chore(deps): bump @actions/cache to 6.2.0 (#756)

* chore(deps): bump @actions/cache to 5.2.0

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a4005a74-ab24-4f47-a559-e9caf4870437

* chore(deps): update licensed record for @actions/cache 5.2.0

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a4005a74-ab24-4f47-a559-e9caf4870437

* chore(deps): bump @actions/cache to 6.2.0

Bump @actions/cache from ^6.1.0 to ^6.2.0, refresh the lockfile,
rebuild the dist bundle, and update the license record.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 0025a82b-5990-4c08-851c-4570aa7f7bbf

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.eslintignore

@@ -1,6 +0,0 @@
-# Ignore list
-/*
-
-# Do not ignore these folders:
-!__tests__/
-!src/

.eslintrc.js

@@ -1,51 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports = {
-  extends: [
-    'eslint:recommended',
-    'plugin:@typescript-eslint/recommended',
-    'plugin:eslint-plugin-jest/recommended',
-    'eslint-config-prettier'
-  ],
-  parser: '@typescript-eslint/parser',
-  plugins: ['@typescript-eslint', 'eslint-plugin-node', 'eslint-plugin-jest'],
-  rules: {
-    '@typescript-eslint/no-require-imports': 'error',
-    '@typescript-eslint/no-non-null-assertion': 'off',
-    '@typescript-eslint/no-explicit-any': 'off',
-    '@typescript-eslint/no-empty-function': 'off',
-    '@typescript-eslint/ban-ts-comment': [
-      'error',
-      {
-        'ts-ignore': 'allow-with-description'
-      }
-    ],
-    'no-console': 'error',
-    'yoda': 'error',
-    'prefer-const': [
-      'error',
-      {
-        destructuring: 'all'
-      }
-    ],
-    'no-control-regex': 'off',
-    'no-constant-condition': ['error', {checkLoops: false}],
-    'node/no-extraneous-import': 'error'
-  },
-  overrides: [
-    {
-      files: ['**/*{test,spec}.ts'],
-      rules: {
-        '@typescript-eslint/no-unused-vars': 'off',
-        'jest/no-standalone-expect': 'off',
-        'jest/no-conditional-expect': 'off',
-        'no-console': 'off',
-
-      }
-    }
-  ],
-  env: {
-    node: true,
-    es6: true,
-    'jest/globals': true
-  }
-};

.github/csc.json

@@ -4,13 +4,14 @@
             "owner": "csc",
             "pattern": [
                 {
-                    "regexp": "^([^\\s].*)\\((\\d+)(?:,\\d+|,\\d+,\\d+)?\\):\\s+(error|warning)\\s+([a-zA-Z]+(?<!MSB)\\d+):\\s*(.*?)\\s+\\[(.*?)\\]$",
+                    "regexp": "^\\s*(?:\\d+>\\s*)?([^\\s].*)\\((\\d+)(?:,(\\d+))?(?:,\\d+)*\\):\\s+(error|warning)\\s+([a-zA-Z]+(?<!MSB)\\d*):\\s*(.*?)\\s+\\[(.*?)\\]$",
                     "file": 1,
                     "line": 2,
-                    "severity": 3,
-                    "code": 4,
-                    "message": 5,
-                    "fromPath": 6
+                    "column": 3,
+                    "severity": 4,
+                    "code": 5,
+                    "message": 6,
+                    "fromPath": 7
                 }
             ]
         }

.github/dependabot.yml

@@ -12,6 +12,8 @@ updates:
     # Check the npm registry for updates every day (weekdays)
     schedule:
       interval: 'weekly'
+    cooldown:
+      default-days: 7
 
   # Enable version updates for GitHub Actions
   - package-ecosystem: 'github-actions'
@@ -20,3 +22,5 @@ updates:
     directory: '/'
     schedule:
       interval: 'weekly'
+    cooldown:
+      default-days: 7

.github/workflows/e2e-tests.yml

@@ -27,7 +27,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -57,7 +57,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -92,7 +92,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -123,7 +123,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -149,7 +149,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -180,7 +180,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -208,7 +208,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -239,7 +239,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -247,7 +247,7 @@ jobs:
         shell: bash
         run: |
           mkdir subdirectory
-          echo '{"sdk":{"version": "9.0.308","rollForward": "latestFeature"}}' > ./subdirectory/global.json
+          echo '{"sdk":{"version": "9.0.308"}}' > ./subdirectory/global.json
       - name: Setup dotnet
         uses: ./
         with:
@@ -265,7 +265,7 @@ jobs:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -273,14 +273,14 @@ jobs:
         shell: bash
         run: |
           mkdir subdirectory
-          echo '{"sdk":{"version": "3.1.0","rollForward": "latestMajor"}}' > ./subdirectory/global.json
+          echo '{"sdk":{"version": "8.0.100","rollForward": "latestMajor"}}' > ./subdirectory/global.json
       - name: Setup dotnet
         uses: ./
         with:
           global-json-file: ./subdirectory/global.json
       - name: Verify dotnet
         shell: pwsh
-        run: __tests__/verify-dotnet.ps1 -Patterns "^(?!3)"
+        run: __tests__/verify-dotnet.ps1 -Patterns "^(?!8)"
 
   test-setup-global-json-rollforward-latestfeature:
     runs-on: ${{ matrix.operating-system }}
@@ -290,7 +290,7 @@ jobs:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -315,7 +315,7 @@ jobs:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -332,38 +332,6 @@ jobs:
         shell: pwsh
         run: __tests__/verify-dotnet.ps1 -Patterns "^10.0.1(?!00)"
 
-  test-setup-global-json-only:
-    runs-on: ${{ matrix.operating-system }}
-    strategy:
-      fail-fast: false
-      matrix:
-        operating-system:
-          [
-            ubuntu-22.04,
-            ubuntu-latest,
-            windows-latest,
-            macos-latest,
-            macos-15-intel
-          ]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Clear toolcache
-        shell: pwsh
-        run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
-      - name: Write global.json
-        shell: bash
-        run: |
-          mkdir subdirectory
-          echo '{"sdk":{"version": "10.0.101","rollForward": "latestFeature"}}' > ./subdirectory/global.json
-      - name: Setup dotnet
-        uses: ./
-        with:
-          global-json-file: ./subdirectory/global.json
-      - name: Verify dotnet
-        shell: pwsh
-        run: __tests__/verify-dotnet.ps1 -Patterns "^10.0"
-
   test-global-json-with-comments:
     runs-on: ${{ matrix.operating-system }}
     strategy:
@@ -379,7 +347,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -387,7 +355,7 @@ jobs:
         shell: bash
         run: |
           mkdir subdirectory
-          echo '/* should support comments */ {"sdk":{"version": "10.0.101","rollForward": "latestFeature"}} // should support comments' > ./subdirectory/global.json
+          echo '/* should support comments */ {"sdk":{"version": "10.0.101"}} // should support comments' > ./subdirectory/global.json
       - name: Setup dotnet
         uses: ./
         with:
@@ -411,7 +379,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -442,7 +410,7 @@ jobs:
       NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -480,7 +448,7 @@ jobs:
       NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -514,7 +482,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -547,7 +515,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -587,7 +555,7 @@ jobs:
       http_proxy: http://squid-proxy:3128
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -610,7 +578,7 @@ jobs:
       no_proxy: github.com,download.visualstudio.microsoft.com,api.nuget.org,builds.dotnet.microsoft.com,ci.dot.net
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -642,7 +610,7 @@ jobs:
         higher-version: ['10.0.101']
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -671,7 +639,7 @@ jobs:
           [ubuntu-latest, windows-latest, macos-15-intel, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -710,7 +678,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Clear toolcache
         shell: pwsh
@@ -738,7 +706,7 @@ jobs:
         operating-system: [ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -758,7 +726,7 @@ jobs:
         operating-system: [macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}

.github/workflows/publish-immutable-actions.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checking out
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Publish
         id: publish
-        uses: actions/publish-immutable-action@v0.0.4
+        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

.github/workflows/release-new-action-version.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - name: Update the ${{ env.TAG_NAME }} tag
         id: update-major-tag
-        uses: actions/publish-action@v0.4.0
+        uses: actions/publish-action@23f4c6f12633a2da8f44938b71fde9afec138fb4 # v0.4.0
         with:
           source-tag: ${{ env.TAG_NAME }}
           slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/test-dotnet.yml

@@ -28,7 +28,7 @@ jobs:
         dotnet-version: ['8.0', '9.0', '10.0']
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}

.licensed.yml

@@ -10,8 +10,11 @@ allowed:
   - mit
   - cc0-1.0
   - unlicense
+  - blueoak-1.0.0
 
 reviewed:
   npm:
     - sax # ISC + MIT
     - "@actions/http-client" # MIT
+    - balanced-match # MIT
+    - brace-expansion # MIT

.licenses/npm/@actions/cache.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/cache"
-version: 5.0.5
+version: 6.2.0
 type: npm
 summary: Actions cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/cache

