Update packages, migrate to ESM by Samirat · Pull Request #1760 · actions/cache

Samirat · 2026-05-20T19:51:36Z

Description

Update cache to the most recent version published from toolkit (v6)
Migrate to ESM (required in order to consume new packages)

Motivation and Context

Related to https://github.com/github/c2c-actions-support/issues/6176 and in general this package needed more work to keep it from falling farther out of date.
The ESM migration is necessary in order to consume any new versions of the cache package

How Has This Been Tested?

Local Tests

Screenshots (if appropriate):

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation (add or update README or docs)

Checklist:

My code follows the code style of this project.
My change requires a change to the documentation.
I have updated the documentation accordingly.
I have read the CONTRIBUTING document.
I have added tests to cover my changes.
All new and existing tests passed.

Copilot

Pull request overview

This PR updates the action to the latest @actions/* toolkit majors (cache v6) and attempts to migrate the repository/tooling to ESM, including updating documentation references and adjusting the Jest test setup for ESM.

Changes:

Bump action/toolkit dependencies to @actions/cache@^6.0.1 and related @actions/* majors; update release notes and docs to reference actions/cache@v6.
Switch the package to ESM ("type": "module") and update TS compiler settings for newer Node/ES targets.
Migrate Jest configuration/tests to an ESM-compatible setup (jest.config.ts, unstable_mockModule, ESM transforms).

Show a summary per file

File	Description
tsconfig.json	Updates TS target/module settings for ESM + modern Node, adjusts excludes.
tips-and-workarounds.md	Updates usage examples to `actions/cache@v6`.
RELEASES.md	Adds v6.0.0 changelog entry.
README.md	Updates docs to reference `actions/cache@v6` and notes v6 changes.
package.json	Bumps version/deps, sets ESM package type, updates Jest invocation.
jest.config.ts	Adds new TS-based Jest config for ESM + ts-jest.
jest.config.js	Removes previous CJS Jest config.
examples.md	Updates usage examples to `actions/cache@v6`.
caching-strategies.md	Updates usage examples to `actions/cache@v6` / restore/save `@v6`.
tests/stateProvider.test.ts	Migrates tests to ESM-style mocking/imports.
tests/saveOnly.test.ts	Migrates tests to ESM-style mocking/imports.
tests/saveImpl.test.ts	Migrates tests to ESM-style mocking/imports; adjusts warning expectations.
tests/save.test.ts	Migrates tests to ESM-style mocking/imports.
tests/restoreOnly.test.ts	Migrates tests to ESM-style mocking/imports.
tests/restoreImpl.test.ts	Migrates tests to ESM-style mocking/imports; adjusts error simulation.
tests/restore.test.ts	Migrates tests to ESM-style mocking/imports.
tests/actionUtils.test.ts	Migrates tests to ESM-style mocking/imports; simplifies assertions.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 15/18 changed files
Comments generated: 6

v6.0.0 is an ESM-only refactor of v5 (actions/cache#1760: "Update packages, migrate to ESM") — the cache backend, key schema, and save/restore behavior are unchanged, so it stays key+path compatible with the gate_cache storage contract (D-104-03/D-104-09). Widen _is_supported_cache_version + the SHA-pin annotation fallback to accept v4/v5/v6, mirroring the v4->v5 acceptance (spec-163). Unblocks dependabot #602 (actions/cache 5.0.5 -> 6.0.0, grouped with actions/checkout 7.0.0, sonarqube-scan-action 8.2.0, setup-python 6.3.0). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Ai-Eng-Gate: passed

Dependabot github-actions group bump (4 updates): - actions/checkout 6.0.3 -> 7.0.0 - actions/cache 5.0.5 -> 6.0.0 - SonarSource/sonarqube-scan-action 8.1.0 -> 8.2.0 - actions/setup-python 6.2.0 -> 6.3.0 Widen the gate-cache contract test (test_ci_cache_key_schema) to accept actions/cache v6: v6.0.0 is an ESM-only refactor of v5 (actions/cache#1760) with the cache backend, key schema, and save/restore behavior unchanged, so it stays key+path compatible with the gate_cache storage contract (D-104-03 / D-104-09). Mirrors the v4->v5 acceptance (spec-163). Collapsed the bot bump + the contract-widening commit into one trailered commit so Verify Gate Trailers passes (the dependabot commit carried no Ai-Eng-Gate trailer). Co-Authored-By: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Ai-Eng-Gate: passed

