chore: remove upstream CI workflows (mirror inertization per internal#233)

Update ts-http-runtime dependency

.github/workflows/check-dist.yml

@@ -1,22 +0,0 @@
-name: Check dist content
-
-on:
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - '**.md'
-  pull_request:
-    paths-ignore:
-      - '**.md'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  call-check-dist:
-    name: Check dist/
-    uses: actions/reusable-workflows/.github/workflows/check-dist.yml@main
-    with:
-      node-version: "24.x"

.github/workflows/close-inactive-issues.yml

@@ -1,23 +0,0 @@
-name: Close inactive issues
-
-on:
-  schedule:
-    - cron: "30 8 * * *"
-
-jobs:
-  close-issues:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/stale@v9
-        with:
-          days-before-issue-stale: 200
-          days-before-issue-close: 5
-          stale-issue-label: "stale"
-          stale-issue-message: "This issue is stale because it has been open for 200 days with no activity. Leave a comment to avoid closing this issue in 5 days."
-          close-issue-message: "This issue was closed because it has been inactive for 5 days since being marked as stale."
-          days-before-pr-stale: -1
-          days-before-pr-close: -1
-          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codeql.yml

@@ -1,45 +0,0 @@
-name: Code scanning
-
-on:
-  push:
-  pull_request:
-  schedule:
-    - cron: '0 19 * * 0'
-
-permissions:
-  contents: read
-  security-events: write
-
-jobs:
-  CodeQL-Build:
-    # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v5
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      # Override language selection by uncommenting this and choosing your languages
-      # with:
-      #   languages: go, javascript, csharp, python, cpp, java, ruby
-
-    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below).
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following
-    #    three lines and modify them (or add more) to build your code if your
-    #    project uses a compiled language
-
-    #- run: |
-    #     make bootstrap
-    #     make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3

.github/workflows/issue-opened-workflow.yml

@@ -1,21 +0,0 @@
-name: Assign issue
-
-on:
-  issues:
-    types: [opened]
-
-permissions:
-  issues: write
-
-jobs:
-  run-action:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Get current oncall
-        id: oncall
-        run: |
-          echo "CURRENT=$(curl --request GET 'https://api.pagerduty.com/oncalls?include[]=users&schedule_ids[]=P5VG2BX&earliest=true' --header 'Authorization: Token token=${{ secrets.PAGERDUTY_TOKEN }}' --header 'Accept: application/vnd.pagerduty+json;version=2' --header 'Content-Type: application/json' | jq -r '.oncalls[].user.name')" >> $GITHUB_OUTPUT
-
-      - name: add_assignees
-        run: |
-          curl -X POST -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN}}" https://api.github.com/repos/${{github.repository}}/issues/${{ github.event.issue.number}}/assignees -d '{"assignees":["${{steps.oncall.outputs.CURRENT}}"]}'

.github/workflows/licensed.yml

@@ -1,43 +0,0 @@
-name: License check
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  validate-cached-dependency-records:
-    runs-on: ubuntu-latest
-    name: Check licenses
-    steps:
-
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Install dependencies
-        run: npm ci --ignore-scripts
-
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: '3.1.7'
-
-      - name: Install licensed tool
-        run: |
-          cd "$RUNNER_TEMP"
-          curl -Lfs -o licensed.tar.gz https://github.com/licensee/licensed/archive/refs/tags/v5.0.4.tar.gz
-          tar -xzf licensed.tar.gz
-          cd licensed-5.0.4
-          bundle install
-
-      - name: Check cached dependency records
-        run: |
-          cd ${{ github.workspace }}
-          BUNDLE_GEMFILE=$RUNNER_TEMP/licensed-5.0.4/Gemfile bundle exec $RUNNER_TEMP/licensed-5.0.4/exe/licensed status

