Migrate to ESM and upgrade dependencies (#1574)

* Migrate to ESM

* updated package.json version

* Update README for v6 and clean up dev dependencies

* Remove unused ts-node

* fix audit issue

---------

Co-authored-by: gowridurgad <gowridurgad@gmail.com>

.eslintignore

@@ -1,6 +0,0 @@
-# Ignore list
-/*
-
-# Do not ignore these folders:
-!__tests__/
-!src/

.eslintrc.js

@@ -1,51 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports = {
-  extends: [
-    'eslint:recommended',
-    'plugin:@typescript-eslint/recommended',
-    'plugin:eslint-plugin-jest/recommended',
-    'eslint-config-prettier'
-  ],
-  parser: '@typescript-eslint/parser',
-  plugins: ['@typescript-eslint', 'eslint-plugin-node', 'eslint-plugin-jest'],
-  rules: {
-    '@typescript-eslint/no-require-imports': 'error',
-    '@typescript-eslint/no-non-null-assertion': 'off',
-    '@typescript-eslint/no-explicit-any': 'off',
-    '@typescript-eslint/no-empty-function': 'off',
-    '@typescript-eslint/ban-ts-comment': [
-      'error',
-      {
-        'ts-ignore': 'allow-with-description'
-      }
-    ],
-    'no-console': 'error',
-    'yoda': 'error',
-    'prefer-const': [
-      'error',
-      {
-        destructuring: 'all'
-      }
-    ],
-    'no-control-regex': 'off',
-    'no-constant-condition': ['error', {checkLoops: false}],
-    'node/no-extraneous-import': 'error'
-  },
-  overrides: [
-    {
-      files: ['**/*{test,spec}.ts'],
-      rules: {
-        '@typescript-eslint/no-unused-vars': 'off',
-        'jest/no-standalone-expect': 'off',
-        'jest/no-conditional-expect': 'off',
-        'no-console': 'off',
-
-      }
-    }
-  ],
-  env: {
-    node: true,
-    es6: true,
-    'jest/globals': true
-  }
-};

.github/workflows/versions.yml

@@ -168,6 +168,21 @@ jobs:
       - name: Verify node
         run: __tests__/verify-node.sh 24
 
+  version-file-dev-engines:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup node from node version file
+        uses: ./
+        with:
+          node-version-file: '__tests__/data/package-dev-engines.json'
+      - name: Verify node
+        run: __tests__/verify-node.sh 20
+
   version-file-volta:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -204,7 +219,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-        node-version: [17, 19]
+        node-version: [21, 23]
     steps:
       - uses: actions/checkout@v6
       - name: Setup Node from dist

.gitignore

@@ -93,3 +93,18 @@ typings/
 
 # DynamoDB Local files
 .dynamodb/
+
+# Ignore everything inside fixture package-manager folders
+__tests__/data/npm/**
+__tests__/data/pnpm/**
+__tests__/data/yarn/**
+
+# Keep only fixture manifests + lockfiles
+!__tests__/data/npm/package.json
+!__tests__/data/npm/package-lock.json
+
+!__tests__/data/pnpm/package.json
+!__tests__/data/pnpm/pnpm-lock.yaml
+
+!__tests__/data/yarn/package.json
+!__tests__/data/yarn/yarn.lock

.licensed.yml

@@ -10,6 +10,11 @@ allowed:
   - mit
   - cc0-1.0
   - unlicense
+  - blueoak-1.0.0
 
 reviewed:
-  npm:
+  npm:
+     - "@actions/http-client"
+     - balanced-match
+     - brace-expansion
+     - fast-content-type-parse

.licenses/npm/@actions/cache.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/cache"
-version: 5.0.1
+version: 6.1.0
 type: npm
 summary: Actions cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/cache

.licenses/npm/@actions/core-1.11.1.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@actions/core"
-version: 1.11.1
-type: npm
-summary: Actions core lib
-homepage: https://github.com/actions/toolkit/tree/main/packages/core
-license: mit
-licenses:
-- sources: LICENSE.md
-  text: |-
-    The MIT License (MIT)
-
-    Copyright 2019 GitHub
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []

.licenses/npm/@actions/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/core"
-version: 2.0.1
+version: 3.0.1
 type: npm
 summary: Actions core lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/core

.licenses/npm/@actions/exec.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/exec"
-version: 1.1.1
+version: 3.0.0
 type: npm
 summary: Actions exec lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/exec

.licenses/npm/@actions/github.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/github"
-version: 6.0.1
+version: 9.1.1
 type: npm
 summary: Actions github lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/github

.licenses/npm/@actions/glob-0.6.1.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/glob"
-version: 0.5.0
+version: 0.6.1
 type: npm
 summary: Actions glob lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/glob

.licenses/npm/@actions/glob-0.7.0.dep.yml

@@ -1,9 +1,9 @@
 ---
-name: "@actions/exec"
+name: "@actions/glob"
-version: 2.0.0
+version: 0.7.0
 type: npm
-summary: Actions exec lib
+summary: Actions glob lib
-homepage: https://github.com/actions/toolkit/tree/main/packages/exec
+homepage: https://github.com/actions/toolkit/tree/main/packages/glob
 license: mit
 licenses:
 - sources: LICENSE.md

.licenses/npm/@actions/http-client-3.0.2.dep.yml

@@ -1,10 +1,10 @@
 ---
 name: "@actions/http-client"
-version: 2.2.3
+version: 3.0.2
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client
-license: mit
+license: other
 licenses:
 - sources: LICENSE
   text: |

.licenses/npm/@actions/http-client-4.0.1.dep.yml

@@ -1,10 +1,10 @@
 ---
 name: "@actions/http-client"
-version: 3.0.0
+version: 4.0.1
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client
-license: mit
+license: other
 licenses:
 - sources: LICENSE
   text: |

.licenses/npm/@actions/io-2.0.0.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@actions/io"
-version: 2.0.0
-type: npm
-summary: Actions io lib
-homepage: https://github.com/actions/toolkit/tree/main/packages/io
-license: mit
-licenses:
-- sources: LICENSE.md
-  text: |-
-    The MIT License (MIT)
-
-    Copyright 2019 GitHub
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []

.licenses/npm/@actions/io.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/io"
-version: 1.1.3
+version: 3.0.2
 type: npm
 summary: Actions io lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/io

.licenses/npm/@actions/tool-cache.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/tool-cache"
-version: 2.0.2
+version: 4.0.0
 type: npm
 summary: Actions tool-cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/tool-cache

.licenses/npm/@azure/core-http-compat.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-http-compat"
-version: 2.3.1
+version: 2.4.0
 type: npm
 summary: Core HTTP Compatibility Library to bridge the gap between Core V1 & V2 packages.
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-compat/

.licenses/npm/@azure/core-rest-pipeline.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-rest-pipeline"
-version: 1.22.2
+version: 1.23.0
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-rest-pipeline/

.licenses/npm/@azure/core-xml.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-xml"
-version: 1.5.0
+version: 1.5.1
 type: npm
 summary: Core library for interacting with XML payloads
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-xml/

.licenses/npm/@azure/storage-blob.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/storage-blob"
-version: 12.29.1
+version: 12.31.0
 type: npm
 summary: Microsoft Azure Storage SDK for JavaScript - Blob
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-blob/

.licenses/npm/@azure/storage-common.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/storage-common"
-version: 12.1.1
+version: 12.3.0
 type: npm
 summary: Azure Storage Common Client Library for JavaScript
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-internal-avro/

.licenses/npm/@babel/runtime-corejs3.dep.yml

@@ -1,33 +0,0 @@
----
-name: "@babel/runtime-corejs3"
-version: 7.28.6
-type: npm
-summary: babel's modular runtime helpers with core-js@3 polyfilling
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |
-    MIT License
-
-    Copyright (c) 2014-present Sebastian McKenzie and other contributors
-
-    Permission is hereby granted, free of charge, to any person obtaining
-    a copy of this software and associated documentation files (the
-    "Software"), to deal in the Software without restriction, including
-    without limitation the rights to use, copy, modify, merge, publish,
-    distribute, sublicense, and/or sell copies of the Software, and to
-    permit persons to whom the Software is furnished to do so, subject to
-    the following conditions:
-
-    The above copyright notice and this permission notice shall be
-    included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-    NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-    LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-    OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-    WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []

.licenses/npm/@chevrotain/cst-dts-gen.dep.yml

@@ -1,213 +0,0 @@
----
-name: "@chevrotain/cst-dts-gen"
-version: 11.1.0
-type: npm
-summary: Generates type definitions for Chevrotain CST nodes
-homepage:
-license: apache-2.0
-licenses:
-- sources: LICENSE.txt
-  text: |2
-
-                                     Apache License
-                               Version 2.0, January 2004
-                            http://www.apache.org/licenses/
-
-       TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-       1. Definitions.
-
-          "License" shall mean the terms and conditions for use, reproduction,
-          and distribution as defined by Sections 1 through 9 of this document.
-
-          "Licensor" shall mean the copyright owner or entity authorized by
-          the copyright owner that is granting the License.
-
-          "Legal Entity" shall mean the union of the acting entity and all
-          other entities that control, are controlled by, or are under common
-          control with that entity. For the purposes of this definition,
-          "control" means (i) the power, direct or indirect, to cause the
-          direction or management of such entity, whether by contract or
-          otherwise, or (ii) ownership of fifty percent (50%) or more of the
-          outstanding shares, or (iii) beneficial ownership of such entity.
-
-          "You" (or "Your") shall mean an individual or Legal Entity
-          exercising permissions granted by this License.
-
-          "Source" form shall mean the preferred form for making modifications,
-          including but not limited to software source code, documentation
-          source, and configuration files.
-
-          "Object" form shall mean any form resulting from mechanical
-          transformation or translation of a Source form, including but
-          not limited to compiled object code, generated documentation,
-          and conversions to other media types.
-
-          "Work" shall mean the work of authorship, whether in Source or
-          Object form, made available under the License, as indicated by a
-          copyright notice that is included in or attached to the work
-          (an example is provided in the Appendix below).
-
-          "Derivative Works" shall mean any work, whether in Source or Object
-          form, that is based on (or derived from) the Work and for which the
-          editorial revisions, annotations, elaborations, or other modifications
-          represent, as a whole, an original work of authorship. For the purposes
-          of this License, Derivative Works shall not include works that remain
-          separable from, or merely link (or bind by name) to the interfaces of,
-          the Work and Derivative Works thereof.
-
-          "Contribution" shall mean any work of authorship, including
-          the original version of the Work and any modifications or additions
-          to that Work or Derivative Works thereof, that is intentionally
-          submitted to Licensor for inclusion in the Work by the copyright owner
-          or by an individual or Legal Entity authorized to submit on behalf of
-          the copyright owner. For the purposes of this definition, "submitted"
-          means any form of electronic, verbal, or written communication sent
-          to the Licensor or its representatives, including but not limited to
-          communication on electronic mailing lists, source code control systems,
-          and issue tracking systems that are managed by, or on behalf of, the
-          Licensor for the purpose of discussing and improving the Work, but
-          excluding communication that is conspicuously marked or otherwise
-          designated in writing by the copyright owner as "Not a Contribution."
-
-          "Contributor" shall mean Licensor and any individual or Legal Entity
-          on behalf of whom a Contribution has been received by Licensor and
-          subsequently incorporated within the Work.
-
-       2. Grant of Copyright License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          copyright license to reproduce, prepare Derivative Works of,
-          publicly display, publicly perform, sublicense, and distribute the
-          Work and such Derivative Works in Source or Object form.
-
-       3. Grant of Patent License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          (except as stated in this section) patent license to make, have made,
-          use, offer to sell, sell, import, and otherwise transfer the Work,
-          where such license applies only to those patent claims licensable
-          by such Contributor that are necessarily infringed by their
-          Contribution(s) alone or by combination of their Contribution(s)
-          with the Work to which such Contribution(s) was submitted. If You
-          institute patent litigation against any entity (including a
-          cross-claim or counterclaim in a lawsuit) alleging that the Work
-          or a Contribution incorporated within the Work constitutes direct
-          or contributory patent infringement, then any patent licenses
-          granted to You under this License for that Work shall terminate
-          as of the date such litigation is filed.
-
-       4. Redistribution. You may reproduce and distribute copies of the
-          Work or Derivative Works thereof in any medium, with or without
-          modifications, and in Source or Object form, provided that You
-          meet the following conditions:
-
-          (a) You must give any other recipients of the Work or
-              Derivative Works a copy of this License; and
-
-          (b) You must cause any modified files to carry prominent notices
-              stating that You changed the files; and
-
-          (c) You must retain, in the Source form of any Derivative Works
-              that You distribute, all copyright, patent, trademark, and
-              attribution notices from the Source form of the Work,
-              excluding those notices that do not pertain to any part of
-              the Derivative Works; and
-
-          (d) If the Work includes a "NOTICE" text file as part of its
-              distribution, then any Derivative Works that You distribute must
-              include a readable copy of the attribution notices contained
-              within such NOTICE file, excluding those notices that do not
-              pertain to any part of the Derivative Works, in at least one
-              of the following places: within a NOTICE text file distributed
-              as part of the Derivative Works; within the Source form or
-              documentation, if provided along with the Derivative Works; or,
-              within a display generated by the Derivative Works, if and
-              wherever such third-party notices normally appear. The contents
-              of the NOTICE file are for informational purposes only and
-              do not modify the License. You may add Your own attribution
-              notices within Derivative Works that You distribute, alongside
-              or as an addendum to the NOTICE text from the Work, provided
-              that such additional attribution notices cannot be construed
-              as modifying the License.
-
-          You may add Your own copyright statement to Your modifications and
-          may provide additional or different license terms and conditions
-          for use, reproduction, or distribution of Your modifications, or
-          for any such Derivative Works as a whole, provided Your use,
-          reproduction, and distribution of the Work otherwise complies with
-          the conditions stated in this License.
-
-       5. Submission of Contributions. Unless You explicitly state otherwise,
-          any Contribution intentionally submitted for inclusion in the Work
-          by You to the Licensor shall be under the terms and conditions of
-          this License, without any additional terms or conditions.
-          Notwithstanding the above, nothing herein shall supersede or modify
-          the terms of any separate license agreement you may have executed
-          with Licensor regarding such Contributions.
-
-       6. Trademarks. This License does not grant permission to use the trade
-          names, trademarks, service marks, or product names of the Licensor,
-          except as required for reasonable and customary use in describing the
-          origin of the Work and reproducing the content of the NOTICE file.
-
-       7. Disclaimer of Warranty. Unless required by applicable law or
-          agreed to in writing, Licensor provides the Work (and each
-          Contributor provides its Contributions) on an "AS IS" BASIS,
-          WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-          implied, including, without limitation, any warranties or conditions
-          of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-          PARTICULAR PURPOSE. You are solely responsible for determining the
-          appropriateness of using or redistributing the Work and assume any
-          risks associated with Your exercise of permissions under this License.
-
-       8. Limitation of Liability. In no event and under no legal theory,
-          whether in tort (including negligence), contract, or otherwise,
-          unless required by applicable law (such as deliberate and grossly
-          negligent acts) or agreed to in writing, shall any Contributor be
-          liable to You for damages, including any direct, indirect, special,
-          incidental, or consequential damages of any character arising as a
-          result of this License or out of the use or inability to use the
-          Work (including but not limited to damages for loss of goodwill,
-          work stoppage, computer failure or malfunction, or any and all
-          other commercial damages or losses), even if such Contributor
-          has been advised of the possibility of such damages.
-
-       9. Accepting Warranty or Additional Liability. While redistributing
-          the Work or Derivative Works thereof, You may choose to offer,
-          and charge a fee for, acceptance of support, warranty, indemnity,
-          or other liability obligations and/or rights consistent with this
-          License. However, in accepting such obligations, You may act only
-          on Your own behalf and on Your sole responsibility, not on behalf
-          of any other Contributor, and only if You agree to indemnify,
-          defend, and hold each Contributor harmless for any liability
-          incurred by, or claims asserted against, such Contributor by reason
-          of your accepting any such warranty or additional liability.
-
-       END OF TERMS AND CONDITIONS
-
-       APPENDIX: How to apply the Apache License to your work.
-
-          To apply the Apache License to your work, attach the following
-          boilerplate notice, with the fields enclosed by brackets "[]"
-          replaced with your own identifying information. (Don't include
-          the brackets!)  The text should be enclosed in the appropriate
-          comment syntax for the file format. We also recommend that a
-          file or class name and description of purpose be included on the
-          same "printed page" as the copyright notice for easier
-          identification within third-party archives.
-
-       Copyright [yyyy] [name of copyright owner]
-
-       Licensed under the Apache License, Version 2.0 (the "License");
-       you may not use this file except in compliance with the License.
-       You may obtain a copy of the License at
-
-           http://www.apache.org/licenses/LICENSE-2.0
-
-       Unless required by applicable law or agreed to in writing, software
-       distributed under the License is distributed on an "AS IS" BASIS,
-       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-       See the License for the specific language governing permissions and
-       limitations under the License.
-notices: []

