Update artifact release notes

Includes:
- #1815

packages/artifact/RELEASES.md

@@ -1,5 +1,10 @@
 # @actions/artifact Releases
 
+### 2.1.11
+
+- Fixed a bug with relative symlinks resolution [#1844](https://github.com/actions/toolkit/pull/1844)
+- Use native `crypto` [#1815](https://github.com/actions/toolkit/pull/1815)
+
 ### 2.1.10
 
 - Fixed a regression with symlinks not being automatically resolved [#1830](https://github.com/actions/toolkit/pull/1830)

packages/artifact/__tests__/upload-artifact.test.ts

@@ -10,6 +10,7 @@ import {FilesNotFoundError} from '../src/internal/shared/errors'
 import {BlockBlobUploadStreamOptions} from '@azure/storage-blob'
 import * as fs from 'fs'
 import * as path from 'path'
+import unzip from 'unzip-stream'
 
 const uploadStreamMock = jest.fn()
 const blockBlobClientMock = jest.fn().mockImplementation(() => ({
@@ -31,9 +32,20 @@ const fixtures = {
     {name: 'file2.txt', content: 'test 2 file content'},
     {name: 'file3.txt', content: 'test 3 file content'},
     {
-      name: 'from_symlink.txt',
+      name: 'real.txt',
+      content: 'from a symlink'
+    },
+    {
+      name: 'relative.txt',
       content: 'from a symlink',
-      symlink: '../symlinked.txt'
+      symlink: 'real.txt',
+      relative: true
+    },
+    {
+      name: 'absolute.txt',
+      content: 'from a symlink',
+      symlink: 'real.txt',
+      relative: false
     }
   ],
   backendIDs: {
@@ -55,14 +67,17 @@ const fixtures = {
 
 describe('upload-artifact', () => {
   beforeAll(() => {
-    if (!fs.existsSync(fixtures.uploadDirectory)) {
-      fs.mkdirSync(fixtures.uploadDirectory, {recursive: true})
-    }
+    fs.mkdirSync(fixtures.uploadDirectory, {
+      recursive: true
+    })
 
     for (const file of fixtures.files) {
       if (file.symlink) {
-        const symlinkPath = path.join(fixtures.uploadDirectory, file.symlink)
-        fs.writeFileSync(symlinkPath, file.content)
+        let symlinkPath = file.symlink
+        if (!file.relative) {
+          symlinkPath = path.join(fixtures.uploadDirectory, file.symlink)
+        }
+
         if (!fs.existsSync(path.join(fixtures.uploadDirectory, file.name))) {
           fs.symlinkSync(
             symlinkPath,
@@ -227,6 +242,12 @@ describe('upload-artifact', () => {
         })
       )
 
+    let loadedBytes = 0
+    const uploadedZip = path.join(
+      fixtures.uploadDirectory,
+      '..',
+      'uploaded.zip'
+    )
     uploadStreamMock.mockImplementation(
       async (
         stream: NodeJS.ReadableStream,
@@ -234,19 +255,28 @@ describe('upload-artifact', () => {
         maxConcurrency?: number,
         options?: BlockBlobUploadStreamOptions
       ) => {
-        const {onProgress, abortSignal} = options || {}
+        const {onProgress} = options || {}
+
+        if (fs.existsSync(uploadedZip)) {
+          fs.unlinkSync(uploadedZip)
+        }
+        const uploadedZipStream = fs.createWriteStream(uploadedZip)
 
         onProgress?.({loadedBytes: 0})
-
-        return new Promise(resolve => {
-          const timerId = setTimeout(() => {
-            onProgress?.({loadedBytes: 256})
-            resolve({})
-          }, 1_000)
-          abortSignal?.addEventListener('abort', () => {
-            clearTimeout(timerId)
+        return new Promise((resolve, reject) => {
+          stream.on('data', chunk => {
+            loadedBytes += chunk.length
+            uploadedZipStream.write(chunk)
+            onProgress?.({loadedBytes})
+          })
+          stream.on('end', () => {
+            onProgress?.({loadedBytes})
+            uploadedZipStream.end()
             resolve({})
           })
+          stream.on('error', err => {
+            reject(err)
+          })
         })
       }
     )
@@ -260,7 +290,34 @@ describe('upload-artifact', () => {
     )
 