.github/workflows/pr-opened-workflow.yml

@@ -1,25 +0,0 @@
-name: Assign pull request reviewer
-
-on:
-  pull_request_target:
-    types: [opened]
-
-permissions:
-  pull-requests: write
-
-jobs:
-  run-action:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Get current oncall
-        id: oncall
-        run: |
-          echo "CURRENT=$(curl --request GET 'https://api.pagerduty.com/oncalls?include[]=users&schedule_ids[]=P5VG2BX&earliest=true' --header 'Authorization: Token token=${{ secrets.PAGERDUTY_TOKEN }}' --header 'Accept: application/vnd.pagerduty+json;version=2' --header 'Content-Type: application/json' | jq -r '.oncalls[].user.name')" >> $GITHUB_OUTPUT
-
-      - name: Request Review
-        run: |
-          curl -X POST -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN}}" https://api.github.com/repos/${{github.repository}}/pulls/${{ github.event.pull_request.number}}/requested_reviewers -d '{"reviewers":["${{steps.oncall.outputs.CURRENT}}"]}'
-
-      - name: Add Assignee
-        run: |
-          curl -X POST -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN}}" https://api.github.com/repos/${{github.repository}}/issues/${{ github.event.pull_request.number}}/assignees -d '{"assignees":["${{steps.oncall.outputs.CURRENT}}"]}'

.github/workflows/publish-immutable-actions.yml

@@ -1,20 +0,0 @@
-name: Publish immutable action
-
-on:
-  release:
-    types: [released]
-
-permissions:
-  contents: read
-  id-token: write
-  packages: write
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checking out
-        uses: actions/checkout@v5
-      - name: Publish
-        id: publish
-        uses: actions/publish-immutable-action@0.0.3

.github/workflows/release-new-action-version.yml

@@ -1,30 +0,0 @@
-name: Release new action version
-
-on:
-  release:
-    types: [released]
-  workflow_dispatch:
-    inputs:
-      TAG_NAME:
-        description: 'Tag name that the major tag will point to'
-        required: true
-
-env:
-  TAG_NAME: ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }}
-
-permissions:
-  contents: write
-
-jobs:
-  update_tag:
-    name: Update the major tag to include the ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }} changes
-    environment:
-      name: releaseNewActionVersion
-    runs-on: ubuntu-latest
-    steps:
-    - name: Update the ${{ env.TAG_NAME }} tag
-      id: update-major-tag
-      uses: actions/publish-action@v0.3.0
-      with:
-        source-tag: ${{ env.TAG_NAME }}
-        slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/workflow.yml

@@ -1,134 +0,0 @@
-name: Tests
-
-on:
-  pull_request:
-    branches:
-      - main
-      - releases/**
-  push:
-    branches:
-      - main
-      - releases/**
-
-permissions:
-  contents: read
-
-jobs:
-  # Build and unit test
-  build:
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macOS-latest]
-      fail-fast: false
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v5
-    - name: Setup Node.js 24.x
-      uses: actions/setup-node@v4
-      with:
-        node-version: 24.x
-        cache: npm
-    - run: npm ci
-    - name: Prettier Format Check
-      run: npm run format-check
-    - name: ESLint Check
-      run: npm run lint
-    - name: Build & Test
-      run: npm run test
-
-  # End to end save and restore
-  test-save:
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macOS-latest]
-      fail-fast: false
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v5
-    - name: Generate files in working directory
-      shell: bash
-      run: __tests__/create-cache-files.sh ${{ runner.os }} test-cache
-    - name: Generate files outside working directory
-      shell: bash
-      run: __tests__/create-cache-files.sh ${{ runner.os }} ~/test-cache
-    - name: Save cache
-      uses: ./
-      with:
-        key: test-${{ runner.os }}-${{ github.run_id }}
-        path: |
-          test-cache
-          ~/test-cache
-
-  test-restore:
-    needs: test-save
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macOS-latest]
-      fail-fast: false
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v5
-    - name: Restore cache
-      uses: ./
-      with:
-        key: test-${{ runner.os }}-${{ github.run_id }}
-        path: |
-          test-cache
-          ~/test-cache
-    - name: Verify cache files in working directory
-      shell: bash
-      run: __tests__/verify-cache-files.sh ${{ runner.os }} test-cache
-    - name: Verify cache files outside working directory
-      shell: bash
-      run: __tests__/verify-cache-files.sh ${{ runner.os }} ~/test-cache
-
-  # End to end with proxy
-  test-proxy-save:
-    runs-on: ubuntu-latest
-    container:
-      image: ubuntu:latest
-      options: --dns 127.0.0.1
-    services:
-      squid-proxy:
-        image: ubuntu/squid:latest
-        ports:
-          - 3128:3128
-    env:
-      https_proxy: http://squid-proxy:3128
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v5
-    - name: Generate files
-      run: __tests__/create-cache-files.sh proxy test-cache
-    - name: Save cache
-      uses: ./
-      with:
-        key: test-proxy-${{ github.run_id }}
-        path: test-cache
-
-  test-proxy-restore:
-    needs: test-proxy-save
-    runs-on: ubuntu-latest
-    container:
-      image: ubuntu:latest
-      options: --dns 127.0.0.1
-    services:
-      squid-proxy:
-        image: ubuntu/squid:latest
-        ports:
-          - 3128:3128
-    env:
-      https_proxy: http://squid-proxy:3128
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v5
-    - name: Restore cache
-      uses: ./
-      with:
-        key: test-proxy-${{ github.run_id }}
-        path: test-cache
-    - name: Verify cache
-      run: __tests__/verify-cache-files.sh proxy test-cache

