Jason Ginchereau
6e8379ea7a
Implement PAX header validation and path safety checks in tar extraction
...
- Added a new test suite for parser-differential bypass detection in tar archives.
- Introduced length-correct PAX extended-header re-parsing to catch discrepancies between node-tar and system tar.
- Enhanced the listAndValidate function to return approved names alongside violations for better extraction control.
- Implemented checks for unsafe characters and glob metacharacters in entry paths.
- Updated the tar extraction logic to utilize an allow-list for approved entries when path validation is in error mode.
- Added utility functions for writing temporary allow-list files for system tar extraction.
2026-06-19 09:17:41 -10:00
Jason Ginchereau
b2734aba36
Remove suppressions that don't work
2026-06-17 14:39:18 -10:00
Jason Ginchereau
6cdcf724e2
Update dependencies to resolve audit issues
2026-06-17 14:39:18 -10:00
Jason Ginchereau
cc4da7ddff
Fix lint issues
2026-06-17 14:39:18 -10:00
Jason Ginchereau
59a9650ce0
Address copilot review feedback
2026-06-17 14:39:18 -10:00
Jason Ginchereau
d14cd0e722
Suppress polynomial-redos warning
2026-06-17 14:39:18 -10:00
62e4d31b22
Update test plan doc regarding warn behavior
...
Co-authored-by: Copilot Autofix powered by AI <[email protected]
2026-06-17 14:39:18 -10:00
Jason Ginchereau
998c5ad7fd
feat: optional path validation during cache restore
2026-06-17 14:39:14 -10:00
Jason Ginchereau and GitHub
0786132e6a
Bump cache package to v6.1.0, update RELEASES.md ( #2436 )
2026-06-17 11:25:12 -10:00
Jason Ginchereau
5fb375f061
Audit fix packages/cache
2026-06-11 17:24:11 -07:00
Jason Ginchereau
26e77e9341
Adit fix, address copilot comments
2026-06-11 17:17:55 -07:00
Jason Ginchereau
78e3d71e19
Handle cache write error due to read-only token
2026-06-11 17:02:12 -07:00
Joshua Brooks
ad7d6fb853
Bump toolkit version, add release notes
2026-05-01 17:38:16 +00:00
Joshua Brooks
2f08a036a6
Audit npm packages
2026-05-01 16:33:28 +00:00
Joshua Brooks
17e04b5199
Update minor versions of cache and artifact dependencies
2026-05-01 16:27:55 +00:00
Zachary Taylor and GitHub
bd4fb086f1
Update UsageError in cache
2026-02-26 14:31:12 -05:00
Daniel Kennedy and GitHub
ae29a2751b
@actions/cache: convert to an ESM module (#2275 )
...
* `@actions/cache`: convert to an ESM module
* Update the fixture to ESM syntax
* Update the cache workflows
* Bump `@actions/glob` to `0.6.1`
* Fix awaiting in the cache unit tests
* Fix a type issues in contracts
* Export the `DownloadOptions`/`UploadOptions` like before
* More cache test fixes
* Make the cache units tests better
* Add some more logging
* Add retries to restore-cache.mjs
2026-01-29 14:23:32 -05:00
Daniel Kennedy
e827417593
Bump @actions/glob to 0.5.1 in @actions/cache
2026-01-27 15:43:44 -05:00
Daniel Kennedy
76339b5f68
Bump @actions/http-client and @actions/github on all packages
2026-01-27 13:31:31 -05:00
Ryan Ghadimi and GitHub
a039cff4a1
Add comment for rate limiting handling
...
Added a comment regarding rate limiting and retry behavior.
2026-01-16 10:26:45 +00:00
9dd77993e7
Update packages/cache/RELEASES.md
...
Co-authored-by: Bassem Dghaidi <[email protected]
2026-01-16 10:25:44 +00:00
Ryan Ghadimi
dd1bb93c72
New error type for cache RL
2026-01-16 10:00:15 +00:00
Ryan Ghadimi
7292b3508f
update release doc
2026-01-16 09:51:21 +00:00
Ryan Ghadimi
4a47af6481
bump pkg
2026-01-16 09:46:28 +00:00
Ryan Ghadimi
a68693e20a
tests & releases
2026-01-16 09:44:57 +00:00
Ryan Ghadimi
acf4bd70fb
Add handling for 429s from cache service
2026-01-14 17:01:59 +00:00
copilot-swe-agent[bot] and TingluoHuang
dfc20acda2
Verify changes with tests - all package-specific tests passing
...
