },
-    "node_modules/@actions/glob/node_modules/@actions/io": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
-      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
-      "license": "MIT"
-    },
    "node_modules/@actions/http-client": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.1.tgz",
-      "integrity": "sha512-SbGS8c/vySbNO3kjFgSW77n83C4MQx/Yoe+b1hAdpuvfHxnkHzDq2pWljUpAA56Si1Gae/7zjeZsV0CYjmLo/w==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
+        "undici": "^6.23.0"
+      }
+    },
+    "node_modules/@actions/http-client/node_modules/undici": {
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
      }
    },
    "node_modules/@actions/io": {
@@ -436,15 +410,6 @@
        "node": ">=14.17"
      }
    },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
    "node_modules/@protobuf-ts/plugin": {
      "version": "2.11.1",
      "resolved": "https://registry.npmjs.org/@protobuf-ts/plugin/-/plugin-2.11.1.tgz",
@@ -716,18 +681,6 @@
        "node": ">=14.17"
      }
    },
-    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
-      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=14.0"
-      }
-    },
    "node_modules/undici-types": {
      "version": "7.16.0",
      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
@@ -1,6 +1,6 @@
 {
  "name": "@actions/cache",
-  "version": "5.0.3",
+  "version": "5.0.5",
  "preview": true,
  "description": "Actions cache lib",
  "keywords": [
@@ -39,9 +39,9 @@
  "dependencies": {
    "@actions/core": "^2.0.0",
    "@actions/exec": "^2.0.0",
-    "@actions/glob": "^0.5.0",
+    "@actions/glob": "^0.5.1",
    "@protobuf-ts/runtime-rpc": "^2.11.1",
-    "@actions/http-client": "^3.0.1",
+    "@actions/http-client": "^3.0.2",
    "@actions/io": "^2.0.0",
    "@azure/abort-controller": "^1.1.0",
    "@azure/core-rest-pipeline": "^1.22.0",
@@ -1,5 +1,9 @@
 # @actions/core Releases

+## 2.0.3
+
+- Bump `@actions/http-client` to `3.0.2`
+
 ## 2.0.1
 - Bump @actions/exec from 1.1.1 to 2.0.0 [#2199](https://github.com/actions/toolkit/pull/2199)

@@ -1,16 +1,16 @@
 {
  "name": "@actions/core",
-  "version": "2.0.2",
+  "version": "2.0.3",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/core",
-      "version": "2.0.2",
+      "version": "2.0.3",
      "license": "MIT",
      "dependencies": {
        "@actions/exec": "^2.0.0",
-        "@actions/http-client": "^3.0.1"
+        "@actions/http-client": "^3.0.2"
      },
      "devDependencies": {
        "@types/node": "^16.18.112"
@@ -26,13 +26,13 @@
      }
    },
    "node_modules/@actions/http-client": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.1.tgz",
-      "integrity": "sha512-SbGS8c/vySbNO3kjFgSW77n83C4MQx/Yoe+b1hAdpuvfHxnkHzDq2pWljUpAA56Si1Gae/7zjeZsV0CYjmLo/w==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/io": {
@@ -41,15 +41,6 @@
      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
      "license": "MIT"
    },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
    "node_modules/@types/node": {
      "version": "16.18.126",
      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.126.tgz",
@@ -67,15 +58,12 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
      "engines": {
-        "node": ">=14.0"
+        "node": ">=18.17"
      }
    }
  }
@@ -1,6 +1,6 @@
 {
  "name": "@actions/core",
-  "version": "2.0.2",
+  "version": "2.0.3",
  "description": "Actions core lib",
  "keywords": [
    "github",
@@ -37,7 +37,7 @@
  },
  "dependencies": {
    "@actions/exec": "^2.0.0",
-    "@actions/http-client": "^3.0.1"
+    "@actions/http-client": "^3.0.2"
  },
  "devDependencies": {
    "@types/node": "^16.18.112"
@@ -1,13 +1,20 @@
 # @actions/exec Releases

-### 2.0.0
+## 3.0.0
+
+- **Breaking change**: Package is now ESM-only
+  - CommonJS consumers must use dynamic `import()` instead of `require()`
+
+## 2.0.0
+
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Bump @actions/io dependency from ^1.0.1 to ^2.0.0

-### 1.1.1
- Update `lockfileVersion` to `v2` in `package-lock.json [#1024](https://github.com/actions/toolkit/pull/1024) 
+## 1.1.1