.licenses/npm/@chevrotain/gast.dep.yml

@@ -1,213 +0,0 @@
----
-name: "@chevrotain/gast"
-version: 11.1.0
-type: npm
-summary: Grammar AST structure for Chevrotain Parsers
-homepage:
-license: apache-2.0
-licenses:
-- sources: LICENSE.txt
-  text: |2
-
-                                     Apache License
-                               Version 2.0, January 2004
-                            http://www.apache.org/licenses/
-
-       TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-       1. Definitions.
-
-          "License" shall mean the terms and conditions for use, reproduction,
-          and distribution as defined by Sections 1 through 9 of this document.
-
-          "Licensor" shall mean the copyright owner or entity authorized by
-          the copyright owner that is granting the License.
-
-          "Legal Entity" shall mean the union of the acting entity and all
-          other entities that control, are controlled by, or are under common
-          control with that entity. For the purposes of this definition,
-          "control" means (i) the power, direct or indirect, to cause the
-          direction or management of such entity, whether by contract or
-          otherwise, or (ii) ownership of fifty percent (50%) or more of the
-          outstanding shares, or (iii) beneficial ownership of such entity.
-
-          "You" (or "Your") shall mean an individual or Legal Entity
-          exercising permissions granted by this License.
-
-          "Source" form shall mean the preferred form for making modifications,
-          including but not limited to software source code, documentation
-          source, and configuration files.
-
-          "Object" form shall mean any form resulting from mechanical
-          transformation or translation of a Source form, including but
-          not limited to compiled object code, generated documentation,
-          and conversions to other media types.
-
-          "Work" shall mean the work of authorship, whether in Source or
-          Object form, made available under the License, as indicated by a
-          copyright notice that is included in or attached to the work
-          (an example is provided in the Appendix below).
-
-          "Derivative Works" shall mean any work, whether in Source or Object
-          form, that is based on (or derived from) the Work and for which the
-          editorial revisions, annotations, elaborations, or other modifications
-          represent, as a whole, an original work of authorship. For the purposes
-          of this License, Derivative Works shall not include works that remain
-          separable from, or merely link (or bind by name) to the interfaces of,
-          the Work and Derivative Works thereof.
-
-          "Contribution" shall mean any work of authorship, including
-          the original version of the Work and any modifications or additions
-          to that Work or Derivative Works thereof, that is intentionally
-          submitted to Licensor for inclusion in the Work by the copyright owner
-          or by an individual or Legal Entity authorized to submit on behalf of
-          the copyright owner. For the purposes of this definition, "submitted"
-          means any form of electronic, verbal, or written communication sent
-          to the Licensor or its representatives, including but not limited to
-          communication on electronic mailing lists, source code control systems,
-          and issue tracking systems that are managed by, or on behalf of, the
-          Licensor for the purpose of discussing and improving the Work, but
-          excluding communication that is conspicuously marked or otherwise
-          designated in writing by the copyright owner as "Not a Contribution."
-
-          "Contributor" shall mean Licensor and any individual or Legal Entity
-          on behalf of whom a Contribution has been received by Licensor and
-          subsequently incorporated within the Work.
-
-       2. Grant of Copyright License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          copyright license to reproduce, prepare Derivative Works of,
-          publicly display, publicly perform, sublicense, and distribute the
-          Work and such Derivative Works in Source or Object form.
-
-       3. Grant of Patent License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          (except as stated in this section) patent license to make, have made,
-          use, offer to sell, sell, import, and otherwise transfer the Work,
-          where such license applies only to those patent claims licensable
-          by such Contributor that are necessarily infringed by their
-          Contribution(s) alone or by combination of their Contribution(s)
-          with the Work to which such Contribution(s) was submitted. If You
-          institute patent litigation against any entity (including a
-          cross-claim or counterclaim in a lawsuit) alleging that the Work
-          or a Contribution incorporated within the Work constitutes direct
-          or contributory patent infringement, then any patent licenses
-          granted to You under this License for that Work shall terminate
-          as of the date such litigation is filed.
-
-       4. Redistribution. You may reproduce and distribute copies of the
-          Work or Derivative Works thereof in any medium, with or without
-          modifications, and in Source or Object form, provided that You
-          meet the following conditions:
-
-          (a) You must give any other recipients of the Work or
-              Derivative Works a copy of this License; and
-
-          (b) You must cause any modified files to carry prominent notices
-              stating that You changed the files; and
-
-          (c) You must retain, in the Source form of any Derivative Works
-              that You distribute, all copyright, patent, trademark, and
-              attribution notices from the Source form of the Work,
-              excluding those notices that do not pertain to any part of
-              the Derivative Works; and
-
-          (d) If the Work includes a "NOTICE" text file as part of its
-              distribution, then any Derivative Works that You distribute must
-              include a readable copy of the attribution notices contained
-              within such NOTICE file, excluding those notices that do not
-              pertain to any part of the Derivative Works, in at least one
-              of the following places: within a NOTICE text file distributed
-              as part of the Derivative Works; within the Source form or
-              documentation, if provided along with the Derivative Works; or,
-              within a display generated by the Derivative Works, if and
-              wherever such third-party notices normally appear. The contents
-              of the NOTICE file are for informational purposes only and
-              do not modify the License. You may add Your own attribution
-              notices within Derivative Works that You distribute, alongside
-              or as an addendum to the NOTICE text from the Work, provided
-              that such additional attribution notices cannot be construed
-              as modifying the License.
-
-          You may add Your own copyright statement to Your modifications and
-          may provide additional or different license terms and conditions
-          for use, reproduction, or distribution of Your modifications, or
-          for any such Derivative Works as a whole, provided Your use,
-          reproduction, and distribution of the Work otherwise complies with
-          the conditions stated in this License.
-
-       5. Submission of Contributions. Unless You explicitly state otherwise,
-          any Contribution intentionally submitted for inclusion in the Work
-          by You to the Licensor shall be under the terms and conditions of
-          this License, without any additional terms or conditions.
-          Notwithstanding the above, nothing herein shall supersede or modify
-          the terms of any separate license agreement you may have executed
-          with Licensor regarding such Contributions.
-
-       6. Trademarks. This License does not grant permission to use the trade
-          names, trademarks, service marks, or product names of the Licensor,
-          except as required for reasonable and customary use in describing the
-          origin of the Work and reproducing the content of the NOTICE file.
-
-       7. Disclaimer of Warranty. Unless required by applicable law or
-          agreed to in writing, Licensor provides the Work (and each
-          Contributor provides its Contributions) on an "AS IS" BASIS,
-          WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-          implied, including, without limitation, any warranties or conditions
-          of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-          PARTICULAR PURPOSE. You are solely responsible for determining the
-          appropriateness of using or redistributing the Work and assume any
-          risks associated with Your exercise of permissions under this License.
-
-       8. Limitation of Liability. In no event and under no legal theory,
-          whether in tort (including negligence), contract, or otherwise,
-          unless required by applicable law (such as deliberate and grossly
-          negligent acts) or agreed to in writing, shall any Contributor be
-          liable to You for damages, including any direct, indirect, special,
-          incidental, or consequential damages of any character arising as a
-          result of this License or out of the use or inability to use the
-          Work (including but not limited to damages for loss of goodwill,
-          work stoppage, computer failure or malfunction, or any and all
-          other commercial damages or losses), even if such Contributor
-          has been advised of the possibility of such damages.
-
-       9. Accepting Warranty or Additional Liability. While redistributing
-          the Work or Derivative Works thereof, You may choose to offer,
-          and charge a fee for, acceptance of support, warranty, indemnity,
-          or other liability obligations and/or rights consistent with this
-          License. However, in accepting such obligations, You may act only
-          on Your own behalf and on Your sole responsibility, not on behalf
-          of any other Contributor, and only if You agree to indemnify,
-          defend, and hold each Contributor harmless for any liability
-          incurred by, or claims asserted against, such Contributor by reason
-          of your accepting any such warranty or additional liability.
-
-       END OF TERMS AND CONDITIONS
-
-       APPENDIX: How to apply the Apache License to your work.
-
-          To apply the Apache License to your work, attach the following
-          boilerplate notice, with the fields enclosed by brackets "[]"
-          replaced with your own identifying information. (Don't include
-          the brackets!)  The text should be enclosed in the appropriate
-          comment syntax for the file format. We also recommend that a
-          file or class name and description of purpose be included on the
-          same "printed page" as the copyright notice for easier
-          identification within third-party archives.
-
-       Copyright [yyyy] [name of copyright owner]
-
-       Licensed under the Apache License, Version 2.0 (the "License");
-       you may not use this file except in compliance with the License.
-       You may obtain a copy of the License at
-
-           http://www.apache.org/licenses/LICENSE-2.0
-
-       Unless required by applicable law or agreed to in writing, software
-       distributed under the License is distributed on an "AS IS" BASIS,
-       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-       See the License for the specific language governing permissions and
-       limitations under the License.
-notices: []

.licenses/npm/@chevrotain/regexp-to-ast.dep.yml

@@ -1,213 +0,0 @@
----
-name: "@chevrotain/regexp-to-ast"
-version: 11.1.0
-type: npm
-summary: Parses a Regular Expression and outputs an AST
-homepage:
-license: apache-2.0
-licenses:
-- sources: LICENSE.txt
-  text: |2
-
-                                     Apache License
-                               Version 2.0, January 2004
-                            http://www.apache.org/licenses/
-
-       TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-       1. Definitions.
-
-          "License" shall mean the terms and conditions for use, reproduction,
-          and distribution as defined by Sections 1 through 9 of this document.
-
-          "Licensor" shall mean the copyright owner or entity authorized by
-          the copyright owner that is granting the License.
-
-          "Legal Entity" shall mean the union of the acting entity and all
-          other entities that control, are controlled by, or are under common
-          control with that entity. For the purposes of this definition,
-          "control" means (i) the power, direct or indirect, to cause the
-          direction or management of such entity, whether by contract or
-          otherwise, or (ii) ownership of fifty percent (50%) or more of the
-          outstanding shares, or (iii) beneficial ownership of such entity.
-
-          "You" (or "Your") shall mean an individual or Legal Entity
-          exercising permissions granted by this License.
-
-          "Source" form shall mean the preferred form for making modifications,
-          including but not limited to software source code, documentation
-          source, and configuration files.
-
-          "Object" form shall mean any form resulting from mechanical
-          transformation or translation of a Source form, including but
-          not limited to compiled object code, generated documentation,
-          and conversions to other media types.
-
-          "Work" shall mean the work of authorship, whether in Source or
-          Object form, made available under the License, as indicated by a
-          copyright notice that is included in or attached to the work
-          (an example is provided in the Appendix below).
-
-          "Derivative Works" shall mean any work, whether in Source or Object
-          form, that is based on (or derived from) the Work and for which the
-          editorial revisions, annotations, elaborations, or other modifications
-          represent, as a whole, an original work of authorship. For the purposes
-          of this License, Derivative Works shall not include works that remain
-          separable from, or merely link (or bind by name) to the interfaces of,
-          the Work and Derivative Works thereof.
-
-          "Contribution" shall mean any work of authorship, including
-          the original version of the Work and any modifications or additions
-          to that Work or Derivative Works thereof, that is intentionally
-          submitted to Licensor for inclusion in the Work by the copyright owner
-          or by an individual or Legal Entity authorized to submit on behalf of
-          the copyright owner. For the purposes of this definition, "submitted"
-          means any form of electronic, verbal, or written communication sent
-          to the Licensor or its representatives, including but not limited to
-          communication on electronic mailing lists, source code control systems,
-          and issue tracking systems that are managed by, or on behalf of, the
-          Licensor for the purpose of discussing and improving the Work, but
-          excluding communication that is conspicuously marked or otherwise
-          designated in writing by the copyright owner as "Not a Contribution."
-
-          "Contributor" shall mean Licensor and any individual or Legal Entity
-          on behalf of whom a Contribution has been received by Licensor and
-          subsequently incorporated within the Work.
-
-       2. Grant of Copyright License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          copyright license to reproduce, prepare Derivative Works of,
-          publicly display, publicly perform, sublicense, and distribute the
-          Work and such Derivative Works in Source or Object form.
-
-       3. Grant of Patent License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          (except as stated in this section) patent license to make, have made,
-          use, offer to sell, sell, import, and otherwise transfer the Work,
-          where such license applies only to those patent claims licensable
-          by such Contributor that are necessarily infringed by their
-          Contribution(s) alone or by combination of their Contribution(s)
-          with the Work to which such Contribution(s) was submitted. If You
-          institute patent litigation against any entity (including a
-          cross-claim or counterclaim in a lawsuit) alleging that the Work
-          or a Contribution incorporated within the Work constitutes direct
-          or contributory patent infringement, then any patent licenses
-          granted to You under this License for that Work shall terminate
-          as of the date such litigation is filed.
-
-       4. Redistribution. You may reproduce and distribute copies of the
-          Work or Derivative Works thereof in any medium, with or without
-          modifications, and in Source or Object form, provided that You
-          meet the following conditions:
-
-          (a) You must give any other recipients of the Work or
-              Derivative Works a copy of this License; and
-
-          (b) You must cause any modified files to carry prominent notices
-              stating that You changed the files; and
-
-          (c) You must retain, in the Source form of any Derivative Works
-              that You distribute, all copyright, patent, trademark, and
-              attribution notices from the Source form of the Work,
-              excluding those notices that do not pertain to any part of
-              the Derivative Works; and
-
-          (d) If the Work includes a "NOTICE" text file as part of its
-              distribution, then any Derivative Works that You distribute must
-              include a readable copy of the attribution notices contained
-              within such NOTICE file, excluding those notices that do not
-              pertain to any part of the Derivative Works, in at least one
-              of the following places: within a NOTICE text file distributed
-              as part of the Derivative Works; within the Source form or
-              documentation, if provided along with the Derivative Works; or,
-              within a display generated by the Derivative Works, if and
-              wherever such third-party notices normally appear. The contents
-              of the NOTICE file are for informational purposes only and
-              do not modify the License. You may add Your own attribution
-              notices within Derivative Works that You distribute, alongside
-              or as an addendum to the NOTICE text from the Work, provided
-              that such additional attribution notices cannot be construed
-              as modifying the License.
-
-          You may add Your own copyright statement to Your modifications and
-          may provide additional or different license terms and conditions
-          for use, reproduction, or distribution of Your modifications, or
-          for any such Derivative Works as a whole, provided Your use,
-          reproduction, and distribution of the Work otherwise complies with
-          the conditions stated in this License.
-
-       5. Submission of Contributions. Unless You explicitly state otherwise,
-          any Contribution intentionally submitted for inclusion in the Work
-          by You to the Licensor shall be under the terms and conditions of
-          this License, without any additional terms or conditions.
-          Notwithstanding the above, nothing herein shall supersede or modify
-          the terms of any separate license agreement you may have executed
-          with Licensor regarding such Contributions.
-
-       6. Trademarks. This License does not grant permission to use the trade
-          names, trademarks, service marks, or product names of the Licensor,
-          except as required for reasonable and customary use in describing the
-          origin of the Work and reproducing the content of the NOTICE file.
-
-       7. Disclaimer of Warranty. Unless required by applicable law or
-          agreed to in writing, Licensor provides the Work (and each
-          Contributor provides its Contributions) on an "AS IS" BASIS,
-          WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-          implied, including, without limitation, any warranties or conditions
-          of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-          PARTICULAR PURPOSE. You are solely responsible for determining the
-          appropriateness of using or redistributing the Work and assume any
-          risks associated with Your exercise of permissions under this License.
-
-       8. Limitation of Liability. In no event and under no legal theory,
-          whether in tort (including negligence), contract, or otherwise,
-          unless required by applicable law (such as deliberate and grossly
-          negligent acts) or agreed to in writing, shall any Contributor be
-          liable to You for damages, including any direct, indirect, special,
-          incidental, or consequential damages of any character arising as a
-          result of this License or out of the use or inability to use the
-          Work (including but not limited to damages for loss of goodwill,
-          work stoppage, computer failure or malfunction, or any and all
-          other commercial damages or losses), even if such Contributor
-          has been advised of the possibility of such damages.
-
-       9. Accepting Warranty or Additional Liability. While redistributing
-          the Work or Derivative Works thereof, You may choose to offer,
-          and charge a fee for, acceptance of support, warranty, indemnity,
-          or other liability obligations and/or rights consistent with this
-          License. However, in accepting such obligations, You may act only
-          on Your own behalf and on Your sole responsibility, not on behalf
-          of any other Contributor, and only if You agree to indemnify,
-          defend, and hold each Contributor harmless for any liability
-          incurred by, or claims asserted against, such Contributor by reason
-          of your accepting any such warranty or additional liability.
-
-       END OF TERMS AND CONDITIONS
-
-       APPENDIX: How to apply the Apache License to your work.
-
-          To apply the Apache License to your work, attach the following
-          boilerplate notice, with the fields enclosed by brackets "[]"
-          replaced with your own identifying information. (Don't include
-          the brackets!)  The text should be enclosed in the appropriate
-          comment syntax for the file format. We also recommend that a
-          file or class name and description of purpose be included on the
-          same "printed page" as the copyright notice for easier
-          identification within third-party archives.
-
-       Copyright [yyyy] [name of copyright owner]
-
-       Licensed under the Apache License, Version 2.0 (the "License");
-       you may not use this file except in compliance with the License.
-       You may obtain a copy of the License at
-
-           http://www.apache.org/licenses/LICENSE-2.0
-
-       Unless required by applicable law or agreed to in writing, software
-       distributed under the License is distributed on an "AS IS" BASIS,
-       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-       See the License for the specific language governing permissions and
-       limitations under the License.
-notices: []