Dependabot github-actions group bump (4 updates): - actions/checkout 6.0.3 -> 7.0.0 - actions/cache 5.0.5 -> 6.0.0 - SonarSource/sonarqube-scan-action 8.1.0 -> 8.2.0 - actions/setup-python 6.2.0 -> 6.3.0 Widen the gate-cache contract test (test_ci_cache_key_schema) to accept actions/cache v6: v6.0.0 is an ESM-only refactor of v5 (actions/cache#1760) with the cache backend, key schema, and save/restore behavior unchanged, so it stays key+path compatible with the gate_cache storage contract (D-104-03 / D-104-09). Mirrors the v4->v5 acceptance (spec-163). Collapsed the bot bump + the contract-widening commit into one trailered commit so Verify Gate Trailers passes (the dependabot commit carried no Ai-Eng-Gate trailer). Co-Authored-By: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Ai-Eng-Gate: passed Co-authored-by: soydachi <dachi.gogotchuri@gmail.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://github.com/actions/cache) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](actions/cache@v6.0.0...v6.1.0) #### What's Changed - Bump [@actions/cache](https://github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://github.com/jasongin) in [#1768](actions/cache#1768) **Full Changelog**: <actions/cache@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](actions/cache@v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@Samirat](https://github.com/Samirat) in [#1760](actions/cache#1760) **Full Changelog**: <actions/cache@v5...v6.0.0> ### [`v6`](actions/cache@v5.1.0...v6.0.0) [Compare Source](actions/cache@v5.1.0...v6.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/webexmemebot/pulls/595 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://github.com/actions/cache) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](actions/cache@v6.0.0...v6.1.0) #### What's Changed - Bump [@actions/cache](https://github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://github.com/jasongin) in [#1768](actions/cache#1768) **Full Changelog**: <actions/cache@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](actions/cache@v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@Samirat](https://github.com/Samirat) in [#1760](actions/cache#1760) **Full Changelog**: <actions/cache@v5...v6.0.0> ### [`v6`](actions/cache@v5.1.0...v6.0.0) [Compare Source](actions/cache@v5.1.0...v6.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/roboluke/pulls/461 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://github.com/actions/cache) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](actions/cache@v6.0.0...v6.1.0) #### What's Changed - Bump [@actions/cache](https://github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://github.com/jasongin) in [#1768](actions/cache#1768) **Full Changelog**: <actions/cache@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](actions/cache@v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@Samirat](https://github.com/Samirat) in [#1760](actions/cache#1760) **Full Changelog**: <actions/cache@v5...v6.0.0> ### [`v6`](actions/cache@v5.1.0...v6.0.0) [Compare Source](actions/cache@v5.1.0...v6.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/pypilot/pulls/459 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://github.com/actions/cache) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](actions/cache@v6.0.0...v6.1.0) #### What's Changed - Bump [@actions/cache](https://github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://github.com/jasongin) in [#1768](actions/cache#1768) **Full Changelog**: <actions/cache@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](actions/cache@v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@Samirat](https://github.com/Samirat) in [#1760](actions/cache#1760) **Full Changelog**: <actions/cache@v5...v6.0.0> ### [`v6`](actions/cache@v5.1.0...v6.0.0) [Compare Source](actions/cache@v5.1.0...v6.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/luke/instant-msg-api/pulls/268 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://github.com/actions/cache) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](actions/cache@v6.0.0...v6.1.0) #### What's Changed - Bump [@actions/cache](https://github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://github.com/jasongin) in [#1768](actions/cache#1768) **Full Changelog**: <actions/cache@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](actions/cache@v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@Samirat](https://github.com/Samirat) in [#1760](actions/cache#1760) **Full Changelog**: <actions/cache@v5...v6.0.0> ### [`v6`](actions/cache@v5.1.0...v6.0.0) [Compare Source](actions/cache@v5.1.0...v6.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/actions/gha-workflows/pulls/83 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://github.com/actions/cache) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](actions/cache@v6.0.0...v6.1.0) #### What's Changed - Bump [@actions/cache](https://github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://github.com/jasongin) in [#1768](actions/cache#1768) **Full Changelog**: <actions/cache@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](actions/cache@v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@Samirat](https://github.com/Samirat) in [#1760](actions/cache#1760) **Full Changelog**: <actions/cache@v5...v6.0.0> ### [`v6`](actions/cache@v5.1.0...v6.0.0) [Compare Source](actions/cache@v5.1.0...v6.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/epage/pulls/230 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://github.com/actions/cache) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](actions/cache@v6.0.0...v6.1.0) #### What's Changed - Bump [@actions/cache](https://github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://github.com/jasongin) in [#1768](actions/cache#1768) **Full Changelog**: <actions/cache@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](actions/cache@v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@Samirat](https://github.com/Samirat) in [#1760](actions/cache#1760) **Full Changelog**: <actions/cache@v5...v6.0.0> ### [`v6`](actions/cache@v5.1.0...v6.0.0) [Compare Source](actions/cache@v5.1.0...v6.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/PwnedPW/pulls/345 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://github.com/actions/cache) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](actions/cache@v6.0.0...v6.1.0) #### What's Changed - Bump [@actions/cache](https://github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://github.com/jasongin) in [#1768](actions/cache#1768) **Full Changelog**: <actions/cache@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](actions/cache@v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@Samirat](https://github.com/Samirat) in [#1760](actions/cache#1760) **Full Changelog**: <actions/cache@v5...v6.0.0> ### [`v6`](actions/cache@v5.1.0...v6.0.0) [Compare Source](actions/cache@v5.1.0...v6.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/6to4_converter/pulls/42 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