-### 1.1.0
+- Update `lockfileVersion` to `v2` in `package-lock.json` [#1024](https://github.com/actions/toolkit/pull/1024)
+
+## 1.1.0

 - [Fix stdline dropping large output](https://github.com/actions/toolkit/pull/773)
 - [Add getExecOutput function](https://github.com/actions/toolkit/pull/814)
@@ -23,4 +30,4 @@

 ### 1.0.0

- Initial release
+- Initial release
@@ -1,5 +1,5 @@
-import * as exec from '../src/exec'
-import * as im from '../src/interfaces'
+import * as exec from '../src/exec.js'
+import * as im from '../src/interfaces.js'

 import * as childProcess from 'child_process'
 import * as fs from 'fs'
@@ -14,7 +14,7 @@ const IS_WINDOWS = process.platform === 'win32'
 const SPAWN_WAIT_SCRIPT = path.join(
  __dirname,
  'scripts',
-  'spawn-wait-for-file.js'
+  'spawn-wait-for-file.cjs'
 )

 let outstream: stream.Writable
@@ -196,7 +196,7 @@ describe('@actions/exec', () => {
    const scriptPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const nodePath: string = await io.which('node', true)

@@ -218,7 +218,7 @@ describe('@actions/exec', () => {
    const scriptPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const nodePath: string = await io.which('node', true)

@@ -255,12 +255,12 @@ describe('@actions/exec', () => {
    const stdErrPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const stdOutPath: string = path.join(
      __dirname,
      'scripts',
-      'stdoutoutput.js'
+      'stdoutoutput.cjs'
    )
    const nodePath: string = await io.which('node', true)
    let stdoutCalled = false
@@ -295,7 +295,7 @@ describe('@actions/exec', () => {
    const stdlinePath: string = path.join(
      __dirname,
      'scripts',
-      'stdlineoutput.js'
+      'stdlineoutput.cjs'
    )
    const nodePath: string = await io.which('node', true)

@@ -344,7 +344,7 @@ describe('@actions/exec', () => {
    const waitForInput: string = path.join(
      __dirname,
      'scripts',
-      'wait-for-input.js'
+      'wait-for-input.cjs'
    )

    const _testExecOptions = getExecOptions()
@@ -622,12 +622,12 @@ describe('@actions/exec', () => {
    const stdErrPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const stdOutPath: string = path.join(
      __dirname,
      'scripts',
-      'stdoutoutput.js'
+      'stdoutoutput.cjs'
    )
    const nodePath: string = await io.which('node', true)

@@ -653,12 +653,12 @@ describe('@actions/exec', () => {
    const stdErrPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const stdOutPath: string = path.join(
      __dirname,
      'scripts',
-      'stdoutoutput.js'
+      'stdoutoutput.cjs'
    )

    const nodePath: string = await io.which('node', true)
@@ -703,12 +703,12 @@ describe('@actions/exec', () => {
    const stdErrPath: string = path.join(
      __dirname,
      'scripts',
-      'stderroutput.js'
+      'stderroutput.cjs'
    )
    const stdOutPath: string = path.join(
      __dirname,
      'scripts',
-      'stdoutoutputlarge.js'
+      'stdoutoutputlarge.cjs'
    )

    const nodePath: string = await io.which('node', true)
@@ -753,7 +753,7 @@ describe('@actions/exec', () => {
    const stdOutPath: string = path.join(
      __dirname,
      'scripts',
-      'stdoutputspecial.js'
+      'stdoutputspecial.cjs'
    )

    const nodePath: string = await io.which('node', true)
@@ -15,10 +15,10 @@ if (!filePath) {
  throw new Error('file is not specified')
 }

-// Spawn wait-for-file.js with inherited stdio
+// Spawn wait-for-file.cjs with inherited stdio
 // This creates a grandchild process that holds the stdio handles open
 // after this process (the child) exits
-const waitScript = path.join(__dirname, 'wait-for-file.js')
+const waitScript = path.join(__dirname, 'wait-for-file.cjs')
 const isWindows = process.platform === 'win32'