.licenses/npm/@actions/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/core"
-version: 2.0.3
+version: 3.0.1
 type: npm
 summary: Actions core lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/core

.licenses/npm/@actions/exec.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/exec"
-version: 2.0.0
+version: 3.0.0
 type: npm
 summary: Actions exec lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/exec

.licenses/npm/@actions/github.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/github"
-version: 6.0.1
+version: 9.1.1
 type: npm
 summary: Actions github lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/github

.licenses/npm/@actions/glob-0.6.1.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/glob"
-version: 0.5.1
+version: 0.6.1
 type: npm
 summary: Actions glob lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/glob

.licenses/npm/@actions/glob-0.7.0.dep.yml

@@ -1,20 +1,20 @@
 ---
-name: "@octokit/openapi-types"
-version: 24.2.0
+name: "@actions/glob"
+version: 0.7.0
 type: npm
-summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
-homepage:
+summary: Actions glob lib
+homepage: https://github.com/actions/toolkit/tree/main/packages/glob
 license: mit
 licenses:
-- sources: LICENSE
+- sources: LICENSE.md
   text: |-
-    Copyright 2020 Gregor Martynus
+    The MIT License (MIT)
+
+    Copyright 2019 GitHub
 
     Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
     The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
 notices: []

.licenses/npm/@actions/http-client-4.0.1.dep.yml

@@ -1,10 +1,10 @@
 ---
 name: "@actions/http-client"
-version: 2.2.3
+version: 4.0.1
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client
-license: mit
+license: other
 licenses:
 - sources: LICENSE
   text: |

.licenses/npm/@actions/io.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/io"
-version: 2.0.0
+version: 3.0.2
 type: npm
 summary: Actions io lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/io

.licenses/npm/@azure/core-client.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-client"
-version: 1.10.1
+version: 1.10.2
 type: npm
 summary: Core library for interfacing with AutoRest generated code
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-client/

.licenses/npm/@azure/core-http-compat.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-http-compat"
-version: 2.3.1
+version: 2.4.0
 type: npm
 summary: Core HTTP Compatibility Library to bridge the gap between Core V1 & V2 packages.
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-compat/

.licenses/npm/@azure/core-rest-pipeline.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@azure/core-rest-pipeline"
-version: 1.22.2
+version: 1.24.0
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-rest-pipeline/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/core-rest-pipeline/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@azure/core-xml.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-xml"
-version: 1.5.0
+version: 1.5.1
 type: npm
 summary: Core library for interacting with XML payloads
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-xml/

.licenses/npm/@azure/storage-blob.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@azure/storage-blob"
-version: 12.29.1
+version: 12.32.0
 type: npm
 summary: Microsoft Azure Storage SDK for JavaScript - Blob
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-blob/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-blob/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@azure/storage-common.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@azure/storage-common"
-version: 12.1.1
+version: 12.4.1
 type: npm
 summary: Azure Storage Common Client Library for JavaScript
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-internal-avro/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-common/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@nodable/entities.dep.yml

@@ -0,0 +1,11 @@
+---
+name: "@nodable/entities"
+version: 2.2.0
+type: npm
+summary: Entity parser for XML, HTML, External entites with security and NCR control
+homepage: 
+license: mit
+licenses:
+- sources: README.md
+  text: MIT
+notices: []

.licenses/npm/@octokit/auth-token.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/auth-token"
-version: 4.0.0
+version: 6.0.0
 type: npm
 summary: GitHub API token authentication for browsers and Node.js
 homepage:

.licenses/npm/@octokit/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/core"
-version: 5.0.1
+version: 7.0.6
 type: npm
 summary: Extendable client for GitHub's REST & GraphQL APIs
 homepage:

.licenses/npm/@octokit/endpoint.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/endpoint"
-version: 9.0.6
+version: 11.0.3
 type: npm
 summary: Turns REST API endpoints into generic request options
 homepage:

.licenses/npm/@octokit/graphql.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/graphql"
-version: 7.0.2
+version: 9.0.3
 type: npm
 summary: GitHub GraphQL API client for browsers and Node
 homepage:

.licenses/npm/@octokit/openapi-types.dep.yml

@@ -1,14 +1,14 @@
 ---
 name: "@octokit/openapi-types"
-version: 20.0.0
+version: 27.0.0
 type: npm
 summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
 homepage:
 license: mit
 licenses:
 - sources: LICENSE
-  text: |-
-    Copyright 2020 Gregor Martynus
+  text: |
+    Copyright (c) GitHub 2025 - Licensed as MIT.
 
     Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

.licenses/npm/@octokit/plugin-paginate-rest.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-paginate-rest"
-version: 9.2.2
+version: 14.0.0
 type: npm
 summary: Octokit plugin to paginate REST API endpoint responses
 homepage:

.licenses/npm/@octokit/plugin-rest-endpoint-methods.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-rest-endpoint-methods"
-version: 10.4.1
+version: 17.0.0
 type: npm
 summary: Octokit plugin adding one method for all of api.github.com REST API endpoints
 homepage:

.licenses/npm/@octokit/request-error.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/request-error"
-version: 5.1.1
+version: 7.1.0
 type: npm
 summary: Error class for Octokit request errors
 homepage:

.licenses/npm/@octokit/request.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/request"
-version: 8.4.1
+version: 10.0.10
 type: npm
 summary: Send parameterized requests to GitHub's APIs with sensible defaults in browsers
   and Node

.licenses/npm/@octokit/types-13.10.0.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@octokit/types"
-version: 13.10.0
-type: npm
-summary: Shared TypeScript definitions for Octokit projects
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |
-    MIT License Copyright (c) 2019 Octokit contributors
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
-notices: []

.licenses/npm/@octokit/types.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/types"
-version: 12.6.0
+version: 16.0.0
 type: npm
 summary: Shared TypeScript definitions for Octokit projects
 homepage:

.licenses/npm/@typespec/ts-http-runtime.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@typespec/ts-http-runtime"
-version: 0.3.2
+version: 0.3.6
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/ts-http-runtime/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/ts-http-runtime/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/anynum.dep.yml

@@ -1,16 +1,17 @@
 ---
-name: undici
-version: 5.29.0
+name: anynum
+version: 1.0.1
 type: npm
-summary: An HTTP/1.1 client, written from scratch for Node.js
-homepage: https://undici.nodejs.org
+summary: Normalize all Unicode decimal digits (Devanagari, Arabic, Thai, etc.) to
+  ASCII numerals. Zero dependencies, performance-first.
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE
   text: |
     MIT License
 
-    Copyright (c) Matteo Collina and Undici contributors
+    Copyright (c) 2026 Natural Intelligence
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal

.licenses/npm/balanced-match-4.0.4.dep.yml

@@ -0,0 +1,34 @@
+---
+name: balanced-match
+version: 4.0.4
+type: npm
+summary: Match balanced character pairs, like "{" and "}"
+homepage:
+license: other
+licenses:
+- sources: LICENSE.md
+  text: |
+    (MIT)
+
+    Original code Copyright Julian Gruber <julian@juliangruber.com>
+
+    Port to TypeScript Copyright Isaac Z. Schlueter <i@izs.me>
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of
+    this software and associated documentation files (the "Software"), to deal in
+    the Software without restriction, including without limitation the rights to
+    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+    of the Software, and to permit persons to whom the Software is furnished to do
+    so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []

.licenses/npm/before-after-hook.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: before-after-hook
-version: 2.2.3
+version: 4.0.0
 type: npm
 summary: asynchronous before/error/after hooks for internal functionality
 homepage:

.licenses/npm/brace-expansion-1.1.15.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 1.1.13
+version: 1.1.15
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion

.licenses/npm/brace-expansion-5.0.6.dep.yml

@@ -1,30 +1,34 @@
 ---
-name: "@fastify/busboy"
-version: 2.1.1
+name: brace-expansion
+version: 5.0.6
 type: npm
-summary: A streaming parser for HTML form data for node.js
+summary: Brace expansion as known from sh/bash
 homepage:
-license: mit
+license: other
 licenses:
 - sources: LICENSE
-  text: |-
-    Copyright Brian White. All rights reserved.
+  text: |
+    MIT License
+
+    Copyright Julian Gruber <julian@juliangruber.com>
+
+    TypeScript port Copyright Isaac Z. Schlueter <i@izs.me>
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to
-    deal in the Software without restriction, including without limitation the
-    rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-    sell copies of the Software, and to permit persons to whom the Software is
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
     furnished to do so, subject to the following conditions:
 
-    The above copyright notice and this permission notice shall be included in
-    all copies or substantial portions of the Software.
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
     AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
-    IN THE SOFTWARE.
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
 notices: []