.licenses/npm/@typespec/ts-http-runtime.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@typespec/ts-http-runtime"
-version: 0.3.2
+version: 0.3.5
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/ts-http-runtime/

.licenses/npm/fast-xml-builder.dep.yml

@@ -0,0 +1,32 @@
+---
+name: fast-xml-builder
+version: 1.1.4
+type: npm
+summary: Build XML from JSON without C/C++ based libraries
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2026 Natural Intelligence
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []

.licenses/npm/fast-xml-parser.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.3.3
+version: 5.5.6
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:

.licenses/npm/minimatch.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: minimatch
-version: 3.1.2
+version: 3.1.5
 type: npm
 summary: a glob matcher in javascript
-homepage: 
+homepage:
 license: isc
 licenses:
 - sources: LICENSE

.licenses/npm/path-expression-matcher.dep.yml

@@ -0,0 +1,32 @@
+---
+name: path-expression-matcher
+version: 1.1.3
+type: npm
+summary: Efficient path tracking and pattern matching for XML/JSON parsers
+homepage: https://github.com/NaturalIntelligence/path-expression-matcher#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2024
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []

.licenses/npm/undici.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 6.23.0
+version: 6.24.1
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org

PR_TRIAGE_REPORT.md

@@ -1,114 +0,0 @@
-# Pull Request Triage Report for actions/cache
-
-*Generated: 2026-01-29*
-
-| PR Link | Author | Date Opened | Days Open | Category |
-|---------|--------|-------------|-----------|----------|
-| [#1700](https://github.com/actions/cache/pull/1700) | Copilot | 2026-01-29 | 0 | Other |
-| [#1689](https://github.com/actions/cache/pull/1689) | StephenHodgson | 2025-12-13 | 47 | New feature |
-| [#1683](https://github.com/actions/cache/pull/1683) | salmanmkc | 2025-12-11 | 49 | Documentation |
-| [#1672](https://github.com/actions/cache/pull/1672) | alinernunes15-a11y | 2025-11-07 | 83 | Documentation |
-| [#1671](https://github.com/actions/cache/pull/1671) | dulcekarma7u7-netizen | 2025-10-28 | 93 | Documentation |
-| [#1654](https://github.com/actions/cache/pull/1654) | timbaverstock-bmbl | 2025-09-22 | 129 | Documentation |
-| [#1639](https://github.com/actions/cache/pull/1639) | atoulme | 2025-08-08 | 174 | Documentation |
-| [#1638](https://github.com/actions/cache/pull/1638) | TNGBBK | 2025-08-07 | 175 | Documentation |
-| [#1605](https://github.com/actions/cache/pull/1605) | loic-bellinger | 2025-05-14 | 260 | Documentation |
-| [#1604](https://github.com/actions/cache/pull/1604) | stuartleeks | 2025-05-08 | 266 | New feature |
-| [#1587](https://github.com/actions/cache/pull/1587) | Yury-Fridlyand | 2025-04-06 | 298 | Documentation |
-| [#1571](https://github.com/actions/cache/pull/1571) | helly25 | 2025-03-11 | 324 | New feature |
-| [#1567](https://github.com/actions/cache/pull/1567) | KtorZ | 2025-03-07 | 328 | Documentation |