Co-authored-by: TingluoHuang <[email protected]
2026-01-07 22:03:56 +00:00
copilot-swe-agent[bot] and TingluoHuang
dc1fec82a6
Update all packages to use @actions/http-client@^3.0.1 and bump patch versions
...
Co-authored-by: TingluoHuang <[email protected]
2026-01-07 21:55:41 +00:00
Salman Muin Kayser Chishti
c655f38a0f
docs(cache): add PR reference to v5.0.1 release notes
2025-12-12 14:53:26 +00:00
Salman Muin Kayser Chishti
cf8caa4e0d
Merge remote-tracking branch 'origin/main' into cache-v5.0.1-release
2025-12-12 14:50:27 +00:00
Salman Muin Kayser Chishti
74ac6db523
fix(cache): update @azure/storage-blob to ^12.29.1 to address punycode deprecation
2025-12-12 14:05:14 +00:00
Salman Muin Kayser Chishti
6fc2f678c8
docs(cache): bump to v5.0.1 and add release notes
2025-12-12 13:42:58 +00:00
Salman Muin Kayser Chishti
5ef62e14dd
fix(cache): update @azure/storage-blob to ^12.29.1 to fix punycode deprecation
...
- Updated @azure/storage-blob from ^12.13.0 to ^12.29.1
- Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http
- Fixes Node.js 24 deprecation warning for punycode module
2025-12-12 13:41:31 +00:00
Salman Muin Kayser Chishti
cc6abe3c3a
chore(releases): update release notes for v5.0.0 to remove punycode deprecation warning
2025-12-11 14:43:23 +00:00
Salman Muin Kayser Chishti
c6502bc679
PR number update in releases
2025-12-11 14:33:30 +00:00
Salman Muin Kayser Chishti
bdd6eb4293
update releases
2025-12-11 14:32:58 +00:00
Salman Muin Kayser Chishti
7c1b12a15e
chore(cache): update @actions/core to 2.0.1
2025-12-11 13:57:58 +00:00
Salman Muin Kayser Chishti
eb7ff8401e
chore(cache): regenerate package-lock.json with Node 24
2025-12-10 11:09:56 +00:00
Salman Muin Kayser Chishti
45ec4a2087
chore: update dependencies and remove deprecated package
...
- Removed `@azure/ms-rest-js` dependency to fix Node.js 24+ punycode deprecation warning.
- The `TransferProgressEvent` type is now imported from `@azure/core-rest-pipeline`.
- Updated `package.json` to reflect the new dependency.
- Updated tests to import `TransferProgressEvent` from the new package.
- Updated `package-lock.json` to remove `@azure/ms-rest-js` and include `@azure/core-rest-pipeline`.
- Bumped versions of several dependencies including `@azure/storage-blob` and `@azure/storage-common`.
2025-12-10 11:04:34 +00:00
Salman Muin Kayser Chishti
b0464628c0
Prepare cache v5 release
2025-12-09 16:11:32 +00:00
Salman Muin Kayser Chishti
66e8437b3e
Revert "Io util package usage update"
...
This reverts commit 783332a4b57e9455ec3a361c4e16f659a35f3a97.
2025-10-15 16:28:21 +01:00
Salman Muin Kayser Chishti
9c7501a5f3
Io util package usage update
2025-10-15 16:28:21 +01:00
Salman Muin Kayser Chishti
88a490d2ce
override for node-fetch
2025-10-15 16:28:21 +01:00
Bassem Dghaidi and Salman Muin Kayser Chishti
59c7ebde79
Prepapre cache v4.1.0 release
2025-10-15 16:24:47 +01:00
Ryan Ghadimi and Salman Muin Kayser Chishti
0c907a43d3
no need to resolve
2025-10-15 16:23:02 +01:00
Ryan Ghadimi and Salman Muin Kayser Chishti
d1c1fc4108
lint
2025-10-15 16:23:02 +01:00
Ryan Ghadimi and Salman Muin Kayser Chishti
36f30e6d37
new error state, tests to cover
2025-10-15 16:23:02 +01:00
Ryan Ghadimi and Salman Muin Kayser Chishti
308e05bc50
remove cache size limit
2025-10-15 16:23:02 +01:00
Salman Muin Kayser Chishti
33a9b6c09c
update with dist updates
2025-10-15 16:22:51 +01:00
Salman Muin Kayser Chishti
48e42b1fdd
linting
2025-09-04 15:24:57 +01:00