.licenses/npm/content-type.dep.yml

@@ -0,0 +1,47 @@
+---
+name: content-type
+version: 2.0.0
+type: npm
+summary: Create and parse HTTP Content-Type header
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    (The MIT License)
+
+    Copyright (c) 2015 Douglas Christopher Wilson
+
+    Permission is hereby granted, free of charge, to any person obtaining
+    a copy of this software and associated documentation files (the
+    'Software'), to deal in the Software without restriction, including
+    without limitation the rights to use, copy, modify, merge, publish,
+    distribute, sublicense, and/or sell copies of the Software, and to
+    permit persons to whom the Software is furnished to do so, subject to
+    the following conditions:
+
+    The above copyright notice and this permission notice shall be
+    included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+    IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+    CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+    TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+    SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+- sources: README.md
+  text: |-
+    [MIT](LICENSE)
+
+    [npm-image]: https://img.shields.io/npm/v/content-type
+    [npm-url]: https://npmjs.org/package/content-type
+    [downloads-image]: https://img.shields.io/npm/dm/content-type
+    [downloads-url]: https://npmjs.org/package/content-type
+    [build-image]: https://img.shields.io/github/actions/workflow/status/jshttp/content-type/ci.yml?branch=master
+    [build-url]: https://github.com/jshttp/content-type/actions/workflows/ci.yml?query=branch%3Amaster
+    [coverage-image]: https://img.shields.io/codecov/c/gh/jshttp/content-type
+    [coverage-url]: https://codecov.io/gh/jshttp/content-type
+    [license-image]: http://img.shields.io/npm/l/content-type.svg?style=flat
+    [license-url]: LICENSE
+notices: []

.licenses/npm/debug.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: debug
-version: 4.3.4
+version: 4.4.3
 type: npm
 summary: Lightweight debugging utility for Node.js and the browser
 homepage:

.licenses/npm/deprecation.dep.yml

@@ -1,28 +0,0 @@
----
-name: deprecation
-version: 2.3.1
-type: npm
-summary: Log a deprecation message with stack
-homepage: https://github.com/gr2m/deprecation#readme
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Gregor Martynus and contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-- sources: README.md
-  text: "[ISC](LICENSE)"
-notices: []

.licenses/npm/fast-xml-builder.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: fast-xml-builder
-version: 1.1.4
+version: 1.2.0
 type: npm
 summary: Build XML from JSON without C/C++ based libraries
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/fast-xml-parser.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.5.11
+version: 5.9.3
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:

.licenses/npm/is-unsafe.dep.yml

@@ -0,0 +1,35 @@
+---
+name: is-unsafe
+version: 1.0.1
+type: npm
+summary: Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across
+  HTML, XML, SVG, SQL, SHELL, and REGEX contexts
+homepage: 
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2026 Natural Intelligence
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: MIT
+notices: []

.licenses/npm/json-with-bigint.dep.yml

@@ -1,16 +1,17 @@
 ---
-name: "@azure/abort-controller"
-version: 1.1.0
+name: json-with-bigint
+version: 3.5.8
 type: npm
-summary: Microsoft Azure SDK for JavaScript - Aborter
-homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/abort-controller/README.md
+summary: JS library that allows you to easily serialize and deserialize data with
+  BigInt values
+homepage:
 license: mit
 licenses:
 - sources: LICENSE
   text: |
-    The MIT License (MIT)
+    MIT License
 
-    Copyright (c) 2020 Microsoft
+    Copyright (c) 2023 Ivan Korolenko
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal

.licenses/npm/lru-cache.dep.yml

@@ -1,26 +0,0 @@
----
-name: lru-cache
-version: 6.0.0
-type: npm
-summary: A cache object that deletes the least-recently-used items.
-homepage:
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/minimatch-10.2.5.dep.yml

@@ -0,0 +1,66 @@
+---
+name: minimatch
+version: 10.2.5
+type: npm
+summary: a glob matcher in javascript
+homepage:
+license: blueoak-1.0.0
+licenses:
+- sources: LICENSE.md
+  text: |
+    # Blue Oak Model License
+
+    Version 1.0.0
+
+    ## Purpose
+
+    This license gives everyone as much permission to work with
+    this software as possible, while protecting contributors
+    from liability.
+
+    ## Acceptance
+
+    In order to receive this license, you must agree to its
+    rules. The rules of this license are both obligations
+    under that agreement and conditions to your license.
+    You must not do anything with this software that triggers
+    a rule that you cannot or will not follow.
+
+    ## Copyright
+
+    Each contributor licenses you to do everything with this
+    software that would otherwise infringe that contributor's
+    copyright in it.
+
+    ## Notices
+
+    You must ensure that everyone who gets a copy of
+    any part of this software from you, with or without
+    changes, also gets the text of this license or a link to
+    <https://blueoakcouncil.org/license/1.0.0>.
+
+    ## Excuse
+
+    If anyone notifies you in writing that you have not
+    complied with [Notices](#notices), you can keep your
+    license by taking all practical steps to comply within 30
+    days after the notice. If you do not do so, your license
+    ends immediately.
+
+    ## Patent
+
+    Each contributor licenses you to do everything with this
+    software that would otherwise infringe any patent claims
+    they can license or become able to license.
+
+    ## Reliability
+
+    No contributor can revoke this license.
+
+    ## No Liability
+
+    **_As far as the law allows, this software comes as is,
+    without any warranty or condition, and no contributor
+    will be liable to anyone for any damages related to this
+    software or this license, under any kind of legal claim._**
+notices: []

.licenses/npm/ms.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: ms
-version: 2.1.2
+version: 2.1.3
 type: npm
 summary: Tiny millisecond conversion utility
 homepage:
@@ -10,7 +10,7 @@ licenses:
   text: |
     The MIT License (MIT)
 
-    Copyright (c) 2016 Zeit, Inc.
+    Copyright (c) 2020 Vercel, Inc.
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal

.licenses/npm/once.dep.yml

@@ -1,26 +0,0 @@
----
-name: once
-version: 1.4.0
-type: npm
-summary: Run a function exactly one time
-homepage: https://github.com/isaacs/once#readme
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/path-expression-matcher.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: path-expression-matcher
-version: 1.4.0
+version: 1.5.0
 type: npm
 summary: Efficient path tracking and pattern matching for XML/JSON parsers
 homepage: https://github.com/NaturalIntelligence/path-expression-matcher#readme

.licenses/npm/semver-6.3.1.dep.yml

@@ -1,26 +0,0 @@
----
-name: semver
-version: 6.3.1
-type: npm
-summary: The semantic version parser used by npm.
-homepage:
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/semver.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: semver
-version: 7.6.0
+version: 7.8.5
 type: npm
 summary: The semantic version parser used by npm.
 homepage:

.licenses/npm/strnum.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: strnum
-version: 2.2.3
+version: 2.4.1
 type: npm
 summary: Parse String to Number based on configuration
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/undici.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 6.24.1
+version: 6.27.0
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org

.licenses/npm/universal-user-agent.dep.yml

@@ -1,8 +1,8 @@
 ---
 name: universal-user-agent
-version: 6.0.1
+version: 7.0.3
 type: npm
-summary: Get a user agent string in both browser and node
+summary: Get a user agent string across all JavaScript Runtime Environments
 homepage:
 license: isc
 licenses:
@@ -10,7 +10,7 @@ licenses:
   text: |
     # [ISC License](https://spdx.org/licenses/ISC)
 
-    Copyright (c) 2018, Gregor Martynus (https://github.com/gr2m)
+    Copyright (c) 2018-2021, Gregor Martynus (https://github.com/gr2m)
 
     Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
 

.licenses/npm/wrappy.dep.yml

@@ -1,26 +0,0 @@
----
-name: wrappy
-version: 1.0.2
-type: npm
-summary: Callback wrapping utility
-homepage: https://github.com/npm/wrappy
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/xml-naming.dep.yml

@@ -0,0 +1,12 @@
+---
+name: xml-naming
+version: 0.1.0
+type: npm
+summary: Validates XML name productions — Name, NCName, QName, NMToken, NMTokens —
+  for XML 1.0 and 1.1
+homepage: 
+license: mit
+licenses:
+- sources: README.md
+  text: MIT
+notices: []

.licenses/npm/yallist.dep.yml

@@ -1,26 +0,0 @@
----
-name: yallist
-version: 4.0.0
-type: npm
-summary: Yet Another Linked List
-homepage:
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.prettierrc.js

@@ -1,11 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports = {
-  printWidth: 80,
-  tabWidth: 2,
-  useTabs: false,
-  semi: true,
-  singleQuote: true,
-  trailingComma: 'none',
-  bracketSpacing: false,
-  arrowParens: 'avoid'
-};

.prettierrc.json

@@ -0,0 +1,10 @@
+{
+  "printWidth": 80,
+  "tabWidth": 2,
+  "useTabs": false,
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "bracketSpacing": false,
+  "arrowParens": "avoid"
+}

README.md

@@ -15,6 +15,10 @@ documentation:
 [Software installed on github hosted runners](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#supported-software)
 for .NET SDK versions that are currently available.
 