     expect(id).toBe(1)
-    expect(size).toBe(256)
+    expect(size).toBe(loadedBytes)
+
+    const extractedDirectory = path.join(
+      fixtures.uploadDirectory,
+      '..',
+      'extracted'
+    )
+    if (fs.existsSync(extractedDirectory)) {
+      fs.rmdirSync(extractedDirectory, {recursive: true})
+    }
+
+    const extract = new Promise((resolve, reject) => {
+      fs.createReadStream(uploadedZip)
+        .pipe(unzip.Extract({path: extractedDirectory}))
+        .on('close', () => {
+          resolve(true)
+        })
+        .on('error', err => {
+          reject(err)
+        })
+    })
+
+    await expect(extract).resolves.toBe(true)
+    for (const file of fixtures.files) {
+      const filePath = path.join(extractedDirectory, file.name)
+      expect(fs.existsSync(filePath)).toBe(true)
+      expect(fs.readFileSync(filePath, 'utf8')).toBe(file.content)
+    }
   })
 
   it('should throw an error uploading blob chunks get delayed', async () => {

packages/artifact/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/artifact",
-  "version": "2.1.10",
+  "version": "2.1.11",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/artifact",
-      "version": "2.1.10",
+      "version": "2.1.11",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.0",
@@ -19,7 +19,6 @@
         "@octokit/request-error": "^5.0.0",
         "@protobuf-ts/plugin": "^2.2.3-alpha.1",
         "archiver": "^7.0.1",
-        "crypto": "^1.0.1",
         "jwt-decode": "^3.1.2",
         "twirp-ts": "^2.5.0",
         "unzip-stream": "^0.3.1"
@@ -852,12 +851,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/crypto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/crypto/-/crypto-1.0.1.tgz",
-      "integrity": "sha512-VxBKmeNcqQdiUQUW2Tzq0t377b54N2bMtXO/qiLa+6eRRmmC4qT3D4OnTGoT/U6O9aklQ/jTwbOtRMTTY8G0Ig==",
-      "deprecated": "This package is no longer supported. It's now a built-in Node module. If you've depended on crypto, you should switch to the one that's built-in."
-    },
     "node_modules/delayed-stream": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",

packages/artifact/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/artifact",
-  "version": "2.1.10",
+  "version": "2.1.11",
   "preview": true,
   "description": "Actions artifact lib",
   "keywords": [
@@ -50,7 +50,6 @@
     "@octokit/request-error": "^5.0.0",
     "@protobuf-ts/plugin": "^2.2.3-alpha.1",
     "archiver": "^7.0.1",
-    "crypto": "^1.0.1",
     "jwt-decode": "^3.1.2",
     "twirp-ts": "^2.5.0",
     "unzip-stream": "^0.3.1"

packages/artifact/src/internal/upload/zip.ts

@@ -1,5 +1,5 @@
 import * as stream from 'stream'
-import {readlink} from 'fs/promises'
+import {realpath} from 'fs/promises'
 import * as archiver from 'archiver'
 import * as core from '@actions/core'
 import {UploadZipSpecification} from './upload-zip-specification'
@@ -46,7 +46,7 @@ export async function createZipUploadStream(
       // Check if symlink and resolve the source path
       let sourcePath = file.sourcePath
       if (file.stats.isSymbolicLink()) {
-        sourcePath = await readlink(file.sourcePath)
+        sourcePath = await realpath(file.sourcePath)
       }
 