Bumps [actions/cache/restore](https://github.com/actions/cache) from 5.0.5 to 6.1.0. Release notes *Sourced from [actions/cache/restore's releases](https://github.com/actions/cache/releases).* > v6.1.0 > ------ > > What's Changed > -------------- > > * Bump `@actions/cache` to v6.1.0 - handle read-only cache access by [`@jasongin`](https://github.com/jasongin) in [actions/cache#1768](https://redirect.github.com/actions/cache/pull/1768) > > **Full Changelog**: <actions/cache@v6...v6.1.0> > > v6.0.0 > ------ > > What's Changed > -------------- > > * Update packages, migrate to ESM by [`@Samirat`](https://github.com/Samirat) in [actions/cache#1760](https://redirect.github.com/actions/cache/pull/1760) > > **Full Changelog**: <actions/cache@v5...v6.0.0> > > v5.1.0 > ------ > > What's Changed > -------------- > > * Bump `@actions/cache` to v5.1.0 - handle read-only cache access by [`@jasongin`](https://github.com/jasongin) in [actions/cache#1775](https://redirect.github.com/actions/cache/pull/1775) > > **Full Changelog**: <actions/cache@v5...v5.1.0> Changelog *Sourced from [actions/cache/restore's changelog](https://github.com/actions/cache/blob/main/RELEASES.md).* > Releases > ======== > > How to prepare a release > ------------------------ > > > [!NOTE] > > Relevant for maintainers with write access only. > > 1. Switch to a new branch from `main`. > 2. Run `npm test` to ensure all tests are passing. > 3. Update the version in [`https://github.com/actions/cache/blob/main/package.json`](https://github.com/actions/cache/blob/main/package.json). > 4. Run `npm run build` to update the compiled files. > 5. Update this [`https://github.com/actions/cache/blob/main/RELEASES.md`](https://github.com/actions/cache/blob/main/RELEASES.md) with the new version and changes in the `## Changelog` section. > 6. Run `licensed cache` to update the license report. > 7. Run `licensed status` and resolve any warnings by updating the [`https://github.com/actions/cache/blob/main/.licensed.yml`](https://github.com/actions/cache/blob/main/.licensed.yml) file with the exceptions. > 8. Commit your changes and push your branch upstream. > 9. Open a pull request against `main` and get it reviewed and merged. > 10. Draft a new release <https://github.com/actions/cache/releases> use the same version number used in `package.json` > 1. Create a new tag with the version number. > 2. Auto generate release notes and update them to match the changes you made in `RELEASES.md`. > 3. Toggle the set as the latest release option. > 4. Publish the release. > 11. Navigate to <https://github.com/actions/cache/actions/workflows/release-new-action-version.yml> > 1. There should be a workflow run queued with the same version number. > 2. Approve the run to publish the new version and update the major tags for this action. > > Changelog > --------- > > ### 6.1.0 > > * Bump `@actions/cache` to v6.1.0 to pick up [actions/toolkit#2435 Handle cache write error due to read-only token](https://redirect.github.com/actions/toolkit/pull/2435) > * Switch redundant "Cache save failed" warning to debug log in save-only > > ### 6.0.0 > > * Updated `@actions/cache` to ^6.0.1, `@actions/core` to ^3.0.1, `@actions/exec` to ^3.0.0, `@actions/io` to ^3.0.2 > * Migrated to ESM module system > * Upgraded Jest to v30 and test infrastructure to be ESM compatible > > ### 5.0.4 > > * Bump `minimatch` to v3.1.5 (fixes ReDoS via globstar patterns) > * Bump `undici` to v6.24.1 (WebSocket decompression bomb protection, header validation fixes) > * Bump `fast-xml-parser` to v5.5.6 > > ### 5.0.3 > > * Bump `@actions/cache` to v5.0.5 (Resolves: <https://github.com/actions/cache/security/dependabot/33>) > * Bump `@actions/core` to v2.0.3 > > ### 5.0.2 ... (truncated) Commits * [`55cc834`](actions/cache@55cc834) Merge pull request [#1768](https://redirect.github.com/actions/cache/issues/1768) from jasongin/readonly-cache * [`d8cd72f`](actions/cache@d8cd72f) Bump `@actions/cache` to v6.1.0 - handle cache write error due to RO token * [`2c8a9bd`](actions/cache@2c8a9bd) Merge pull request [#1760](https://redirect.github.com/actions/cache/issues/1760) from actions/samirat/esm\_migration\_and\_package\_update * [`e9b91fd`](actions/cache@e9b91fd) Prettier fixes * [`e4884b8`](actions/cache@e4884b8) Rebuild dist * [`10baf01`](actions/cache@10baf01) Fixed licenses * [`e39b386`](actions/cache@e39b386) Fix test mock return order * [`b692820`](actions/cache@b692820) PR feedback * [`6074912`](actions/cache@6074912) Rebuild dist bundles as ESM to match type:module * [`5a912e8`](actions/cache@5a912e8) Fix lint and jest issues * Additional commits viewable in [compare view](actions/cache@27d5ce7...55cc834) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/cache/restore&package-manager=github\_actions&previous-version=5.0.5&new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0. Release notes *Sourced from [actions/cache's releases](https://github.com/actions/cache/releases).* > v6.1.0 > ------ > > What's Changed > -------------- > > * Bump `@actions/cache` to v6.1.0 - handle read-only cache access by [`@jasongin`](https://github.com/jasongin) in [actions/cache#1768](https://redirect.github.com/actions/cache/pull/1768) > > **Full Changelog**: <actions/cache@v6...v6.1.0> > > v6.0.0 > ------ > > What's Changed > -------------- > > * Update packages, migrate to ESM by [`@Samirat`](https://github.com/Samirat) in [actions/cache#1760](https://redirect.github.com/actions/cache/pull/1760) > > **Full Changelog**: <actions/cache@v5...v6.0.0> > > v5.1.0 > ------ > > What's Changed > -------------- > > * Bump `@actions/cache` to v5.1.0 - handle read-only cache access by [`@jasongin`](https://github.com/jasongin) in [actions/cache#1775](https://redirect.github.com/actions/cache/pull/1775) > > **Full Changelog**: <actions/cache@v5...v5.1.0> Changelog *Sourced from [actions/cache's changelog](https://github.com/actions/cache/blob/main/RELEASES.md).* > Releases > ======== > > How to prepare a release > ------------------------ > > > [!NOTE] > > Relevant for maintainers with write access only. > > 1. Switch to a new branch from `main`. > 2. Run `npm test` to ensure all tests are passing. > 3. Update the version in [`https://github.com/actions/cache/blob/main/package.json`](https://github.com/actions/cache/blob/main/package.json). > 4. Run `npm run build` to update the compiled files. > 5. Update this [`https://github.com/actions/cache/blob/main/RELEASES.md`](https://github.com/actions/cache/blob/main/RELEASES.md) with the new version and changes in the `## Changelog` section. > 6. Run `licensed cache` to update the license report. > 7. Run `licensed status` and resolve any warnings by updating the [`https://github.com/actions/cache/blob/main/.licensed.yml`](https://github.com/actions/cache/blob/main/.licensed.yml) file with the exceptions. > 8. Commit your changes and push your branch upstream. > 9. Open a pull request against `main` and get it reviewed and merged. > 10. Draft a new release <https://github.com/actions/cache/releases> use the same version number used in `package.json` > 1. Create a new tag with the version number. > 2. Auto generate release notes and update them to match the changes you made in `RELEASES.md`. > 3. Toggle