Only use mirrorToken in getManifest if it's provided (#1548 )

* Only use `mirrorToken` in `getManifest` if it's provided Signed-off-by: Timo Sand <timo.sand@f-secure.com> * `npm run build` Signed-off-by: Timo Sand <timo.sand@f-secure.com> --------- Signed-off-by: Timo Sand <timo.sand@f-secure.com>
Remove dummy NODE_AUTH_TOKEN export (#1558 )
2026-06-14 14:13:52 +08:00 · 2026-06-09 11:03:18 -05:00 · 2026-05-27 21:56:31 -05:00 · 2026-05-26 17:51:36 -05:00 · 2026-04-22 21:58:57 -05:00 · 2026-04-19 21:54:55 -05:00
28 changed files with 56017 additions and 85400 deletions
--- a/.github/workflows/versions.yml
+++ b/.github/workflows/versions.yml
@@ -219,7 +219,7 @@ jobs:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [17, 19]
+        node-version: [21, 23]
    steps:
      - uses: actions/checkout@v6
      - name: Setup Node from dist
--- a/.licenses/npm/@actions/cache.dep.yml
+++ b/.licenses/npm/@actions/cache.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: "@actions/cache"
-version: 5.0.1
+version: 5.0.5
 type: npm
 summary: Actions cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/cache
--- a/.licenses/npm/@actions/core-1.11.1.dep.yml
+++ b/.licenses/npm/@actions/core-1.11.1.dep.yml
@@ -1,20 +0,0 @@
---
-name: "@actions/core"
-version: 1.11.1
-type: npm
-summary: Actions core lib
-homepage: https://github.com/actions/toolkit/tree/main/packages/core
-license: mit
-licenses:
- sources: LICENSE.md
-  text: |-
-    The MIT License (MIT)
-
-    Copyright 2019 GitHub
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []
--- a/.licenses/npm/@actions/core-2.0.1.dep.yml
+++ b/.licenses/npm/@actions/core-2.0.1.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: "@actions/core"
-version: 2.0.1
+version: 2.0.3
 type: npm
 summary: Actions core lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/core
--- a/.licenses/npm/@actions/exec-1.1.1.dep.yml
+++ b/.licenses/npm/@actions/exec-1.1.1.dep.yml
@@ -1,20 +0,0 @@
---
-name: "@actions/exec"
-version: 1.1.1
-type: npm
-summary: Actions exec lib
-homepage: https://github.com/actions/toolkit/tree/main/packages/exec
-license: mit
-licenses:
- sources: LICENSE.md
-  text: |-
-    The MIT License (MIT)
-
-    Copyright 2019 GitHub
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []
--- a/.licenses/npm/@actions/exec-2.0.0.dep.yml
+++ b/.licenses/npm/@actions/exec-2.0.0.dep.yml
--- a/.licenses/npm/@actions/glob.dep.yml
+++ b/.licenses/npm/@actions/glob.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: "@actions/glob"
-version: 0.5.0
+version: 0.5.1
 type: npm
 summary: Actions glob lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/glob
--- a/.licenses/npm/@actions/io-1.1.3.dep.yml
+++ b/.licenses/npm/@actions/io-1.1.3.dep.yml
@@ -1,20 +0,0 @@
---
-name: "@actions/io"
-version: 1.1.3
-type: npm
-summary: Actions io lib
-homepage: https://github.com/actions/toolkit/tree/main/packages/io
-license: mit
-licenses:
- sources: LICENSE.md
-  text: |-
-    The MIT License (MIT)
-
-    Copyright 2019 GitHub
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []
--- a/.licenses/npm/@actions/io-2.0.0.dep.yml
+++ b/.licenses/npm/@actions/io-2.0.0.dep.yml
--- a/.licenses/npm/@actions/tool-cache.dep.yml
+++ b/.licenses/npm/@actions/tool-cache.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: "@actions/tool-cache"
-version: 2.0.2
+version: 3.0.1
 type: npm
 summary: Actions tool-cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/tool-cache
--- a/.licenses/npm/brace-expansion.dep.yml
+++ b/.licenses/npm/brace-expansion.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 1.1.12
+version: 1.1.13
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion
--- a/.licenses/npm/fast-xml-builder.dep.yml
+++ b/.licenses/npm/fast-xml-builder.dep.yml
@@ -0,0 +1,32 @@
+---
+name: fast-xml-builder
+version: 1.1.4
+type: npm
+summary: Build XML from JSON without C/C++ based libraries
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2026 Natural Intelligence
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/fast-xml-parser.dep.yml
+++ b/.licenses/npm/fast-xml-parser.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.3.4
+version: 5.5.11
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:
--- a/.licenses/npm/minimatch.dep.yml
+++ b/.licenses/npm/minimatch.dep.yml
@@ -1,9 +1,9 @@
 ---
 name: minimatch
-version: 3.1.2
+version: 3.1.5
 type: npm
 summary: a glob matcher in javascript
-homepage: https://github.com/isaacs/minimatch#readme
+homepage:
 license: isc
 licenses:
 - sources: LICENSE
--- a/.licenses/npm/path-expression-matcher.dep.yml
+++ b/.licenses/npm/path-expression-matcher.dep.yml
@@ -0,0 +1,32 @@
+---
+name: path-expression-matcher
+version: 1.4.0
+type: npm
+summary: Efficient path tracking and pattern matching for XML/JSON parsers
+homepage: https://github.com/NaturalIntelligence/path-expression-matcher#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2024
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/strnum.dep.yml
