Add release notes

ESM-only with updated @octokit dependencies

packages/cache/RELEASES.md

@@ -1,5 +1,9 @@
 # @actions/cache Releases
 
+### 5.0.5
+
+- Bump `@actions/glob` to `0.5.1`
+
 ### 5.0.4
 
 - Bump `@actions/http-client` to `3.0.2`

packages/cache/package-lock.json

@@ -1,17 +1,17 @@
 {
   "name": "@actions/cache",
-  "version": "5.0.4",
+  "version": "5.0.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/cache",
-      "version": "5.0.4",
+      "version": "5.0.5",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^2.0.0",
         "@actions/exec": "^2.0.0",
-        "@actions/glob": "^0.5.0",
+        "@actions/glob": "^0.5.1",
         "@actions/http-client": "^3.0.2",
         "@actions/io": "^2.0.0",
         "@azure/abort-controller": "^1.1.0",
@@ -28,13 +28,13 @@
       }
     },
     "node_modules/@actions/core": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.1.tgz",
-      "integrity": "sha512-oBfqT3GwkvLlo1fjvhQLQxuwZCGTarTE5OuZ2Wg10hvhBj7LRIlF611WT4aZS6fDhO5ZKlY7lCAZTlpmyaHaeg==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.3.tgz",
+      "integrity": "sha512-Od9Thc3T1mQJYddvVPM4QGiLUewdh+3txmDYHHxoNdkqysR1MbCT+rFOtNUxYAz+7+6RIsqipVahY2GJqGPyxA==",
       "license": "MIT",
       "dependencies": {
         "@actions/exec": "^2.0.0",
-        "@actions/http-client": "^3.0.0"
+        "@actions/http-client": "^3.0.2"
       }
     },
     "node_modules/@actions/exec": {
@@ -47,50 +47,15 @@
       }
     },
     "node_modules/@actions/glob": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.5.0.tgz",
-      "integrity": "sha512-tST2rjPvJLRZLuT9NMUtyBjvj9Yo0MiJS3ow004slMvm8GFM+Zv9HvMJ7HWzfUyJnGrJvDsYkWBaaG3YKXRtCw==",
+      "version": "0.5.1",
+      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.5.1.tgz",
+      "integrity": "sha512-+dv/t2aKQdKp9WWSp+1yIXVJzH5Q38M0Mta26pzIbeec14EcIleMB7UU6N7sNgbEuYfyuVGpE5pOKjl6j1WXkA==",
       "license": "MIT",
       "dependencies": {
-        "@actions/core": "^1.9.1",
+        "@actions/core": "^2.0.3",
         "minimatch": "^3.0.4"
       }
     },
-    "node_modules/@actions/glob/node_modules/@actions/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
-      "license": "MIT",
-      "dependencies": {
-        "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1"
-      }
-    },
-    "node_modules/@actions/glob/node_modules/@actions/exec": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
-      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
-      "license": "MIT",
-      "dependencies": {
-        "@actions/io": "^1.0.1"
-      }
-    },
-    "node_modules/@actions/glob/node_modules/@actions/http-client": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
-      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
-      "license": "MIT",
-      "dependencies": {
-        "tunnel": "^0.0.6",
-        "undici": "^5.25.4"
-      }
-    },
-    "node_modules/@actions/glob/node_modules/@actions/io": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
-      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
-      "license": "MIT"
-    },
     "node_modules/@actions/http-client": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
@@ -445,15 +410,6 @@
         "node": ">=14.17"
       }
     },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
     "node_modules/@protobuf-ts/plugin": {
       "version": "2.11.1",
       "resolved": "https://registry.npmjs.org/@protobuf-ts/plugin/-/plugin-2.11.1.tgz",
@@ -725,18 +681,6 @@
         "node": ">=14.17"
       }
     },
-    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
-      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=14.0"
-      }
-    },
     "node_modules/undici-types": {
       "version": "7.16.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",

packages/cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/cache",
-  "version": "5.0.4",
+  "version": "5.0.5",
   "preview": true,
   "description": "Actions cache lib",
   "keywords": [
@@ -39,7 +39,7 @@
   "dependencies": {
     "@actions/core": "^2.0.0",
     "@actions/exec": "^2.0.0",
-    "@actions/glob": "^0.5.0",
+    "@actions/glob": "^0.5.1",
     "@protobuf-ts/runtime-rpc": "^2.11.1",
     "@actions/http-client": "^3.0.2",
     "@actions/io": "^2.0.0",

packages/http-client/RELEASES.md

@@ -1,38 +1,53 @@
-## Releases
+# Releases
+
+## 4.0.0
+
+- **Breaking change**: Package is now ESM-only
+  - CommonJS consumers must use dynamic `import()` instead of `require()`
 