.licenses/npm/@chevrotain/types.dep.yml

@@ -1,213 +0,0 @@
----
-name: "@chevrotain/types"
-version: 11.1.0
-type: npm
-summary: Type Signatures and API Website for Chevrotain
-homepage: https://chevrotain.io/documentation/
-license: apache-2.0
-licenses:
-- sources: LICENSE.txt
-  text: |2
-
-                                     Apache License
-                               Version 2.0, January 2004
-                            http://www.apache.org/licenses/
-
-       TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-       1. Definitions.
-
-          "License" shall mean the terms and conditions for use, reproduction,
-          and distribution as defined by Sections 1 through 9 of this document.
-
-          "Licensor" shall mean the copyright owner or entity authorized by
-          the copyright owner that is granting the License.
-
-          "Legal Entity" shall mean the union of the acting entity and all
-          other entities that control, are controlled by, or are under common
-          control with that entity. For the purposes of this definition,
-          "control" means (i) the power, direct or indirect, to cause the
-          direction or management of such entity, whether by contract or
-          otherwise, or (ii) ownership of fifty percent (50%) or more of the
-          outstanding shares, or (iii) beneficial ownership of such entity.
-
-          "You" (or "Your") shall mean an individual or Legal Entity
-          exercising permissions granted by this License.
-
-          "Source" form shall mean the preferred form for making modifications,
-          including but not limited to software source code, documentation
-          source, and configuration files.
-
-          "Object" form shall mean any form resulting from mechanical
-          transformation or translation of a Source form, including but
-          not limited to compiled object code, generated documentation,
-          and conversions to other media types.
-
-          "Work" shall mean the work of authorship, whether in Source or
-          Object form, made available under the License, as indicated by a
-          copyright notice that is included in or attached to the work
-          (an example is provided in the Appendix below).
-
-          "Derivative Works" shall mean any work, whether in Source or Object
-          form, that is based on (or derived from) the Work and for which the
-          editorial revisions, annotations, elaborations, or other modifications
-          represent, as a whole, an original work of authorship. For the purposes
-          of this License, Derivative Works shall not include works that remain
-          separable from, or merely link (or bind by name) to the interfaces of,
-          the Work and Derivative Works thereof.
-
-          "Contribution" shall mean any work of authorship, including
-          the original version of the Work and any modifications or additions
-          to that Work or Derivative Works thereof, that is intentionally
-          submitted to Licensor for inclusion in the Work by the copyright owner
-          or by an individual or Legal Entity authorized to submit on behalf of
-          the copyright owner. For the purposes of this definition, "submitted"
-          means any form of electronic, verbal, or written communication sent
-          to the Licensor or its representatives, including but not limited to
-          communication on electronic mailing lists, source code control systems,
-          and issue tracking systems that are managed by, or on behalf of, the
-          Licensor for the purpose of discussing and improving the Work, but
-          excluding communication that is conspicuously marked or otherwise
-          designated in writing by the copyright owner as "Not a Contribution."
-
-          "Contributor" shall mean Licensor and any individual or Legal Entity
-          on behalf of whom a Contribution has been received by Licensor and
-          subsequently incorporated within the Work.
-
-       2. Grant of Copyright License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          copyright license to reproduce, prepare Derivative Works of,
-          publicly display, publicly perform, sublicense, and distribute the
-          Work and such Derivative Works in Source or Object form.
-
-       3. Grant of Patent License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          (except as stated in this section) patent license to make, have made,
-          use, offer to sell, sell, import, and otherwise transfer the Work,
-          where such license applies only to those patent claims licensable
-          by such Contributor that are necessarily infringed by their
-          Contribution(s) alone or by combination of their Contribution(s)
-          with the Work to which such Contribution(s) was submitted. If You
-          institute patent litigation against any entity (including a
-          cross-claim or counterclaim in a lawsuit) alleging that the Work
-          or a Contribution incorporated within the Work constitutes direct
-          or contributory patent infringement, then any patent licenses
-          granted to You under this License for that Work shall terminate
-          as of the date such litigation is filed.
-
-       4. Redistribution. You may reproduce and distribute copies of the
-          Work or Derivative Works thereof in any medium, with or without
-          modifications, and in Source or Object form, provided that You
-          meet the following conditions:
-
-          (a) You must give any other recipients of the Work or
-              Derivative Works a copy of this License; and
-
-          (b) You must cause any modified files to carry prominent notices
-              stating that You changed the files; and
-
-          (c) You must retain, in the Source form of any Derivative Works
-              that You distribute, all copyright, patent, trademark, and
-              attribution notices from the Source form of the Work,
-              excluding those notices that do not pertain to any part of
-              the Derivative Works; and
-
-          (d) If the Work includes a "NOTICE" text file as part of its
-              distribution, then any Derivative Works that You distribute must
-              include a readable copy of the attribution notices contained
-              within such NOTICE file, excluding those notices that do not
-              pertain to any part of the Derivative Works, in at least one
-              of the following places: within a NOTICE text file distributed
-              as part of the Derivative Works; within the Source form or
-              documentation, if provided along with the Derivative Works; or,
-              within a display generated by the Derivative Works, if and
-              wherever such third-party notices normally appear. The contents
-              of the NOTICE file are for informational purposes only and
-              do not modify the License. You may add Your own attribution
-              notices within Derivative Works that You distribute, alongside
-              or as an addendum to the NOTICE text from the Work, provided
-              that such additional attribution notices cannot be construed
-              as modifying the License.
-
-          You may add Your own copyright statement to Your modifications and
-          may provide additional or different license terms and conditions
-          for use, reproduction, or distribution of Your modifications, or
-          for any such Derivative Works as a whole, provided Your use,
-          reproduction, and distribution of the Work otherwise complies with
-          the conditions stated in this License.
-
-       5. Submission of Contributions. Unless You explicitly state otherwise,
-          any Contribution intentionally submitted for inclusion in the Work
-          by You to the Licensor shall be under the terms and conditions of
-          this License, without any additional terms or conditions.
-          Notwithstanding the above, nothing herein shall supersede or modify
-          the terms of any separate license agreement you may have executed
-          with Licensor regarding such Contributions.
-
-       6. Trademarks. This License does not grant permission to use the trade
-          names, trademarks, service marks, or product names of the Licensor,
-          except as required for reasonable and customary use in describing the
-          origin of the Work and reproducing the content of the NOTICE file.
-
-       7. Disclaimer of Warranty. Unless required by applicable law or
-          agreed to in writing, Licensor provides the Work (and each
-          Contributor provides its Contributions) on an "AS IS" BASIS,
-          WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-          implied, including, without limitation, any warranties or conditions
-          of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-          PARTICULAR PURPOSE. You are solely responsible for determining the
-          appropriateness of using or redistributing the Work and assume any
-          risks associated with Your exercise of permissions under this License.
-
-       8. Limitation of Liability. In no event and under no legal theory,
-          whether in tort (including negligence), contract, or otherwise,
-          unless required by applicable law (such as deliberate and grossly
-          negligent acts) or agreed to in writing, shall any Contributor be
-          liable to You for damages, including any direct, indirect, special,
-          incidental, or consequential damages of any character arising as a
-          result of this License or out of the use or inability to use the
-          Work (including but not limited to damages for loss of goodwill,
-          work stoppage, computer failure or malfunction, or any and all
-          other commercial damages or losses), even if such Contributor
-          has been advised of the possibility of such damages.
-
-       9. Accepting Warranty or Additional Liability. While redistributing
-          the Work or Derivative Works thereof, You may choose to offer,
-          and charge a fee for, acceptance of support, warranty, indemnity,
-          or other liability obligations and/or rights consistent with this
-          License. However, in accepting such obligations, You may act only
-          on Your own behalf and on Your sole responsibility, not on behalf
-          of any other Contributor, and only if You agree to indemnify,
-          defend, and hold each Contributor harmless for any liability
-          incurred by, or claims asserted against, such Contributor by reason
-          of your accepting any such warranty or additional liability.
-
-       END OF TERMS AND CONDITIONS
-
-       APPENDIX: How to apply the Apache License to your work.
-
-          To apply the Apache License to your work, attach the following
-          boilerplate notice, with the fields enclosed by brackets "[]"
-          replaced with your own identifying information. (Don't include
-          the brackets!)  The text should be enclosed in the appropriate
-          comment syntax for the file format. We also recommend that a
-          file or class name and description of purpose be included on the
-          same "printed page" as the copyright notice for easier
-          identification within third-party archives.
-
-       Copyright [yyyy] [name of copyright owner]
-
-       Licensed under the Apache License, Version 2.0 (the "License");
-       you may not use this file except in compliance with the License.
-       You may obtain a copy of the License at
-
-           http://www.apache.org/licenses/LICENSE-2.0
-
-       Unless required by applicable law or agreed to in writing, software
-       distributed under the License is distributed on an "AS IS" BASIS,
-       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-       See the License for the specific language governing permissions and
-       limitations under the License.
-notices: []

.licenses/npm/@chevrotain/utils.dep.yml

@@ -1,213 +0,0 @@
----
-name: "@chevrotain/utils"
-version: 11.1.0
-type: npm
-summary: common utilities
-homepage:
-license: apache-2.0
-licenses:
-- sources: LICENSE.txt
-  text: |2
-
-                                     Apache License
-                               Version 2.0, January 2004
-                            http://www.apache.org/licenses/
-
-       TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-       1. Definitions.
-
-          "License" shall mean the terms and conditions for use, reproduction,
-          and distribution as defined by Sections 1 through 9 of this document.
-
-          "Licensor" shall mean the copyright owner or entity authorized by
-          the copyright owner that is granting the License.
-
-          "Legal Entity" shall mean the union of the acting entity and all
-          other entities that control, are controlled by, or are under common
-          control with that entity. For the purposes of this definition,
-          "control" means (i) the power, direct or indirect, to cause the
-          direction or management of such entity, whether by contract or
-          otherwise, or (ii) ownership of fifty percent (50%) or more of the
-          outstanding shares, or (iii) beneficial ownership of such entity.
-
-          "You" (or "Your") shall mean an individual or Legal Entity
-          exercising permissions granted by this License.
-
-          "Source" form shall mean the preferred form for making modifications,
-          including but not limited to software source code, documentation
-          source, and configuration files.
-
-          "Object" form shall mean any form resulting from mechanical
-          transformation or translation of a Source form, including but
-          not limited to compiled object code, generated documentation,
-          and conversions to other media types.
-
-          "Work" shall mean the work of authorship, whether in Source or
-          Object form, made available under the License, as indicated by a
-          copyright notice that is included in or attached to the work
-          (an example is provided in the Appendix below).
-
-          "Derivative Works" shall mean any work, whether in Source or Object
-          form, that is based on (or derived from) the Work and for which the
-          editorial revisions, annotations, elaborations, or other modifications
-          represent, as a whole, an original work of authorship. For the purposes
-          of this License, Derivative Works shall not include works that remain
-          separable from, or merely link (or bind by name) to the interfaces of,
-          the Work and Derivative Works thereof.
-
-          "Contribution" shall mean any work of authorship, including
-          the original version of the Work and any modifications or additions
-          to that Work or Derivative Works thereof, that is intentionally
-          submitted to Licensor for inclusion in the Work by the copyright owner
-          or by an individual or Legal Entity authorized to submit on behalf of
-          the copyright owner. For the purposes of this definition, "submitted"
-          means any form of electronic, verbal, or written communication sent
-          to the Licensor or its representatives, including but not limited to
-          communication on electronic mailing lists, source code control systems,
-          and issue tracking systems that are managed by, or on behalf of, the
-          Licensor for the purpose of discussing and improving the Work, but
-          excluding communication that is conspicuously marked or otherwise
-          designated in writing by the copyright owner as "Not a Contribution."
-
-          "Contributor" shall mean Licensor and any individual or Legal Entity
-          on behalf of whom a Contribution has been received by Licensor and
-          subsequently incorporated within the Work.
-
-       2. Grant of Copyright License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          copyright license to reproduce, prepare Derivative Works of,
-          publicly display, publicly perform, sublicense, and distribute the
-          Work and such Derivative Works in Source or Object form.
-
-       3. Grant of Patent License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          (except as stated in this section) patent license to make, have made,
-          use, offer to sell, sell, import, and otherwise transfer the Work,
-          where such license applies only to those patent claims licensable
-          by such Contributor that are necessarily infringed by their
-          Contribution(s) alone or by combination of their Contribution(s)
-          with the Work to which such Contribution(s) was submitted. If You
-          institute patent litigation against any entity (including a
-          cross-claim or counterclaim in a lawsuit) alleging that the Work
-          or a Contribution incorporated within the Work constitutes direct
-          or contributory patent infringement, then any patent licenses
-          granted to You under this License for that Work shall terminate
-          as of the date such litigation is filed.
-
-       4. Redistribution. You may reproduce and distribute copies of the
-          Work or Derivative Works thereof in any medium, with or without
-          modifications, and in Source or Object form, provided that You
-          meet the following conditions:
-
-          (a) You must give any other recipients of the Work or
-              Derivative Works a copy of this License; and
-
-          (b) You must cause any modified files to carry prominent notices
-              stating that You changed the files; and
-
-          (c) You must retain, in the Source form of any Derivative Works
-              that You distribute, all copyright, patent, trademark, and
-              attribution notices from the Source form of the Work,
-              excluding those notices that do not pertain to any part of
-              the Derivative Works; and
-
-          (d) If the Work includes a "NOTICE" text file as part of its
-              distribution, then any Derivative Works that You distribute must
-              include a readable copy of the attribution notices contained
-              within such NOTICE file, excluding those notices that do not
-              pertain to any part of the Derivative Works, in at least one
-              of the following places: within a NOTICE text file distributed
-              as part of the Derivative Works; within the Source form or
-              documentation, if provided along with the Derivative Works; or,
-              within a display generated by the Derivative Works, if and
-              wherever such third-party notices normally appear. The contents
-              of the NOTICE file are for informational purposes only and
-              do not modify the License. You may add Your own attribution
-              notices within Derivative Works that You distribute, alongside
-              or as an addendum to the NOTICE text from the Work, provided
-              that such additional attribution notices cannot be construed
-              as modifying the License.
-
-          You may add Your own copyright statement to Your modifications and
-          may provide additional or different license terms and conditions
-          for use, reproduction, or distribution of Your modifications, or
-          for any such Derivative Works as a whole, provided Your use,
-          reproduction, and distribution of the Work otherwise complies with
-          the conditions stated in this License.
-
-       5. Submission of Contributions. Unless You explicitly state otherwise,
-          any Contribution intentionally submitted for inclusion in the Work
-          by You to the Licensor shall be under the terms and conditions of
-          this License, without any additional terms or conditions.
-          Notwithstanding the above, nothing herein shall supersede or modify
-          the terms of any separate license agreement you may have executed
-          with Licensor regarding such Contributions.
-
-       6. Trademarks. This License does not grant permission to use the trade
-          names, trademarks, service marks, or product names of the Licensor,
-          except as required for reasonable and customary use in describing the
-          origin of the Work and reproducing the content of the NOTICE file.
-
-       7. Disclaimer of Warranty. Unless required by applicable law or
-          agreed to in writing, Licensor provides the Work (and each
-          Contributor provides its Contributions) on an "AS IS" BASIS,
-          WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-          implied, including, without limitation, any warranties or conditions
-          of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-          PARTICULAR PURPOSE. You are solely responsible for determining the
-          appropriateness of using or redistributing the Work and assume any
-          risks associated with Your exercise of permissions under this License.
-
-       8. Limitation of Liability. In no event and under no legal theory,
-          whether in tort (including negligence), contract, or otherwise,
-          unless required by applicable law (such as deliberate and grossly
-          negligent acts) or agreed to in writing, shall any Contributor be
-          liable to You for damages, including any direct, indirect, special,
-          incidental, or consequential damages of any character arising as a
-          result of this License or out of the use or inability to use the
-          Work (including but not limited to damages for loss of goodwill,
-          work stoppage, computer failure or malfunction, or any and all
-          other commercial damages or losses), even if such Contributor
-          has been advised of the possibility of such damages.
-
-       9. Accepting Warranty or Additional Liability. While redistributing
-          the Work or Derivative Works thereof, You may choose to offer,
-          and charge a fee for, acceptance of support, warranty, indemnity,
-          or other liability obligations and/or rights consistent with this
-          License. However, in accepting such obligations, You may act only
-          on Your own behalf and on Your sole responsibility, not on behalf
-          of any other Contributor, and only if You agree to indemnify,
-          defend, and hold each Contributor harmless for any liability
-          incurred by, or claims asserted against, such Contributor by reason
-          of your accepting any such warranty or additional liability.
-
-       END OF TERMS AND CONDITIONS
-
-       APPENDIX: How to apply the Apache License to your work.
-
-          To apply the Apache License to your work, attach the following
-          boilerplate notice, with the fields enclosed by brackets "[]"
-          replaced with your own identifying information. (Don't include
-          the brackets!)  The text should be enclosed in the appropriate
-          comment syntax for the file format. We also recommend that a
-          file or class name and description of purpose be included on the
-          same "printed page" as the copyright notice for easier
-          identification within third-party archives.
-
-       Copyright [yyyy] [name of copyright owner]
-
-       Licensed under the Apache License, Version 2.0 (the "License");
-       you may not use this file except in compliance with the License.
-       You may obtain a copy of the License at
-
-           http://www.apache.org/licenses/LICENSE-2.0
-
-       Unless required by applicable law or agreed to in writing, software
-       distributed under the License is distributed on an "AS IS" BASIS,
-       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-       See the License for the specific language governing permissions and
-       limitations under the License.
-notices: []

.licenses/npm/@fastify/busboy.dep.yml

@@ -1,30 +0,0 @@
----
-name: "@fastify/busboy"
-version: 2.1.1
-type: npm
-summary: A streaming parser for HTML form data for node.js
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |-
-    Copyright Brian White. All rights reserved.
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to
-    deal in the Software without restriction, including without limitation the
-    rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-    sell copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in
-    all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
-    IN THE SOFTWARE.
-notices: []

.licenses/npm/@nodable/entities.dep.yml

@@ -0,0 +1,11 @@
+---
+name: "@nodable/entities"
+version: 2.1.0
+type: npm
+summary: Entity parser for XML, HTML, External entites with security and NCR control
+homepage:
+license: mit
+licenses:
+- sources: README.md
+  text: MIT
+notices: []

.licenses/npm/@octokit/auth-token.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/auth-token"
-version: 4.0.0
+version: 6.0.0
 type: npm
 summary: GitHub API token authentication for browsers and Node.js
 homepage:

.licenses/npm/@octokit/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/core"
-version: 5.2.2
+version: 7.0.6
 type: npm
 summary: Extendable client for GitHub's REST & GraphQL APIs
 homepage:

.licenses/npm/@octokit/endpoint.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/endpoint"
-version: 9.0.6
+version: 11.0.3
 type: npm
 summary: Turns REST API endpoints into generic request options
 homepage:

.licenses/npm/@octokit/graphql.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/graphql"
-version: 7.1.1
+version: 9.0.3
 type: npm
 summary: GitHub GraphQL API client for browsers and Node
 homepage:

.licenses/npm/@octokit/openapi-types-24.2.0.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@octokit/openapi-types"
-version: 24.2.0
-type: npm
-summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |-
-    Copyright 2020 Gregor Martynus
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
-notices: []

.licenses/npm/@octokit/openapi-types.dep.yml

@@ -1,14 +1,14 @@
 ---
 name: "@octokit/openapi-types"
-version: 20.0.0
+version: 27.0.0
 type: npm
 summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
 homepage:
 license: mit
 licenses:
 - sources: LICENSE
-  text: |-
+  text: |
-    Copyright 2020 Gregor Martynus
+    Copyright (c) GitHub 2025 - Licensed as MIT.
 
     Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

.licenses/npm/@octokit/plugin-paginate-rest.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-paginate-rest"
-version: 9.2.2
+version: 14.0.0
 type: npm
 summary: Octokit plugin to paginate REST API endpoint responses
 homepage:

.licenses/npm/@octokit/plugin-rest-endpoint-methods.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-rest-endpoint-methods"
-version: 10.4.1
+version: 17.0.0
 type: npm
 summary: Octokit plugin adding one method for all of api.github.com REST API endpoints
 homepage:

.licenses/npm/@octokit/request-error.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/request-error"
-version: 5.1.1
+version: 7.1.0
 type: npm
 summary: Error class for Octokit request errors
 homepage:

.licenses/npm/@octokit/request.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/request"
-version: 8.4.1
+version: 10.0.8
 type: npm
 summary: Send parameterized requests to GitHub's APIs with sensible defaults in browsers
   and Node

.licenses/npm/@octokit/types-13.10.0.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@octokit/types"
-version: 13.10.0
-type: npm
-summary: Shared TypeScript definitions for Octokit projects
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |
-    MIT License Copyright (c) 2019 Octokit contributors
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
-notices: []

.licenses/npm/@octokit/types.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/types"
-version: 12.6.0
+version: 16.0.0
 type: npm
 summary: Shared TypeScript definitions for Octokit projects
 homepage:

.licenses/npm/@typespec/ts-http-runtime.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@typespec/ts-http-runtime"
-version: 0.3.2
+version: 0.3.5
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/ts-http-runtime/

.licenses/npm/balanced-match-4.0.4.dep.yml

@@ -0,0 +1,34 @@
+---
+name: balanced-match
+version: 4.0.4
+type: npm
+summary: Match balanced character pairs, like "{" and "}"
+homepage:
+license: other
+licenses:
+- sources: LICENSE.md
+  text: |
+    (MIT)
+
+    Original code Copyright Julian Gruber <julian@juliangruber.com>
+
+    Port to TypeScript Copyright Isaac Z. Schlueter <i@izs.me>
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of
+    this software and associated documentation files (the "Software"), to deal in
+    the Software without restriction, including without limitation the rights to
+    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+    of the Software, and to permit persons to whom the Software is furnished to do
+    so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []

.licenses/npm/before-after-hook.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: before-after-hook
-version: 2.2.3
+version: 4.0.0
 type: npm
 summary: asynchronous before/error/after hooks for internal functionality
-homepage: 
+homepage:
 license: apache-2.0
 licenses:
 - sources: LICENSE

.licenses/npm/brace-expansion-1.1.13.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 1.1.12
+version: 1.1.13
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion

.licenses/npm/brace-expansion-5.0.6.dep.yml

@@ -1,15 +1,18 @@
 ---
-name: core-js-pure
+name: brace-expansion
-version: 3.48.0
+version: 5.0.6
 type: npm
-summary: Standard library
+summary: Brace expansion as known from sh/bash
-homepage: https://core-js.io
+homepage:
-license: mit
+license: other
 licenses:
 - sources: LICENSE
   text: |
-    Copyright (c) 2013–2025 Denis Pushkarev (zloirock.ru)
+    MIT License
-    Copyright (c) 2025–2026 CoreJS Company (core-js.io)
+
+    Copyright Julian Gruber <julian@juliangruber.com>
+
+    TypeScript port Copyright Isaac Z. Schlueter <i@izs.me>
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal
@@ -18,14 +21,14 @@ licenses:
     copies of the Software, and to permit persons to whom the Software is
     furnished to do so, subject to the following conditions:
 
-    The above copyright notice and this permission notice shall be included in
+    The above copyright notice and this permission notice shall be included in all
-    all copies or substantial portions of the Software.
+    copies or substantial portions of the Software.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
     AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    THE SOFTWARE.
+    SOFTWARE.
 notices: []

.licenses/npm/chevrotain.dep.yml

@@ -1,214 +0,0 @@
----
-name: chevrotain
-version: 11.1.0
-type: npm
-summary: Chevrotain is a high performance fault tolerant javascript parsing DSL for
-  building recursive decent parsers
-homepage: https://chevrotain.io/docs/
-license: apache-2.0
-licenses:
-- sources: LICENSE.txt
-  text: |2
-
-                                     Apache License
-                               Version 2.0, January 2004
-                            http://www.apache.org/licenses/
-
-       TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-       1. Definitions.
-
-          "License" shall mean the terms and conditions for use, reproduction,
-          and distribution as defined by Sections 1 through 9 of this document.
-
-          "Licensor" shall mean the copyright owner or entity authorized by
-          the copyright owner that is granting the License.
-
-          "Legal Entity" shall mean the union of the acting entity and all
-          other entities that control, are controlled by, or are under common
-          control with that entity. For the purposes of this definition,
-          "control" means (i) the power, direct or indirect, to cause the
-          direction or management of such entity, whether by contract or
-          otherwise, or (ii) ownership of fifty percent (50%) or more of the
-          outstanding shares, or (iii) beneficial ownership of such entity.
-
-          "You" (or "Your") shall mean an individual or Legal Entity
-          exercising permissions granted by this License.
-
-          "Source" form shall mean the preferred form for making modifications,
-          including but not limited to software source code, documentation
-          source, and configuration files.
-
-          "Object" form shall mean any form resulting from mechanical
-          transformation or translation of a Source form, including but
-          not limited to compiled object code, generated documentation,
-          and conversions to other media types.
-
-          "Work" shall mean the work of authorship, whether in Source or
-          Object form, made available under the License, as indicated by a
-          copyright notice that is included in or attached to the work
-          (an example is provided in the Appendix below).
-
-          "Derivative Works" shall mean any work, whether in Source or Object
-          form, that is based on (or derived from) the Work and for which the
-          editorial revisions, annotations, elaborations, or other modifications
-          represent, as a whole, an original work of authorship. For the purposes
-          of this License, Derivative Works shall not include works that remain
-          separable from, or merely link (or bind by name) to the interfaces of,
-          the Work and Derivative Works thereof.
-
-          "Contribution" shall mean any work of authorship, including
-          the original version of the Work and any modifications or additions
-          to that Work or Derivative Works thereof, that is intentionally
-          submitted to Licensor for inclusion in the Work by the copyright owner
-          or by an individual or Legal Entity authorized to submit on behalf of
-          the copyright owner. For the purposes of this definition, "submitted"
-          means any form of electronic, verbal, or written communication sent
-          to the Licensor or its representatives, including but not limited to
-          communication on electronic mailing lists, source code control systems,
-          and issue tracking systems that are managed by, or on behalf of, the
-          Licensor for the purpose of discussing and improving the Work, but
-          excluding communication that is conspicuously marked or otherwise
-          designated in writing by the copyright owner as "Not a Contribution."
-
-          "Contributor" shall mean Licensor and any individual or Legal Entity
-          on behalf of whom a Contribution has been received by Licensor and
-          subsequently incorporated within the Work.
-
-       2. Grant of Copyright License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          copyright license to reproduce, prepare Derivative Works of,
-          publicly display, publicly perform, sublicense, and distribute the
-          Work and such Derivative Works in Source or Object form.
-
-       3. Grant of Patent License. Subject to the terms and conditions of
-          this License, each Contributor hereby grants to You a perpetual,
-          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-          (except as stated in this section) patent license to make, have made,
-          use, offer to sell, sell, import, and otherwise transfer the Work,
-          where such license applies only to those patent claims licensable
-          by such Contributor that are necessarily infringed by their
-          Contribution(s) alone or by combination of their Contribution(s)
-          with the Work to which such Contribution(s) was submitted. If You
-          institute patent litigation against any entity (including a
-          cross-claim or counterclaim in a lawsuit) alleging that the Work
-          or a Contribution incorporated within the Work constitutes direct
-          or contributory patent infringement, then any patent licenses
-          granted to You under this License for that Work shall terminate
-          as of the date such litigation is filed.
-
-       4. Redistribution. You may reproduce and distribute copies of the
-          Work or Derivative Works thereof in any medium, with or without
-          modifications, and in Source or Object form, provided that You
-          meet the following conditions:
-
-          (a) You must give any other recipients of the Work or
-              Derivative Works a copy of this License; and
-
-          (b) You must cause any modified files to carry prominent notices
-              stating that You changed the files; and
-
-          (c) You must retain, in the Source form of any Derivative Works
-              that You distribute, all copyright, patent, trademark, and
-              attribution notices from the Source form of the Work,
-              excluding those notices that do not pertain to any part of
-              the Derivative Works; and
-
-          (d) If the Work includes a "NOTICE" text file as part of its
-              distribution, then any Derivative Works that You distribute must
-              include a readable copy of the attribution notices contained
-              within such NOTICE file, excluding those notices that do not
-              pertain to any part of the Derivative Works, in at least one
-              of the following places: within a NOTICE text file distributed
-              as part of the Derivative Works; within the Source form or
-              documentation, if provided along with the Derivative Works; or,
-              within a display generated by the Derivative Works, if and
-              wherever such third-party notices normally appear. The contents
-              of the NOTICE file are for informational purposes only and
-              do not modify the License. You may add Your own attribution
-              notices within Derivative Works that You distribute, alongside
-              or as an addendum to the NOTICE text from the Work, provided
-              that such additional attribution notices cannot be construed
-              as modifying the License.
-
-          You may add Your own copyright statement to Your modifications and
-          may provide additional or different license terms and conditions
-          for use, reproduction, or distribution of Your modifications, or
-          for any such Derivative Works as a whole, provided Your use,
-          reproduction, and distribution of the Work otherwise complies with
-          the conditions stated in this License.
-
-       5. Submission of Contributions. Unless You explicitly state otherwise,
-          any Contribution intentionally submitted for inclusion in the Work
-          by You to the Licensor shall be under the terms and conditions of
-          this License, without any additional terms or conditions.
-          Notwithstanding the above, nothing herein shall supersede or modify
-          the terms of any separate license agreement you may have executed
-          with Licensor regarding such Contributions.
-
-       6. Trademarks. This License does not grant permission to use the trade
-          names, trademarks, service marks, or product names of the Licensor,
-          except as required for reasonable and customary use in describing the
-          origin of the Work and reproducing the content of the NOTICE file.
-
-       7. Disclaimer of Warranty. Unless required by applicable law or
-          agreed to in writing, Licensor provides the Work (and each
-          Contributor provides its Contributions) on an "AS IS" BASIS,
-          WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-          implied, including, without limitation, any warranties or conditions
-          of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-          PARTICULAR PURPOSE. You are solely responsible for determining the
-          appropriateness of using or redistributing the Work and assume any
-          risks associated with Your exercise of permissions under this License.
-
-       8. Limitation of Liability. In no event and under no legal theory,
-          whether in tort (including negligence), contract, or otherwise,
-          unless required by applicable law (such as deliberate and grossly
-          negligent acts) or agreed to in writing, shall any Contributor be
-          liable to You for damages, including any direct, indirect, special,
-          incidental, or consequential damages of any character arising as a
-          result of this License or out of the use or inability to use the
-          Work (including but not limited to damages for loss of goodwill,
-          work stoppage, computer failure or malfunction, or any and all
-          other commercial damages or losses), even if such Contributor
-          has been advised of the possibility of such damages.
-
-       9. Accepting Warranty or Additional Liability. While redistributing
-          the Work or Derivative Works thereof, You may choose to offer,
-          and charge a fee for, acceptance of support, warranty, indemnity,
-          or other liability obligations and/or rights consistent with this
-          License. However, in accepting such obligations, You may act only
-          on Your own behalf and on Your sole responsibility, not on behalf
-          of any other Contributor, and only if You agree to indemnify,
-          defend, and hold each Contributor harmless for any liability
-          incurred by, or claims asserted against, such Contributor by reason
-          of your accepting any such warranty or additional liability.
-
-       END OF TERMS AND CONDITIONS
-
-       APPENDIX: How to apply the Apache License to your work.
-
-          To apply the Apache License to your work, attach the following
-          boilerplate notice, with the fields enclosed by brackets "[]"
-          replaced with your own identifying information. (Don't include
-          the brackets!)  The text should be enclosed in the appropriate
-          comment syntax for the file format. We also recommend that a
-          file or class name and description of purpose be included on the
-          same "printed page" as the copyright notice for easier
-          identification within third-party archives.
-
-       Copyright [yyyy] [name of copyright owner]
-
-       Licensed under the Apache License, Version 2.0 (the "License");
-       you may not use this file except in compliance with the License.
-       You may obtain a copy of the License at
-
-           http://www.apache.org/licenses/LICENSE-2.0
-
-       Unless required by applicable law or agreed to in writing, software
-       distributed under the License is distributed on an "AS IS" BASIS,
-       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-       See the License for the specific language governing permissions and
-       limitations under the License.
-notices: []

.licenses/npm/deprecation.dep.yml

@@ -1,28 +0,0 @@
----
-name: deprecation
-version: 2.3.1
-type: npm
-summary: Log a deprecation message with stack
-homepage: https://github.com/gr2m/deprecation#readme
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Gregor Martynus and contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-- sources: README.md
-  text: "[ISC](LICENSE)"
-notices: []

.licenses/npm/fast-content-type-parse.dep.yml

@@ -0,0 +1,37 @@
+---
+name: fast-content-type-parse
+version: 3.0.0
+type: npm
+summary: Parse HTTP Content-Type header according to RFC 7231
+homepage: https://github.com/fastify/fast-content-type-parse#readme
+license: other
+licenses:
+- sources: LICENSE
+  text: |-
+    MIT License
+
+    Copyright (c) 2023 The Fastify Team
+
+    The Fastify team members are listed at https://github.com/fastify/fastify#team
+    and in the README file.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: Licensed under [MIT](./LICENSE).
+notices: []

.licenses/npm/fast-xml-builder.dep.yml

@@ -1,16 +1,16 @@
 ---
-name: js-toml
+name: fast-xml-builder
-version: 1.0.2
+version: 1.2.0
 type: npm
-summary: A TOML parser for JavaScript/TypeScript, targeting TOML 1.0.0 Spec
+summary: Build XML from JSON without C/C++ based libraries
-homepage: https://github.com/sunnyadn/js-toml
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE
   text: |
     MIT License
 
-    Copyright (c) 2022 Sunny
+    Copyright (c) 2026 Natural Intelligence
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal
@@ -29,6 +29,4 @@ licenses:
     LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE.
-- sources: README.md
-  text: MIT
 notices: []

.licenses/npm/fast-xml-parser.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.3.3
+version: 5.7.2
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:

.licenses/npm/json-with-bigint.dep.yml

@@ -1,16 +1,17 @@
 ---
-name: "@azure/abort-controller"
+name: json-with-bigint
-version: 1.1.0
+version: 3.5.8
 type: npm
-summary: Microsoft Azure SDK for JavaScript - Aborter
+summary: JS library that allows you to easily serialize and deserialize data with
-homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/abort-controller/README.md
+  BigInt values
+homepage:
 license: mit
 licenses:
 - sources: LICENSE
   text: |
-    The MIT License (MIT)
+    MIT License
 
-    Copyright (c) 2020 Microsoft
+    Copyright (c) 2023 Ivan Korolenko
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal

.licenses/npm/lodash-es.dep.yml

@@ -1,58 +0,0 @@
----
-name: lodash-es
-version: 4.17.21
-type: npm
-summary: Lodash exported as ES modules.
-homepage: https://lodash.com/custom-builds
-license: other
-licenses:
-- sources: LICENSE
-  text: |
-    Copyright OpenJS Foundation and other contributors <https://openjsf.org/>
-
-    Based on Underscore.js, copyright Jeremy Ashkenas,
-    DocumentCloud and Investigative Reporters & Editors <http://underscorejs.org/>
-
-    This software consists of voluntary contributions made by many
-    individuals. For exact contribution history, see the revision history
-    available at https://github.com/lodash/lodash
-
-    The following license applies to all parts of this software except as
-    documented below:
-
-    ====
-
-    Permission is hereby granted, free of charge, to any person obtaining
-    a copy of this software and associated documentation files (the
-    "Software"), to deal in the Software without restriction, including
-    without limitation the rights to use, copy, modify, merge, publish,
-    distribute, sublicense, and/or sell copies of the Software, and to
-    permit persons to whom the Software is furnished to do so, subject to
-    the following conditions:
-
-    The above copyright notice and this permission notice shall be
-    included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-    NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-    LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-    OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-    WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-    ====
-
-    Copyright and related rights for sample code are waived via CC0. Sample
-    code is defined as all source code displayed within the prose of the
-    documentation.
-
-    CC0: http://creativecommons.org/publicdomain/zero/1.0/
-
-    ====
-
-    Files located in the node_modules and vendor directories are externally
-    maintained libraries used by this software which have their own
-    licenses; we recommend you read them, as their terms may differ from the
-    terms above.
-notices: []