-| [#1536](https://github.com/actions/cache/pull/1536) | KyFaSt | 2025-01-22 | 372 | Security fix |
-| [#1516](https://github.com/actions/cache/pull/1516) | vorburger | 2024-12-12 | 413 | Documentation |
-| [#1514](https://github.com/actions/cache/pull/1514) | lima-limon-inc | 2024-12-11 | 414 | Documentation |
-| [#1493](https://github.com/actions/cache/pull/1493) | EnricoMi | 2024-11-04 | 451 | New feature |
-| [#1472](https://github.com/actions/cache/pull/1472) | mustafacco7 | 2024-10-18 | 468 | Documentation |
-| [#1451](https://github.com/actions/cache/pull/1451) | karlhorky | 2024-08-13 | 534 | Documentation |
-| [#1439](https://github.com/actions/cache/pull/1439) | rusty-key | 2024-07-23 | 555 | Documentation |
-| [#1436](https://github.com/actions/cache/pull/1436) | llakala | 2024-07-19 | 559 | New feature |
-| [#1378](https://github.com/actions/cache/pull/1378) | Olegt0rr | 2024-04-16 | 653 | Other |
-| [#1374](https://github.com/actions/cache/pull/1374) | itchyny | 2024-04-14 | 655 | Other |
-| [#1337](https://github.com/actions/cache/pull/1337) | marco-cpd | 2024-02-23 | 706 | Bug fix |
-| [#1328](https://github.com/actions/cache/pull/1328) | vorburger | 2024-02-16 | 713 | Documentation |
-| [#1312](https://github.com/actions/cache/pull/1312) | Mogyuchi | 2024-01-28 | 732 | Documentation |
-| [#1308](https://github.com/actions/cache/pull/1308) | PrinsFrank | 2024-01-22 | 738 | New feature |
-| [#1290](https://github.com/actions/cache/pull/1290) | joseluisq | 2023-12-01 | 790 | Documentation |
-| [#1283](https://github.com/actions/cache/pull/1283) | IanButterworth | 2023-11-18 | 803 | Documentation |
-| [#1282](https://github.com/actions/cache/pull/1282) | jlanga | 2023-11-17 | 804 | New feature |
-| [#1252](https://github.com/actions/cache/pull/1252) | Magnus167 | 2023-10-01 | 851 | Documentation |
-| [#1248](https://github.com/actions/cache/pull/1248) | Fishrock123 | 2023-09-25 | 857 | Documentation |
-| [#1231](https://github.com/actions/cache/pull/1231) | kbdharun | 2023-09-05 | 877 | Other |
-| [#1222](https://github.com/actions/cache/pull/1222) | dsame | 2023-08-23 | 890 | Documentation |
-| [#1191](https://github.com/actions/cache/pull/1191) | Yakiyo | 2023-06-15 | 959 | Documentation |
-| [#1185](https://github.com/actions/cache/pull/1185) | jorendorff | 2023-06-12 | 962 | Documentation |
-| [#1184](https://github.com/actions/cache/pull/1184) | byrgulle12 | 2023-06-09 | 965 | Spam candidate |
-| [#1183](https://github.com/actions/cache/pull/1183) | pgrange | 2023-06-08 | 966 | Bug fix |
-| [#1167](https://github.com/actions/cache/pull/1167) | tommy-gilligan | 2023-05-04 | 1001 | Documentation |
-| [#1160](https://github.com/actions/cache/pull/1160) | rikhuijzer | 2023-04-24 | 1011 | Documentation |
-| [#1159](https://github.com/actions/cache/pull/1159) | rodrigoalcarazdelaosa | 2023-04-23 | 1012 | Documentation |
-| [#1096](https://github.com/actions/cache/pull/1096) | Lord-Kamina | 2023-01-31 | 1094 | New feature |
-| [#876](https://github.com/actions/cache/pull/876) | bchen1029 | 2022-07-26 | 1283 | Bug fix |