 ## 3.0.2
 
 - Bump `undici` from `5.28.5` to `6.23.0`
 
 ## 3.0.1
+
 - Add support for ACTIONS_ORCHESTRATION_ID in user-agent and default user-agent [#2229](https://github.com/actions/toolkit/pull/2229)
 
 ## 3.0.0
+
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 
 ## 2.2.3
+
 - Fixed an issue where proxy username and password were not handled correctly [#1799](https://github.com/actions/toolkit/pull/1799)
 
 ## 2.2.2
+
 - Better handling of url encoded usernames and passwords in proxy config [#1782](https://github.com/actions/toolkit/pull/1782)
 
 ## 2.2.1
+
 - Make sure RequestOptions.keepAlive is applied properly on node20 runtime [#1572](https://github.com/actions/toolkit/pull/1572)
 
 ## 2.2.0
+
 - Add function to return proxy agent dispatcher for compatibility with latest octokit packages [#1547](https://github.com/actions/toolkit/pull/1547)
 
 ## 2.1.1
+
 - Add `HttpClientResponse.readBodyBuffer` method to read from a response stream and return a buffer [#1475](https://github.com/actions/toolkit/pull/1475)
 
 ## 2.1.0
+
 - Add support for `*` and subdomains in `no_proxy` [#1355](https://github.com/actions/toolkit/pull/1355) [#1223](https://github.com/actions/toolkit/pull/1223)
 - Bypass proxy for loopback IP adresses [#1360](https://github.com/actions/toolkit/pull/1360))
 
 ## 2.0.1
+
 - Fix an issue with missing `tunnel` dependency [#1085](https://github.com/actions/toolkit/pull/1085)
 
 ## 2.0.0
+
 - The package is now compiled with TypeScript's [`strict` compiler setting](https://www.typescriptlang.org/tsconfig#strict). To comply with stricter rules:
   - Some exported types now include `| null` or `| undefined`, matching their actual behavior.
   - Types implementing the method `RequestHandler.handleAuthentication()` now throw an `Error` rather than returning `null` if they do not support handling an HTTP 401 response. Callers can still use `canHandleAuthentication()` to determine if this handling is supported or not.
@@ -44,25 +59,32 @@
 
 ## 1.0.11
 
-Contains a bug fix where proxy is defined without a user and password. see [PR here](https://github.com/actions/http-client/pull/42)   
+Contains a bug fix where proxy is defined without a user and password. see [PR here](https://github.com/actions/http-client/pull/42)
 
 ## 1.0.9
-Throw HttpClientError instead of a generic Error from the \<verb>Json() helper methods when the server responds with a non-successful status code. 
+
+Throw HttpClientError instead of a generic Error from the \<verb>Json() helper methods when the server responds with a non-successful status code.
 
 ## 1.0.8
+
 Fixed security issue where a redirect (e.g. 302) to another domain would pass headers.  The fix was to strip the authorization header if the hostname was different.  More [details in PR #27](https://github.com/actions/http-client/pull/27)
 
 ## 1.0.7
+
 Update NPM dependencies and add 429 to the list of HttpCodes
 
 ## 1.0.6
+
 Automatically sends Content-Type and Accept application/json headers for \<verb>Json() helper methods if not set in the client or parameters.
 
 ## 1.0.5
+
 Adds \<verb>Json() helper methods for json over http scenarios.
 
 ## 1.0.4
+
 Started to add \<verb>Json() helper methods.  Do not use this release for that.  Use >= 1.0.5 since there was an issue with types.
 
 ## 1.0.1 to 1.0.3
+
 Adds proxy support.

packages/http-client/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/http-client",
-  "version": "3.0.2",
+  "version": "4.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/http-client",
-      "version": "3.0.2",
+      "version": "4.0.0",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",

packages/http-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/http-client",
-  "version": "3.0.2",
+  "version": "4.0.0",
   "description": "Actions Http Client",
   "keywords": [
     "github",
@@ -9,8 +9,27 @@
   ],
   "homepage": "https://github.com/actions/toolkit/tree/main/packages/http-client",
   "license": "MIT",
+  "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "import": "./lib/index.js"
+    },
+    "./lib/auth": {
+      "types": "./lib/auth.d.ts",
+      "import": "./lib/auth.js"
+    },
+    "./lib/proxy": {  
+      "types": "./lib/proxy.d.ts",  
+      "import": "./lib/proxy.js"
+    },
+    "./lib/interfaces": {  
+      "types": "./lib/interfaces.d.ts",  
+      "import": "./lib/interfaces.js"
+    }
+  },
   "directories": {
     "lib": "lib",
     "test": "__tests__"