.licenses/npm/minimatch-10.2.5.dep.yml

@@ -0,0 +1,66 @@
+---
+name: minimatch
+version: 10.2.5
+type: npm
+summary: a glob matcher in javascript
+homepage:
+license: blueoak-1.0.0
+licenses:
+- sources: LICENSE.md
+  text: |
+    # Blue Oak Model License
+
+    Version 1.0.0
+
+    ## Purpose
+
+    This license gives everyone as much permission to work with
+    this software as possible, while protecting contributors
+    from liability.
+
+    ## Acceptance
+
+    In order to receive this license, you must agree to its
+    rules. The rules of this license are both obligations
+    under that agreement and conditions to your license.
+    You must not do anything with this software that triggers
+    a rule that you cannot or will not follow.
+
+    ## Copyright
+
+    Each contributor licenses you to do everything with this
+    software that would otherwise infringe that contributor's
+    copyright in it.
+
+    ## Notices
+
+    You must ensure that everyone who gets a copy of
+    any part of this software from you, with or without
+    changes, also gets the text of this license or a link to
+    <https://blueoakcouncil.org/license/1.0.0>.
+
+    ## Excuse
+
+    If anyone notifies you in writing that you have not
+    complied with [Notices](#notices), you can keep your
+    license by taking all practical steps to comply within 30
+    days after the notice. If you do not do so, your license
+    ends immediately.
+
+    ## Patent
+
+    Each contributor licenses you to do everything with this
+    software that would otherwise infringe any patent claims
+    they can license or become able to license.
+
+    ## Reliability
+
+    No contributor can revoke this license.
+
+    ## No Liability
+
+    **_As far as the law allows, this software comes as is,
+    without any warranty or condition, and no contributor
+    will be liable to anyone for any damages related to this
+    software or this license, under any kind of legal claim._**
+notices: []

.licenses/npm/minimatch-3.1.5.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: minimatch
-version: 3.1.2
+version: 3.1.5
 type: npm
 summary: a glob matcher in javascript
-homepage: https://github.com/isaacs/minimatch#readme
+homepage:
 license: isc
 licenses:
 - sources: LICENSE

.licenses/npm/once.dep.yml

@@ -1,26 +0,0 @@
----
-name: once
-version: 1.4.0
-type: npm
-summary: Run a function exactly one time
-homepage: https://github.com/isaacs/once#readme
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/path-expression-matcher.dep.yml

@@ -1,16 +1,16 @@
 ---
-name: xregexp
+name: path-expression-matcher
-version: 5.1.2
+version: 1.5.0
 type: npm
-summary: Extended regular expressions
+summary: Efficient path tracking and pattern matching for XML/JSON parsers
-homepage: http://xregexp.com/
+homepage: https://github.com/NaturalIntelligence/path-expression-matcher#readme
 license: mit
 licenses:
 - sources: LICENSE
   text: |
-    The MIT License
+    MIT License
 
-    Copyright (c) 2007-present Steven Levithan <https://xregexp.com/>
+    Copyright (c) 2024
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal
@@ -19,14 +19,14 @@ licenses:
     copies of the Software, and to permit persons to whom the Software is
     furnished to do so, subject to the following conditions:
 
-    The above copyright notice and this permission notice shall be included in
+    The above copyright notice and this permission notice shall be included in all
-    all copies or substantial portions of the Software.
+    copies or substantial portions of the Software.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
     AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    THE SOFTWARE.
+    SOFTWARE.
 notices: []

.licenses/npm/semver-6.3.1.dep.yml

@@ -1,26 +0,0 @@
----
-name: semver
-version: 6.3.1
-type: npm
-summary: The semantic version parser used by npm.
-homepage: 
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/semver.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: semver
-version: 7.7.3
+version: 7.8.5
 type: npm
 summary: The semantic version parser used by npm.
 homepage:

.licenses/npm/strnum.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: strnum
-version: 2.1.2
+version: 2.2.3
 type: npm
 summary: Parse String to Number based on configuration
 homepage:

.licenses/npm/undici.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 5.29.0
+version: 6.27.0
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org

.licenses/npm/universal-user-agent.dep.yml

@@ -1,8 +1,8 @@
 ---
 name: universal-user-agent
-version: 6.0.1
+version: 7.0.3
 type: npm
-summary: Get a user agent string in both browser and node
+summary: Get a user agent string across all JavaScript Runtime Environments
 homepage:
 license: isc
 licenses:
@@ -10,7 +10,7 @@ licenses:
   text: |
     # [ISC License](https://spdx.org/licenses/ISC)
 
-    Copyright (c) 2018, Gregor Martynus (https://github.com/gr2m)
+    Copyright (c) 2018-2021, Gregor Martynus (https://github.com/gr2m)
 
     Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
 

.licenses/npm/uuid.dep.yml

@@ -1,20 +0,0 @@
----
-name: uuid
-version: 11.1.0
-type: npm
-summary: RFC9562 UUIDs
-homepage:
-license: mit
-licenses:
-- sources: LICENSE.md
-  text: |
-    The MIT License (MIT)
-
-    Copyright (c) 2010-2020 Robert Kieffer and other contributors
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []

.licenses/npm/wrappy.dep.yml

@@ -1,26 +0,0 @@
----
-name: wrappy
-version: 1.0.2
-type: npm
-summary: Callback wrapping utility
-homepage: https://github.com/npm/wrappy
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/xml-naming.dep.yml

@@ -0,0 +1,12 @@
+---
+name: xml-naming
+version: 0.1.0
+type: npm
+summary: Validates XML name productions — Name, NCName, QName, NMToken, NMTokens —
+  for XML 1.0 and 1.1
+homepage:
+license: mit
+licenses:
+- sources: README.md
+  text: MIT
+notices: []

.prettierrc.js

@@ -1,11 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports = {
-  printWidth: 80,
-  tabWidth: 2,
-  useTabs: false,
-  semi: true,
-  singleQuote: true,
-  trailingComma: 'none',
-  bracketSpacing: false,
-  arrowParens: 'avoid'
-};

.prettierrc.json

@@ -0,0 +1,10 @@
+{
+  "printWidth": 80,
+  "tabWidth": 2,
+  "useTabs": false,
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "bracketSpacing": false,
+  "arrowParens": "avoid"
+}

README.md

@@ -12,6 +12,10 @@ This action provides the following functionality for GitHub Actions users:
 - Registering problem matchers for error output
 - Configuring authentication for GPR or npm
 
+## Breaking changes in V7
+
+- **Migrated to ESM** to enable support for the latest `@actions/*` package versions.
+
 ## Breaking changes in V6
 
 - Caching is now automatically enabled for npm projects when either the `devEngines.packageManager` field or the top-level `packageManager` field in `package.json` is set to `npm`. For other package managers, such as Yarn and pnpm, caching is disabled by default and must be configured manually using the `cache` input.
@@ -41,7 +45,7 @@ See [action.yml](action.yml)
     # Examples: 12.x, 10.15.1, >=10.15.0, lts/Hydrogen, 16-nightly, latest, node
     node-version: ''
 
-    # File containing the version Spec of the version to use.  Examples: package.json, mise.toml, .nvmrc, .node-version, .tool-versions.
+    # File containing the version Spec of the version to use.  Examples: package.json, .nvmrc, .node-version, .tool-versions.
     # If node-version and node-version-file are both provided the action will use version from node-version.
     node-version-file: ''
 