 // On Windows, use detached:true to properly keep streams open
@@ -1,21 +1,21 @@
 {
  "name": "@actions/exec",
-  "version": "2.0.0",
+  "version": "3.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/exec",
-      "version": "2.0.0",
+      "version": "3.0.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/io": "^2.0.0"
+        "@actions/io": "^3.0.2"
      }
    },
    "node_modules/@actions/io": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
-      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
+      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
      "license": "MIT"
    }
  }
@@ -1,6 +1,6 @@
 {
  "name": "@actions/exec",
-  "version": "2.0.0",
+  "version": "3.0.0",
  "description": "Actions exec lib",
  "keywords": [
    "github",
@@ -9,8 +9,15 @@
  ],
  "homepage": "https://github.com/actions/toolkit/tree/main/packages/exec",
  "license": "MIT",
+  "type": "module",
  "main": "lib/exec.js",
  "types": "lib/exec.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/exec.d.ts",
+      "import": "./lib/exec.js"
+    }
+  },
  "directories": {
    "lib": "lib",
    "test": "__tests__"
@@ -36,6 +43,6 @@
    "url": "https://github.com/actions/toolkit/issues"
  },
  "dependencies": {
-    "@actions/io": "^2.0.0"
+    "@actions/io": "^3.0.2"
  }
 }
@@ -1,6 +1,6 @@
 import {StringDecoder} from 'string_decoder'
-import {ExecOptions, ExecOutput, ExecListeners} from './interfaces'
-import * as tr from './toolrunner'
+import {ExecOptions, ExecOutput, ExecListeners} from './interfaces.js'
+import * as tr from './toolrunner.js'

 export {ExecOptions, ExecOutput, ExecListeners}

@@ -3,7 +3,7 @@ import * as events from 'events'
 import * as child from 'child_process'
 import * as path from 'path'
 import * as stream from 'stream'
-import * as im from './interfaces'
+import * as im from './interfaces.js'
 import * as io from '@actions/io'
 import * as ioUtil from '@actions/io/lib/io-util'
 import {setTimeout} from 'timers'
@@ -3,7 +3,9 @@
  "compilerOptions": {
    "baseUrl": "./",
    "outDir": "./lib",
-    "rootDir": "./src"
+    "rootDir": "./src",
+    "module": "node16",
+    "moduleResolution": "node16"
  },
  "include": [
    "./src"
@@ -6,9 +6,20 @@

 Returns an authenticated Octokit client that follows the machine [proxy settings](https://help.github.com/en/actions/hosting-your-own-runners/using-a-proxy-server-with-self-hosted-runners) and correctly sets GHES base urls. See https://octokit.github.io/rest.js for the API.

+**Note:** This package is ESM-only starting from v9.0.0. For CommonJS projects, use dynamic import:
 ```js
-const github = require('@actions/github');
-const core = require('@actions/core');
+async function main() {
+    const { getOctokit, context } = await import('@actions/github');
+    // ... your code here
+}
+main();
+```
+
+For bundled actions (recommended), most bundlers like esbuild, webpack, and rollup handle ESM imports automatically.
+
+```js
+import * as github from '@actions/github';
+import * as core from '@actions/core';

 async function run() {
    // This should be a token with access to your repository scoped in as a secret.
@@ -46,7 +57,7 @@ const result = await octokit.graphql(query, variables);
 Finally, you can get the context of the current action:

 ```js
-const github = require('@actions/github');
+import * as github from '@actions/github';

 const context = github.context;

@@ -1,5 +1,17 @@
 # @actions/github Releases

+### 9.0.0
+
+- **Breaking change**: Package is now ESM-only
+  - CommonJS consumers must use dynamic `import()` instead of `require()`
+  - Example: `const { getOctokit, context } = await import('@actions/github')`
+- Fix TypeScript compilation by migrating to ESM, enabling proper imports from `@octokit/core/types`
+
+### 8.0.1
+
+- Update `undici` to `6.23.0`
+- Update `@actions/http-client` to `3.0.2`
+
 ### 8.0.0