       // Add the file to the zip

packages/cache/package-lock.json

@@ -17,12 +17,10 @@
         "@azure/abort-controller": "^1.1.0",
         "@azure/ms-rest-js": "^2.6.0",
         "@azure/storage-blob": "^12.13.0",
-        "semver": "^6.3.1",
-        "uuid": "^3.3.3"
+        "semver": "^6.3.1"
       },
       "devDependencies": {
         "@types/semver": "^6.0.0",
-        "@types/uuid": "^3.4.5",
         "typescript": "^5.2.2"
       }
     },
@@ -296,12 +294,6 @@
         "@types/node": "*"
       }
     },
-    "node_modules/@types/uuid": {
-      "version": "3.4.10",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-3.4.10.tgz",
-      "integrity": "sha512-BgeaZuElf7DEYZhWYDTc/XcLZXdVgFkVSTa13BqKvbnmUrxr3TJFKofUxCtDO9UQOdhnV+HPOESdHiHKZOJV1A==",
-      "dev": true
-    },
     "node_modules/abort-controller": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
@@ -486,15 +478,6 @@
         "node": ">=14.17"
       }
     },
-    "node_modules/uuid": {
-      "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
-      "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==",
-      "deprecated": "Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.",
-      "bin": {
-        "uuid": "bin/uuid"
-      }
-    },
     "node_modules/webidl-conversions": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
@@ -764,12 +747,6 @@
         "@types/node": "*"
       }
     },
-    "@types/uuid": {
-      "version": "3.4.10",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-3.4.10.tgz",
-      "integrity": "sha512-BgeaZuElf7DEYZhWYDTc/XcLZXdVgFkVSTa13BqKvbnmUrxr3TJFKofUxCtDO9UQOdhnV+HPOESdHiHKZOJV1A==",
-      "dev": true
-    },
     "abort-controller": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
@@ -900,11 +877,6 @@
       "integrity": "sha512-mI4WrpHsbCIcwT9cF4FZvr80QUeKvsUsUvKDoR+X/7XHQH98xYD8YHZg7ANtz2GtZt/CBq2QJ0thkGJMHfqc1w==",
       "dev": true
     },
-    "uuid": {
-      "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
-      "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A=="
-    },
     "webidl-conversions": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",

packages/cache/package.json

@@ -45,12 +45,10 @@
     "@azure/abort-controller": "^1.1.0",
     "@azure/ms-rest-js": "^2.6.0",
     "@azure/storage-blob": "^12.13.0",
-    "semver": "^6.3.1",
-    "uuid": "^3.3.3"
+    "semver": "^6.3.1"
   },
   "devDependencies": {
     "@types/semver": "^6.0.0",
-    "@types/uuid": "^3.4.5",
     "typescript": "^5.2.2"
   }
 }

packages/cache/src/internal/cacheUtils.ts

@@ -2,11 +2,11 @@ import * as core from '@actions/core'
 import * as exec from '@actions/exec'
 import * as glob from '@actions/glob'
 import * as io from '@actions/io'
+import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as path from 'path'
 import * as semver from 'semver'
 import * as util from 'util'
-import {v4 as uuidV4} from 'uuid'
 import {
   CacheFilename,
   CompressionMethod,
@@ -34,7 +34,7 @@ export async function createTempDirectory(): Promise<string> {
     tempDirectory = path.join(baseLocation, 'actions', 'temp')
   }
 
-  const dest = path.join(tempDirectory, uuidV4())
+  const dest = path.join(tempDirectory, crypto.randomUUID())
   await io.mkdirP(dest)
   return dest
 }

packages/core/RELEASES.md

@@ -1,5 +1,12 @@
 # @actions/core Releases
 
+### 1.11.1
+- Fix uses of `crypto.randomUUID` on Node 18 and earlier [#1842](https://github.com/actions/toolkit/pull/1842)
+
+### 1.11.0
+- Add platform info utilities [#1551](https://github.com/actions/toolkit/pull/1551)
+- Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824)
+
 ### 1.10.1
 - Fix error message reference in oidc utils [#1511](https://github.com/actions/toolkit/pull/1511)
 

packages/core/__tests__/core.test.ts

@@ -4,9 +4,6 @@ import * as path from 'path'
 import * as core from '../src/core'
 import {HttpClient} from '@actions/http-client'
 import {toCommandProperties} from '../src/utils'
-import * as uuid from 'uuid'
-
-jest.mock('uuid')
 
 /* eslint-disable @typescript-eslint/unbound-method */
 
@@ -49,11 +46,23 @@ const testEnvVars = {
 const UUID = '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'
 const DELIMITER = `ghadelimiter_${UUID}`
 