@@ -119,6 +123,7 @@ steps:
 - uses: actions/setup-node@v6
   with:
     node-version: 24
+    package-manager-cache: false # Disable automatic npm caching if not required
 - run: npm ci
 - run: npm test
 ```
@@ -217,6 +222,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
+          package-manager-cache: false # Disable automatic npm caching if not required
       - run: npm ci
       - run: npm test
 ```
@@ -232,6 +238,7 @@ uses: actions/setup-node@v6
 with:
   token: ${{ secrets.GH_DOTCOM_TOKEN }}
   node-version: 24
+  package-manager-cache: false # Disable automatic npm caching if not required
 ```
 
 If the runner is not able to access github.com, any Nodejs versions requested during a workflow run must come from the runner's tool cache. See "[Setting up the tool cache on self-hosted runners without internet access](https://docs.github.com/en/enterprise-server@3.2/admin/github-actions/managing-access-to-actions-from-githubcom/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access)" for more information.
@@ -249,6 +256,7 @@ If the runner is not able to access github.com, any Nodejs versions requested du
  - [Publishing to npmjs and GPR with npm](docs/advanced-usage.md#publish-to-npmjs-and-gpr-with-npm)
  - [Publishing to npmjs and GPR with yarn](docs/advanced-usage.md#publish-to-npmjs-and-gpr-with-yarn)
  - [Using private packages](docs/advanced-usage.md#use-private-packages)
+ - [Publishing to npm with Trusted Publisher (OIDC)](docs/advanced-usage.md#publishing-to-npm-with-trusted-publisher-oidc)
  - [Using private mirror](docs/advanced-usage.md#use-private-mirror)
 
 ## Recommended permissions

__tests__/authutil.test.ts

@@ -1,19 +1,57 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeAll,
+  beforeEach,
+  afterAll
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
 import os from 'os';
 import fs from 'fs';
 import * as path from 'path';
-import * as core from '@actions/core';
 import * as io from '@actions/io';
-import * as auth from '../src/authutil';
+
-import * as cacheUtils from '../src/cache-utils';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn((name: string) => {
+    const val =
+      process.env[`INPUT_${name.replace(/ /g, '_').toUpperCase()}`] || '';
+    return val.trim();
+  }),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn())
+}));
+
+// Dynamic imports AFTER mocking so authutil sees the mocked core.
+const core = await import('@actions/core');
+const auth = await import('../src/authutil.js');
 
 let rcFile: string;
 
 describe('authutil tests', () => {
   const _runnerDir = path.join(__dirname, 'runner');
 
-  let cnSpy: jest.SpyInstance;
+  let cnSpy: jest.SpiedFunction<typeof process.stdout.write>;
-  let logSpy: jest.SpyInstance;
+  let logSpy: jest.SpiedFunction<typeof console.log>;
-  let dbgSpy: jest.SpyInstance;
 
   beforeAll(async () => {
     const randPath = path.join(Math.random().toString(36).substring(7));
@@ -37,19 +75,8 @@ describe('authutil tests', () => {
     // writes
     cnSpy = jest.spyOn(process.stdout, 'write');
     logSpy = jest.spyOn(console, 'log');
-    dbgSpy = jest.spyOn(core, 'debug');
+    cnSpy.mockImplementation(() => true);
-    cnSpy.mockImplementation(line => {
+    logSpy.mockImplementation(() => {});
-      // uncomment to debug
-      // process.stderr.write('write:' + line + '\n');
-    });
-    logSpy.mockImplementation(line => {
-      // uncomment to debug
-      // process.stderr.write('log:' + line + '\n');
-    });
-    dbgSpy.mockImplementation(msg => {
-      // uncomment to see debug output
-      // process.stderr.write(msg + '\n');
-    });
   }, 100000);
 
   function dbg(message: string) {
@@ -118,6 +145,29 @@ describe('authutil tests', () => {
     expect(process.env.NODE_AUTH_TOKEN).toEqual('foobar');
   });
 
+  it('should not export NODE_AUTH_TOKEN if not set in environment', async () => {
+    const exportSpy = core.exportVariable as jest.Mock;
+    exportSpy.mockClear();
+    delete process.env.NODE_AUTH_TOKEN;
+    await auth.configAuthentication('https://registry.npmjs.org/');
+    expect(fs.statSync(rcFile)).toBeDefined();
+    const rc = readRcFile(rcFile);
+    expect(rc['registry']).toBe('https://registry.npmjs.org/');
+    expect(exportSpy).not.toHaveBeenCalledWith(
+      'NODE_AUTH_TOKEN',
+      expect.anything()
+    );
+  });
+
+  it('should export NODE_AUTH_TOKEN if set to empty string', async () => {
+    const exportSpy = core.exportVariable as jest.Mock;
+    exportSpy.mockClear();
+    process.env.NODE_AUTH_TOKEN = '';
+    await auth.configAuthentication('https://registry.npmjs.org/');
+    expect(fs.statSync(rcFile)).toBeDefined();
+    expect(exportSpy).toHaveBeenCalledWith('NODE_AUTH_TOKEN', '');
+  });
+
   it('configAuthentication should overwrite non-scoped with non-scoped', async () => {
     fs.writeFileSync(rcFile, 'registry=NNN');
     await auth.configAuthentication('https://registry.npmjs.org/');

__tests__/cache-restore.test.ts

@@ -1,14 +1,76 @@
-import * as core from '@actions/core';
+import {jest, describe, it, expect, beforeEach, afterEach} from '@jest/globals';
-import * as cache from '@actions/cache';
+import {fileURLToPath} from 'url';
 import * as path from 'path';
-import * as glob from '@actions/glob';
 import osm from 'os';
 
-import * as utils from '../src/cache-utils';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
-import {restoreCache} from '../src/cache-restore';
+
+// Mock @actions modules before importing anything that depends on them
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/cache', () => ({
+  saveCache: jest.fn(),
+  restoreCache: jest.fn(),
+  isFeatureAvailable: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/glob', () => ({
+  hashFiles: jest.fn(),
+  create: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/exec', () => ({
+  exec: jest.fn(),
+  getExecOutput: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/io', () => ({
+  which: jest.fn(),
+  mkdirP: jest.fn(),
+  rmRF: jest.fn(),
+  mv: jest.fn(),
+  cp: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const cache = await import('@actions/cache');
+const glob = await import('@actions/glob');
+const exec = await import('@actions/exec');
+const utils = await import('../src/cache-utils.js');
+const {restoreCache} = await import('../src/cache-restore.js');
 
 describe('cache-restore', () => {
-  process.env['GITHUB_WORKSPACE'] = path.join(__dirname, 'data');
+  const packageManagers = ['yarn', 'npm', 'pnpm'] as const;
+  type PackageManager = (typeof packageManagers)[number];
+
+  const setWorkspaceFor = (pm: PackageManager) => {
+    process.env['GITHUB_WORKSPACE'] = path.join(__dirname, 'data', pm);
+  };
+  const originalGithubWorkspace = process.env['GITHUB_WORKSPACE'];
   if (!process.env.RUNNER_OS) {
     process.env.RUNNER_OS = 'Linux';
   }
@@ -25,7 +87,7 @@ describe('cache-restore', () => {
     'abf7c9b306a3149dcfba4673e2362755503bcceaab46f0e4e6fee0ade493e20c';
   const pnpmFileHash =
     '26309058093e84713f38869c50cf1cee9b08155ede874ec1b44ce3fca8c68c70';
-  const cachesObject = {
+  const cachesObject: Record<string, string> = {
     [npmCachePath]: npmFileHash,
     [pnpmCachePath]: pnpmFileHash,
     [yarn1CachePath]: yarnFileHash,
@@ -47,64 +109,66 @@ describe('cache-restore', () => {
     }
   }
 
-  let saveStateSpy: jest.SpyInstance;
+  let saveStateSpy: jest.Mock;
-  let infoSpy: jest.SpyInstance;
+  let infoSpy: jest.Mock;
-  let debugSpy: jest.SpyInstance;
+  let debugSpy: jest.Mock;
-  let setOutputSpy: jest.SpyInstance;
+  let setOutputSpy: jest.Mock;
-  let getCommandOutputSpy: jest.SpyInstance;
+  let getExecOutputSpy: jest.Mock;
-  let restoreCacheSpy: jest.SpyInstance;
+  let restoreCacheSpy: jest.Mock;
-  let hashFilesSpy: jest.SpyInstance;
+  let hashFilesSpy: jest.Mock;
-  let archSpy: jest.SpyInstance;
+  let archSpy: jest.SpiedFunction<typeof osm.arch>;
 
   beforeEach(() => {
     // core
-    infoSpy = jest.spyOn(core, 'info');
+    infoSpy = core.info as jest.Mock;
     infoSpy.mockImplementation(() => undefined);
 
-    debugSpy = jest.spyOn(core, 'debug');
+    debugSpy = core.debug as jest.Mock;
     debugSpy.mockImplementation(() => undefined);
 
-    setOutputSpy = jest.spyOn(core, 'setOutput');
+    setOutputSpy = core.setOutput as jest.Mock;
     setOutputSpy.mockImplementation(() => undefined);
 
-    saveStateSpy = jest.spyOn(core, 'saveState');
+    saveStateSpy = core.saveState as jest.Mock;
     saveStateSpy.mockImplementation(() => undefined);
 
     // glob
-    hashFilesSpy = jest.spyOn(glob, 'hashFiles');
+    hashFilesSpy = glob.hashFiles as jest.Mock;
-    hashFilesSpy.mockImplementation((pattern: string) => {
+    (hashFilesSpy as jest.Mock<typeof glob.hashFiles>).mockImplementation(
-      if (pattern.includes('package-lock.json')) {
+      async (pattern: string) => {
-        return npmFileHash;
+        if (pattern.includes('package-lock.json')) {
-      } else if (pattern.includes('pnpm-lock.yaml')) {
+          return npmFileHash;
-        return pnpmFileHash;
+        } else if (pattern.includes('pnpm-lock.yaml')) {
-      } else if (pattern.includes('yarn.lock')) {
+          return pnpmFileHash;
-        return yarnFileHash;
+        } else if (pattern.includes('yarn.lock')) {
-      } else {
+          return yarnFileHash;
-        return '';
+        } else {
-      }
+          return '';
-    });
-
-    // cache
-    restoreCacheSpy = jest.spyOn(cache, 'restoreCache');
-    restoreCacheSpy.mockImplementation(
-      (cachePaths: Array<string>, key: string) => {
-        if (!cachePaths || cachePaths.length === 0) {
-          return undefined;
         }
-
-        const cachPath = cachePaths[0];
-        const fileHash = cachesObject[cachPath];
-
-        if (key.includes(fileHash)) {
-          return key;
-        }
-
-        return undefined;
       }
     );
 
-    // cache-utils
+    // cache
-    getCommandOutputSpy = jest.spyOn(utils, 'getCommandOutput');
+    restoreCacheSpy = cache.restoreCache as jest.Mock;
+    (
+      restoreCacheSpy as jest.Mock<typeof cache.restoreCache>
+    ).mockImplementation(async (cachePaths: string[], key: string) => {
+      if (!cachePaths || cachePaths.length === 0) {
+        return undefined;
+      }
+
+      const cachPath = cachePaths[0];
+      const fileHash = cachesObject[cachPath];
+
+      if (key.includes(fileHash)) {
+        return key;
+      }
+
+      return undefined;
+    });
+
+    // exec
+    getExecOutputSpy = exec.getExecOutput as jest.Mock;
 
     // os
     archSpy = jest.spyOn(osm, 'arch');
@@ -131,23 +195,33 @@ describe('cache-restore', () => {
     ])(
       'restored dependencies for %s',
       async (packageManager, toolVersion, fileHash) => {
-        getCommandOutputSpy.mockImplementation((command: string) => {
+        const expectedCacheKey = `node-cache-${platform}-${arch}-${packageManager}-${fileHash}`;
-          if (command.includes('version')) {
+        setWorkspaceFor(packageManager as PackageManager);
-            return toolVersion;
+        getExecOutputSpy.mockImplementation(async (command: any) => ({
-          } else {
+          stdout: command.includes('version')
-            return findCacheFolder(command);
+            ? toolVersion
-          }
+            : findCacheFolder(command),
-        });
+          stderr: '',
+          exitCode: 0
+        }));
 
         await restoreCache(packageManager, '');
         expect(hashFilesSpy).toHaveBeenCalled();
         expect(infoSpy).toHaveBeenCalledWith(
-          `Cache restored from key: node-cache-${platform}-${arch}-${packageManager}-${fileHash}`
+          `Cache restored from key: ${expectedCacheKey}`
         );
         expect(infoSpy).not.toHaveBeenCalledWith(
           `${packageManager} cache is not found`
         );
         expect(setOutputSpy).toHaveBeenCalledWith('cache-hit', true);
+        expect(setOutputSpy).toHaveBeenCalledWith(
+          'cache-primary-key',
+          expectedCacheKey
+        );
+        expect(setOutputSpy).toHaveBeenCalledWith(
+          'cache-matched-key',
+          expectedCacheKey
+        );
       }
     );
   });
@@ -161,13 +235,15 @@ describe('cache-restore', () => {
     ])(
       'dependencies are changed %s',
       async (packageManager, toolVersion, fileHash) => {
-        getCommandOutputSpy.mockImplementation((command: string) => {
+        const expectedCacheKey = `node-cache-${platform}-${arch}-${packageManager}-${fileHash}`;
-          if (command.includes('version')) {
+        setWorkspaceFor(packageManager as PackageManager);
-            return toolVersion;
+        getExecOutputSpy.mockImplementation(async (command: any) => ({
-          } else {
+          stdout: command.includes('version')
-            return findCacheFolder(command);
+            ? toolVersion
-          }
+            : findCacheFolder(command),
-        });
+          stderr: '',
+          exitCode: 0
+        }));
 
         restoreCacheSpy.mockImplementationOnce(() => undefined);
         await restoreCache(packageManager, '');
@@ -176,11 +252,24 @@ describe('cache-restore', () => {
           `${packageManager} cache is not found`
         );
         expect(setOutputSpy).toHaveBeenCalledWith('cache-hit', false);
+        expect(setOutputSpy).toHaveBeenCalledWith(
+          'cache-primary-key',
+          expectedCacheKey
+        );
+        expect(setOutputSpy).toHaveBeenCalledWith(
+          'cache-matched-key',
+          undefined
+        );
       }
     );
   });
 
   afterEach(() => {
+    if (originalGithubWorkspace === undefined) {
+      delete process.env['GITHUB_WORKSPACE'];
+    } else {
+      process.env['GITHUB_WORKSPACE'] = originalGithubWorkspace;
+    }
     jest.resetAllMocks();
     jest.clearAllMocks();
   });

__tests__/cache-save.test.ts

@@ -1,12 +1,74 @@
-import * as core from '@actions/core';
+import {jest, describe, it, expect, beforeEach, afterEach} from '@jest/globals';
-import * as cache from '@actions/cache';
+import {fileURLToPath} from 'url';
-import * as glob from '@actions/glob';
-import fs from 'fs';
 import path from 'path';
+import fs from 'fs';
 
-import * as utils from '../src/cache-utils';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
-import {run} from '../src/cache-save';
+
-import {State} from '../src/constants';
+// Mock @actions modules before importing anything that depends on them
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/cache', () => ({
+  saveCache: jest.fn(),
+  restoreCache: jest.fn(),
+  isFeatureAvailable: jest.fn(),
+  ValidationError: class ValidationError extends Error {
+    constructor(message: string) {
+      super(message);
+      this.name = 'ValidationError';
+    }
+  }
+}));
+
+jest.unstable_mockModule('@actions/glob', () => ({
+  hashFiles: jest.fn(),
+  create: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/exec', () => ({
+  exec: jest.fn(),
+  getExecOutput: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/io', () => ({
+  which: jest.fn(),
+  mkdirP: jest.fn(),
+  rmRF: jest.fn(),
+  mv: jest.fn(),
+  cp: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const cache = await import('@actions/cache');
+const glob = await import('@actions/glob');
+const exec = await import('@actions/exec');
+const utils = await import('../src/cache-utils.js');
+const {run} = await import('../src/cache-save.js');
+const {State} = await import('../src/constants.js');
 
 describe('run', () => {
   const yarnFileHash =
@@ -20,42 +82,42 @@ describe('run', () => {
 
   const inputs = {} as any;
 
-  let getInputSpy: jest.SpyInstance;
+  let getInputSpy: jest.Mock;
-  let infoSpy: jest.SpyInstance;
+  let infoSpy: jest.Mock;
-  let warningSpy: jest.SpyInstance;
+  let warningSpy: jest.Mock;
-  let debugSpy: jest.SpyInstance;
+  let debugSpy: jest.Mock;
-  let setFailedSpy: jest.SpyInstance;
+  let setFailedSpy: jest.Mock;
-  let getStateSpy: jest.SpyInstance;
+  let getStateSpy: jest.Mock;
-  let saveCacheSpy: jest.SpyInstance;
+  let saveCacheSpy: jest.Mock;
-  let getCommandOutputSpy: jest.SpyInstance;
+  let getExecOutputSpy: jest.Mock;
-  let hashFilesSpy: jest.SpyInstance;
+  let hashFilesSpy: jest.Mock;
-  let existsSpy: jest.SpyInstance;
+  let existsSpy: jest.SpiedFunction<typeof fs.existsSync>;
 
   beforeEach(() => {
-    getInputSpy = jest.spyOn(core, 'getInput');
+    getInputSpy = core.getInput as jest.Mock;
-    getInputSpy.mockImplementation((name: string) => inputs[name]);
+    getInputSpy.mockImplementation((name: any) => inputs[name]);
 
-    infoSpy = jest.spyOn(core, 'info');
+    infoSpy = core.info as jest.Mock;
     infoSpy.mockImplementation(() => undefined);
 
-    warningSpy = jest.spyOn(core, 'warning');
+    warningSpy = core.warning as jest.Mock;
     warningSpy.mockImplementation(() => undefined);
 
-    setFailedSpy = jest.spyOn(core, 'setFailed');
+    setFailedSpy = core.setFailed as jest.Mock;
     setFailedSpy.mockImplementation(() => undefined);
 
-    debugSpy = jest.spyOn(core, 'debug');
+    debugSpy = core.debug as jest.Mock;
     debugSpy.mockImplementation(() => undefined);
 
-    getStateSpy = jest.spyOn(core, 'getState');
+    getStateSpy = core.getState as jest.Mock;
 
     // cache
-    saveCacheSpy = jest.spyOn(cache, 'saveCache');
+    saveCacheSpy = cache.saveCache as jest.Mock;
     saveCacheSpy.mockImplementation(() => undefined);
 
     // glob
-    hashFilesSpy = jest.spyOn(glob, 'hashFiles');
+    hashFilesSpy = glob.hashFiles as jest.Mock;
-    hashFilesSpy.mockImplementation((pattern: string) => {
+    hashFilesSpy.mockImplementation((pattern: any) => {
       if (pattern.includes('package-lock.json')) {
         return npmFileHash;
       } else if (pattern.includes('yarn.lock')) {
@@ -68,17 +130,20 @@ describe('run', () => {
     existsSpy = jest.spyOn(fs, 'existsSync');
     existsSpy.mockImplementation(() => true);
 
-    // utils
+    // exec
-    getCommandOutputSpy = jest.spyOn(utils, 'getCommandOutput');
+    getExecOutputSpy = exec.getExecOutput as jest.Mock;
   });
 
   afterEach(() => {
     existsSpy.mockRestore();
+    jest.resetAllMocks();
+    jest.clearAllMocks();
   });
 
   describe('Package manager validation', () => {
     it('Package manager is not provided, skip caching', async () => {
       inputs['cache'] = '';
+      getStateSpy.mockImplementation(() => '');
 
       await run();
 
@@ -124,7 +189,7 @@ describe('run', () => {
 
       expect(getInputSpy).not.toHaveBeenCalled();
       expect(getStateSpy).toHaveBeenCalledTimes(4);
-      expect(getCommandOutputSpy).toHaveBeenCalledTimes(0);
+      expect(getExecOutputSpy).toHaveBeenCalledTimes(0);
       expect(debugSpy).toHaveBeenCalledTimes(0);
       expect(infoSpy).toHaveBeenCalledWith(
         `Cache hit occurred on the primary key ${yarnFileHash}, not saving cache.`
@@ -148,7 +213,7 @@ describe('run', () => {
 
       expect(getInputSpy).not.toHaveBeenCalled();
       expect(getStateSpy).toHaveBeenCalledTimes(4);
-      expect(getCommandOutputSpy).toHaveBeenCalledTimes(0);
+      expect(getExecOutputSpy).toHaveBeenCalledTimes(0);
       expect(debugSpy).toHaveBeenCalledTimes(0);
       expect(infoSpy).toHaveBeenCalledWith(
         `Cache hit occurred on the primary key ${yarnFileHash}, not saving cache.`
@@ -167,13 +232,17 @@ describe('run', () => {
               ? '["/foo/bar"]'
               : 'not expected'
       );
-      getCommandOutputSpy.mockImplementationOnce(() => `${commonPath}/npm`);
+      getExecOutputSpy.mockImplementationOnce(() => ({
+        stdout: `${commonPath}/npm`,
+        stderr: '',
+        exitCode: 0
+      }));
 
       await run();
 
       expect(getInputSpy).not.toHaveBeenCalled();
       expect(getStateSpy).toHaveBeenCalledTimes(4);