+++ b/.licenses/npm/strnum.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: strnum
-version: 2.1.2
+version: 2.2.3
 type: npm
 summary: Parse String to Number based on configuration
 homepage:
--- a/.licenses/npm/undici-6.24.1.dep.yml
+++ b/.licenses/npm/undici-6.24.1.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 6.23.0
+version: 6.24.1
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org
--- a/.licenses/npm/uuid.dep.yml
+++ b/.licenses/npm/uuid.dep.yml
@@ -1,20 +0,0 @@
---
-name: uuid
-version: 11.1.0
-type: npm
-summary: RFC9562 UUIDs
-homepage:
-license: mit
-licenses:
- sources: LICENSE.md
-  text: |
-    The MIT License (MIT)
-
-    Copyright (c) 2010-2020 Robert Kieffer and other contributors
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []
--- a/README.md
+++ b/README.md
@@ -249,6 +249,7 @@ If the runner is not able to access github.com, any Nodejs versions requested du
 - [Publishing to npmjs and GPR with npm](docs/advanced-usage.md#publish-to-npmjs-and-gpr-with-npm)
 - [Publishing to npmjs and GPR with yarn](docs/advanced-usage.md#publish-to-npmjs-and-gpr-with-yarn)
 - [Using private packages](docs/advanced-usage.md#use-private-packages)
+ - [Publishing to npm with Trusted Publisher (OIDC)](docs/advanced-usage.md#publishing-to-npm-with-trusted-publisher-oidc)
 - [Using private mirror](docs/advanced-usage.md#use-private-mirror)

 ## Recommended permissions
--- a/452
+++ b/452
@@ -1,452 +0,0 @@
-Main logo
-Search for transactions, addresses, blocks and embedded text data...
-
-
-API
-API documentation
-API documentation
-Introduction
-General stats endpoints
-Retrieve overall information about blockchains and tokens
-Stats on multiple blockchains at once
-Bitcoin-like blockchain stats
-Ethereum-like blockchain stats
-Ripple-like blockchain stats
-Stellar-like blockchain stats
-Monero-like blockchain stats
-Cardano-like blockchain stats
-Mixin-like DAG stats
-Tezos-like blockchain stats
-EOS-like blockchain stats
-Cross-chain token stats
-Omni Layer stats
-ERC-20 stats
-Dashboard endpoints
-Retrieve information about various entities in a neat format from our databases
-Raw data endpoints
-Retrieve raw information about various entities directly from our full nodes
-Infinitable endpoints
-SQL-like queries: filter, sort, and aggregate blockchain data
-Misc endpoints
-Privacy-o-meter
-News aggregator
-Support
-Show all
-Blockchair API
-Blockchair API
-Blockchair API provides developers, researchers, and businesses with access to data contained in 19 blockchains
-Explore pricing plans
-Stats on multiple blockchains at once
-Allows to retrieve the most important stats on all blockchains we support via just one API request.
-
-Endpoint:
-
-https://api.blockchair.com/stats
-If you require data on just one blockchain, please use https://api.blockchair.com/{:chain}/stats instead.
-
-Output:
-
-data contains an array with stats on 15 blockchains we support at once:
-
-Bitcoin
-Bitcoin Cash
-Ethereum
-Litecoin
-Bitcoin SV
-Dogecoin
-Dash
-Ripple
-Groestlcoin
-Stellar
-Monero
-Cardano
-Zcash
-Mixin
-Tezos
-eCash
-and on 3 cross-chain tokens:
-
-Tether (USDT)
-USD Coin (USDC)
-Binance USD (BUSD)
-Note that Bitcoin Testnet stats are not included in this output.
-
-Description of the fields is available in the next three sections of documentation.
-
-Example output:
-
-https://api.blockchair.com/stats:
-
-{
-  "data": {
-    "bitcoin": {
-      "data": {
-        "blocks": 599952,
-        ...
-      }
-    },
-    "bitcoin-cash": {
-      "data": {
-        "blocks": 605134,
-        ...
-      }
-    },
-    "bitcoin-sv": {
-      "data": {
-        "blocks": 604886,
-        ...
-      }
-    },
-    "ethereum": {
-      "data": {
-        "blocks": 8766052,
-        ...
-      }
-    },
-    "litecoin": {
-      "data": {
-        "blocks": 1721519,
-        ...
-      }
-    },
-    "dogecoin": {
-      "data": {
-        "blocks": 2941267,
-        ...
-      }
-    },
-    "dash": {
-      "data": {
-        "blocks": 1156197,
-        ...
-      }
-    },
-    "ripple": {
-      "data": {
-        "ledgers": 50795982,
-        ...
-      }
-    },
-    "groestlcoin": {
-      "data": {
-        "blocks": 2801282,
-        ...
-      }
-    },
-    "stellar": {
-      "data": {
-        "ledgers": 26968006,
-        ...
-      }
-    },
-    "monero": {
-      "data": {
-        "blocks": 2014108,
-        ...
-      }
-    },
-    "cardano": {
-      "data": {
-        "blocks": 3673733,
-        ...
-      }
-    },
-    "zcash": {
-      "data": {
-        "blocks": 756512,
-        ...
-      }
-    },
-    "mixin": {
-      "data": {
-        "snapshots": 18632532,
-        ...
-      }
-    },
-    "tezos": {
-      "data": {
-        "blocks": 974144,
-        ...
-      }
-    },
-    "cross-chain": {
-      "tether": {
-        "data": ...
-      },
-      "usd-coin": {
-        "data": ...
-      },
-      "binance-usd": {
-        "data": ...
