- Added a new test suite for parser-differential bypass detection in tar archives.
- Introduced length-correct PAX extended-header re-parsing to catch discrepancies between node-tar and system tar.
- Enhanced the listAndValidate function to return approved names alongside violations for better extraction control.
- Implemented checks for unsafe characters and glob metacharacters in entry paths.
- Updated the tar extraction logic to utilize an allow-list for approved entries when path validation is in error mode.
- Added utility functions for writing temporary allow-list files for system tar extraction.
* `@actions/cache`: convert to an ESM module
* Update the fixture to ESM syntax
* Update the cache workflows
* Bump `@actions/glob` to `0.6.1`
* Fix awaiting in the cache unit tests
* Fix a type issues in contracts
* Export the `DownloadOptions`/`UploadOptions` like before
* More cache test fixes
* Make the cache units tests better
* Add some more logging
* Add retries to restore-cache.mjs
Remove abandoned @azure/ms-rest-js dependency which pulls in node-fetch@v2, causing punycode deprecation warnings on Node.js 24+.
The TransferProgressEvent type is now imported from @azure/core-rest-pipeline instead.
- Update restoreCacheV2.test.ts, restoreCache.test.ts, saveCacheV2.test.ts, and saveCache.test.ts
- Change test expectations from core.warning to core.error for cache operation failures
- All tests now pass successfully
Co-authored-by: Link- <[email protected]>
- Update isFeatureAvailable() to leverage ACTIONS_CACHE_SERVICE_V2 feature flag
- For v2: check ACTIONS_RESULTS_URL availability
- For v1: check either ACTIONS_CACHE_URL or ACTIONS_RESULTS_URL availability
- Change warning logs to error logs for cache failures
- Add comprehensive tests covering all scenarios
Co-authored-by: Link- <[email protected]>
Jason Ginchereau