-      expect(getCommandOutputSpy).toHaveBeenCalledTimes(0);
+      expect(getExecOutputSpy).toHaveBeenCalledTimes(0);
       expect(debugSpy).toHaveBeenCalledTimes(0);
       expect(setFailedSpy).not.toHaveBeenCalled();
     });
@@ -194,7 +263,7 @@ describe('run', () => {
 
       expect(getInputSpy).not.toHaveBeenCalled();
       expect(getStateSpy).toHaveBeenCalledTimes(4);
-      expect(getCommandOutputSpy).toHaveBeenCalledTimes(0);
+      expect(getExecOutputSpy).toHaveBeenCalledTimes(0);
       expect(debugSpy).toHaveBeenCalledTimes(0);
       expect(setFailedSpy).not.toHaveBeenCalled();
     });
@@ -203,7 +272,7 @@ describe('run', () => {
   describe('action saves the cache', () => {
     it('saves cache from yarn 1', async () => {
       inputs['cache'] = 'yarn';
-      getStateSpy.mockImplementation((key: string) =>
+      getStateSpy.mockImplementation((key: any) =>
         key === State.CachePackageManager
           ? inputs['cache']
           : key === State.CacheMatchedKey
@@ -219,7 +288,7 @@ describe('run', () => {
 
       expect(getInputSpy).not.toHaveBeenCalled();
       expect(getStateSpy).toHaveBeenCalledTimes(4);
-      expect(getCommandOutputSpy).toHaveBeenCalledTimes(0);
+      expect(getExecOutputSpy).toHaveBeenCalledTimes(0);
       expect(debugSpy).toHaveBeenCalledTimes(0);
       expect(infoSpy).not.toHaveBeenCalledWith(
         `Cache hit occurred on the primary key ${yarnFileHash}, not saving cache.`
@@ -233,7 +302,7 @@ describe('run', () => {
 
     it('saves cache from yarn 2', async () => {
       inputs['cache'] = 'yarn';
-      getStateSpy.mockImplementation((key: string) =>
+      getStateSpy.mockImplementation((key: any) =>
         key === State.CachePackageManager
           ? inputs['cache']
           : key === State.CacheMatchedKey
@@ -249,7 +318,7 @@ describe('run', () => {
 
       expect(getInputSpy).not.toHaveBeenCalled();
       expect(getStateSpy).toHaveBeenCalledTimes(4);
-      expect(getCommandOutputSpy).toHaveBeenCalledTimes(0);
+      expect(getExecOutputSpy).toHaveBeenCalledTimes(0);
       expect(debugSpy).toHaveBeenCalledTimes(0);
       expect(infoSpy).not.toHaveBeenCalledWith(
         `Cache hit occurred on the primary key ${yarnFileHash}, not saving cache.`
@@ -263,7 +332,7 @@ describe('run', () => {
 
     it('saves cache from npm', async () => {
       inputs['cache'] = 'npm';
-      getStateSpy.mockImplementation((key: string) =>
+      getStateSpy.mockImplementation((key: any) =>
         key === State.CachePackageManager
           ? inputs['cache']
           : key === State.CacheMatchedKey
@@ -279,7 +348,7 @@ describe('run', () => {
 
       expect(getInputSpy).not.toHaveBeenCalled();
       expect(getStateSpy).toHaveBeenCalledTimes(4);
-      expect(getCommandOutputSpy).toHaveBeenCalledTimes(0);
+      expect(getExecOutputSpy).toHaveBeenCalledTimes(0);
       expect(debugSpy).toHaveBeenCalledTimes(0);
       expect(infoSpy).not.toHaveBeenCalledWith(
         `Cache hit occurred on the primary key ${npmFileHash}, not saving cache.`
@@ -293,7 +362,7 @@ describe('run', () => {
 
     it('saves cache from pnpm', async () => {
       inputs['cache'] = 'pnpm';
-      getStateSpy.mockImplementation((key: string) =>
+      getStateSpy.mockImplementation((key: any) =>
         key === State.CachePackageManager
           ? inputs['cache']
           : key === State.CacheMatchedKey
@@ -309,7 +378,7 @@ describe('run', () => {
 
       expect(getInputSpy).not.toHaveBeenCalled();
       expect(getStateSpy).toHaveBeenCalledTimes(4);
-      expect(getCommandOutputSpy).toHaveBeenCalledTimes(0);
+      expect(getExecOutputSpy).toHaveBeenCalledTimes(0);
       expect(debugSpy).toHaveBeenCalledTimes(0);
       expect(infoSpy).not.toHaveBeenCalledWith(
         `Cache hit occurred on the primary key ${pnpmFileHash}, not saving cache.`
@@ -323,7 +392,7 @@ describe('run', () => {
 
     it('save with -1 cacheId , should not fail workflow', async () => {
       inputs['cache'] = 'npm';
-      getStateSpy.mockImplementation((key: string) =>
+      getStateSpy.mockImplementation((key: any) =>
         key === State.CachePackageManager
           ? inputs['cache']
           : key === State.CacheMatchedKey
@@ -342,8 +411,10 @@ describe('run', () => {
 
       expect(getInputSpy).not.toHaveBeenCalled();
       expect(getStateSpy).toHaveBeenCalledTimes(4);
-      expect(getCommandOutputSpy).toHaveBeenCalledTimes(0);
+      expect(getExecOutputSpy).toHaveBeenCalledTimes(0);
-      expect(debugSpy).toHaveBeenCalledTimes(0);
+      expect(debugSpy).toHaveBeenCalledWith(
+        `Cache was not saved for the key: ${yarnFileHash}`
+      );
       expect(infoSpy).not.toHaveBeenCalledWith(
         `Cache hit occurred on the primary key ${npmFileHash}, not saving cache.`
       );
@@ -356,7 +427,7 @@ describe('run', () => {
 
     it('saves with error from toolkit, should fail workflow', async () => {
       inputs['cache'] = 'npm';
-      getStateSpy.mockImplementation((key: string) =>
+      getStateSpy.mockImplementation((key: any) =>
         key === State.CachePackageManager
           ? inputs['cache']
           : key === State.CacheMatchedKey
@@ -375,7 +446,7 @@ describe('run', () => {
 
       expect(getInputSpy).not.toHaveBeenCalled();
       expect(getStateSpy).toHaveBeenCalledTimes(4);
-      expect(getCommandOutputSpy).toHaveBeenCalledTimes(0);
+      expect(getExecOutputSpy).toHaveBeenCalledTimes(0);
       expect(debugSpy).toHaveBeenCalledTimes(0);
       expect(infoSpy).not.toHaveBeenCalledWith(
         `Cache hit occurred on the primary key ${npmFileHash}, not saving cache.`
@@ -384,9 +455,4 @@ describe('run', () => {
       expect(setFailedSpy).toHaveBeenCalled();
     });
   });
-
-  afterEach(() => {
-    jest.resetAllMocks();
-    jest.clearAllMocks();
-  });
 });

__tests__/cache-utils.test.ts

@@ -1,45 +1,133 @@
-import * as core from '@actions/core';
-import * as cache from '@actions/cache';
-import path from 'path';
-import * as utils from '../src/cache-utils';
 import {
-  PackageManagerInfo,
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  afterAll
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
+import path from 'path';
+import fs from 'fs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+// Mock @actions modules before importing anything that depends on them
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/cache', () => ({
+  saveCache: jest.fn(),
+  restoreCache: jest.fn(),
+  isFeatureAvailable: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/glob', () => ({
+  hashFiles: jest.fn(),
+  create: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/exec', () => ({
+  exec: jest.fn(),
+  getExecOutput: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/io', () => ({
+  which: jest.fn(),
+  mkdirP: jest.fn(),
+  rmRF: jest.fn(),
+  mv: jest.fn(),
+  cp: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const cache = await import('@actions/cache');
+const glob = await import('@actions/glob');
+const exec = await import('@actions/exec');
+const utils = await import('../src/cache-utils.js');
+const cacheUtils = await import('../src/cache-utils.js');
+// @ts-ignore - test file outside rootDir
+const {MockGlobber} = await import('./mock/glob-mock.js');
+
+import type {PackageManagerInfo} from '../src/cache-utils.js';
+
+const {
   isCacheFeatureAvailable,
   supportedPackageManagers,
   isGhes,
   resetProjectDirectoriesMemoized
-} from '../src/cache-utils';
+} = utils;
-import fs from 'fs';
+
-import * as cacheUtils from '../src/cache-utils';
+// Helper: mock exec.getExecOutput to simulate getCommandOutput behavior
-import * as glob from '@actions/glob';
+function mockGetCommandOutput(
-import {Globber} from '@actions/glob';
+  spy: jest.Mock,
-import {MockGlobber} from './mock/glob-mock';
+  fn: (command: string, cwd?: string) => string
+) {
+  spy.mockImplementation(async (command: any, _args: any, options: any) => ({
+    stdout: fn(command, options?.cwd),
+    stderr: '',
+    exitCode: 0
+  }));
+}
+
+function mockGetCommandOutputOnce(spy: jest.Mock, result: string) {
+  spy.mockImplementationOnce(async () => ({
+    stdout: result,
+    stderr: '',
+    exitCode: 0
+  }));
+}
 
 describe('cache-utils', () => {
   const versionYarn1 = '1.2.3';
 
-  let debugSpy: jest.SpyInstance;
+  let debugSpy: jest.Mock;
-  let getCommandOutputSpy: jest.SpyInstance;
+  let getExecOutputSpy: jest.Mock;
-  let isFeatureAvailable: jest.SpyInstance;
+  let isFeatureAvailable: jest.Mock;
-  let info: jest.SpyInstance;
+  let info: jest.Mock;
-  let warningSpy: jest.SpyInstance;
+  let warningSpy: jest.Mock;
-  let fsRealPathSyncSpy: jest.SpyInstance;
+  let fsRealPathSyncSpy: jest.SpiedFunction<typeof fs.realpathSync>;
 
   beforeEach(() => {
     console.log('::stop-commands::stoptoken');
     process.env['GITHUB_WORKSPACE'] = path.join(__dirname, 'data');
-    debugSpy = jest.spyOn(core, 'debug');
-    debugSpy.mockImplementation(msg => {});
 
-    info = jest.spyOn(core, 'info');
+    debugSpy = core.debug as jest.Mock;
-    warningSpy = jest.spyOn(core, 'warning');
+    debugSpy.mockImplementation((_msg: any) => {});
 
-    isFeatureAvailable = jest.spyOn(cache, 'isFeatureAvailable');
+    info = core.info as jest.Mock;
+    warningSpy = core.warning as jest.Mock;
 
-    getCommandOutputSpy = jest.spyOn(utils, 'getCommandOutput');
+    isFeatureAvailable = cache.isFeatureAvailable as jest.Mock;
+
+    getExecOutputSpy = exec.getExecOutput as jest.Mock;
 
     fsRealPathSyncSpy = jest.spyOn(fs, 'realpathSync');
-    fsRealPathSyncSpy.mockImplementation(dirName => {
+    fsRealPathSyncSpy.mockImplementation((dirName: any) => {
       return dirName;
     });
   });
@@ -47,7 +135,6 @@ describe('cache-utils', () => {
   afterEach(() => {
     jest.resetAllMocks();
     jest.clearAllMocks();
-    //jest.restoreAllMocks();
   });
 
   afterAll(async () => {
@@ -64,7 +151,7 @@ describe('cache-utils', () => {
       ['yarn2', null],
       ['npm7', null]
     ])('getPackageManagerInfo for %s is %o', async (packageManager, result) => {
-      getCommandOutputSpy.mockImplementationOnce(() => versionYarn1);
+      mockGetCommandOutputOnce(getExecOutputSpy, versionYarn1);
       await expect(utils.getPackageManagerInfo(packageManager)).resolves.toBe(
         result
       );
@@ -92,7 +179,6 @@ describe('cache-utils', () => {
 
   it('isCacheFeatureAvailable for GHES is available', () => {
     isFeatureAvailable.mockImplementation(() => true);
-
     expect(isCacheFeatureAvailable()).toStrictEqual(true);
   });
 
@@ -103,24 +189,22 @@ describe('cache-utils', () => {
   });
 
   describe('getCacheDirectoriesPaths', () => {
-    let existsSpy: jest.SpyInstance;
+    let existsSpy: jest.SpiedFunction<typeof fs.existsSync>;
-    let lstatSpy: jest.SpyInstance;
+    let lstatSpy: jest.SpiedFunction<typeof fs.lstatSync>;
-    let globCreateSpy: jest.SpyInstance;
+    let globCreateSpy: jest.Mock;
 
     beforeEach(() => {
       existsSpy = jest.spyOn(fs, 'existsSync');
       existsSpy.mockImplementation(() => true);
 
       lstatSpy = jest.spyOn(fs, 'lstatSync');
-      lstatSpy.mockImplementation(arg => ({
+      lstatSpy.mockImplementation(
-        isDirectory: () => true
+        (_arg: any) => ({isDirectory: () => true}) as any
-      }));
+      );
 
-      globCreateSpy = jest.spyOn(glob, 'create');
+      globCreateSpy = glob.create as jest.Mock;
-
+      globCreateSpy.mockImplementation((_pattern: any) =>
-      globCreateSpy.mockImplementation(
+        MockGlobber.create(['/foo', '/bar'])
-        (pattern: string): Promise<Globber> =>
-          MockGlobber.create(['/foo', '/bar'])
       );
 
       resetProjectDirectoriesMemoized();
@@ -129,7 +213,6 @@ describe('cache-utils', () => {
     afterEach(() => {
       existsSpy.mockRestore();
       lstatSpy.mockRestore();
-      globCreateSpy.mockRestore();
     });
 
     it.each([
@@ -142,22 +225,18 @@ describe('cache-utils', () => {
     ])(
       'getCacheDirectoriesPaths should return one dir for non yarn',
       async (packageManagerInfo, cacheDependency) => {
-        getCommandOutputSpy.mockImplementation(() => 'foo');
+        mockGetCommandOutput(getExecOutputSpy, () => 'foo');
-
         const dirs = await cacheUtils.getCacheDirectories(
           packageManagerInfo,
           cacheDependency
         );
         expect(dirs).toEqual(['foo']);
-        // to do not call for a version
+        expect(getExecOutputSpy).toHaveBeenCalledTimes(1);
-        // call once for get cache folder
-        expect(getCommandOutputSpy).toHaveBeenCalledTimes(1);
       }
     );
 
     it('getCacheDirectoriesPaths should return one dir for yarn without cacheDependency', async () => {
-      getCommandOutputSpy.mockImplementation(() => 'foo');
+      mockGetCommandOutput(getExecOutputSpy, () => 'foo');
-
       const dirs = await cacheUtils.getCacheDirectories(
         supportedPackageManagers.yarn,
         ''
@@ -178,15 +257,12 @@ describe('cache-utils', () => {
     ])(
       'getCacheDirectoriesPaths should throw for getCommandOutput returning empty',
       async (packageManagerInfo, cacheDependency) => {
-        getCommandOutputSpy.mockImplementation((command: string) =>
+        mockGetCommandOutput(getExecOutputSpy, (command: string) =>
-          // return empty string to indicate getCacheFolderPath failed
-          //        --version still works
           command.includes('version') ? '1.' : ''
         );
-
         await expect(
           cacheUtils.getCacheDirectories(packageManagerInfo, cacheDependency)
-        ).rejects.toThrow(); //'Could not get cache folder path for /dir');
+        ).rejects.toThrow();
       }
     );
 
@@ -196,10 +272,9 @@ describe('cache-utils', () => {
     ])(
       'getCacheDirectoriesPaths should nothrow in case of having not directories',
       async (packageManagerInfo, cacheDependency) => {
-        lstatSpy.mockImplementation(arg => ({
+        lstatSpy.mockImplementation(
-          isDirectory: () => false
+          (_arg: any) => ({isDirectory: () => false}) as any
-        }));
+        );
-
         await cacheUtils.getCacheDirectories(
           packageManagerInfo,
           cacheDependency
@@ -214,9 +289,8 @@ describe('cache-utils', () => {
     it.each(['1.1.1', '2.2.2'])(
       'getCacheDirectoriesPaths yarn v%s should return one dir without cacheDependency',
       async version => {
-        getCommandOutputSpy.mockImplementationOnce(() => version);
+        mockGetCommandOutputOnce(getExecOutputSpy, version);
-        getCommandOutputSpy.mockImplementationOnce(() => `foo${version}`);
+        mockGetCommandOutputOnce(getExecOutputSpy, `foo${version}`);
-
         const dirs = await cacheUtils.getCacheDirectories(
           supportedPackageManagers.yarn,
           ''
@@ -229,14 +303,12 @@ describe('cache-utils', () => {
       'getCacheDirectoriesPaths yarn v%s should return 2 dirs with globbed cacheDependency',
       async version => {
         let dirNo = 1;
-        getCommandOutputSpy.mockImplementation((command: string) =>
+        mockGetCommandOutput(getExecOutputSpy, (command: string) =>
           command.includes('version') ? version : `file_${version}_${dirNo++}`
         );
-        globCreateSpy.mockImplementation(
+        globCreateSpy.mockImplementation((_pattern: any) =>
-          (pattern: string): Promise<Globber> =>
+          MockGlobber.create(['/tmp/dir1/file', '/tmp/dir2/file'])
-            MockGlobber.create(['/tmp/dir1/file', '/tmp/dir2/file'])
         );
-
         const dirs = await cacheUtils.getCacheDirectories(
           supportedPackageManagers.yarn,
           '/tmp/**/file'
@@ -249,18 +321,16 @@ describe('cache-utils', () => {
       'getCacheDirectoriesPaths yarn v%s should return 2 dirs  with globbed cacheDependency expanding to duplicates',
       async version => {
         let dirNo = 1;
-        getCommandOutputSpy.mockImplementation((command: string) =>
+        mockGetCommandOutput(getExecOutputSpy, (command: string) =>
           command.includes('version') ? version : `file_${version}_${dirNo++}`
         );
-        globCreateSpy.mockImplementation(
+        globCreateSpy.mockImplementation((_pattern: any) =>
-          (pattern: string): Promise<Globber> =>
+          MockGlobber.create([
-            MockGlobber.create([
+            '/tmp/dir1/file',
-              '/tmp/dir1/file',
+            '/tmp/dir2/file',
-              '/tmp/dir2/file',
+            '/tmp/dir1/file'
-              '/tmp/dir1/file'
+          ])
-            ])
         );
-
         const dirs = await cacheUtils.getCacheDirectories(
           supportedPackageManagers.yarn,
           '/tmp/**/file'
@@ -273,55 +343,59 @@ describe('cache-utils', () => {
       'getCacheDirectoriesPaths yarn v%s should return 2 uniq dirs despite duplicate cache directories',
       async version => {
         let dirNo = 1;
-        getCommandOutputSpy.mockImplementation((command: string) =>
+        mockGetCommandOutput(getExecOutputSpy, (command: string) =>
           command.includes('version')
             ? version
             : `file_${version}_${dirNo++ % 2}`
         );
-        globCreateSpy.mockImplementation(
+        globCreateSpy.mockImplementation((_pattern: any) =>
-          (pattern: string): Promise<Globber> =>
+          MockGlobber.create([
-            MockGlobber.create([
+            '/tmp/dir1/file',
-              '/tmp/dir1/file',
+            '/tmp/dir2/file',
-              '/tmp/dir2/file',
+            '/tmp/dir3/file'
-              '/tmp/dir3/file'
+          ])
-            ])
         );
-
         const dirs = await cacheUtils.getCacheDirectories(
           supportedPackageManagers.yarn,
           '/tmp/**/file'
         );
         expect(dirs).toEqual([`file_${version}_1`, `file_${version}_0`]);
-        expect(getCommandOutputSpy).toHaveBeenCalledTimes(6);
+        expect(getExecOutputSpy).toHaveBeenCalledTimes(6);
-        expect(getCommandOutputSpy).toHaveBeenCalledWith(
+        expect(getExecOutputSpy).toHaveBeenCalledWith(
           'yarn --version',
-          '/tmp/dir1'
+          undefined,
+          expect.objectContaining({cwd: '/tmp/dir1'})
         );
-        expect(getCommandOutputSpy).toHaveBeenCalledWith(
+        expect(getExecOutputSpy).toHaveBeenCalledWith(
           'yarn --version',
-          '/tmp/dir2'
+          undefined,
+          expect.objectContaining({cwd: '/tmp/dir2'})
         );
-        expect(getCommandOutputSpy).toHaveBeenCalledWith(
+        expect(getExecOutputSpy).toHaveBeenCalledWith(
           'yarn --version',
-          '/tmp/dir3'
+          undefined,
+          expect.objectContaining({cwd: '/tmp/dir3'})
         );
-        expect(getCommandOutputSpy).toHaveBeenCalledWith(
+        expect(getExecOutputSpy).toHaveBeenCalledWith(
           version.startsWith('1.')
             ? 'yarn cache dir'
             : 'yarn config get cacheFolder',
-          '/tmp/dir1'
+          undefined,
+          expect.objectContaining({cwd: '/tmp/dir1'})
         );
-        expect(getCommandOutputSpy).toHaveBeenCalledWith(
+        expect(getExecOutputSpy).toHaveBeenCalledWith(
           version.startsWith('1.')
             ? 'yarn cache dir'
             : 'yarn config get cacheFolder',
-          '/tmp/dir2'
+          undefined,
+          expect.objectContaining({cwd: '/tmp/dir2'})
         );
-        expect(getCommandOutputSpy).toHaveBeenCalledWith(
+        expect(getExecOutputSpy).toHaveBeenCalledWith(
           version.startsWith('1.')
             ? 'yarn cache dir'
             : 'yarn config get cacheFolder',
-          '/tmp/dir3'
+          undefined,
+          expect.objectContaining({cwd: '/tmp/dir3'})