-      }
-    }
-  },
-  "context": {
-    "code": 200,
-    ...
-    }
-  }
-}
-Endpoint:
-
-https://api.blockchair.com/stellar/stats
-Output:
-
-data contains an array with blockchain statistics:
-
-ledgers — total number of ledgers
-circulation — number of coins in circulation (in stroops)
-best_ledger_height — the latest ledger number
-best_ledger_hash — the latest ledger hash
-best_ledger_time — the latest ledger time
-ledgers_24h — number of ledgers closed over the last 24 hours
-transactions_24h — number of transactions confirmed over the last 24 hours
-successful_transactions_24h— number of successful transactions over the last 24 hours
-failed_transactions_24h— number of failed transactions over the last 24 hours
-operations_24h — number of operations over the last 24 hours
-average_transaction_fee_24h — average transaction fee over the last 24 hours
-average_transaction_fee_usd_24h — the same in USD
-market_price_usd — average market price of 1 coin in USD (market data source: CoinGecko)
-market_price_btc — average market price of 1 coin in BTC
-market_price_usd_change_24h_percentage — market price change in percent for 24 hours
-market_cap_usd — market capitalization (coins in circulation * price per coin in USD)
-market_dominance_percentage — dominance index (how much % of the total cryptocurrency market is the market capitalization of the coin)
-countdowns (optional) — an optional array of events ([event, time_left] format), where time_left is the number of seconds till the event
-Example output:
-
-https://api.blockchair.com/stellar/stats:
-
-{
-  "data": {
-    "ledgers": 26602978,
-    "best_ledger_height": 26602978,
-    "best_ledger_hash": "3151f16e9a6ce9ee43f57a068c83a04c7e864ccc7d1027519d42aab79e13b40f",
-    "best_ledger_time": "2019-11-02 16:42:01",
-    "circulation": 1054439020873472900,
-    "ledgers_24h": 15643,
-    "transactions_24h": 461072,
-    "successful_transactions_24h": 285958,
-    "failed_transactions_24h": 175114,
-    "operations_24h": 1085466,
-    "average_transaction_fee_24h": 283.5731513695005,
-    "average_transaction_fee_usd_24h": 0.000001991250668916633,
-    "market_price_usd": 0.07022,
-    "market_price_btc": 0.0000075229454120425,
-    "market_price_usd_change_24h_percentage": 3.41847,
-    "market_cap_usd": 1406714595,
-    "market_dominance_percentage": 0.56
-  },
-  "context": {
-    "code": 200,
-    ...
-  }
-}
-Request cost formula:
-
-Always 1.
-
-Explore visualization on our front-end:
-
-https://blockchair.com/stellar
-Request cost formula:
-rs, and businesses with access to data contained in 19 blockchains
-Explore pricing plans
-Bitcoin-like blockchain stats
-Endpoints:
-
-https://api.blockchair.com/bitcoin/stats
-https://api.blockchair.com/bitcoin-cash/stats
-https://api.blockchair.com/litecoin/stats
-https://api.blockchair.com/bitcoin-sv/stats
-https://api.blockchair.com/dogecoin/stats
-https://api.blockchair.com/dash/stats
-https://api.blockchair.com/groestlcoin/stats
-https://api.blockchair.com/zcash/stats
-https://api.blockchair.com/ecash/stats
-https://api.blockchair.com/bitcoin/testnet/stats
-Output:
-
-data contains an array with blockchain statistics:
-
-blocks — total number of blocks (note that it's 1 more than the latest block number as there is block #0)
-transactions — total number of transactions
-outputs — total number of outputs (including spent)
-circulation — number of coins in circulation (in satoshi)
-blockchain_size — total size of all blocks in bytes (note: it's not the size of a full node, it's just bare blocks; nodes are bigger in size as they use database indexing, etc)
-nodes— number of full network nodes (it's an approximate number and actually not a blockchain metric)
-difficulty — current mining difficulty
-hashrate_24h — approximated hashrate over the last 24 hours (returned as a string as it doesn't fit into an integer)
-next_retarget_time_estimate — approximate timestamp of the next difficulty retarget (this field is available for Bitcoin and Litecoin only)
-next_difficulty_estimate — approximate next difficulty value (this field is available for Bitcoin and Litecoin only)
-best_block_height — the latest block height
-best_block_hash — the latest block hash
-best_block_time — the latest block time
-mempool_transactions — number of transactions in the mempool
-mempool_outputs — number of outputs in the mempool
-mempool_size — mempool size in bytes
-mempool_tps — number of transactions per second added to the mempool
-mempool_total_fee_usd — sum of transaction fees in the mempool, in USD
-blocks_24h — number of blocks mined over the last 24 hours
-transactions_24h — number of transactions confirmed over the last 24 hours
-volume_24h — total monetary volume of transactions over the last 24 hours
-average_transaction_fee_24h — average transaction fee over the last 24 hours
-average_transaction_fee_usd_24h — the same in USD
-median_transaction_fee_24h— median transaction fee over the last 24 hours
-median_transaction_fee_usd_24h — the same in USD
-inflation_24h— number of new coins mined over the last 24 hours (in satoshi), this can be considered as the daily inflation
-inflation_usd_24h — the same in USD
-cdd_24h— total coindays destroyed over the last 24 hours
-largest_transaction_24h — array of hash and value_usd — biggest payment over the last 24 hours
-market_price_usd — average market price of 1 coin in USD (market data source: CoinGecko)