the set as the latest release option. > 4. Publish the release. > 11. Navigate to <https://github.com/actions/cache/actions/workflows/release-new-action-version.yml> > 1. There should be a workflow run queued with the same version number. > 2. Approve the run to publish the new version and update the major tags for this action. > > Changelog > --------- > > ### 6.1.0 > > * Bump `@actions/cache` to v6.1.0 to pick up [actions/toolkit#2435 Handle cache write error due to read-only token](https://redirect.github.com/actions/toolkit/pull/2435) > * Switch redundant "Cache save failed" warning to debug log in save-only > > ### 6.0.0 > > * Updated `@actions/cache` to ^6.0.1, `@actions/core` to ^3.0.1, `@actions/exec` to ^3.0.0, `@actions/io` to ^3.0.2 > * Migrated to ESM module system > * Upgraded Jest to v30 and test infrastructure to be ESM compatible > > ### 5.0.4 > > * Bump `minimatch` to v3.1.5 (fixes ReDoS via globstar patterns) > * Bump `undici` to v6.24.1 (WebSocket decompression bomb protection, header validation fixes) > * Bump `fast-xml-parser` to v5.5.6 > > ### 5.0.3 > > * Bump `@actions/cache` to v5.0.5 (Resolves: <https://github.com/actions/cache/security/dependabot/33>) > * Bump `@actions/core` to v2.0.3 > > ### 5.0.2 ... (truncated) Commits * [`55cc834`](actions/cache@55cc834) Merge pull request [#1768](https://redirect.github.com/actions/cache/issues/1768) from jasongin/readonly-cache * [`d8cd72f`](actions/cache@d8cd72f) Bump `@actions/cache` to v6.1.0 - handle cache write error due to RO token * [`2c8a9bd`](actions/cache@2c8a9bd) Merge pull request [#1760](https://redirect.github.com/actions/cache/issues/1760) from actions/samirat/esm\_migration\_and\_package\_update * [`e9b91fd`](actions/cache@e9b91fd) Prettier fixes * [`e4884b8`](actions/cache@e4884b8) Rebuild dist * [`10baf01`](actions/cache@10baf01) Fixed licenses * [`e39b386`](actions/cache@e39b386) Fix test mock return order * [`b692820`](actions/cache@b692820) PR feedback * [`6074912`](actions/cache@6074912) Rebuild dist bundles as ESM to match type:module * [`5a912e8`](actions/cache@5a912e8) Fix lint and jest issues * Additional commits viewable in [compare view](actions/cache@27d5ce7...55cc834) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/cache&package-manager=github\_actions&previous-version=5.0.5&new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/cache/save](https://github.com/actions/cache) from 5.0.5 to 6.1.0. Release notes *Sourced from [actions/cache/save's releases](https://github.com/actions/cache/releases).* > v6.1.0 > ------ > > What's Changed > -------------- > > * Bump `@actions/cache` to v6.1.0 - handle read-only cache access by [`@jasongin`](https://github.com/jasongin) in [actions/cache#1768](https://redirect.github.com/actions/cache/pull/1768) > > **Full Changelog**: <actions/cache@v6...v6.1.0> > > v6.0.0 > ------ > > What's Changed > -------------- > > * Update packages, migrate to ESM by [`@Samirat`](https://github.com/Samirat) in [actions/cache#1760](https://redirect.github.com/actions/cache/pull/1760) > > **Full Changelog**: <actions/cache@v5...v6.0.0> > > v5.1.0 > ------ > > What's Changed > -------------- > > * Bump `@actions/cache` to v5.1.0 - handle read-only cache access by [`@jasongin`](https://github.com/jasongin) in [actions/cache#1775](https://redirect.github.com/actions/cache/pull/1775) > > **Full Changelog**: <actions/cache@v5...v5.1.0> Changelog *Sourced from [actions/cache/save's changelog](https://github.com/actions/cache/blob/main/RELEASES.md).