-| [#726](https://github.com/actions/cache/pull/726) | robinp | 2022-02-05 | 1454 | Documentation |
-| [#717](https://github.com/actions/cache/pull/717) | jsoref | 2022-01-23 | 1467 | New feature |
-| [#677](https://github.com/actions/cache/pull/677) | planetmarshall | 2021-11-14 | 1537 | Documentation |
-| [#673](https://github.com/actions/cache/pull/673) | TimoRoth | 2021-11-08 | 1543 | New feature |
-| [#557](https://github.com/actions/cache/pull/557) | melvyn-apryl | 2021-03-27 | 1769 | Documentation |
-| [#498](https://github.com/actions/cache/pull/498) | eyal0 | 2021-01-04 | 1851 | New feature |
-| [#402](https://github.com/actions/cache/pull/402) | vlsi | 2020-08-19 | 1989 | Documentation |
-| [#325](https://github.com/actions/cache/pull/325) | mzabaluev | 2020-05-24 | 2076 | Documentation |
-| [#268](https://github.com/actions/cache/pull/268) | FinalDes | 2020-04-21 | 2109 | Documentation |
-| [#234](https://github.com/actions/cache/pull/234) | evandrocoan | 2020-03-27 | 2134 | Documentation |
-
-## Summary by Category
-
-| Category | Count |
-|----------|-------|
-| Documentation | 31 |
-| New feature | 11 |
-| Bug fix | 3 |
-| Other | 4 |
-| Security fix | 1 |
-| Spam candidate | 1 |
-| **Total** | **51** |
-
-## Category Definitions
-
-- **New feature**: PRs that add new functionality or capabilities to the cache action
-- **Bug fix**: PRs that fix issues or incorrect behavior in the existing code
-- **Security fix**: PRs that address security concerns or add security-related documentation
-- **Documentation**: PRs that add/update README, examples, or other documentation
-- **Spam candidate**: PRs with unclear purpose, incomplete/garbled content, or no meaningful changes
-- **Other**: PRs that don't fit into the above categories (e.g., refactoring, dependency updates)
-
-## Detailed Analysis Notes
-
-### Documentation PRs (31)
-Most open PRs are documentation improvements, including:
-- New caching examples (pnpm, opam, Docker, ASDF, Bazel, Hugo, Dart, etc.)
-- Clarifications on existing behavior (path matching, cache-hit output, key rendering)
-- Updated links and references
-- README improvements
-
-### New Feature PRs (11)
-Feature requests include:
-- Conditional save options (`save-on-success`, `save` input)
-- Force-overwrite capability for existing caches
-- New outputs (cachePath, cache-primary-key)
-- Compression level control
-- Cache refresh/update mechanisms
-
-### Bug Fix PRs (3)
-- #1337: Adjusts storage warning message with incorrect limit
-- #1183: Fixes cabal store path for Ubuntu
-- #876: Fixes cache-hit value when cache not found
-
-### Security Fix PRs (1)
-- #1536: Adds recommended minimum permissions to README (by GitHub staff member)
-
-### Spam Candidate PRs (1)
-- #1184: Unclear PR with garbled Turkish text in title, renames file with no meaningful changes
-
-### Other PRs (4)
-- #1700: This current WIP triage PR
-- #1378: Bumps action versions in examples
-- #1374: Code refactoring (avoids re-evaluation of key input)
-- #1231: Updates actions/checkout to v4 in workflows