-market_price_btc — average market price of 1 coin in BTC (for Bitcoin it always returns 1)
-market_price_usd_change_24h_percentage — market price change in percent for 24 hours
-market_cap_usd — market capitalization (coins in circulation * price per coin in USD)
-market_dominance_percentage — dominance index (how much % of the total cryptocurrency market is the market capitalization of the coin)
-countdowns (optional) — an optional array of events ([event, time_left] format), where time_left is the number of seconds till the event
-suggested_transaction_fee_per_byte_sat — suggests a proper transaction fee in satoshi per byte based on the latest block
-hodling_addresses — the total number of addresses with positive balance
-Example output:
-
-https://api.blockchair.com/bitcoin/stats:
-
-{
-  "data": {
-    "blocks": 690165,
-    "transactions": 654248075,
-    "outputs": 1776138129,
-    "circulation": 1875100229497096,
-    "blocks_24h": 130,
-    "transactions_24h": 229726,
-    "difficulty": 14363025673660,
-    "volume_24h": 187713267560047,
-    "mempool_transactions": 6591,
-    "mempool_outputs": 16532,
-    "mempool_size": 5076549,
-    "mempool_tps": 5.416666666666667,
-    "mempool_total_fee_usd": 14219.1005,
-    "best_block_height": 690164,
-    "best_block_hash": "000000000000000000023fcb3703bf89ddbfc1ef5109f21c2387a9d630b78c6e",
-    "best_block_time": "2021-07-08 14:37:00",
-    "blockchain_size": 353767186147,
-    "average_transaction_fee_24h": 14421,
-    "inflation_24h": 81250000000,
-    "median_transaction_fee_24h": 5269,
-    "cdd_24h": 3696149.5996842394,
-    "mempool_outputs": 44316,
-    "largest_transaction_24h": {
-      "hash": "7a83c11f42dadad1c6916cceb079835aa09ed70127dba7cdf15aa904277c907d",
-      "value_usd": 773548352
-    },
-    "nodes": 8502,
-    "hashrate_24h": "92904707138521187685",
-    "inflation_usd_24h": 26587437.5,
-    "average_transaction_fee_usd_24h": 4.719001232335435,
-    "median_transaction_fee_usd_24h": 1.724338485,
-    "market_price_usd": 32723,
-    "market_price_btc": 1,
-    "market_price_usd_change_24h_percentage": -5.7534,
-    "market_cap_usd": 613578128025,
-    "market_dominance_percentage": 43.03,
-    "next_retarget_time_estimate": "2021-07-18 19:23:20",
-    "next_difficulty_estimate": 17958208674260,
-    "countdowns": [],
-    "suggested_transaction_fee_per_byte_sat": 17,
-    "hodling_addresses": 38343147
-  },
-  "context": {
-    "code": 200,
-    ...
-  }
-}
-
-Always 1.
-
-Explore visualizations on our front-end:
-
-https://blockchair.com/
-https://blockchair.com/compare
-Explorers
-Bitcoin
-Ethereum
-Litecoin
-Cardano
-Ripple
-Polkadot
-Dogecoin
-Solana new
-Bitcoin Cash
-Stellar
-Monero
-EOS
-Kusama
-Bitcoin SV
-eCash
-Zcash
-Dash
-Mixin
-Groestlcoin
-Tether USD
-USD Coin
-Binance USD
-Data
-API
-Database dumps
-Full node dumps
-Charts
-Services
-Blockchair News
-Blockchair Donut
-Blockchair Awesome
-Products
-Transaction receipts
-Wallet statements
-Portfolio tracker
-Broadcast transaction
-Privacy-o-meter
-Node explorers
-Release monitor
-Halving countdown
-Compare blockchains
-Get Blockchair extension
-Useful links
-About Blockchair
-FAQ
-Changelog
-Careers
-Terms of service
-Privacy policy
-Blockchair Onion v3 URL 
-Blockchair Onion v2 URL 
-For partners
-Partnerships
-Advertise with us
-Brand kit
-For developers
-Submit a bug or request
-Bug bounty program
-API documentation
-Status
-Social
-Twitter
-Telegram
-GitHub
-LinkedIn
-Languages
-English
-Español
-Français
-Italiano
-Nederlands
-Português
-Русский
-中文
-فارسی
-Вahasa Indonesia
-Türkçe
-日本語
-한국어
-Deutsch
-© 2021 Blockchair
-Footer Blockchair logoNo 3d party trackers
-Works without javascript
-1.010-3049-g4e40c42b Thu Feb 3 12:14:18 UTC 2022
--- a/tests/authutil.test.ts
+++ b/tests/authutil.test.ts
@@ -118,6 +118,27 @@ describe('authutil tests', () => {
    expect(process.env.NODE_AUTH_TOKEN).toEqual('foobar');
  });

+  it('should not export NODE_AUTH_TOKEN if not set in environment', async () => {
+    const exportSpy = jest.spyOn(core, 'exportVariable');
+    delete process.env.NODE_AUTH_TOKEN;
+    await auth.configAuthentication('https://registry.npmjs.org/');
+    expect(fs.statSync(rcFile)).toBeDefined();
+    const rc = readRcFile(rcFile);
+    expect(rc['registry']).toBe('https://registry.npmjs.org/');
+    expect(exportSpy).not.toHaveBeenCalledWith(
+      'NODE_AUTH_TOKEN',
+      expect.anything()
+    );
+  });
+
+  it('should export NODE_AUTH_TOKEN if set to empty string', async () => {
+    const exportSpy = jest.spyOn(core, 'exportVariable');
+    process.env.NODE_AUTH_TOKEN = '';
+    await auth.configAuthentication('https://registry.npmjs.org/');
+    expect(fs.statSync(rcFile)).toBeDefined();
+    expect(exportSpy).toHaveBeenCalledWith('NODE_AUTH_TOKEN', '');
+  });
+
  it('configAuthentication should overwrite non-scoped with non-scoped', async () => {
    fs.writeFileSync(rcFile, 'registry=NNN');
    await auth.configAuthentication('https://registry.npmjs.org/');
--- a/dist/cache-save/index.js
+++ b/dist/cache-save/index.js
--- a/dist/setup/index.js
+++ b/dist/setup/index.js
--- a/docs/advanced-usage.md
+++ b/docs/advanced-usage.md
@@ -329,36 +329,51 @@ steps:
 - run: npm test
 ```

-**Restore-Only Cache**
+**Restore-only cache**
+
+You can restore caches without saving new entries, which helps reduce cache writes and storage usage in read-only cache workflows.