+jest.mock('crypto', () => ({
+  ...jest.requireActual('crypto'),
+  randomUUID: jest.fn(() => UUID)
+}))
+
+const TEMP_DIR = path.join(__dirname, '_temp')
+
 describe('@actions/core', () => {
   beforeAll(() => {
-    const filePath = path.join(__dirname, `test`)
+    const filePath = TEMP_DIR
     if (!fs.existsSync(filePath)) {
       fs.mkdirSync(filePath)
+    } else {
+      // Clear out the temp directory
+      for (const file of fs.readdirSync(filePath)) {
+        fs.unlinkSync(path.join(filePath, file))
+      }
     }
   })
 
@@ -62,10 +71,6 @@ describe('@actions/core', () => {
       process.env[key] = testEnvVars[key as keyof typeof testEnvVars]
     }
     process.stdout.write = jest.fn()
-
-    jest.spyOn(uuid, 'v4').mockImplementation(() => {
-      return UUID
-    })
   })
 
   afterEach(() => {
@@ -141,7 +146,7 @@ describe('@actions/core', () => {
       `Unexpected input: value should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -155,7 +160,7 @@ describe('@actions/core', () => {
       `Unexpected input: name should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -347,7 +352,7 @@ describe('@actions/core', () => {
       `Unexpected input: value should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -361,7 +366,7 @@ describe('@actions/core', () => {
       `Unexpected input: name should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -585,7 +590,7 @@ describe('@actions/core', () => {
       `Unexpected input: value should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -599,7 +604,7 @@ describe('@actions/core', () => {
       `Unexpected input: name should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -641,7 +646,7 @@ function assertWriteCalls(calls: string[]): void {
 }
 
 function createFileCommandFile(command: string): void {
-  const filePath = path.join(__dirname, `test/${command}`)
+  const filePath = path.join(__dirname, `_temp/${command}`)
   process.env[`GITHUB_${command}`] = filePath
   fs.appendFileSync(filePath, '', {
     encoding: 'utf8'
@@ -649,7 +654,7 @@ function createFileCommandFile(command: string): void {
 }
 
 function verifyFileCommand(command: string, expectedContents: string): void {
-  const filePath = path.join(__dirname, `test/${command}`)
+  const filePath = path.join(__dirname, `_temp/${command}`)
   const contents = fs.readFileSync(filePath, 'utf8')
   try {
     expect(contents).toEqual(expectedContents)

packages/core/package-lock.json

@@ -1,21 +1,19 @@
 {
   "name": "@actions/core",
-  "version": "1.10.1",
+  "version": "1.11.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/core",
-      "version": "1.10.1",
+      "version": "1.11.1",
       "license": "MIT",
       "dependencies": {
         "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1",
-        "uuid": "^8.3.2"
+        "@actions/http-client": "^2.0.1"
       },
       "devDependencies": {
-        "@types/node": "^12.0.2",
-        "@types/uuid": "^8.3.4"
+        "@types/node": "^16.18.112"
       }
     },
     "node_modules/@actions/exec": {
@@ -40,15 +38,9 @@
       "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
     },
     "node_modules/@types/node": {
-      "version": "12.0.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.0.2.tgz",
-      "integrity": "sha512-5tabW/i+9mhrfEOUcLDu2xBPsHJ+X5Orqy9FKpale3SjDA17j5AEpYq5vfy3oAeAHGcvANRCO3NV3d2D6q3NiA==",
-      "dev": true
-    },
-    "node_modules/@types/uuid": {
-      "version": "8.3.4",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-8.3.4.tgz",
-      "integrity": "sha512-c/I8ZRb51j+pYGAu5CrFMRxqZ2ke4y2grEBO5AUjgSkSk+qT2Ea+OdWElz/OiMf5MNpn2b17kuVBwZLQJXzihw==",
+      "version": "16.18.112",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.112.tgz",
+      "integrity": "sha512-EKrbKUGJROm17+dY/gMi31aJlGLJ75e1IkTojt9n6u+hnaTBDs+M1bIdOawpk2m6YUAXq/R2W0SxCng1tndHCg==",
       "dev": true
     },
     "node_modules/tunnel": {
@@ -58,14 +50,6 @@
       "engines": {
         "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
       }
-    },
-    "node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
     }
   },
   "dependencies": {
@@ -91,26 +75,15 @@
       "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
     },
     "@types/node": {
-      "version": "12.0.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.0.2.tgz",
-      "integrity": "sha512-5tabW/i+9mhrfEOUcLDu2xBPsHJ+X5Orqy9FKpale3SjDA17j5AEpYq5vfy3oAeAHGcvANRCO3NV3d2D6q3NiA==",
-      "dev": true
-    },
-    "@types/uuid": {
-      "version": "8.3.4",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-8.3.4.tgz",
-      "integrity": "sha512-c/I8ZRb51j+pYGAu5CrFMRxqZ2ke4y2grEBO5AUjgSkSk+qT2Ea+OdWElz/OiMf5MNpn2b17kuVBwZLQJXzihw==",
+      "version": "16.18.112",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.112.tgz",
+      "integrity": "sha512-EKrbKUGJROm17+dY/gMi31aJlGLJ75e1IkTojt9n6u+hnaTBDs+M1bIdOawpk2m6YUAXq/R2W0SxCng1tndHCg==",
       "dev": true
     },
     "tunnel": {
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
       "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
-    },
-    "uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
     }
   }
 }