* > Releases > ======== > > How to prepare a release > ------------------------ > > > [!NOTE] > > Relevant for maintainers with write access only. > > 1. Switch to a new branch from `main`. > 2. Run `npm test` to ensure all tests are passing. > 3. Update the version in [`https://github.com/actions/cache/blob/main/package.json`](https://github.com/actions/cache/blob/main/package.json). > 4. Run `npm run build` to update the compiled files. > 5. Update this [`https://github.com/actions/cache/blob/main/RELEASES.md`](https://github.com/actions/cache/blob/main/RELEASES.md) with the new version and changes in the `## Changelog` section. > 6. Run `licensed cache` to update the license report. > 7. Run `licensed status` and resolve any warnings by updating the [`https://github.com/actions/cache/blob/main/.licensed.yml`](https://github.com/actions/cache/blob/main/.licensed.yml) file with the exceptions. > 8. Commit your changes and push your branch upstream. > 9. Open a pull request against `main` and get it reviewed and merged. > 10. Draft a new release <https://github.com/actions/cache/releases> use the same version number used in `package.json` > 1. Create a new tag with the version number. > 2. Auto generate release notes and update them to match the changes you made in `RELEASES.md`. > 3. Toggle the set as the latest release option. > 4. Publish the release. > 11. Navigate to <https://github.com/actions/cache/actions/workflows/release-new-action-version.yml> > 1. There should be a workflow run queued with the same version number. > 2. Approve the run to publish the new version and update the major tags for this action. > > Changelog > --------- > > ### 6.1.0 > > * Bump `@actions/cache` to v6.1.0 to pick up [actions/toolkit#2435 Handle cache write error due to read-only token](https://redirect.github.com/actions/toolkit/pull/2435) > * Switch redundant "Cache save failed" warning to debug log in save-only > > ### 6.0.0 > > * Updated `@actions/cache` to ^6.0.1, `@actions/core` to ^3.0.1, `@actions/exec` to ^3.0.0, `@actions/io` to ^3.0.2 > * Migrated to ESM module system > * Upgraded Jest to v30 and test infrastructure to be ESM compatible > > ### 5.0.4 > > * Bump `minimatch` to v3.1.5 (fixes ReDoS via globstar patterns) > * Bump `undici` to v6.24.1 (WebSocket decompression bomb protection, header validation fixes) > * Bump `fast-xml-parser` to v5.5.6 > > ### 5.0.3 > > * Bump `@actions/cache` to v5.0.5 (Resolves: <https://github.com/actions/cache/security/dependabot/33>) > * Bump `@actions/core` to v2.0.3 > > ### 5.0.2 ... (truncated) Commits * [`55cc834`](actions/cache@55cc834) Merge pull request [#1768](https://redirect.github.com/actions/cache/issues/1768) from jasongin/readonly-cache * [`d8cd72f`](actions/cache@d8cd72f) Bump `@actions/cache` to v6.1.0 - handle cache write error due to RO token * [`2c8a9bd`](actions/cache@2c8a9bd) Merge pull request [#1760](https://redirect.github.com/actions/cache/issues/1760) from actions/samirat/esm\_migration\_and\_package\_update * [`e9b91fd`](actions/cache@e9b91fd) Prettier fixes * [`e4884b8`](actions/cache@e4884b8) Rebuild dist * [`10baf01`](actions/cache@10baf01) Fixed licenses * [`e39b386`](actions/cache@e39b386) Fix test mock return order * [`b692820`](actions/cache@b692820) PR feedback * [`6074912`](actions/cache@6074912) Rebuild dist bundles as ESM to match type:module * [`5a912e8`](actions/cache@5a912e8) Fix lint and jest issues * Additional commits viewable in [compare view](actions/cache@27d5ce7...55cc834) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/cache/save&package-manager=github\_actions&previous-version=5.0.5&new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Samirat added 2 commits May 20, 2026 19:31