 ```yaml
-## In some workflows, you may want to restore a cache without saving it. This can help reduce cache writes and storage usage in workflows that only need to read from cache
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      # Restore Node.js modules cache (restore-only)
-      - name: Restore Node modules cache
-        uses: actions/cache@v5
-        id: cache-node-modules
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
-      # Setup Node.js
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: '24'
-      # Install dependencies
-      - run: npm install
+steps:
+- uses: actions/checkout@v6
+# - uses: pnpm/action-setup@v6 
+#   with:
+#     version: 10
+
+- name: Setup Node.js
+  uses: actions/setup-node@v6
+  with:
+    node-version: '24'
+
+- name: Normalize runner architecture
+  shell: bash
+  run: echo "ARCH=$(echo '${{ runner.arch }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
+    
+- name: Output of cache path
+  id: cachepath
+  shell: bash
+  run: echo "path=$(npm config get cache)" >> $GITHUB_OUTPUT
+  # run: echo "path=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
+  # For yarn workflow, output of yarn cache dir (v1) or yarn config get cacheFolder (v2+)
+  # run: echo "path=$(yarn cache dir)" >> $GITHUB_OUTPUT 
+    
+- name: Restore Node cache
+  uses: actions/cache/restore@v5
+  with:
+    path: ${{ steps.cachepath.outputs.path }}
+    key: node-cache-${{ runner.os }}-${{ env.ARCH }}-npm-${{ hashFiles('**/package-lock.json') }}
+    # key: node-cache-${{ runner.os }}-${{ env.ARCH }}-yarn-${{ hashFiles('**/yarn.lock') }}
+    # key: node-cache-${{ runner.os }}-${{ env.ARCH }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+    
+- run: npm ci
+# - run: yarn install --frozen-lockfile # optional, --immutable
+# - run: pnpm install
 ```
+> **Note**: Uncomment the commands relevant to your project's package manager.

-> For more details related to cache scenarios, please refer [Node – npm](https://github.com/actions/cache/blob/main/examples.md#node---npm).
+> For more details related to cache scenarios, please refer [actions/cache/restore](https://github.com/actions/cache/tree/main/restore#only-restore-cache).

-## Multiple Operating Systems and Architectures
+## Multiple operating systems and architectures

 ```yaml
 jobs:
@@ -475,6 +490,45 @@ To access private GitHub Packages within the same organization, go to "Manage Ac

 Please refer to the [Ensuring workflow access to your package - Configuring a package's access control and visibility](https://docs.github.com/en/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility#ensuring-workflow-access-to-your-package) for more details.

+## Publishing to npm with Trusted Publisher (OIDC)
+
+npm supports Trusted Publishers, enabling packages to be published from GitHub Actions using OpenID Connect (OIDC) instead of long-lived npm tokens. This improves security by replacing static credentials with short-lived tokens, reducing the risk of credential leakage and simplifying authentication in CI/CD workflows.
+
+### Requirements
+
+Trusted publishing requires a compatible npm version:
+
+* **npm ≥ 11.5.1 (required)**
+* **Node.js 24 or newer (recommended)** — includes a compatible npm version by default
+
+> If npm is below 11.5.1, publishing will fail even if OIDC permissions are correctly configured.
+
+You must also configure a **Trusted Publisher** in npm for your package/scope that matches your GitHub repository and workflow (and optional environment, if used).
+
+### Example workflow
+
+```yaml
+    permissions:
+      contents: read
+      id-token: write  # Required for OIDC
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm ci
+      - run: npm run build --if-present
+      - run: npm publish
+```
+
+> **Note**: If the Trusted Publisher configuration (GitHub owner/repo/workflow file, and optional environment) does not match the workflow run identity exactly, publishing may fail with **E404 Not Found** even if the package exists on npm.
+
+For more details, see the [npm Trusted Publishers documentation](https://docs.npmjs.com/trusted-publishers) and the [GitHub Actions OpenID Connect (OIDC) overview](https://docs.github.com/en/actions/concepts/security/openid-connect).
+
 ## Use private mirror

 It is possible to use a private mirror hosting Node.js binaries. This mirror must be a full mirror of the official Node.js distribution.