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/core",
-  "version": "1.10.1",
+  "version": "1.11.1",
   "description": "Actions core lib",
   "keywords": [
     "github",
@@ -37,11 +37,9 @@
   },
   "dependencies": {
     "@actions/exec": "^1.1.1",
-    "@actions/http-client": "^2.0.1",
-    "uuid": "^8.3.2"
+    "@actions/http-client": "^2.0.1"
   },
   "devDependencies": {
-    "@types/node": "^12.0.2",
-    "@types/uuid": "^8.3.4"
+    "@types/node": "^16.18.112"
   }
 }

packages/core/src/file-command.ts

@@ -3,9 +3,9 @@
 // We use any as a valid input type
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
+import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as os from 'os'
-import {v4 as uuidv4} from 'uuid'
 import {toCommandValue} from './utils'
 
 export function issueFileCommand(command: string, message: any): void {
@@ -25,7 +25,7 @@ export function issueFileCommand(command: string, message: any): void {
 }
 
 export function prepareKeyValueMessage(key: string, value: any): string {
-  const delimiter = `ghadelimiter_${uuidv4()}`
+  const delimiter = `ghadelimiter_${crypto.randomUUID()}`
   const convertedValue = toCommandValue(value)
 
   // These should realistically never happen, but just in case someone finds a

packages/tool-cache/package-lock.json

@@ -13,13 +13,11 @@
         "@actions/exec": "^1.0.0",
         "@actions/http-client": "^2.0.1",
         "@actions/io": "^1.1.1",
-        "semver": "^6.1.0",
-        "uuid": "^3.3.2"
+        "semver": "^6.1.0"
       },
       "devDependencies": {
         "@types/nock": "^11.1.0",
         "@types/semver": "^6.0.0",
-        "@types/uuid": "^3.4.4",
         "nock": "^13.2.9"
       }
     },
@@ -71,27 +69,12 @@
         "nock": "*"
       }
     },
-    "node_modules/@types/node": {
-      "version": "12.7.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.7.0.tgz",
-      "integrity": "sha512-vqcj1MVm2Sla4PpMfYKh1MyDN4D2f/mPIZD7RdAGqEsbE+JxfeqQHHVbRDQ0Nqn8i73gJa1HQ1Pu3+nH4Q0Yiw==",
-      "dev": true
-    },
     "node_modules/@types/semver": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/@types/semver/-/semver-6.0.1.tgz",
       "integrity": "sha512-ffCdcrEE5h8DqVxinQjo+2d1q+FV5z7iNtPofw3JsrltSoSVlOGaW0rY8XxtO9XukdTn8TaCGWmk2VFGhI70mg==",
       "dev": true
     },
-    "node_modules/@types/uuid": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-3.4.5.tgz",
-      "integrity": "sha512-MNL15wC3EKyw1VLF+RoVO4hJJdk9t/Hlv3rt1OL65Qvuadm4BYo6g9ZJQqoq7X8NBFSsQXgAujWciovh2lpVjA==",
-      "dev": true,
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
     "node_modules/debug": {
       "version": "4.3.4",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
@@ -166,15 +149,6 @@
       "engines": {
         "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
       }
-    },
-    "node_modules/uuid": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.3.2.tgz",
-      "integrity": "sha512-yXJmeNaw3DnnKAOKJE51sL/ZaYfWJRl1pK9dr19YFCu0ObS231AB1/LbqTKRAQ5kw8A90rA6fr4riOUpTZvQZA==",
-      "deprecated": "Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.",