+## What's new in V6
+
+- Migrated action internals to ESM for compatibility with latest `@actions/*` packages. No changes to action inputs, outputs, or behavior.
+
 ## Breaking changes in V5
 
 - Upgraded action from node20 to node24
@@ -29,8 +33,8 @@ See [action.yml](action.yml)
 **Basic**:
 ```yaml
 steps:
-- uses: actions/checkout@v6
-- uses: actions/setup-dotnet@v5
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: '8.0.x'
 - run: dotnet build <my project>
@@ -40,9 +44,9 @@ steps:
 **Multiple version installation**:
 ```yml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
 - name: Setup dotnet
-  uses: actions/setup-dotnet@v5
+  uses: actions/setup-dotnet@v6
   with:
     dotnet-version: | 
       8.0.x
@@ -75,8 +79,8 @@ The optional `dotnet-channel` input specifies the source channel for the install
 **Install latest LTS version:**
 ```yaml
 steps:
-- uses: actions/checkout@v6
-- uses: actions/setup-dotnet@v5
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: latest
     dotnet-channel: LTS
@@ -88,9 +92,9 @@ Using the architecture input, it is possible to specify the required .NET SDK ar
 **Example: Install multiple SDK versions for a specific architecture**
 ```yml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
 - name: Setup dotnet (x86)
-  uses: actions/setup-dotnet@v5
+  uses: actions/setup-dotnet@v6
   with:
     dotnet-version: |
       8.0.x
@@ -107,8 +111,8 @@ The `dotnet-quality` input installs the latest build of the specified quality in
 
 ```yml
 steps:
-- uses: actions/checkout@v6
-- uses: actions/setup-dotnet@v5
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: '8.0.x'
     dotnet-quality: 'preview'
@@ -119,8 +123,8 @@ steps:
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
-- uses: actions/setup-dotnet@v5
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: latest
     dotnet-channel: LTS
@@ -134,15 +138,15 @@ steps:
 
 ```yml
 steps:
-- uses: actions/checkout@v6
-- uses: actions/setup-dotnet@v5
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
   with:
     global-json-file: csharp/global.json
 - run: dotnet build <my project>
   working-directory: csharp
 ```
 
-> **Note**: The action supports `latest*` variants of the [rollForward](https://learn.microsoft.com/en-us/dotnet/core/tools/global-json#rollforward) field in `global.json`. When set to `latestPatch`, `latestFeature`, `latestMinor`, or `latestMajor`, the action installs the appropriate SDK version.
+> **Note**: The action supports `latest*` variants of the [rollForward](https://learn.microsoft.com/en-us/dotnet/core/tools/global-json#rollforward) field in `global.json`. When set to `latestPatch`, `latestFeature`, `latestMinor`, or `latestMajor`, the action installs the appropriate SDK version. For prerelease versions, the exact pinned version is always installed regardless of the `rollForward` setting.
 
 ## Caching NuGet Packages
 The action has a built-in functionality for caching and restoring dependencies. It uses [toolkit/cache](https://github.com/actions/toolkit/tree/main/packages/cache) under the hood for caching global packages data but requires less configuration settings. The `cache` input is optional, and caching is turned off by default.
@@ -153,8 +157,8 @@ The action searches for [NuGet Lock files](https://learn.microsoft.com/nuget/con
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
-- uses: actions/setup-dotnet@v5
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: 8.x
     cache: true
@@ -178,8 +182,8 @@ steps:
 env:
   NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
 steps:
-- uses: actions/checkout@v6
-- uses: actions/setup-dotnet@v5
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: 8.x
     cache: true
@@ -192,8 +196,8 @@ steps:
 env:
   NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
 steps:
-- uses: actions/checkout@v6
-- uses: actions/setup-dotnet@v5
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: 8.x
     cache: true
@@ -212,9 +216,9 @@ jobs:
         dotnet: [ '8.0.x', '9.0.x', '10.0.x' ]
     name: Dotnet ${{ matrix.dotnet }} sample
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: ${{ matrix.dotnet }}
       - name: Execute dotnet
@@ -232,14 +236,15 @@ jobs:
         dotnet: [ '8.0.x', '9.0.x', '10.0.x' ]
     name: Dotnet ${{ matrix.dotnet }} sample
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         id: stepid
         with:
           dotnet-version: ${{ matrix.dotnet }}
       - name: Create temporary global.json
-        run: echo '{"sdk":{"version": "${{ steps.stepid.outputs.dotnet-version }}"}}' > ./global.json
+        run: |
+          echo '{"sdk":{"version": "${{ steps.stepid.outputs.dotnet-version }}"}}' > ./global.json
       - name: Execute dotnet
         run: dotnet build <my project>
 ```
@@ -249,8 +254,8 @@ jobs:
 ### Github Package Registry (GPR)
 ```yml
 steps:
-- uses: actions/checkout@v6
-- uses: actions/setup-dotnet@v5
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: '8.0.x'
     source-url: https://nuget.pkg.github.com/<owner>/index.json
@@ -265,7 +270,7 @@ steps:
 
 ### Azure Artifacts
 ```yml
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     source-url: https://pkgs.dev.azure.com/<your-organization>/_packaging/<your-feed-name>/nuget/v3/index.json
   env:
@@ -276,7 +281,7 @@ steps:
 
 ### nuget.org
 ```yml
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: 8.0.x
 - name: Publish the package to nuget.org
@@ -293,7 +298,7 @@ The `workloads` input allows you to install .NET workloads as part of the SDK se
 steps:
 - uses: actions/checkout@v5
 - name: Setup .NET with workloads
-  uses: actions/setup-dotnet@v5
+  uses: actions/setup-dotnet@v6
   with:
     dotnet-version: '9.0.x'
     workloads: workload1, workload2  # Specify the workloads required for the project, such as wasm-tools, maui, etc.
@@ -315,7 +320,7 @@ Using the **dotnet-version** output it's possible to get the installed by the ac
 In case of a single version installation, the `dotnet-version` output contains the version that is installed by the action.
 
 ```yaml
-    - uses: actions/setup-dotnet@v5
+    - uses: actions/setup-dotnet@v6
       id: stepid
       with:
         dotnet-version: 8.0.416
@@ -327,7 +332,7 @@ In case of a single version installation, the `dotnet-version` output contains t
 In case of a multiple version installation, the `dotnet-version` output contains the latest version that is installed by the action.
 
 ```yaml
-    - uses: actions/setup-dotnet@v5
+    - uses: actions/setup-dotnet@v6
       id: stepid
       with:
         dotnet-version: | 
@@ -340,7 +345,7 @@ In case of a multiple version installation, the `dotnet-version` output contains
 When the `dotnet-version` input is used along with the `global-json-file` input, the `dotnet-version` output contains the version resolved from the `global.json`.
 
 ```yaml
-    - uses: actions/setup-dotnet@v5
+    - uses: actions/setup-dotnet@v6
       id: stepid
       with:
         dotnet-version: | 
@@ -380,8 +385,8 @@ build:
     DOTNET_INSTALL_DIR: "path/to/directory"
     NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
   steps:
-    - uses: actions/checkout@v6
-    - uses: actions/setup-dotnet@v5
+    - uses: actions/checkout@v7
+    - uses: actions/setup-dotnet@v6
       with:
         dotnet-version: '8.0.x'
         cache: true
@@ -409,4 +414,4 @@ The scripts and documentation in this project are released under the [MIT Licens
 
 ## Contributions
 
-Contributions are welcome! See [Contributor's Guide](docs/contributors.md)
+Contributions are welcome! See [Contributor's Guide](docs/contributors.md)

__tests__/__snapshots__/authutil.test.ts.snap

@@ -1,4 +1,4 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
 exports[`authutil tests existing config not in repo root, sets up a partial NuGet.config user/PAT for GPR 1`] = `
 "<?xml version="1.0"?>

__tests__/authutil.test.ts

@@ -1,6 +1,10 @@
+import {afterAll, beforeEach, describe, expect, it} from '@jest/globals';
 import * as io from '@actions/io';
 import fs from 'fs';
 import path from 'path';
+import {fileURLToPath} from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 const fakeSourcesDirForTesting = path.join(
   __dirname,
@@ -71,7 +75,7 @@ const azureartifactsnugetorgNuGetConfig = `<?xml version="1.0" encoding="utf-8"?
 const nugetConfigFile = path.join(fakeSourcesDirForTesting, '../nuget.config');
 
 process.env['GITHUB_REPOSITORY'] = 'OwnerName/repo';
-import * as auth from '../src/authutil';
+import * as auth from '../src/authutil.js';
 
 describe('authutil tests', () => {
   beforeEach(async () => {

__tests__/cache-restore.test.ts

@@ -1,16 +1,40 @@
-import {readdir} from 'node:fs/promises';
-import * as cache from '@actions/cache';
-import * as core from '@actions/core';
-import * as glob from '@actions/glob';
-import {restoreCache} from '../src/cache-restore';
-import {getNuGetFolderPath} from '../src/cache-utils';
-import {lockFilePatterns} from '../src/constants';
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest
+} from '@jest/globals';
 