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,22 +1,22 @@
 {
  "name": "setup-node",
-  "version": "6.2.0",
+  "version": "6.4.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "setup-node",
-      "version": "6.2.0",
+      "version": "6.4.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/cache": "^5.0.1",
-        "@actions/core": "^1.11.1",
-        "@actions/exec": "^1.1.1",
+        "@actions/cache": "^5.0.5",
+        "@actions/core": "^2.0.3",
+        "@actions/exec": "^2.0.0",
        "@actions/github": "^6.0.1",
-        "@actions/glob": "^0.5.0",
-        "@actions/http-client": "^2.2.1",
-        "@actions/io": "^1.0.2",
-        "@actions/tool-cache": "^2.0.2",
+        "@actions/glob": "^0.5.1",
+        "@actions/http-client": "^3.0.2",
+        "@actions/io": "^2.0.0",
+        "@actions/tool-cache": "^3.0.1",
        "semver": "^7.6.3"
      },
      "devDependencies": {
@@ -42,15 +42,15 @@
      }
    },
    "node_modules/@actions/cache": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.0.1.tgz",
-      "integrity": "sha512-c+oH047Z2zmXLhjMZfEKjxZfv6Ou7T0sn5fhz6yupICXm5OOR47oZn5zxNO8MP7ttkxv5TOg3WsMrffri5Xhfw==",
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.0.5.tgz",
+      "integrity": "sha512-jiQSg0gfd+C2KPgcmdCOq7dCuCIQQWQ4b1YfGIRaaA9w7PJbRwTOcCz4LiFEUnqZGf0ha/8OKL3BeNwetHzYsQ==",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^2.0.0",
        "@actions/exec": "^2.0.0",
-        "@actions/glob": "^0.5.0",
-        "@actions/http-client": "^3.0.0",
+        "@actions/glob": "^0.5.1",
+        "@actions/http-client": "^3.0.2",
        "@actions/io": "^2.0.0",
        "@azure/abort-controller": "^1.1.0",
        "@azure/core-rest-pipeline": "^1.22.0",
@@ -59,41 +59,6 @@
        "semver": "^6.3.1"
      }
    },
-    "node_modules/@actions/cache/node_modules/@actions/core": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.1.tgz",
-      "integrity": "sha512-oBfqT3GwkvLlo1fjvhQLQxuwZCGTarTE5OuZ2Wg10hvhBj7LRIlF611WT4aZS6fDhO5ZKlY7lCAZTlpmyaHaeg==",
-      "license": "MIT",
-      "dependencies": {
-        "@actions/exec": "^2.0.0",
-        "@actions/http-client": "^3.0.0"
-      }
-    },
-    "node_modules/@actions/cache/node_modules/@actions/exec": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz",
-      "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==",
-      "license": "MIT",
-      "dependencies": {
-        "@actions/io": "^2.0.0"
-      }
-    },
-    "node_modules/@actions/cache/node_modules/@actions/http-client": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
-      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
-      "license": "MIT",
-      "dependencies": {
-        "tunnel": "^0.0.6",
-        "undici": "^6.23.0"
-      }
-    },
-    "node_modules/@actions/cache/node_modules/@actions/io": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
-      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
-      "license": "MIT"
-    },
    "node_modules/@actions/cache/node_modules/semver": {
      "version": "6.3.1",
      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
@@ -103,32 +68,23 @@
        "semver": "bin/semver.js"
      }
    },
-    "node_modules/@actions/cache/node_modules/undici": {
-      "version": "6.23.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
-      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.17"
-      }
-    },
    "node_modules/@actions/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.3.tgz",
+      "integrity": "sha512-Od9Thc3T1mQJYddvVPM4QGiLUewdh+3txmDYHHxoNdkqysR1MbCT+rFOtNUxYAz+7+6RIsqipVahY2GJqGPyxA==",
      "license": "MIT",
      "dependencies": {
-        "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1"
+        "@actions/exec": "^2.0.0",
+        "@actions/http-client": "^3.0.2"
      }
    },
    "node_modules/@actions/exec": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
-      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz",
+      "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==",
      "license": "MIT",
      "dependencies": {
-        "@actions/io": "^1.0.1"
+        "@actions/io": "^2.0.0"
      }
    },
    "node_modules/@actions/github": {
@@ -146,17 +102,7 @@
        "undici": "^5.28.5"
      }
    },
-    "node_modules/@actions/glob": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.5.0.tgz",
-      "integrity": "sha512-tST2rjPvJLRZLuT9NMUtyBjvj9Yo0MiJS3ow004slMvm8GFM+Zv9HvMJ7HWzfUyJnGrJvDsYkWBaaG3YKXRtCw==",
-      "license": "MIT",
-      "dependencies": {
-        "@actions/core": "^1.9.1",
-        "minimatch": "^3.0.4"
-      }
-    },
-    "node_modules/@actions/http-client": {
+    "node_modules/@actions/github/node_modules/@actions/http-client": {
      "version": "2.2.3",
      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
@@ -166,22 +112,54 @@
        "undici": "^5.25.4"
      }
    },
+    "node_modules/@actions/github/node_modules/undici": {
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.0"
+      }
+    },
+    "node_modules/@actions/glob": {
+      "version": "0.5.1",
+      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.5.1.tgz",
+      "integrity": "sha512-+dv/t2aKQdKp9WWSp+1yIXVJzH5Q38M0Mta26pzIbeec14EcIleMB7UU6N7sNgbEuYfyuVGpE5pOKjl6j1WXkA==",
+      "license": "MIT",