 - Update @octokit dependencies 
@@ -1,8 +1,6 @@
 import * as path from 'path'
-import {Context} from '../src/context'
-
-/* eslint-disable @typescript-eslint/no-require-imports */
-/* eslint-disable @typescript-eslint/no-var-requires */
+import {readFileSync} from 'fs'
+import {Context} from '../src/context.js'

 describe('@actions/context', () => {
  let context: Context
@@ -14,7 +12,10 @@ describe('@actions/context', () => {
  })

  it('returns the payload object', () => {
-    expect(context.payload).toEqual(require('./payload.json'))
+    const payload = JSON.parse(
+      readFileSync(path.join(__dirname, 'payload.json'), 'utf8')
+    )
+    expect(context.payload).toEqual(payload)
  })

  it('returns an empty payload if the GITHUB_EVENT_PATH environment variable is falsey', () => {
@@ -1,14 +1,19 @@
+/** @type {import('jest').Config} */
 module.exports = {
  clearMocks: true,
  moduleFileExtensions: ['js', 'ts'],
  testEnvironment: 'node',
  testMatch: ['**/*.test.ts'],
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1'
+  },
  transform: {
    '^.+\\.(ts|js)$': ['ts-jest', {
-      useESM: false,
      tsconfig: {
        allowJs: true,
-        esModuleInterop: true
+        esModuleInterop: true,
+        module: 'node16',
+        moduleResolution: 'node16'
      }
    }]
  },
@@ -1,43 +1,34 @@
 {
  "name": "@actions/github",
-  "version": "8.0.0",
+  "version": "9.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/github",
-      "version": "8.0.0",
+      "version": "9.0.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/http-client": "^3.0.1",
+        "@actions/http-client": "^3.0.2",
        "@octokit/core": "^7.0.6",
        "@octokit/plugin-paginate-rest": "^14.0.0",
        "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
        "@octokit/request": "^10.0.7",
        "@octokit/request-error": "^7.1.0",
-        "undici": "^5.28.5"
+        "undici": "^6.23.0"
      },
      "devDependencies": {
        "proxy": "^2.1.1"
      }
    },
    "node_modules/@actions/http-client": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.1.tgz",
-      "integrity": "sha512-SbGS8c/vySbNO3kjFgSW77n83C4MQx/Yoe+b1hAdpuvfHxnkHzDq2pWljUpAA56Si1Gae/7zjeZsV0CYjmLo/w==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
-      }
-    },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@octokit/auth-token": {
@@ -372,15 +363,12 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
      "engines": {
-        "node": ">=14.0"
+        "node": ">=18.17"
      }
    },
    "node_modules/universal-user-agent": {
@@ -1,6 +1,6 @@
 {
  "name": "@actions/github",
-  "version": "8.0.0",
+  "version": "9.0.0",
  "description": "Actions github lib",
  "keywords": [
    "github",
@@ -8,8 +8,19 @@
  ],
  "homepage": "https://github.com/actions/toolkit/tree/main/packages/github",
  "license": "MIT",
+  "type": "module",
  "main": "lib/github.js",
  "types": "lib/github.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/github.d.ts",
+      "import": "./lib/github.js"
+    },
+    "./lib/utils": {
+      "types": "./lib/utils.d.ts",
+      "import": "./lib/utils.js"
+    }
+  },
  "directories": {
    "lib": "lib",
    "test": "__tests__"
@@ -38,13 +49,13 @@
    "url": "https://github.com/actions/toolkit/issues"
  },
  "dependencies": {
-    "@actions/http-client": "^3.0.1",
+    "@actions/http-client": "^3.0.2",
    "@octokit/core": "^7.0.6",
    "@octokit/plugin-paginate-rest": "^14.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
    "@octokit/request": "^10.0.7",
    "@octokit/request-error": "^7.1.0",
-    "undici": "^5.28.5"
+    "undici": "^6.23.0"
  },
  "devDependencies": {
    "proxy": "^2.1.1"
@@ -1,5 +1,5 @@
 // Originally pulled from https://github.com/JasonEtco/actions-toolkit/blob/main/src/context.ts
-import {WebhookPayload} from './interfaces'
+import {WebhookPayload} from './interfaces.js'
 import {readFileSync, existsSync} from 'fs'
 import {EOL} from 'os'

@@ -1,8 +1,7 @@
-import * as Context from './context'
-import {GitHub, getOctokitOptions} from './utils'
-
+import * as Context from './context.js'
+import {GitHub, getOctokitOptions} from './utils.js'
 // octokit + plugins
-import {OctokitOptions, OctokitPlugin} from '@octokit/core/dist-types/types'
+import type {OctokitOptions, OctokitPlugin} from '@octokit/core/types'

 export const context = new Context.Context()