-jest.mock('node:fs/promises');
-jest.mock('@actions/cache');
-jest.mock('@actions/core');
-jest.mock('@actions/glob');
-jest.mock('../src/cache-utils');
+jest.unstable_mockModule('node:fs/promises', () => ({
+  readdir: jest.fn()
+}));
+jest.unstable_mockModule('@actions/cache', () => ({
+  restoreCache: jest.fn()
+}));
+jest.unstable_mockModule('@actions/core', () => ({
+  saveState: jest.fn(),
+  setOutput: jest.fn(),
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn()
+}));
+jest.unstable_mockModule('@actions/glob', () => ({
+  hashFiles: jest.fn()
+}));
+jest.unstable_mockModule('../src/cache-utils', () => ({
+  getNuGetFolderPath: jest.fn()
+}));
+
+const {readdir} = await import('node:fs/promises');
+const cache = await import('@actions/cache');
+const core = await import('@actions/core');
+const glob = await import('@actions/glob');
+const {restoreCache} = await import('../src/cache-restore.js');
+const {getNuGetFolderPath} = await import('../src/cache-utils.js');
+const {lockFilePatterns} = await import('../src/constants.js');
 
 describe('cache-restore tests', () => {
   describe.each(lockFilePatterns)('restoreCache("%s")', lockFilePattern => {
@@ -32,7 +56,9 @@ describe('cache-restore tests', () => {
       jest.mocked(core.setOutput).mockClear();
       jest.mocked(cache.restoreCache).mockClear();
     });
-    afterEach(() => (process.env.GITHUB_WORKSPACE = githubWorkspace));
+    afterEach(() => {
+      process.env.GITHUB_WORKSPACE = githubWorkspace;
+    });
 
     it('throws error when lock file is not found', async () => {
       jest.mocked(glob.hashFiles).mockResolvedValue('');

__tests__/cache-save.test.ts

@@ -1,13 +1,32 @@
-import * as cache from '@actions/cache';
-import * as core from '@actions/core';
-import fs from 'node:fs';
-import {run} from '../src/cache-save';
-import {getNuGetFolderPath} from '../src/cache-utils';
+import {beforeAll, beforeEach, describe, expect, it, jest} from '@jest/globals';
 
-jest.mock('@actions/cache');
-jest.mock('@actions/core');
-jest.mock('node:fs');
-jest.mock('../src/cache-utils');
+jest.unstable_mockModule('@actions/cache', () => ({
+  saveCache: jest.fn()
+}));
+jest.unstable_mockModule('@actions/core', () => ({
+  setFailed: jest.fn(),
+  getState: jest.fn(),
+  setOutput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  debug: jest.fn(),
+  info: jest.fn(),
+  warning: jest.fn()
+}));
+jest.unstable_mockModule('node:fs', () => ({
+  default: {
+    existsSync: jest.fn()
+  }
+}));
+jest.unstable_mockModule('../src/cache-utils', () => ({
+  getNuGetFolderPath: jest.fn()
+}));
+
+const cache = await import('@actions/cache');
+const core = await import('@actions/core');
+const fs = (await import('node:fs')).default;
+const {run} = await import('../src/cache-save.js');
+const {getNuGetFolderPath} = await import('../src/cache-utils.js');
+const {State} = await import('../src/constants.js');
 
 describe('cache-save tests', () => {
   beforeAll(() => {
@@ -84,4 +103,22 @@ describe('cache-save tests', () => {
     expect(jest.mocked(core.getState)).toHaveBeenCalledTimes(2);
     expect(jest.mocked(cache.saveCache)).toHaveBeenCalled();
   });
+
+  it('does not fail and traces when saveCache returns -1', async () => {
+    jest.mocked(core.getBooleanInput).mockReturnValue(true);
+    jest.mocked(core.getState).mockImplementation(s => s);
+    jest.mocked(fs.existsSync).mockReturnValue(true);
+    jest.mocked(cache.saveCache).mockResolvedValue(-1);
+
+    await run();
+
+    expect(jest.mocked(core.setFailed)).not.toHaveBeenCalled();
+    expect(jest.mocked(cache.saveCache)).toHaveBeenCalled();
+    expect(jest.mocked(core.debug)).toHaveBeenCalledWith(
+      `Cache was not saved for the key: ${State.CachePrimaryKey}`
+    );
+    expect(jest.mocked(core.info)).not.toHaveBeenCalledWith(
+      `Cache saved with the key: ${State.CachePrimaryKey}`
+    );
+  });
 });

__tests__/cache-utils.test.ts

@@ -1,11 +1,29 @@
-import * as cache from '@actions/cache';
-import * as exec from '@actions/exec';
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest
+} from '@jest/globals';
 
-import {getNuGetFolderPath, isCacheFeatureAvailable} from '../src/cache-utils';
+jest.unstable_mockModule('@actions/cache', () => ({
+  isFeatureAvailable: jest.fn()
+}));
+jest.unstable_mockModule('@actions/core', () => ({
+  warning: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn()
+}));
+jest.unstable_mockModule('@actions/exec', () => ({
+  getExecOutput: jest.fn()
+}));
 
-jest.mock('@actions/cache');
-jest.mock('@actions/core');
-jest.mock('@actions/exec');
+const cache = await import('@actions/cache');
+const exec = await import('@actions/exec');
+const {getNuGetFolderPath, isCacheFeatureAvailable} =
+  await import('../src/cache-utils.js');
 
 describe('cache-utils tests', () => {
   describe('getNuGetFolderPath()', () => {
@@ -104,9 +122,15 @@ Options:
     url => {
       // Save & Restore env
       let serverUrlEnv: string | undefined;
-      beforeAll(() => (serverUrlEnv = process.env['GITHUB_SERVER_URL']));
-      beforeEach(() => (process.env['GITHUB_SERVER_URL'] = url));
-      afterEach(() => (process.env['GITHUB_SERVER_URL'] = serverUrlEnv));
+      beforeAll(() => {
+        serverUrlEnv = process.env['GITHUB_SERVER_URL'];
+      });
+      beforeEach(() => {
+        process.env['GITHUB_SERVER_URL'] = url;
+      });
+      afterEach(() => {
+        process.env['GITHUB_SERVER_URL'] = serverUrlEnv;
+      });
 
       it('returns true when cache.isFeatureAvailable() === true', () => {
         jest.mocked(cache.isFeatureAvailable).mockReturnValue(true);

__tests__/csc.test.ts

@@ -1,45 +1,97 @@
-import cscFile from '../.github/csc.json';
+import {describe, expect, test} from '@jest/globals';
+import cscFile from '../.github/csc.json' with {type: 'json'};
 describe('csc tests', () => {
-  test('regular expression in csc.json is valid', async () => {
-    const regexPattern = cscFile['problemMatcher'][0]['pattern'][0]['regexp'];
-    const regexResultsMap = cscFile['problemMatcher'][0]['pattern'][0];
+  const regexPattern = cscFile['problemMatcher'][0]['pattern'][0]['regexp'];
+  const regexResultsMap = cscFile['problemMatcher'][0]['pattern'][0];
+  const regex = new RegExp(regexPattern);
 
-    const regex = new RegExp(regexPattern);
-
-    const stringsToMatch = [
-      'Program.cs(10,79): error CS1002: ; expected [/Users/zacharyeisinger/Documents/repo/setup-dotnet/__tests__/sample-broken-csproj/sample.csproj]',
-      "S:\\Msbuild\\src\\Build\\Evaluation\\ExpressionShredder.cs(33,7): error CS1003: Syntax error, ',' expected [S:\\msbuild\\src\\Build\\Microsoft.Build.csproj > Properties:prop]"
-    ];
-    // Expected results are calculated according to the csc matcher located in csc.json file
-    const expectedResults = [
-      {
+  const testCases: Array<{input: string; results: Record<string, string>}> = [
+    {
+      input:
+        'Program.cs(10,79): error CS1002: ; expected [/Users/zacharyeisinger/Documents/repo/setup-dotnet/__tests__/sample-broken-csproj/sample.csproj]',
+      results: {
         file: 'Program.cs',
         line: '10',
+        column: '79',
         severity: 'error',
         code: 'CS1002',
         message: '; expected',
         fromPath:
           '/Users/zacharyeisinger/Documents/repo/setup-dotnet/__tests__/sample-broken-csproj/sample.csproj'
-      },
-      {
+      }
+    },
+    {
+      input:
+        "S:\\Msbuild\\src\\Build\\Evaluation\\ExpressionShredder.cs(33,7): error CS1003: Syntax error, ',' expected [S:\\msbuild\\src\\Build\\Microsoft.Build.csproj > Properties:prop]",
+      results: {
         file: 'S:\\Msbuild\\src\\Build\\Evaluation\\ExpressionShredder.cs',
         line: '33',
+        column: '7',
         severity: 'error',
         code: 'CS1003',
         message: "Syntax error, ',' expected",
         fromPath:
           'S:\\msbuild\\src\\Build\\Microsoft.Build.csproj > Properties:prop'
       }
-    ];
+    },
+    {
+      // `dotnet format` style error
+      input:
+        'C:\\actions-runner\\_work\\Some\\Folder\\SomeFile.cs(222,8): error WHITESPACE: Fix whitespace formatting. Delete 1 characters. [C:\\actions-runner\\_work\\Some\\Folder\\SomeProject.csproj]',
+      results: {
+        file: 'C:\\actions-runner\\_work\\Some\\Folder\\SomeFile.cs',
+        line: '222',
+        column: '8',
+        severity: 'error',
+        code: 'WHITESPACE',
+        message: 'Fix whitespace formatting. Delete 1 characters.',
+        fromPath: 'C:\\actions-runner\\_work\\Some\\Folder\\SomeProject.csproj'
+      }
+    },
+    {
+      // CSC error with whitespace prefix
+      input:
+        '  /Volumes/Code/ghe_actions-2.301.1/Some/Folder/SomeFile.cs(10,8): error CS1014: A get or set accessor expected [/Volumes/Code/ghe_actions-2.301.1/Some/Folder/SomeProject.csproj]',
+      results: {
+        file: '/Volumes/Code/ghe_actions-2.301.1/Some/Folder/SomeFile.cs',
+        line: '10',
+        column: '8',
+        severity: 'error',
+        code: 'CS1014',
+        message: 'A get or set accessor expected',
+        fromPath:
+          '/Volumes/Code/ghe_actions-2.301.1/Some/Folder/SomeProject.csproj'
+      }
+    },
+    {
+      // CSC error with MSBuild prefix
+      input:
+        '    20>C:\\actions-runner\\_work\\Some\\Folder\\SomeFile.cs(8,2): error CS1014: A get or set accessor expected [C:\\actions-runner\\_work\\Some\\Folder\\SomeProject.csproj]',
+      results: {
+        file: 'C:\\actions-runner\\_work\\Some\\Folder\\SomeFile.cs',
+        line: '8',
+        column: '2',
+        severity: 'error',
+        code: 'CS1014',
+        message: 'A get or set accessor expected',
+        fromPath: 'C:\\actions-runner\\_work\\Some\\Folder\\SomeProject.csproj'
+      }
+    }
+  ];
 
