Bump actions/cache from 5 to 6 - #189
Conversation
Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v5...v6) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![ev-vaultkeeper[bot]](https://avatars.githubusercontent.com/u/47702631?s=60&v=4){kind=small}
There was a problem hiding this comment.
Safe to merge. ✅
This bumps actions/cache v5 → v6 in .github/workflows/build-and-deploy-node-bindings.yml (the only usage of actions/cache in the repo).
Interface compatibility: The action.yml manifests for v5 and v6 are identical — same inputs (path, key, restore-keys, upload-chunk-size, enableCrossOsArchive, fail-on-cache-miss, lookup-only, save-always), same cache-hit output, and the same using: node24 runtime (no runner runtime change). Our step only uses path and key, both unchanged, so this is fully backwards-compatible.
Changelog (v5 → v6): v6.0.0 bumps internal deps (@actions/cache ^6.0.1, @actions/core ^3.0.1, etc.), migrates the action's internals to ESM, and upgrades Jest to v30 — all internal to the action's build, no consumer-facing behaviour change. v5.0.4/v6 also carry security fixes (minimatch ReDoS, undici decompression-bomb protection, fast-xml-parser), so this is a net security improvement.
Build/verification: No build applies to a GitHub Actions tag bump; the workflow YAML parses correctly and no source changes were needed. Socket Security and Project Report checks passed.
Note (not blocking): The failing linux check on this PR is unrelated — it comes from build-and-deploy-python-bindings.yml (failed at PyO3/maturin-action@v1), which does not use actions/cache. Also worth noting the workflow this change touches currently has all on: triggers commented out, so it doesn't run in CI as-is.
Bumps actions/cache from 5 to 6.
Release notes
Sourced from actions/cache's releases.
... (truncated)
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
55cc834Merge pull request #1768 from jasongin/readonly-cached8cd72fBump@actions/cacheto v6.1.0 - handle cache write error due to RO token2c8a9bdMerge pull request #1760 from actions/samirat/esm_migration_and_package_updatee9b91fdPrettier fixese4884b8Rebuild dist10baf01Fixed licensese39b386Fix test mock return orderb692820PR feedback6074912Rebuild dist bundles as ESM to match type:module5a912e8Fix lint and jest issuesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)