@@ -1,6 +1,6 @@
 import * as http from 'http'
 import * as httpClient from '@actions/http-client'
-import {OctokitOptions} from '@octokit/core/dist-types/types'
+import type {OctokitOptions} from '@octokit/core/types'
 import {ProxyAgent, fetch} from 'undici'

 export function getAuthString(
@@ -1,9 +1,9 @@
-import * as Context from './context'
-import * as Utils from './internal/utils'
+import * as Context from './context.js'
+import * as Utils from './internal/utils.js'
+import type {OctokitOptions} from '@octokit/core/types'

 // octokit + plugins
 import {Octokit} from '@octokit/core'
-import {OctokitOptions} from '@octokit/core/dist-types/types'
 import {restEndpointMethods} from '@octokit/plugin-rest-endpoint-methods'
 import {paginateRest} from '@octokit/plugin-paginate-rest'

@@ -3,7 +3,9 @@
  "compilerOptions": {
    "baseUrl": "./",
    "outDir": "./lib",
-    "rootDir": "./src"
+    "rootDir": "./src",
+    "module": "node16",
+    "moduleResolution": "node16"
  },
  "include": [
    "./src"
@@ -1,5 +1,9 @@
 # @actions/glob Releases

+### 0.5.1
+
+- Bump `@actions/core` to `2.0.3`
+
 ### 0.5.0
 - Added `excludeHiddenFiles` option, which is disabled by default to preserve existing behavior [#1791: Add glob option to ignore hidden files](https://github.com/actions/toolkit/pull/1791)

@@ -1,62 +1,53 @@
 {
  "name": "@actions/glob",
-  "version": "0.5.0",
+  "version": "0.5.1",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/glob",
-      "version": "0.5.0",
+      "version": "0.5.1",
      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^1.9.1",
+        "@actions/core": "^2.0.3",
        "minimatch": "^3.0.4"
      }
    },
    "node_modules/@actions/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.3.tgz",
+      "integrity": "sha512-Od9Thc3T1mQJYddvVPM4QGiLUewdh+3txmDYHHxoNdkqysR1MbCT+rFOtNUxYAz+7+6RIsqipVahY2GJqGPyxA==",
      "license": "MIT",
      "dependencies": {
-        "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1"
+        "@actions/exec": "^2.0.0",
+        "@actions/http-client": "^3.0.2"
      }
    },
    "node_modules/@actions/exec": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
-      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz",
+      "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==",
      "license": "MIT",
      "dependencies": {
-        "@actions/io": "^1.0.1"
+        "@actions/io": "^2.0.0"
      }
    },
    "node_modules/@actions/http-client": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
-      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.25.4"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/io": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
-      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
+      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
      "license": "MIT"
    },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
    "node_modules/balanced-match": {
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -101,15 +92,12 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
      "engines": {
-        "node": ">=14.0"
+        "node": ">=18.17"
      }
    }
  }
@@ -1,6 +1,6 @@
 {
  "name": "@actions/glob",
-  "version": "0.5.0",
+  "version": "0.5.1",
  "preview": true,
  "description": "Actions glob lib",
  "keywords": [
@@ -37,7 +37,7 @@
    "url": "https://github.com/actions/toolkit/issues"
  },
  "dependencies": {
-    "@actions/core": "^1.9.1",
+    "@actions/core": "^2.0.3",
    "minimatch": "^3.0.4"
  }
 }
@@ -1,38 +1,53 @@
-## Releases
+# Releases
+
+## 4.0.0
+
+- **Breaking change**: Package is now ESM-only
+  - CommonJS consumers must use dynamic `import()` instead of `require()`

 ## 3.0.2

 - Bump `undici` from `5.28.5` to `6.23.0`

 ## 3.0.1
+
 - Add support for ACTIONS_ORCHESTRATION_ID in user-agent and default user-agent [#2229](https://github.com/actions/toolkit/pull/2229)

 ## 3.0.0
+
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)

 ## 2.2.3
+
 - Fixed an issue where proxy username and password were not handled correctly [#1799](https://github.com/actions/toolkit/pull/1799)

 ## 2.2.2
+
 - Better handling of url encoded usernames and passwords in proxy config [#1782](https://github.com/actions/toolkit/pull/1782)

 ## 2.2.1
+
 - Make sure RequestOptions.keepAlive is applied properly on node20 runtime [#1572](https://github.com/actions/toolkit/pull/1572)

 ## 2.2.0
+
 - Add function to return proxy agent dispatcher for compatibility with latest octokit packages [#1547](https://github.com/actions/toolkit/pull/1547)