-    stringsToMatch.map((string, index) => {
-      const matchedResultsArray = string.match(regex);
-      for (const propName in expectedResults[index]) {
-        const propertyIndex = regexResultsMap[propName];
-        const expectedPropValue = expectedResults[index][propName];
+  test.each(testCases)(
+    'regex matches and parses: $input',
+    ({input, results}: {input: string; results: Record<string, string>}) => {
+      const matchedResultsArray = input.match(regex);
+      expect(matchedResultsArray).not.toBeNull();
+
+      for (const propName in results) {
+        const propertyIndex = (regexResultsMap as any)[propName];
+        const expectedPropValue = results[propName];
         const matchedPropValue = matchedResultsArray![propertyIndex];
         expect(matchedPropValue).toEqual(expectedPropValue);
       }
-    });
-  }, 10000);
+    },
+    10000
+  );
 });

__tests__/installation-scripts.test.ts

@@ -1,7 +1,11 @@
+import {describe, expect, it} from '@jest/globals';
 import path from 'path';
 import fs from 'fs';
+import {fileURLToPath} from 'url';
 import * as hc from '@actions/http-client';
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
 const HTTP_CLIENT_OPTIONS = {allowRetries: true, maxRetries: 10} as const;
 const TEST_TIMEOUT = 30000;
 

__tests__/installer.test.ts

@@ -1,14 +1,52 @@
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest
+} from '@jest/globals';
 import each from 'jest-each';
 import semver from 'semver';
-import fs from 'fs';
 import fspromises from 'fs/promises';
 import os from 'os';
-import * as exec from '@actions/exec';
-import * as core from '@actions/core';
-import * as io from '@actions/io';
-import * as installer from '../src/installer';
+import path from 'path';
 
-import {IS_WINDOWS} from '../src/utils';
+jest.unstable_mockModule('@actions/exec', () => ({
+  getExecOutput: jest.fn()
+}));
+jest.unstable_mockModule('@actions/core', () => ({
+  warning: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn(),
+  setOutput: jest.fn(),
+  exportVariable: jest.fn((name: string, val: string) => {
+    process.env[name] = val;
+  }),
+  addPath: jest.fn((p: string) => {
+    process.env['PATH'] = `${p}${path.delimiter}${process.env['PATH']}`;
+  })
+}));
+jest.unstable_mockModule('@actions/io', () => ({
+  which: jest.fn()
+}));
+jest.unstable_mockModule('fs', () => {
+  const actual = jest.requireActual('fs') as typeof import('fs');
+  const chmodSync = jest.fn();
+  return {
+    ...actual,
+    chmodSync,
+    default: {...actual, chmodSync}
+  };
+});
+
+const exec = await import('@actions/exec');
+const core = await import('@actions/core');
+const io = await import('@actions/io');
+const fs = await import('fs');
+const installer = await import('../src/installer.js');
+const {IS_WINDOWS} = await import('../src/utils.js');
 
 describe('installer tests', () => {
   const env = process.env;
@@ -16,14 +54,24 @@ describe('installer tests', () => {
   beforeEach(() => {
     jest.resetModules();
     process.env = {...env};
+    (core.exportVariable as jest.Mock).mockImplementation(
+      (...args: unknown[]) => {
+        const [name, val] = args as [string, string];
+        process.env[name] = val;
+      }
+    );
+    (core.addPath as jest.Mock).mockImplementation((...args: unknown[]) => {
+      const [p] = args as [string];
+      process.env['PATH'] = `${p}${path.delimiter}${process.env['PATH']}`;
+    });
   });
 
   describe('DotnetCoreInstaller tests', () => {
-    const getExecOutputSpy = jest.spyOn(exec, 'getExecOutput');
-    const warningSpy = jest.spyOn(core, 'warning');
-    const whichSpy = jest.spyOn(io, 'which');
+    const getExecOutputSpy = exec.getExecOutput as jest.Mock;
+    const warningSpy = core.warning as jest.Mock;
+    const whichSpy = io.which as jest.Mock;
     const maxSatisfyingSpy = jest.spyOn(semver, 'maxSatisfying');
-    const chmodSyncSpy = jest.spyOn(fs, 'chmodSync');
+    const chmodSyncSpy = fs.chmodSync as jest.Mock;
     const readdirSpy = jest.spyOn(fspromises, 'readdir');
 
     describe('installDotnet() tests', () => {

__tests__/latest-version.test.ts

@@ -1,22 +1,31 @@
-import {DotnetVersionResolver} from '../src/installer';
-import * as hc from '@actions/http-client';
-import * as core from '@actions/core';
+import {afterEach, beforeEach, describe, expect, it, jest} from '@jest/globals';
 
-// Mock http-client
-jest.mock('@actions/http-client');
+jest.unstable_mockModule('@actions/http-client', () => ({
+  HttpClient: jest.fn()
+}));
+jest.unstable_mockModule('@actions/core', () => ({
+  warning: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn()
+}));
+
+const hc = await import('@actions/http-client');
+const core = await import('@actions/core');
+const {DotnetVersionResolver} = await import('../src/installer.js');
 
 describe('DotnetVersionResolver with latest', () => {
-  let getJsonMock: jest.Mock;
-  let warningSpy: jest.SpyInstance;
+  let getJsonMock: jest.Mock<(...args: any[]) => Promise<any>>;
+  let warningSpy: jest.Mock;
 
   beforeEach(() => {
-    getJsonMock = jest.fn();
-    (hc.HttpClient as any).mockImplementation(() => {
+    getJsonMock = jest.fn<(...args: any[]) => Promise<any>>();
+    (hc.HttpClient as jest.Mock).mockImplementation(() => {
       return {
         getJson: getJsonMock
       };
     });
-    warningSpy = jest.spyOn(core, 'warning').mockImplementation(() => {});
+    warningSpy = core.warning as jest.Mock;
+    warningSpy.mockImplementation(() => {});
   });
 
   afterEach(() => {

__tests__/setup-dotnet.test.ts

@@ -1,26 +1,71 @@
-import * as core from '@actions/core';
-import fs from 'fs';
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+  test
+} from '@jest/globals';
 import semver from 'semver';
-import * as auth from '../src/authutil';
 import os from 'os';
-import * as setup from '../src/setup-dotnet';
-import {DotnetCoreInstaller, DotnetInstallDir} from '../src/installer';
-import * as cacheUtils from '../src/cache-utils';
-import * as cacheRestore from '../src/cache-restore';
+
+jest.unstable_mockModule('@actions/core', () => ({
+  getInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  setFailed: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  info: jest.fn(),
+  setOutput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn()
+}));
+jest.unstable_mockModule('fs', () => {
+  const actual = jest.requireActual('fs') as typeof import('fs');
+  const existsSync = jest.fn(actual.existsSync);
+  const readFileSync = jest.fn(actual.readFileSync);
+  return {
+    ...actual,
+    existsSync,
+    readFileSync,
+    default: {...actual, existsSync, readFileSync}
+  };
+});
+jest.unstable_mockModule('../src/authutil', () => ({
+  configAuthentication: jest.fn()
+}));
+jest.unstable_mockModule('../src/cache-utils', () => ({
+  isCacheFeatureAvailable: jest.fn(),
+  getNuGetFolderPath: jest.fn()
+}));
+jest.unstable_mockModule('../src/cache-restore', () => ({
+  restoreCache: jest.fn()
+}));
+
+const core = await import('@actions/core');
+const fs = await import('fs');
+const auth = await import('../src/authutil.js');
+const cacheUtils = await import('../src/cache-utils.js');
+const cacheRestore = await import('../src/cache-restore.js');
+const setup = await import('../src/setup-dotnet.js');
+const {DotnetCoreInstaller, DotnetInstallDir} =
+  await import('../src/installer.js');
 
 describe('setup-dotnet tests', () => {
   const inputs = {} as any;
 