Update packages, migrate to ESM

80f7777

Update documentation for v6 release

b9bf592

Samirat requested a review from a team as a code owner May 20, 2026 19:51

Copilot AI review requested due to automatic review settings May 20, 2026 19:51

Copilot started reviewing on behalf of Samirat May 20, 2026 19:51 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

Comment thread package.json

Comment thread package.json Outdated

Comment thread __tests__/saveImpl.test.ts Outdated

Comment thread __tests__/saveImpl.test.ts Outdated

Comment thread __tests__/saveImpl.test.ts Outdated

Comment thread __tests__/saveImpl.test.ts Outdated

Fix lint and jest issues

5a912e8

boxofyellow reviewed May 20, 2026

View reviewed changes

Comment thread __tests__/actionUtils.test.ts

Comment thread __tests__/restoreImpl.test.ts

Comment thread README.md Outdated

Comment thread README.md Outdated

Samirat added 6 commits June 11, 2026 14:22

Rebuild dist bundles as ESM to match type:module

6074912

PR feedback

b692820

Fix test mock return order

e39b386

Fixed licenses

10baf01

Rebuild dist

e4884b8

Prettier fixes

e9b91fd

danwkennedy approved these changes Jun 22, 2026

View reviewed changes

Samirat merged commit 2c8a9bd into main Jun 23, 2026
16 checks passed

Samirat deleted the samirat/esm_migration_and_package_update branch June 23, 2026 14:42

github-actions Bot mentioned this pull request Jun 23, 2026

Bump actions/cache from 5 to 6 labrynx/auto_comments#36

Open

jasongin mentioned this pull request Jun 23, 2026

Bump @actions/cache to v6.1.0 - handle read-only cache access #1768

Merged

10 tasks

claude Bot mentioned this pull request Jun 24, 2026

build(deps): update actions/cache action to v6 ncaq/himari#272

Merged

1 task

ALRubinger mentioned this pull request Jun 28, 2026

chore(deps): update actions/cache action to v6 ALRubinger/aileron#1675

Open

1 task

macamp0328 mentioned this pull request Jun 29, 2026

chore(deps): bump actions/cache from 5 to 6 macamp0328/liner-notes#482

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update packages, migrate to ESM#1760

Update packages, migrate to ESM#1760
Samirat merged 9 commits into
mainfrom
samirat/esm_migration_and_package_update

Samirat commented May 20, 2026

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Labels

4 participants

Uh oh!

Conversation

Samirat commented May 20, 2026

Description

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

Checklist:

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Labels

4 participants