 ## 2.1.1
+
 - Add `HttpClientResponse.readBodyBuffer` method to read from a response stream and return a buffer [#1475](https://github.com/actions/toolkit/pull/1475)

 ## 2.1.0
+
 - Add support for `*` and subdomains in `no_proxy` [#1355](https://github.com/actions/toolkit/pull/1355) [#1223](https://github.com/actions/toolkit/pull/1223)
 - Bypass proxy for loopback IP adresses [#1360](https://github.com/actions/toolkit/pull/1360))

 ## 2.0.1
+
 - Fix an issue with missing `tunnel` dependency [#1085](https://github.com/actions/toolkit/pull/1085)

 ## 2.0.0
+
 - The package is now compiled with TypeScript's [`strict` compiler setting](https://www.typescriptlang.org/tsconfig#strict). To comply with stricter rules:
  - Some exported types now include `| null` or `| undefined`, matching their actual behavior.
  - Types implementing the method `RequestHandler.handleAuthentication()` now throw an `Error` rather than returning `null` if they do not support handling an HTTP 401 response. Callers can still use `canHandleAuthentication()` to determine if this handling is supported or not.
@@ -44,25 +59,32 @@

 ## 1.0.11

-Contains a bug fix where proxy is defined without a user and password. see [PR here](https://github.com/actions/http-client/pull/42)   
+Contains a bug fix where proxy is defined without a user and password. see [PR here](https://github.com/actions/http-client/pull/42)

 ## 1.0.9
-Throw HttpClientError instead of a generic Error from the \<verb>Json() helper methods when the server responds with a non-successful status code. 
+
+Throw HttpClientError instead of a generic Error from the \<verb>Json() helper methods when the server responds with a non-successful status code.

 ## 1.0.8
+
 Fixed security issue where a redirect (e.g. 302) to another domain would pass headers.  The fix was to strip the authorization header if the hostname was different.  More [details in PR #27](https://github.com/actions/http-client/pull/27)

 ## 1.0.7
+
 Update NPM dependencies and add 429 to the list of HttpCodes

 ## 1.0.6
+
 Automatically sends Content-Type and Accept application/json headers for \<verb>Json() helper methods if not set in the client or parameters.

 ## 1.0.5
+
 Adds \<verb>Json() helper methods for json over http scenarios.

 ## 1.0.4
+
 Started to add \<verb>Json() helper methods.  Do not use this release for that.  Use >= 1.0.5 since there was an issue with types.

 ## 1.0.1 to 1.0.3
+
 Adds proxy support.
@@ -1,12 +1,12 @@
 {
  "name": "@actions/http-client",
-  "version": "3.0.2",
+  "version": "4.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/http-client",
-      "version": "3.0.2",
+      "version": "4.0.0",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
@@ -1,6 +1,6 @@
 {
  "name": "@actions/http-client",
-  "version": "3.0.2",
+  "version": "4.0.0",
  "description": "Actions Http Client",
  "keywords": [
    "github",
@@ -9,8 +9,27 @@
  ],
  "homepage": "https://github.com/actions/toolkit/tree/main/packages/http-client",
  "license": "MIT",
+  "type": "module",
  "main": "lib/index.js",
  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "import": "./lib/index.js"
+    },
+    "./lib/auth": {
+      "types": "./lib/auth.d.ts",
+      "import": "./lib/auth.js"
+    },
+    "./lib/proxy": {  
+      "types": "./lib/proxy.d.ts",  
+      "import": "./lib/proxy.js"
+    },
+    "./lib/interfaces": {  
+      "types": "./lib/interfaces.d.ts",  
+      "import": "./lib/interfaces.js"
+    }
+  },
  "directories": {
    "lib": "lib",
    "test": "__tests__"
@@ -1,6 +1,6 @@
 import * as http from 'http'
-import * as ifm from './interfaces'
-import {HttpClientResponse} from './index'
+import * as ifm from './interfaces.js'
+import {HttpClientResponse} from './index.js'

 export class BasicCredentialHandler implements ifm.RequestHandler {
  username: string
@@ -2,9 +2,9 @@

 import * as http from 'http'
 import * as https from 'https'
-import * as ifm from './interfaces'
+import * as ifm from './interfaces.js'
 import * as net from 'net'
-import * as pm from './proxy'
+import * as pm from './proxy.js'
 import * as tunnel from 'tunnel'
 import {ProxyAgent} from 'undici'