-  const getInputSpy = jest.spyOn(core, 'getInput');
-  const getMultilineInputSpy = jest.spyOn(core, 'getMultilineInput');
-  const getBooleanInputSpy = jest.spyOn(core, 'getBooleanInput');
-  const setFailedSpy = jest.spyOn(core, 'setFailed');
-  const warningSpy = jest.spyOn(core, 'warning');
-  const debugSpy = jest.spyOn(core, 'debug');
-  const infoSpy = jest.spyOn(core, 'info');
-  const setOutputSpy = jest.spyOn(core, 'setOutput');
+  const getInputSpy = core.getInput as jest.Mock;
+  const getMultilineInputSpy = core.getMultilineInput as jest.Mock;
+  const getBooleanInputSpy = core.getBooleanInput as jest.Mock;
+  const setFailedSpy = core.setFailed as jest.Mock;
+  const warningSpy = core.warning as jest.Mock;
+  const debugSpy = core.debug as jest.Mock;
+  const infoSpy = core.info as jest.Mock;
+  const setOutputSpy = core.setOutput as jest.Mock;
 
-  const existsSyncSpy = jest.spyOn(fs, 'existsSync');
+  const existsSyncSpy = fs.existsSync as jest.Mock;
 
   const maxSatisfyingSpy = jest.spyOn(semver, 'maxSatisfying');
 
@@ -29,12 +74,10 @@ describe('setup-dotnet tests', () => {
     'installDotnet'
   );
 
-  const isCacheFeatureAvailableSpy = jest.spyOn(
-    cacheUtils,
-    'isCacheFeatureAvailable'
-  );
-  const restoreCacheSpy = jest.spyOn(cacheRestore, 'restoreCache');
-  const configAuthenticationSpy = jest.spyOn(auth, 'configAuthentication');
+  const isCacheFeatureAvailableSpy =
+    cacheUtils.isCacheFeatureAvailable as jest.Mock;
+  const restoreCacheSpy = cacheRestore.restoreCache as jest.Mock;
+  const configAuthenticationSpy = auth.configAuthentication as jest.Mock;
   const addToPathOriginal = DotnetInstallDir.addToPath;
 
   describe('run() tests', () => {

action.yml

@@ -7,18 +7,25 @@ branding:
 inputs:
   dotnet-version:
     description: 'Optional SDK version(s) to use. If not provided, will install global.json version when available. Examples: 2.2.104, 3.1, 3.1.x, 3.x, 6.0.2xx, latest'
+    required: false
   dotnet-quality:
     description: 'Optional quality of the build. The possible values are: daily, preview, ga.'
+    required: false
   dotnet-channel:
     description: 'Optional channel for the installation. The possible values are: STS, LTS, A.B (e.g. 8.0), A.B.Cxx (e.g. 8.0.1xx, available since 5.0). To be used with "dotnet-version: latest".'
+    required: false
   global-json-file:
     description: 'Optional global.json location, if your global.json isn''t located in the root of the repo.'
+    required: false
   source-url:
     description: 'Optional package source for which to set up authentication. Will consult any existing NuGet.config in the root of the repo and provide a temporary NuGet.config using the NUGET_AUTH_TOKEN environment variable as a ClearTextPassword'
+    required: false
   owner:
     description: 'Optional OWNER for using packages from GitHub Package Registry organizations/users other than the current repository''s owner. Only used if a GPR URL is also provided in source-url'
+    required: false
   config-file:
     description: 'Optional NuGet.config location, if your NuGet.config isn''t located in the root of the repo.'
+    required: false
   cache:
     description: 'Optional input to enable caching of the NuGet global-packages folder'
     required: false

dist/cache-save/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

dist/setup/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

eslint.config.mjs

@@ -0,0 +1,74 @@
+// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
+import js from '@eslint/js';
+import tsParser from '@typescript-eslint/parser';
+import tsPlugin from '@typescript-eslint/eslint-plugin';
+import jest from 'eslint-plugin-jest';
+import n from 'eslint-plugin-n';
+import prettier from 'eslint-config-prettier';
+import globals from 'globals';
+
+export default [
+  {
+    ignores: ['**/*', '!src/**', '!__tests__/**']
+  },
+  js.configs.recommended,
+  {
+    files: ['**/*.ts'],
+    languageOptions: {
+      parser: tsParser,
+      ecmaVersion: 2022,
+      sourceType: 'module',
+      globals: {
+        ...globals.node,
+        ...globals.es2015
+      }
+    },
+    plugins: {
+      '@typescript-eslint': tsPlugin,
+      n
+    },
+    rules: {
+      ...tsPlugin.configs.recommended.rules,
+      '@typescript-eslint/no-require-imports': 'error',
+      '@typescript-eslint/no-non-null-assertion': 'off',
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-empty-function': 'off',
+      '@typescript-eslint/ban-ts-comment': [
+        'error',
+        {
+          'ts-ignore': 'allow-with-description'
+        }
+      ],
+      'no-console': 'error',
+      yoda: 'error',
+      'prefer-const': [
+        'error',
+        {
+          destructuring: 'all'
+        }
+      ],
+      'no-control-regex': 'off',
+      'no-constant-condition': ['error', {checkLoops: false}],
+      'no-undef': 'off',
+      'no-useless-assignment': 'off',
+      'n/no-extraneous-import': 'error'
+    }
+  },
+  {
+    files: ['**/*{test,spec}.ts'],
+    plugins: {jest},
+    languageOptions: {
+      globals: {
+        ...globals.jest
+      }
+    },
+    rules: {
+      ...jest.configs['flat/recommended'].rules,
+      '@typescript-eslint/no-unused-vars': 'off',
+      'jest/no-standalone-expect': 'off',
+      'jest/no-conditional-expect': 'off',
+      'no-console': 'off'
+    }
+  },
+  prettier
+];

jest.config.js

@@ -1,11 +0,0 @@
-module.exports = {
-  clearMocks: true,
-  moduleFileExtensions: ['js', 'ts'],
-  testEnvironment: 'node',
-  testMatch: ['**/*.test.ts'],
-  testRunner: 'jest-circus/runner',
-  transform: {
-    '^.+\\.ts$': 'ts-jest'
-  },
-  verbose: true
-}

jest.config.ts

@@ -0,0 +1,28 @@
+import type {JestConfigWithTsJest} from 'ts-jest';
+
+const jestConfig: JestConfigWithTsJest = {
+  clearMocks: true,
+  testEnvironment: 'node',
+  moduleFileExtensions: ['js', 'ts'],
+  testMatch: ['**/*.test.ts'],
+  testRunner: 'jest-circus/runner',
+  extensionsToTreatAsEsm: ['.ts'],
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1'
+  },
+  transform: {
+    '^.+\\.ts$': [
+      'ts-jest',
+      {
+        useESM: true,
+        diagnostics: {
+          ignoreCodes: [151002]
+        }
+      }
+    ]
+  },
+  transformIgnorePatterns: ['node_modules/(?!(@actions)/)'],
+  verbose: true
+};
+
+export default jestConfig;