-      "bin": {
-        "uuid": "bin/uuid"
-      }
     }
   },
   "dependencies": {
@@ -224,27 +198,12 @@
         "nock": "*"
       }
     },
-    "@types/node": {
-      "version": "12.7.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.7.0.tgz",
-      "integrity": "sha512-vqcj1MVm2Sla4PpMfYKh1MyDN4D2f/mPIZD7RdAGqEsbE+JxfeqQHHVbRDQ0Nqn8i73gJa1HQ1Pu3+nH4Q0Yiw==",
-      "dev": true
-    },
     "@types/semver": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/@types/semver/-/semver-6.0.1.tgz",
       "integrity": "sha512-ffCdcrEE5h8DqVxinQjo+2d1q+FV5z7iNtPofw3JsrltSoSVlOGaW0rY8XxtO9XukdTn8TaCGWmk2VFGhI70mg==",
       "dev": true
     },
-    "@types/uuid": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-3.4.5.tgz",
-      "integrity": "sha512-MNL15wC3EKyw1VLF+RoVO4hJJdk9t/Hlv3rt1OL65Qvuadm4BYo6g9ZJQqoq7X8NBFSsQXgAujWciovh2lpVjA==",
-      "dev": true,
-      "requires": {
-        "@types/node": "*"
-      }
-    },
     "debug": {
       "version": "4.3.4",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
@@ -299,11 +258,6 @@
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
       "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
-    },
-    "uuid": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.3.2.tgz",
-      "integrity": "sha512-yXJmeNaw3DnnKAOKJE51sL/ZaYfWJRl1pK9dr19YFCu0ObS231AB1/LbqTKRAQ5kw8A90rA6fr4riOUpTZvQZA=="
     }
   }
 }

packages/tool-cache/package.json

@@ -40,13 +40,11 @@
     "@actions/exec": "^1.0.0",
     "@actions/http-client": "^2.0.1",
     "@actions/io": "^1.1.1",
-    "semver": "^6.1.0",
-    "uuid": "^3.3.2"
+    "semver": "^6.1.0"
   },
   "devDependencies": {
     "@types/nock": "^11.1.0",
     "@types/semver": "^6.0.0",
-    "@types/uuid": "^3.4.4",
     "nock": "^13.2.9"
   }
 }

packages/tool-cache/src/tool-cache.ts

@@ -1,5 +1,6 @@
 import * as core from '@actions/core'
 import * as io from '@actions/io'
+import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as mm from './manifest'
 import * as os from 'os'
@@ -10,7 +11,6 @@ import * as stream from 'stream'
 import * as util from 'util'
 import {ok} from 'assert'
 import {OutgoingHttpHeaders} from 'http'
-import uuidV4 from 'uuid/v4'
 import {exec} from '@actions/exec/lib/exec'
 import {ExecOptions} from '@actions/exec/lib/interfaces'
 import {RetryHelper} from './retry-helper'
@@ -41,7 +41,7 @@ export async function downloadTool(
   auth?: string,
   headers?: OutgoingHttpHeaders
 ): Promise<string> {
-  dest = dest || path.join(_getTempDirectory(), uuidV4())
+  dest = dest || path.join(_getTempDirectory(), crypto.randomUUID())
   await io.mkdirP(path.dirname(dest))
   core.debug(`Downloading ${url}`)
   core.debug(`Destination ${dest}`)
@@ -651,7 +651,7 @@ export async function findFromManifest(
 async function _createExtractFolder(dest?: string): Promise<string> {
   if (!dest) {
     // create a temp dir
-    dest = path.join(_getTempDirectory(), uuidV4())
+    dest = path.join(_getTempDirectory(), crypto.randomUUID())
   }
   await io.mkdirP(dest)
   return dest