@@ -1,6 +1,6 @@
 import * as http from 'http'
 import * as https from 'https'
-import {HttpClientResponse} from './index'
+import {HttpClientResponse} from './index.js'

 export interface HttpClient {
  options(
@@ -3,8 +3,9 @@
  "compilerOptions": {
    "outDir": "./lib",
    "rootDir": "./src",
-    "moduleResolution": "node",
-    "declaration": true,
+    "module": "node16",
+    "moduleResolution": "node16",
+    "declaration": true
  },
  "include": [
    "./src"
@@ -1,26 +1,43 @@
 # @actions/io Releases

-### 2.0.0
+## 3.0.2
+
+- Fix: update lock file version
+
+## 3.0.1
+
+- Fix: export `@actions/io/lib/io-util`
+
+## 3.0.0
+
+- **Breaking change**: Package is now ESM-only
+  - CommonJS consumers must use dynamic `import()` instead of `require()`
+
+## 2.0.0
+
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Ensures consistent behavior for paths on Node 24 with Windows

-### 1.1.3
+## 1.1.3
+
 - Replace `child_process.exec` with `fs.rm` in `rmRF` for all OS implementations [#1373](https://github.com/actions/toolkit/pull/1373)

-### 1.1.2
- Update `lockfileVersion` to `v2` in `package-lock.json [#1020](https://github.com/actions/toolkit/pull/1020) 
+## 1.1.2
+
+- Update `lockfileVersion` to `v2` in `package-lock.json [#1020](https://github.com/actions/toolkit/pull/1020)
+
+## 1.1.1

-### 1.1.1
 - [Fixed a bug where we incorrectly escaped paths for rmrf](https://github.com/actions/toolkit/pull/828)

-### 1.1.0
+## 1.1.0

 - Add `findInPath` method to locate all matching executables in the system path

-### 1.0.2
+## 1.0.2

 - [Add \"types\" to package.json](https://github.com/actions/toolkit/pull/221)

-### 1.0.0
+## 1.0.0

 - Initial release
@@ -2,8 +2,8 @@ import * as child from 'child_process'
 import {promises as fs} from 'fs'
 import * as os from 'os'
 import * as path from 'path'
-import * as io from '../src/io'
-import * as ioUtil from '../src/io-util'
+import * as io from '../src/io.js'
+import * as ioUtil from '../src/io-util.js'

 describe('cp', () => {
  beforeAll(async () => {
@@ -1,12 +1,12 @@
 {
  "name": "@actions/io",
-  "version": "2.0.0",
+  "version": "3.0.2",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/io",
-      "version": "2.0.0",
+      "version": "3.0.2",
      "license": "MIT"
    }
  }
@@ -1,6 +1,6 @@
 {
  "name": "@actions/io",
-  "version": "2.0.0",
+  "version": "3.0.2",
  "description": "Actions io lib",
  "keywords": [
    "github",
@@ -9,8 +9,19 @@
  ],
  "homepage": "https://github.com/actions/toolkit/tree/main/packages/io",
  "license": "MIT",
+  "type": "module",
  "main": "lib/io.js",
  "types": "lib/io.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/io.d.ts",
+      "import": "./lib/io.js"
+    },
+    "./lib/io-util": {
+      "types": "./lib/io-util.d.ts",
+      "import": "./lib/io-util.js"
+    }
+  },
  "directories": {
    "lib": "lib",
    "test": "__tests__"
@@ -1,6 +1,6 @@
 import {ok} from 'assert'
 import * as path from 'path'
-import * as ioUtil from './io-util'
+import * as ioUtil from './io-util.js'

 /**
 * Interface for cp/mv options
@@ -3,7 +3,9 @@
  "compilerOptions": {
    "baseUrl": "./",
    "outDir": "./lib",
-    "rootDir": "./src"
+    "rootDir": "./src",
+    "module": "node16",
+    "moduleResolution": "node16"
  },
  "include": [
    "./src"
@@ -1,5 +1,9 @@
 # @actions/tool-cache Releases

