## Basic validation CI fix
Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x
from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages:
- `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the
root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead
of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x)
- `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use
minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x
- `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that
natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x
from the jest coverage instrumentation path
`npm audit --audit-level=high` now reports 0 vulnerabilities.
## Licensed CI fix
Update .licenses/npm/ cache to match the new dependency tree:
- Add: brace-expansion-5.0.8.dep.yml
- Add: minimatch-10.2.6.dep.yml
- Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit)
- Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit)
- Remove stale: minimatch-3.1.5.dep.yml
- Remove stale: @actions/glob-0.6.1.dep.yml
- Remove stale: concat-map.dep.yml
- Remove stale: balanced-match-1.0.2.dep.yml
Rebuild dist artifacts to include updated brace-expansion.
Bump @actions/cache from ^6.1.0 to ^6.2.0 and rebuild the vendored dist
bundles (dist/setup, dist/cache-save) via ncc. Update the licensed cache
record for @actions/cache to 6.2.0.
6.2.0 ships two transparent client behaviors: honor ACTIONS_CACHE_MODE to
skip restore/save when the effective cache-mode disallows it, and surface a
core.warning (not a run failure) when the cache service denies a read/write
due to token scopes.
Copilot-Session: 0acd1380-0102-4f9d-b613-192a6ddef737
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Migrate to ESM
* updated package.json version
* Update README for v6 and clean up dev dependencies
* Remove unused ts-node
* fix audit issue
---------
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
* Bump @actions/cache to v5.0.0
This update removes the punycode deprecation warning by updating to a version of @actions/cache that no longer depends on packages using the deprecated punycode module.
* Update license cache for @actions/cache v5.0.0 dependencies
Regenerated license files to reflect the updated dependency tree after bumping @actions/cache to v5.0.0. This includes license information for new transitive dependencies and removes licenses for dependencies that are no longer used.
* Update license metadata for @actions/http-client
Mark @actions/http-client v2.2.1 and v3.0.0 as MIT license (correctly identified from LICENSE file content)
* prepare release 6.0.1
* Bump version to 6.1.1 in package.json and package-lock.json
* fix: update @actions/cache with storage-blob fix for Node.js 24 punycode deprecation
* fix: update @actions/cache to ^5.0.1 for Node.js 24 punycode fix
Updates @actions/cache to version 5.0.1 which includes the @azure/storage-blob
update that fixes the punycode deprecation warning on Node.js 24.
* fix: update @actions/cache to ^5.0.1 for Node.js 24 punycode fix
Updates @actions/cache to version 5.0.1 which includes the @azure/storage-blob
update that fixes the punycode deprecation warning on Node.js 24.
* add support for ghes caching
* fix licesnses
* work on resolving comments
* change internal error to warning
* fix warning for internal errors
* update version
copilot-swe-agent[bot]