RELEASES.md

@@ -25,6 +25,12 @@
 
 ## Changelog
 
+### 5.0.4
+
+- Bump `minimatch` to v3.1.5 (fixes ReDoS via globstar patterns)
+- Bump `undici` to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
+- Bump `fast-xml-parser` to v5.5.6
+
 ### 5.0.3
 
 - Bump `@actions/cache` to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

examples.md

@@ -49,7 +49,7 @@
   with:
     path: |
       ~/.bun/install/cache
-    key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb') }}
+    key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
 ```
 
 ### Windows
@@ -59,7 +59,7 @@
   with:
     path: |
       ~\.bun
-    key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb') }}
+    key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
 ```
 
 ## C# - NuGet

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "cache",
-  "version": "5.0.2",
+  "version": "5.0.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cache",
-      "version": "5.0.2",
+      "version": "5.0.4",
       "license": "MIT",
       "dependencies": {
         "@actions/cache": "^5.0.5",
@@ -1875,13 +1875,13 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -1945,9 +1945,9 @@
       }
     },
     "node_modules/@typespec/ts-http-runtime": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.2.tgz",
-      "integrity": "sha512-IlqQ/Gv22xUC1r/WQm4StLkYQmaaTsXAhUVsNE0+xiyf0yRFiH5++q78U3bw6bLKDCTmh0uqKB9eG9+Bt75Dkg==",
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.5.tgz",
+      "integrity": "sha512-yURCknZhvywvQItHMMmFSo+fq5arCUIyz/CVk7jD89MSai7dkaX8ufjCWp3NttLojoTVbcE72ri+be/TnEbMHw==",
       "license": "MIT",
       "dependencies": {
         "http-proxy-agent": "^7.0.0",
@@ -2008,9 +2008,9 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3741,10 +3741,10 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/fast-xml-parser": {
-      "version": "5.3.3",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.3.tgz",
-      "integrity": "sha512-2O3dkPAAC6JavuMm8+4+pgTk+5hoAs+CjZ+sWcQLkX9+/tHRuTkQh/Oaifr8qDmZ8iEHb771Ea6G8CdwkrgvYA==",
+    "node_modules/fast-xml-builder": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
+      "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
       "funding": [
         {
           "type": "github",
@@ -3753,7 +3753,24 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "strnum": "^2.1.0"
+        "path-expression-matcher": "^1.1.3"
+      }
+    },
+    "node_modules/fast-xml-parser": {
+      "version": "5.5.6",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.6.tgz",
+      "integrity": "sha512-3+fdZyBRVg29n4rXP0joHthhcHdPUHaIC16cuyyd1iLsuaO6Vea36MPrxgAzbZna8lhvZeRL8Bc9GP56/J9xEw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "fast-xml-builder": "^1.1.4",
+        "path-expression-matcher": "^1.1.3",
+        "strnum": "^2.1.2"
       },
       "bin": {
         "fxparser": "src/cli/cli.js"
@@ -3838,9 +3855,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
@@ -5805,9 +5822,9 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
@@ -6141,6 +6158,21 @@
         "node": ">=8"
       }
     },
+    "node_modules/path-expression-matcher": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.1.3.tgz",
+      "integrity": "sha512-qdVgY8KXmVdJZRSS1JdEPOKPdTiEK/pi0RkcT2sw1RhXxohdujUlJFPuS1TSkevZ9vzd3ZlL7ULl1MHGTApKzQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/path-is-absolute": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
@@ -7462,9 +7494,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.23.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
-      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "version": "6.24.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cache",
-  "version": "5.0.3",
+  "version": "5.0.4",
   "private": true,
   "description": "Cache dependencies and build outputs",
   "main": "dist/restore/index.js",