package.json

@@ -1,6 +1,7 @@
 {
   "name": "setup-dotnet",
-  "version": "5.3.0",
+  "version": "6.0.0",
+  "type": "module",
   "private": true,
   "description": "setup dotnet action",
   "main": "dist/setup/index.js",
@@ -9,12 +10,12 @@
   },
   "scripts": {
     "build": "ncc build -o dist/setup src/setup-dotnet.ts && ncc build -o dist/cache-save src/cache-save.ts",
-    "format": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write \"**/*.{ts,yml,yaml}\"",
-    "format-check": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --check \"**/*.{ts,yml,yaml}\"",
-    "lint": "eslint --config ./.eslintrc.js \"**/*.ts\"",
-    "lint:fix": "eslint --config ./.eslintrc.js \"**/*.ts\" --fix",
+    "format": "prettier --no-error-on-unmatched-pattern --write \"**/*.{ts,yml,yaml}\"",
+    "format-check": "prettier --no-error-on-unmatched-pattern --check \"**/*.{ts,yml,yaml}\"",
+    "lint": "eslint \"**/*.ts\"",
+    "lint:fix": "eslint \"**/*.ts\" --fix",
     "prepare": "husky install",
-    "test": "jest --coverage --config ./jest.config.js",
+    "test": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js --coverage",
     "update-installers": "nwget https://dot.net/v1/dotnet-install.ps1 -O externals/install-dotnet.ps1 && nwget https://dot.net/v1/dotnet-install.sh -O externals/install-dotnet.sh"
   },
   "repository": {
@@ -29,38 +30,37 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^5.0.5",
-    "@actions/core": "^2.0.3",
-    "@actions/exec": "^2.0.0",
-    "@actions/github": "^6.0.0",
-    "@actions/glob": "^0.5.1",
-    "@actions/http-client": "^3.0.2",
-    "@actions/io": "^2.0.0",
-    "fast-xml-parser": "^5.5.11",
+    "@actions/cache": "^6.2.0",
+    "@actions/core": "^3.0.1",
+    "@actions/exec": "^3.0.0",
+    "@actions/github": "^9.1.1",
+    "@actions/glob": "^0.7.0",
+    "@actions/http-client": "^4.0.1",
+    "@actions/io": "^3.0.2",
+    "fast-xml-parser": "^5.9.3",
     "json5": "^2.2.3",
-    "semver": "^7.6.0"
+    "semver": "^7.8.5"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.12",
-    "@types/node": "^24.1.0",
-    "@types/semver": "^7.5.8",
-    "@typescript-eslint/eslint-plugin": "^8.0.0",
-    "@typescript-eslint/parser": "^8.0.0",
-    "@vercel/ncc": "^0.38.1",
-    "eslint": "^8.57.0",
-    "eslint-config-prettier": "^10.1.5",
-    "eslint-plugin-jest": "^29.0.1",
-    "eslint-plugin-node": "^11.1.0",
+    "@eslint/js": "^10.0.1",
+    "@jest/globals": "^30.4.1",
+    "@types/node": "^24.13.2",
+    "@types/semver": "^7.7.0",
+    "@typescript-eslint/eslint-plugin": "^8.62.0",
+    "@typescript-eslint/parser": "^8.62.0",
+    "@vercel/ncc": "^0.44.0",
+    "eslint": "^10.5.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-jest": "^29.15.2",
+    "eslint-plugin-n": "^18.1.0",
+    "globals": "^17.7.0",
     "husky": "^9.1.7",
-    "jest": "^29.7.0",
-    "jest-circus": "^29.7.0",
-    "jest-each": "^29.7.0",
-    "prettier": "^3.2.5",
-    "ts-jest": "^29.1.2",
-    "typescript": "^5.9.2",
+    "jest": "^30.4.2",
+    "jest-circus": "^30.4.2",
+    "jest-each": "^30.0.0",
+    "prettier": "^3.8.4",
+    "ts-jest": "^29.4.11",
+    "typescript": "^6.0.3",
     "wget-improved": "^3.2.1"
-  },
-  "jest": {
-    "testEnvironment": "node"
   }
 }

src/cache-restore.ts

@@ -4,8 +4,8 @@ import * as cache from '@actions/cache';
 import * as core from '@actions/core';
 import * as glob from '@actions/glob';
 
-import {getNuGetFolderPath} from './cache-utils';
-import {lockFilePatterns, State, Outputs} from './constants';
+import {getNuGetFolderPath} from './cache-utils.js';
+import {lockFilePatterns, State, Outputs} from './constants.js';
 
 export const restoreCache = async (cacheDependencyPath?: string) => {
   const lockFilePath = cacheDependencyPath || (await findLockFile());

src/cache-save.ts

@@ -1,8 +1,8 @@
 import * as core from '@actions/core';
 import * as cache from '@actions/cache';
 import fs from 'node:fs';
-import {getNuGetFolderPath} from './cache-utils';
-import {State} from './constants';
+import {getNuGetFolderPath} from './cache-utils.js';
+import {State} from './constants.js';
 
 // Catch and log any unhandled exceptions.  These exceptions can leak out of the uploadChunk method in
 // @actions/toolkit when a failed upload closes the file descriptor causing any in-process reads to
@@ -47,7 +47,11 @@ const cachePackages = async () => {
   }
 
   const cacheId = await cache.saveCache([cachePath], primaryKey);
-  if (cacheId == -1) {
+  if (cacheId === -1) {
+    // saveCache returns -1 without throwing when the cache was not saved, e.g.
+    // a reserve collision or a read-only token (fork PR). @actions/cache has
+    // already logged the reason at the appropriate severity, so just trace it.
+    core.debug(`Cache was not saved for the key: ${primaryKey}`);
     return;
   }
 

src/cache-utils.ts

@@ -2,7 +2,7 @@ import * as cache from '@actions/cache';
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
 
-import {cliCommand} from './constants';
+import {cliCommand} from './constants.js';
 
 type NuGetFolderName =
   | 'http-cache'

src/installer.ts

@@ -5,10 +5,11 @@ import * as io from '@actions/io';
 import * as hc from '@actions/http-client';
 import {chmodSync} from 'fs';
 import path from 'path';
+import {fileURLToPath} from 'url';
 import os from 'os';
 import semver from 'semver';
-import {IS_WINDOWS, PLATFORM} from './utils';
-import {QualityOptions} from './setup-dotnet';
+import {IS_WINDOWS, PLATFORM} from './utils.js';
+import type {QualityOptions} from './setup-dotnet.js';
 
 export interface DotnetVersion {
   type: string;
@@ -233,7 +234,13 @@ export class DotnetInstallScript {
 
   constructor() {
     this.escapedScript = path
-      .join(__dirname, '..', '..', 'externals', this.scriptName)
+      .join(
+        path.dirname(fileURLToPath(import.meta.url)),
+        '..',
+        '..',
+        'externals',
+        this.scriptName
+      )
       .replace(/'/g, "''");
 
     if (IS_WINDOWS) {

src/setup-dotnet.ts

@@ -4,15 +4,16 @@ import {
   DotnetCoreInstaller,
   DotnetInstallDir,
   normalizeArch
-} from './installer';
+} from './installer.js';
 import * as fs from 'fs';
 import path from 'path';
+import {fileURLToPath} from 'url';
 import semver from 'semver';
 import os from 'os';
-import * as auth from './authutil';
-import {isCacheFeatureAvailable} from './cache-utils';
-import {restoreCache} from './cache-restore';
-import {Outputs} from './constants';
+import * as auth from './authutil.js';
+import {isCacheFeatureAvailable} from './cache-utils.js';
+import {restoreCache} from './cache-restore.js';
+import {Outputs} from './constants.js';
 import JSON5 from 'json5';
 
 const qualityOptions = ['daily', 'preview', 'ga'] as const;
@@ -152,7 +153,8 @@ export async function run() {
             await exec.exec('dotnet', ['workload', 'install', ...workloads]);
           } catch (err) {
             throw new Error(
-              `Failed to install workloads [${workloads.join(', ')}]: ${err}`
+              `Failed to install workloads [${workloads.join(', ')}]: ${err}`,
+              {cause: err}
             );
           }
         }
@@ -172,7 +174,12 @@ export async function run() {
       await restoreCache(cacheDependencyPath);
     }
 
-    const matchersPath = path.join(__dirname, '..', '..', '.github');
+    const matchersPath = path.join(
+      path.dirname(fileURLToPath(import.meta.url)),
+      '..',
+      '..',
+      '.github'
+    );
     core.info(`##[add-matcher]${path.join(matchersPath, 'csc.json')}`);
   } catch (error) {
     core.setFailed(error.message);
@@ -207,7 +214,16 @@ function getVersionFromGlobalJson(globalJsonPath: string): string {
   if (globalJson.sdk && globalJson.sdk.version) {
     version = globalJson.sdk.version;
     const rollForward = globalJson.sdk.rollForward;
-    if (rollForward) {
+    if (rollForward && !semver.prerelease(version)) {
+      const versionPattern = /^\d+\.\d+\.[1-9]\d{2,}$/;
+      if (!versionPattern.test(version)) {
+        throw new Error(
+          `Version '${version}' is not valid for the 'sdk.version' value in global.json. ` +
+            `When 'rollForward' is specified, a full SDK version is required. ` +
+            `See: https://learn.microsoft.com/en-us/dotnet/core/tools/global-json`
+        );
+      }
+
       const [major, minor, featurePatch] = version.split('.');
       const feature = featurePatch.substring(0, 1);
 

tsconfig.json

@@ -3,7 +3,7 @@
     /* Basic Options */
     // "incremental": true,                   /* Enable incremental compilation */
     "target": "ES2022",                          /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
-    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
+    "module": "NodeNext",                     /* Specify module code generation. */
     "lib": [
       "ES2022"
     ],
@@ -64,5 +64,5 @@
     // "experimentalDecorators": true,        /* Enables experimental support for ES7 decorators. */
     // "emitDecoratorMetadata": true,         /* Enables experimental support for emitting type metadata for decorators. */
   },
-  "exclude": ["node_modules", "**/*.test.ts"]
+  "exclude": ["node_modules", "**/*.test.ts", "jest.config.ts"]
 }