packages/http-client/src/auth.ts

@@ -1,6 +1,6 @@
 import * as http from 'http'
-import * as ifm from './interfaces'
-import {HttpClientResponse} from './index'
+import * as ifm from './interfaces.js'
+import {HttpClientResponse} from './index.js'
 
 export class BasicCredentialHandler implements ifm.RequestHandler {
   username: string

packages/http-client/src/index.ts

@@ -2,9 +2,9 @@
 
 import * as http from 'http'
 import * as https from 'https'
-import * as ifm from './interfaces'
+import * as ifm from './interfaces.js'
 import * as net from 'net'
-import * as pm from './proxy'
+import * as pm from './proxy.js'
 import * as tunnel from 'tunnel'
 import {ProxyAgent} from 'undici'
 

packages/http-client/src/interfaces.ts

@@ -1,6 +1,6 @@
 import * as http from 'http'
 import * as https from 'https'
-import {HttpClientResponse} from './index'
+import {HttpClientResponse} from './index.js'
 
 export interface HttpClient {
   options(

packages/http-client/tsconfig.json

@@ -3,8 +3,9 @@
   "compilerOptions": {
     "outDir": "./lib",
     "rootDir": "./src",
-    "moduleResolution": "node",
-    "declaration": true,
+    "module": "node16",
+    "moduleResolution": "node16",
+    "declaration": true
   },
   "include": [
     "./src"

packages/io/RELEASES.md

@@ -1,26 +1,35 @@
 # @actions/io Releases
 
-### 2.0.0
+## 3.0.0
+
+- **Breaking change**: Package is now ESM-only
+  - CommonJS consumers must use dynamic `import()` instead of `require()`
+
+## 2.0.0
+
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Ensures consistent behavior for paths on Node 24 with Windows
 
-### 1.1.3
+## 1.1.3
+
 - Replace `child_process.exec` with `fs.rm` in `rmRF` for all OS implementations [#1373](https://github.com/actions/toolkit/pull/1373)
 
-### 1.1.2
+## 1.1.2
+
 - Update `lockfileVersion` to `v2` in `package-lock.json [#1020](https://github.com/actions/toolkit/pull/1020) 
 
-### 1.1.1
+## 1.1.1
+
 - [Fixed a bug where we incorrectly escaped paths for rmrf](https://github.com/actions/toolkit/pull/828)
 
-### 1.1.0
+## 1.1.0
 
 - Add `findInPath` method to locate all matching executables in the system path
 
-### 1.0.2
+## 1.0.2
 
 - [Add \"types\" to package.json](https://github.com/actions/toolkit/pull/221)
 
-### 1.0.0
+## 1.0.0
 
 - Initial release

packages/io/__tests__/io.test.ts

@@ -2,8 +2,8 @@ import * as child from 'child_process'
 import {promises as fs} from 'fs'
 import * as os from 'os'
 import * as path from 'path'
-import * as io from '../src/io'
-import * as ioUtil from '../src/io-util'
+import * as io from '../src/io.js'
+import * as ioUtil from '../src/io-util.js'
 
 describe('cp', () => {
   beforeAll(async () => {

packages/io/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/io",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/io",
-      "version": "2.0.0",
+      "version": "3.0.0",
       "license": "MIT"
     }
   }

packages/io/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/io",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "Actions io lib",
   "keywords": [
     "github",
@@ -9,8 +9,15 @@
   ],
   "homepage": "https://github.com/actions/toolkit/tree/main/packages/io",
   "license": "MIT",
+  "type": "module",
   "main": "lib/io.js",
   "types": "lib/io.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/io.d.ts",
+      "import": "./lib/io.js"
+    }
+  },
   "directories": {
     "lib": "lib",
     "test": "__tests__"

packages/io/src/io.ts

@@ -1,6 +1,6 @@
 import {ok} from 'assert'
 import * as path from 'path'
-import * as ioUtil from './io-util'
+import * as ioUtil from './io-util.js'
 
 /**
  * Interface for cp/mv options

packages/io/tsconfig.json

@@ -3,7 +3,9 @@
   "compilerOptions": {
     "baseUrl": "./",
     "outDir": "./lib",
-    "rootDir": "./src"
+    "rootDir": "./src",
+    "module": "node16",
+    "moduleResolution": "node16"
   },
   "include": [
     "./src"