+      "dependencies": {
+        "@actions/core": "^2.0.3",
+        "minimatch": "^3.0.4"
+      }
+    },
+    "node_modules/@actions/http-client": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
+      "license": "MIT",
+      "dependencies": {
+        "tunnel": "^0.0.6",
+        "undici": "^6.23.0"
+      }
+    },
    "node_modules/@actions/io": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
-      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
+      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
      "license": "MIT"
    },
    "node_modules/@actions/tool-cache": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/tool-cache/-/tool-cache-2.0.2.tgz",
-      "integrity": "sha512-fBhNNOWxuoLxztQebpOaWu6WeVmuwa77Z+DxIZ1B+OYvGkGQon6kTVg6Z32Cb13WCuw0szqonK+hh03mJV7Z6w==",
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@actions/tool-cache/-/tool-cache-3.0.1.tgz",
+      "integrity": "sha512-euK7sID37jMg1yWGkdXkLPI5Te7x/+2QMUPeHXogcpzUZ81mqlDZ+CgYhQo3LtB8LpVnnQyjs+hTTU0Ir4Y0RQ==",
      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^1.11.1",
-        "@actions/exec": "^1.0.0",
-        "@actions/http-client": "^2.0.1",
-        "@actions/io": "^1.1.1",
+        "@actions/core": "^2.0.1",
+        "@actions/exec": "^2.0.0",
+        "@actions/http-client": "^3.0.2",
+        "@actions/io": "^2.0.0",
        "semver": "^6.1.0"
      }
    },
@@ -2214,9 +2192,9 @@
      }
    },
    "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -2465,9 +2443,9 @@
      "license": "Apache-2.0"
    },
    "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^1.0.0",
@@ -3341,10 +3319,10 @@
      "dev": true,
      "license": "MIT"
    },
-    "node_modules/fast-xml-parser": {
-      "version": "5.3.4",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.4.tgz",
-      "integrity": "sha512-EFd6afGmXlCx8H8WTZHhAoDaWaGyuIBoZJ2mknrNxug+aZKjkp0a0dlars9Izl+jF+7Gu1/5f/2h68cQpe0IiA==",
+    "node_modules/fast-xml-builder": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
+      "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
      "funding": [
        {
          "type": "github",
@@ -3353,7 +3331,24 @@
      ],
      "license": "MIT",
      "dependencies": {
-        "strnum": "^2.1.0"
+        "path-expression-matcher": "^1.1.3"
+      }
+    },
+    "node_modules/fast-xml-parser": {
+      "version": "5.5.11",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.11.tgz",
+      "integrity": "sha512-QL0eb0YbSTVWF6tTf1+LEMSgtCEjBYPpnAjoLC8SscESlAjXEIRJ7cHtLG0pLeDFaZLa4VKZLArtA/60ZS7vyA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "fast-xml-builder": "^1.1.4",
+        "path-expression-matcher": "^1.4.0",
+        "strnum": "^2.2.3"
      },
      "bin": {
        "fxparser": "src/cli/cli.js"
@@ -3438,9 +3433,9 @@
      }
    },
    "node_modules/flatted": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
      "dev": true,
      "license": "ISC"
    },
@@ -3606,9 +3601,9 @@
      "license": "MIT"
    },
    "node_modules/handlebars": {
-      "version": "4.7.8",
-      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.8.tgz",
-      "integrity": "sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==",
+      "version": "4.7.9",
+      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz",
+      "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -4769,9 +4764,9 @@
      }
    },
    "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
      "license": "ISC",
      "dependencies": {
        "brace-expansion": "^1.1.7"
@@ -4981,6 +4976,21 @@
        "node": ">=8"
      }
    },
+    "node_modules/path-expression-matcher": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.4.0.tgz",
+      "integrity": "sha512-s4DQMxIdhj3jLFWd9LxHOplj4p9yQ4ffMGowFf3cpEgrrJjEhN0V5nxw4Ye1EViAGDoL4/1AeO6qHpqYPOzE4Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
    "node_modules/path-is-absolute": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
@@ -5026,9 +5036,9 @@
      "license": "ISC"
    },
    "node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -5565,9 +5575,9 @@
      }
    },
    "node_modules/strnum": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.1.2.tgz",
-      "integrity": "sha512-l63NF9y/cLROq/yqKXSLtcMeeyOfnSQlfMSlzFt/K73oIaD8DGaQWd7Z34X9GPiKqP5rbSh84Hl4bOlLcjiSrQ==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.3.tgz",
+      "integrity": "sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg==",
      "funding": [
        {
          "type": "github",
@@ -5813,15 +5823,12 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "6.24.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
      "engines": {
-        "node": ">=14.0"
+        "node": ">=18.17"
      }
    },
    "node_modules/undici-types": {
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "setup-node",
-  "version": "6.2.0",
+  "version": "6.4.0",
  "private": true,
  "description": "setup node action",
  "main": "lib/setup-node.js",
@@ -28,14 +28,14 @@
  "author": "GitHub",
  "license": "MIT",
  "dependencies": {
-    "@actions/cache": "^5.0.1",
-    "@actions/core": "^1.11.1",
-    "@actions/exec": "^1.1.1",
+    "@actions/cache": "^5.0.5",
+    "@actions/core": "^2.0.3",
+    "@actions/exec": "^2.0.0",
    "@actions/github": "^6.0.1",