+### 3.0.1
+
+- Bump `@actions/http-client` to `3.0.2`
+
 ### 3.0.0

 - Update to v2.0.1 of `@actions/core`
@@ -1,17 +1,17 @@
 {
  "name": "@actions/tool-cache",
-  "version": "3.0.0",
+  "version": "3.0.1",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/tool-cache",
-      "version": "3.0.0",
+      "version": "3.0.1",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^2.0.1",
        "@actions/exec": "^2.0.0",
-        "@actions/http-client": "^3.0.1",
+        "@actions/http-client": "^3.0.2",
        "@actions/io": "^2.0.0",
        "semver": "^6.1.0"
      },
@@ -41,13 +41,13 @@
      }
    },
    "node_modules/@actions/http-client": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.1.tgz",
-      "integrity": "sha512-SbGS8c/vySbNO3kjFgSW77n83C4MQx/Yoe+b1hAdpuvfHxnkHzDq2pWljUpAA56Si1Gae/7zjeZsV0CYjmLo/w==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/io": {
@@ -56,15 +56,6 @@
      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
      "license": "MIT"
    },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
    "node_modules/@types/nock": {
      "version": "11.1.0",
      "resolved": "https://registry.npmjs.org/@types/nock/-/nock-11.1.0.tgz",
@@ -159,15 +150,12 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
      "engines": {
-        "node": ">=14.0"
+        "node": ">=18.17"
      }
    }
  }
@@ -1,6 +1,6 @@
 {
  "name": "@actions/tool-cache",
-  "version": "3.0.0",
+  "version": "3.0.1",
  "description": "Actions tool-cache lib",
  "keywords": [
    "github",
@@ -38,7 +38,7 @@
  "dependencies": {
    "@actions/core": "^2.0.1",
    "@actions/exec": "^2.0.0",
-    "@actions/http-client": "^3.0.1",
+    "@actions/http-client": "^3.0.2",
    "@actions/io": "^2.0.0",
    "semver": "^6.1.0"
  },
Author	SHA1	Message	Date
Daniel Kennedy	2d38e51528	Bump `@actions/io` to `3.0.2`	2026-01-28 14:44:07 -05:00
Daniel Kennedy	123c3678fa	`@actions/exec`: convert to ESM module	2026-01-28 14:44:07 -05:00
Daniel Kennedy	a6e9f4bab2	`@actions/io`: update lock file version	2026-01-28 14:36:03 -05:00
Daniel Kennedy	758b556388	`@actions/io`: export `lib/io-util`	2026-01-28 14:08:19 -05:00
Daniel Kennedy	9e060cb3e1	Add release notes	2026-01-28 13:33:17 -05:00
Daniel Kennedy	5501ba08b7	`@actions/io`: convert to ESM module	2026-01-28 13:33:17 -05:00
Daniel Kennedy	4446f00fc7	Add a release entry for `4.0.0`	2026-01-28 10:27:09 -05:00
Daniel Kennedy	965dcc7493	Fix a JSON lint issue	2026-01-28 10:27:09 -05:00
Daniel Kennedy	d464f9dd60	Add proxy/interfaces exports	2026-01-28 10:27:09 -05:00
Daniel Kennedy	c9ab4f9548	http-client: convert to ESM	2026-01-28 10:27:09 -05:00
Lokesh Gopu	a2986ee511	Merge pull request #2260 from actions/lokesh755-actions-github-v9-esm ESM-only with updated @octokit dependencies	2026-01-27 15:58:18 -05:00
Daniel Kennedy	e827417593	Bump `@actions/glob` to `0.5.1` in `@actions/cache`	2026-01-27 15:43:44 -05:00
Lokesh Gopu	b05d26b3fa	ESM-only with updated @octokit dependencies	2026-01-27 15:35:32 -05:00
Daniel Kennedy	ecdfc18bf2	Bump `@actions/glob` version to `0.5.1`	2026-01-27 14:55:56 -05:00
Daniel Kennedy	e8e0ce7ad8	Bump `@actions/core` to `2.0.3` on `@actions/glob`	2026-01-27 14:55:56 -05:00
Daniel Kennedy	dc6427f3c3	Attest: undo the `@actions/github`/`@octokit` bumps	2026-01-27 13:31:31 -05:00
Daniel Kennedy	76339b5f68	Bump `@actions/http-client` and `@actions/github` on all packages	2026-01-27 13:31:31 -05:00
Daniel Kennedy	c0ef67ec49	Release @actions/github `v8.0.1`	2026-01-27 10:29:06 -05:00
Daniel Kennedy	968fd7f8d3	Bump `undici` to `v6.23.0` and `@actions/http-client` to `v3.0.2` in `@actions/github`	2026-01-27 10:29:06 -05:00