-    "@actions/glob": "^0.5.0",
-    "@actions/http-client": "^2.2.1",
-    "@actions/io": "^1.0.2",
-    "@actions/tool-cache": "^2.0.2",
+    "@actions/glob": "^0.5.1",
+    "@actions/http-client": "^3.0.2",
+    "@actions/io": "^2.0.0",
+    "@actions/tool-cache": "^3.0.1",
    "semver": "^7.6.3"
  },
  "devDependencies": {
--- a/src/authutil.ts
+++ b/src/authutil.ts
@@ -46,9 +46,8 @@ function writeRegistryToFile(registryUrl: string, fileLocation: string) {
  newContents += `${authString}${os.EOL}${registryString}`;
  fs.writeFileSync(fileLocation, newContents);
  core.exportVariable('NPM_CONFIG_USERCONFIG', fileLocation);
-  // Export empty node_auth_token if didn't exist so npm doesn't complain about not being able to find it
-  core.exportVariable(
-    'NODE_AUTH_TOKEN',
-    process.env.NODE_AUTH_TOKEN || 'XXXXX-XXXXX-XXXXX-XXXXX'
-  );
+  // Only export NODE_AUTH_TOKEN if explicitly provided by user
+  if (Object.prototype.hasOwnProperty.call(process.env, 'NODE_AUTH_TOKEN')) {
+    core.exportVariable('NODE_AUTH_TOKEN', process.env.NODE_AUTH_TOKEN);
+  }
 }
--- a/src/distributions/official_builds/official_builds.ts
+++ b/src/distributions/official_builds/official_builds.ts
@@ -84,7 +84,9 @@ export default class OfficialBuilds extends BaseDistribution {
        downloadPath = await tc.downloadTool(
          versionInfo.downloadUrl,
          undefined,
-          this.nodeInfo.mirror ? this.nodeInfo.mirrorToken : this.nodeInfo.auth
+          this.nodeInfo.mirror && this.nodeInfo.mirrorToken
+            ? this.nodeInfo.mirrorToken
+            : this.nodeInfo.auth
        );

        if (downloadPath) {
@@ -188,7 +190,9 @@ export default class OfficialBuilds extends BaseDistribution {
    return tc.getManifestFromRepo(
      'actions',
      'node-versions',
-      this.nodeInfo.mirror ? this.nodeInfo.mirrorToken : this.nodeInfo.auth,
+      this.nodeInfo.mirror && this.nodeInfo.mirrorToken
+        ? this.nodeInfo.mirrorToken
+        : this.nodeInfo.auth,
      'main'
    );
  }
Author	SHA1	Message	Date
Timo Sand	f4a67bbeca	Only use `mirrorToken` in `getManifest` if it's provided (#1548 ) * Only use `mirrorToken` in `getManifest` if it's provided Signed-off-by: Timo Sand <timo.sand@f-secure.com> * `npm run build` Signed-off-by: Timo Sand <timo.sand@f-secure.com> --------- Signed-off-by: Timo Sand <timo.sand@f-secure.com>	2026-06-09 11:03:18 -05:00
gowridurgad	0355742c94	Remove dummy NODE_AUTH_TOKEN export (#1558 ) Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-05-27 21:56:31 -05:00
priya-kinthali	ad1b57eb81	docs: Update restore-only cache documentation (#1550 ) * update restore-only cache example in advanced-usage.md * fix copilot suggestion * update naming	2026-05-26 17:51:36 -05:00
Chiranjib Swain	670825a89d	Add documentation for publishing to npm with Trusted Publisher (OIDC) (#1536 )	2026-04-22 21:58:57 -05:00
priya-kinthali	48b55a011b	Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533 ) * setup node in local * update workflows to remove EOL versions * update node-dist versions in versions.yml	2026-04-19 21:54:55 -05:00
Copilot	ab72c7e7eb	Upgrade @actions dependencies (#1525 ) * chore: upgrade @actions dependencies and update licenses - @actions/core: ^1.11.1 → ^2.0.3 - @actions/cache: ^5.0.1 → ^5.0.5 - @actions/glob: ^0.5.0 → ^0.5.1 - @actions/http-client: ^2.2.1 → ^3.0.2 - @actions/tool-cache: ^2.0.2 → ^3.0.1 - @actions/io: ^1.0.2 → ^2.0.0 - Run npm audit fix - Update license files for new versions - Rebuild dist files Agent-Logs-Url: https://github.com/actions/setup-node/sessions/872a3dbf-9b85-446b-963b-9127718d9560 Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com> * fix: update license files to fix Licensed CI failures Update 5 license records that were out of date after the dependency upgrade: - brace-expansion: 1.1.12 → 1.1.13 - fast-xml-builder: 1.0.0 → 1.1.4 - fast-xml-parser: 5.4.1 → 5.5.11 - strnum: 2.1.2 → 2.2.3 - path-expression-matcher: add new record (version 1.4.0, new transitive dep) Rebuild dist/ files to reflect updated lock file Agent-Logs-Url: https://github.com/actions/setup-node/sessions/fb0e70ce-ad19-48df-88a4-97f3bdc896cb Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com> * feat: upgrade @actions/exec to ^2.0.0 and fix license records - Upgrade @actions/exec from ^1.1.1 to ^2.0.0 in package.json - Update package-lock.json via npm install - Run `licensed cache` to regenerate license records: - Remove exec-1.1.1.dep.yml and exec-2.0.0.dep.yml (replaced by exec.dep.yml) - Remove io-1.1.3.dep.yml and io-2.0.0.dep.yml (replaced by io.dep.yml) - Create exec.dep.yml (v2.0.0) - single version now in tree - Create io.dep.yml (v2.0.0) - @actions/exec@1.1.1's nested io@1.1.3 removed - Rebuild dist/ files Agent-Logs-Url: https://github.com/actions/setup-node/sessions/24a1a530-6840-4445-8262-8342ec739e6d Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com>	2026-04-16 12:06:31 -05:00
dependabot[bot]	53b83947a5	Bump minimatch from 3.1.2 to 3.1.5 (#1498 ) * Bump minimatch from 3.1.2 to 3.1.3 Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.3. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.3) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Check failure fix --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-03-02 15:21:49 -06:00