         );
       }
     );
@@ -329,22 +403,20 @@ describe('cache-utils', () => {
     it.each(['1.1.1', '2.2.2'])(
       'getCacheDirectoriesPaths yarn v%s should return 4 dirs with multiple globs',
       async version => {
-        // simulate wrong indents
         const cacheDependencyPath = `/tmp/dir1/file
           /tmp/dir2/file
 /tmp/**/file
           `;
-        globCreateSpy.mockImplementation(
+        globCreateSpy.mockImplementation((_pattern: any) =>
-          (pattern: string): Promise<Globber> =>
+          MockGlobber.create([
-            MockGlobber.create([
+            '/tmp/dir1/file',
-              '/tmp/dir1/file',
+            '/tmp/dir2/file',
-              '/tmp/dir2/file',
+            '/tmp/dir3/file',
-              '/tmp/dir3/file',
+            '/tmp/dir4/file'
-              '/tmp/dir4/file'
+          ])
-            ])
         );
         let dirNo = 1;
-        getCommandOutputSpy.mockImplementation((command: string) =>
+        mockGetCommandOutput(getExecOutputSpy, (command: string) =>
           command.includes('version') ? version : `file_${version}_${dirNo++}`
         );
         const dirs = await cacheUtils.getCacheDirectories(

__tests__/canary-installer.test.ts

@@ -1,51 +1,162 @@
-import * as core from '@actions/core';
+import {
-import * as io from '@actions/io';
+  jest,
-import * as tc from '@actions/tool-cache';
+  describe,
-import * as httpm from '@actions/http-client';
+  it,
-import * as exec from '@actions/exec';
+  expect,
-import * as cache from '@actions/cache';
+  beforeEach,
+  afterEach,
+  afterAll
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
 import fs from 'fs';
 import cp from 'child_process';
 import osm from 'os';
 import path from 'path';
-import * as main from '../src/main';
-import * as auth from '../src/authutil';
-import {INodeVersion} from '../src/distributions/base-models';
 
-import nodeTestManifest from './data/versions-manifest.json';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
-import nodeTestDist from './data/node-dist-index.json';
+
-import nodeTestDistNightly from './data/node-nightly-index.json';
+// Mock @actions modules before importing anything that depends on them
-import nodeTestDistRc from './data/node-rc-index.json';
+jest.unstable_mockModule('@actions/core', () => ({
-import nodeV8CanaryTestDist from './data/v8-canary-dist-index.json';
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/io', () => ({
+  which: jest.fn(),
+  mkdirP: jest.fn(),
+  rmRF: jest.fn(),
+  mv: jest.fn(),
+  cp: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/tool-cache', () => ({
+  find: jest.fn(),
+  findAllVersions: jest.fn(),
+  downloadTool: jest.fn(),
+  extractTar: jest.fn(),
+  extractZip: jest.fn(),
+  extractXar: jest.fn(),
+  extract7z: jest.fn(),
+  cacheDir: jest.fn(),
+  cacheFile: jest.fn(),
+  getManifestFromRepo: jest.fn(),
+  findFromManifest: jest.fn(),
+  HTTPError: class HTTPError extends Error {
+    readonly httpStatusCode: number;
+    constructor(httpStatusCode?: number) {
+      super(`Unexpected HTTP response: ${httpStatusCode}`);
+      this.httpStatusCode = httpStatusCode ?? 0;
+    }
+  }
+}));
+
+const _mockGetJson = jest.fn();
+jest.unstable_mockModule('@actions/http-client', () => ({
+  HttpClient: jest.fn().mockImplementation(() => ({
+    getJson: _mockGetJson
+  }))
+}));
+
+jest.unstable_mockModule('@actions/exec', () => ({
+  exec: jest.fn(),
+  getExecOutput: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/cache', () => ({
+  saveCache: jest.fn(),
+  restoreCache: jest.fn(),
+  isFeatureAvailable: jest.fn()
+}));
+
+// Pre-import real authutil before mocking
+const realAuth = await import('../src/authutil.js');
+jest.unstable_mockModule('../src/authutil.js', () => ({
+  ...realAuth,
+  configAuthentication: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const io = await import('@actions/io');
+const tc = await import('@actions/tool-cache');
+const httpm = await import('@actions/http-client');
+const exec = await import('@actions/exec');
+const cache = await import('@actions/cache');
+const main = await import('../src/main.js');
+const auth = await import('../src/authutil.js');
+
+const {default: nodeTestManifest} = await import(
+  './data/versions-manifest.json',
+  {with: {type: 'json'}}
+);
+const {default: nodeTestDist} = await import('./data/node-dist-index.json', {
+  with: {type: 'json'}
+});
+const {default: nodeTestDistNightly} = await import(
+  './data/node-nightly-index.json',
+  {with: {type: 'json'}}
+);
+const {default: nodeTestDistRc} = await import('./data/node-rc-index.json', {
+  with: {type: 'json'}
+});
+const {default: nodeV8CanaryTestDist} = await import(
+  './data/v8-canary-dist-index.json',
+  {with: {type: 'json'}}
+);
+
+import type {INodeVersion} from '../src/distributions/base-models.js';
+import type {IToolRelease} from '@actions/tool-cache';
 
 describe('setup-node', () => {
   let inputs = {} as any;
   let os = {} as any;
 
-  let inSpy: jest.SpyInstance;
+  let inSpy: jest.Mock;
-  let findSpy: jest.SpyInstance;
+  let findSpy: jest.Mock;
-  let findAllVersionsSpy: jest.SpyInstance;
+  let findAllVersionsSpy: jest.Mock;
-  let cnSpy: jest.SpyInstance;
+  let cnSpy: jest.SpiedFunction<typeof process.stdout.write>;
-  let logSpy: jest.SpyInstance;
+  let logSpy: jest.Mock;
-  let warningSpy: jest.SpyInstance;
+  let warningSpy: jest.Mock;
-  let getManifestSpy: jest.SpyInstance;
+  let addPathSpy: jest.Mock;
-  let getDistSpy: jest.SpyInstance;
+  let setFailedSpy: jest.Mock;
-  let platSpy: jest.SpyInstance;
+  let getManifestSpy: jest.Mock;
-  let archSpy: jest.SpyInstance;
+  let getDistSpy: jest.Mock;
-  let dlSpy: jest.SpyInstance;
+  let platSpy: jest.SpiedFunction<typeof osm.platform>;
-  let exSpy: jest.SpyInstance;
+  let archSpy: jest.SpiedFunction<typeof osm.arch>;
-  let cacheSpy: jest.SpyInstance;
+  let dlSpy: jest.Mock;
-  let dbgSpy: jest.SpyInstance;
+  let exSpy: jest.Mock;
-  let whichSpy: jest.SpyInstance;
+  let cacheSpy: jest.Mock;
-  let existsSpy: jest.SpyInstance;
+  let dbgSpy: jest.Mock;
-  let readFileSyncSpy: jest.SpyInstance;
+  let whichSpy: jest.Mock;
-  let mkdirpSpy: jest.SpyInstance;
+  let existsSpy: jest.SpiedFunction<typeof fs.existsSync>;
-  let execSpy: jest.SpyInstance;
+  let readFileSyncSpy: jest.Mock;
-  let authSpy: jest.SpyInstance;
+  let mkdirpSpy: jest.Mock;
-  let parseNodeVersionSpy: jest.SpyInstance;
+  let execSpy: jest.SpiedFunction<typeof cp.execSync>;
-  let isCacheActionAvailable: jest.SpyInstance;
+  let authSpy: jest.Mock;
-  let getExecOutputSpy: jest.SpyInstance;
+  let parseNodeVersionSpy: jest.Mock;
-  let getJsonSpy: jest.SpyInstance;
+  let isCacheActionAvailable: jest.Mock;
+  let getExecOutputSpy: jest.Mock;
+  let getJsonSpy: jest.Mock;
 
   beforeEach(() => {
     // @actions/core
@@ -53,8 +164,8 @@ describe('setup-node', () => {
     process.env['GITHUB_PATH'] = ''; // Stub out ENV file functionality so we can verify it writes to standard out
     process.env['GITHUB_OUTPUT'] = ''; // Stub out ENV file functionality so we can verify it writes to standard out
     inputs = {};
-    inSpy = jest.spyOn(core, 'getInput');
+    inSpy = core.getInput as jest.Mock;
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
     // node
     os = {};
@@ -65,34 +176,35 @@ describe('setup-node', () => {
     execSpy = jest.spyOn(cp, 'execSync');
 
     // @actions/tool-cache
-    findSpy = jest.spyOn(tc, 'find');
+    findSpy = tc.find as jest.Mock;
-    findAllVersionsSpy = jest.spyOn(tc, 'findAllVersions');
+    findAllVersionsSpy = tc.findAllVersions as jest.Mock;
-    dlSpy = jest.spyOn(tc, 'downloadTool');
+    dlSpy = tc.downloadTool as jest.Mock;
-    exSpy = jest.spyOn(tc, 'extractTar');
+    exSpy = tc.extractTar as jest.Mock;
-    cacheSpy = jest.spyOn(tc, 'cacheDir');
+    cacheSpy = tc.cacheDir as jest.Mock;
-    getManifestSpy = jest.spyOn(tc, 'getManifestFromRepo');
+    getManifestSpy = tc.getManifestFromRepo as jest.Mock;
 
     // http-client
-    getJsonSpy = jest.spyOn(httpm.HttpClient.prototype, 'getJson');
+    getJsonSpy = _mockGetJson;
+    (httpm.HttpClient as jest.Mock).mockImplementation(() => ({
+      getJson: _mockGetJson
+    }));
 
     // io
-    whichSpy = jest.spyOn(io, 'which');
+    whichSpy = io.which as jest.Mock;
     existsSpy = jest.spyOn(fs, 'existsSync');
-    mkdirpSpy = jest.spyOn(io, 'mkdirP');
+    mkdirpSpy = io.mkdirP as jest.Mock;
 
     // @actions/tool-cache
-    isCacheActionAvailable = jest.spyOn(cache, 'isFeatureAvailable');
+    isCacheActionAvailable = cache.isFeatureAvailable as jest.Mock;
 
     // disable authentication portion for installer tests
-    authSpy = jest.spyOn(auth, 'configAuthentication');
+    authSpy = auth.configAuthentication as jest.Mock;
     authSpy.mockImplementation(() => {});
 
     // gets
-    getManifestSpy.mockImplementation(
+    getManifestSpy.mockImplementation(() => <IToolRelease[]>nodeTestManifest);
-      () => <tc.IToolRelease[]>nodeTestManifest
-    );
 
-    getJsonSpy.mockImplementation(url => {
+    getJsonSpy.mockImplementation((url: any) => {
       let res: any;
       if (url.includes('/rc')) {
         res = <INodeVersion[]>nodeTestDistRc;
@@ -109,28 +221,18 @@ describe('setup-node', () => {
 
     // writes
     cnSpy = jest.spyOn(process.stdout, 'write');
-    logSpy = jest.spyOn(core, 'info');
+    logSpy = core.info as jest.Mock;
-    dbgSpy = jest.spyOn(core, 'debug');
+    dbgSpy = core.debug as jest.Mock;
-    warningSpy = jest.spyOn(core, 'warning');
+    warningSpy = core.warning as jest.Mock;
-    cnSpy.mockImplementation(line => {
+    addPathSpy = core.addPath as jest.Mock;
-      // uncomment to debug
+    setFailedSpy = core.setFailed as jest.Mock;
-      // process.stderr.write('write:' + line + '\n');
+    cnSpy.mockImplementation(() => true);
-    });
+    logSpy.mockImplementation(() => {});
-    logSpy.mockImplementation(line => {
+    dbgSpy.mockImplementation(() => {});
-      // uncomment to debug
+    warningSpy.mockImplementation(() => {});
-      // process.stderr.write('log:' + line + '\n');
-    });
-    dbgSpy.mockImplementation(msg => {
-      // uncomment to see debug output
-      // process.stderr.write(msg + '\n');
-    });
-    warningSpy.mockImplementation(msg => {
-      // uncomment to debug
-      // process.stderr.write('log:' + msg + '\n');
-    });
 
     // @actions/exec
-    getExecOutputSpy = jest.spyOn(exec, 'getExecOutput');
+    getExecOutputSpy = exec.getExecOutput as jest.Mock;
     getExecOutputSpy.mockImplementation(() => 'v16.15.0');
   });
 
@@ -178,7 +280,7 @@ describe('setup-node', () => {
     inputs['node-version'] = '20-v8-canary';
     os['arch'] = 'x64';
 
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
     const toolPath = path.normalize(
       '/cache/node/20.0.0-v8-canary20221103f7e2421e91/x64'
@@ -193,7 +295,7 @@ describe('setup-node', () => {
     await main.run();
 
     const expPath = path.join(toolPath, 'bin');
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(expPath);
   });
 
   it('handles unhandled find error and reports error', async () => {
@@ -213,7 +315,7 @@ describe('setup-node', () => {
 
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith('::error::' + errMsg + osm.EOL);
+    expect(setFailedSpy).toHaveBeenCalledWith(errMsg);
   });
 
   //--------------------------------------------------
@@ -249,7 +351,7 @@ describe('setup-node', () => {
     expect(logSpy).toHaveBeenCalledWith(
       `Attempting to download ${versionSpec}...`
     );
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(expPath);
   });
 
   it('does not find a version that does not exist', async () => {
@@ -268,8 +370,8 @@ describe('setup-node', () => {
     ]);
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith(
+    expect(setFailedSpy).toHaveBeenCalledWith(
-      `::error::Unable to find Node version '${versionSpec}' for platform ${os.platform} and architecture ${os.arch}.${osm.EOL}`
+      `Unable to find Node version '${versionSpec}' for platform ${os.platform} and architecture ${os.arch}.`
     );
   });
 
@@ -295,7 +397,7 @@ describe('setup-node', () => {
     });
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith(`::error::${errMsg}${osm.EOL}`);
+    expect(setFailedSpy).toHaveBeenCalledWith(errMsg);
   });
 
   it('acquires specified architecture of node', async () => {
@@ -319,7 +421,6 @@ describe('setup-node', () => {
         darwin: 'darwin',
         win32: 'win'
       }[os.platform];
-
       inputs['node-version'] = version;
       inputs['architecture'] = arch;
       inputs['token'] = 'faketoken';
@@ -393,9 +494,7 @@ describe('setup-node', () => {
         );
         expect(logSpy).toHaveBeenCalledWith('Extracting ...');
         expect(logSpy).toHaveBeenCalledWith('Adding to the cache ...');
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
 
@@ -428,9 +527,7 @@ describe('setup-node', () => {
         // assert
         expect(findAllVersionsSpy).toHaveBeenCalled();
         expect(logSpy).toHaveBeenCalledWith(`Found in cache @ ${toolPath}`);
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
 
@@ -490,9 +587,7 @@ describe('setup-node', () => {
         );
         expect(logSpy).toHaveBeenCalledWith('Extracting ...');
         expect(logSpy).toHaveBeenCalledWith('Adding to the cache ...');
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
 
@@ -554,9 +649,7 @@ describe('setup-node', () => {
         );
         expect(logSpy).toHaveBeenCalledWith('Extracting ...');
         expect(logSpy).toHaveBeenCalledWith('Adding to the cache ...');
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
   });
@@ -575,13 +668,11 @@ describe('setup-node', () => {
       findAllVersionsSpy.mockImplementation(() => [versionExpected]);
 
       const toolPath = path.normalize(`/cache/node/${versionExpected}/x64`);
-      findSpy.mockImplementation(version => toolPath);
+      findSpy.mockImplementation((version: any) => toolPath);
 
       await main.run();
 
-      expect(cnSpy).toHaveBeenCalledWith(
+      expect(addPathSpy).toHaveBeenCalledWith(`${toolPath}${path.sep}bin`);
-        `::add-path::${toolPath}${path.sep}bin${osm.EOL}`
-      );
 
       expect(dlSpy).not.toHaveBeenCalled();
       expect(exSpy).not.toHaveBeenCalled();

__tests__/data/npm/package-lock.json

@@ -0,0 +1,109 @@
+{
+  "name": "npm-fixture",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "npm-fixture",
+      "dependencies": {
+        "accepts": "^1.3.8",
+        "array-flatten": "^3.0.0",
+        "bytes": "^3.1.2",
+        "content-disposition": "^0.5.4"
+      },
+      "engines": {
+        "node": "^24.0.0"
+      }
+    },
+    "node_modules/accepts": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "~2.1.34",
+        "negotiator": "0.6.3"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/accepts/node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/accepts/node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/array-flatten": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-3.0.0.tgz",
+      "integrity": "sha512-zPMVc3ZYlGLNk4mpK1NzP2wg0ml9t7fUgDsayR5Y5rSzxQilzR9FGu/EH2jQOcKSAeAfWeylyW8juy3OkWRvNA==",
+      "license": "MIT"
+    },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/content-disposition": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "5.2.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/negotiator": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    }
+  }
+}

__tests__/data/npm/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "npm-fixture",
+  "engines": {
+    "node": "^24.0.0"
+  },
+  "dependencies": {
+    "accepts": "^1.3.8",
+    "array-flatten": "^3.0.0",
+    "bytes": "^3.1.2",
+    "content-disposition": "^0.5.4"
+  }
+}

__tests__/data/package-dev-engines.json

@@ -0,0 +1,11 @@
+{
+  "engines": {
+    "node": "^19"
+  },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": "^20"
+    }
+  }
+}

__tests__/data/pnpm/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "pnpm-fixture",
+  "engines": {
+    "node": "^24.0.0"
+  },
+  "dependencies": {
+    "accepts": "^1.3.8",
+    "array-flatten": "^3.0.0",
+    "bytes": "^3.1.2",
+    "content-disposition": "^0.5.4"
+  }
+}

__tests__/data/pnpm/pnpm-lock.yaml

@@ -0,0 +1,100 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+  .:
+    dependencies:
+      accepts:
+        specifier: ^1.3.8
+        version: 1.3.8
+      array-flatten:
+        specifier: ^3.0.0
+        version: 3.0.0
+      bytes:
+        specifier: ^3.1.2
+        version: 3.1.2
+      content-disposition:
+        specifier: ^0.5.4
+        version: 0.5.4
+
+packages:
+  accepts@1.3.8:
+    resolution:
+      {
+        integrity: sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==
+      }
+    engines: {node: '>= 0.6'}
+
+  array-flatten@3.0.0:
+    resolution:
+      {
+        integrity: sha512-zPMVc3ZYlGLNk4mpK1NzP2wg0ml9t7fUgDsayR5Y5rSzxQilzR9FGu/EH2jQOcKSAeAfWeylyW8juy3OkWRvNA==
+      }
+
+  bytes@3.1.2:
+    resolution:
+      {
+        integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==
+      }
+    engines: {node: '>= 0.8'}
+
+  content-disposition@0.5.4:
+    resolution:
+      {
+        integrity: sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==
+      }
+    engines: {node: '>= 0.6'}
+
+  mime-db@1.52.0:
+    resolution:
+      {
+        integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==
+      }
+    engines: {node: '>= 0.6'}
+
+  mime-types@2.1.35:
+    resolution:
+      {
+        integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==
+      }
+    engines: {node: '>= 0.6'}
+
+  negotiator@0.6.3:
+    resolution:
+      {
+        integrity: sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==
+      }
+    engines: {node: '>= 0.6'}
+
+  safe-buffer@5.2.1:
+    resolution:
+      {
+        integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==
+      }
+
+snapshots:
+  accepts@1.3.8:
+    dependencies:
+      mime-types: 2.1.35
+      negotiator: 0.6.3
+
+  array-flatten@3.0.0: {}
+
+  bytes@3.1.2: {}
+
+  content-disposition@0.5.4:
+    dependencies:
+      safe-buffer: 5.2.1
+
+  mime-db@1.52.0: {}
+
+  mime-types@2.1.35:
+    dependencies:
+      mime-db: 1.52.0
+
+  negotiator@0.6.3: {}
+
+  safe-buffer@5.2.1: {}

__tests__/data/yarn.lock

@@ -1,689 +0,0 @@
-# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
-
-
-accepts@^1.3.8:
-  version "1.3.8"
-  resolved "https://registry.yarnpkg.com/accepts/-/accepts-1.3.8.tgz#0bf0be125b67014adcb0b0921e62db7bffe16b2e"
-  integrity sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==
-  dependencies:
-    mime-types "~2.1.34"
-    negotiator "0.6.3"
-
-accepts@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/accepts/-/accepts-2.0.0.tgz#bbcf4ba5075467f3f2131eab3cffc73c2f5d7895"
-  integrity sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==
-  dependencies:
-    mime-types "^3.0.0"
-    negotiator "^1.0.0"
-
-array-flatten@3.0.0, array-flatten@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/array-flatten/-/array-flatten-3.0.0.tgz#6428ca2ee52c7b823192ec600fa3ed2f157cd541"
-  integrity sha512-zPMVc3ZYlGLNk4mpK1NzP2wg0ml9t7fUgDsayR5Y5rSzxQilzR9FGu/EH2jQOcKSAeAfWeylyW8juy3OkWRvNA==
-
-body-parser@^1.20.3:
-  version "1.20.3"
-  resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.3.tgz#1953431221c6fb5cd63c4b36d53fab0928e548c6"
-  integrity sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==
-  dependencies:
-    bytes "3.1.2"
-    content-type "~1.0.5"
-    debug "2.6.9"
-    depd "2.0.0"
-    destroy "1.2.0"
-    http-errors "2.0.0"
-    iconv-lite "0.4.24"
-    on-finished "2.4.1"
-    qs "6.13.0"
-    raw-body "2.5.2"
-    type-is "~1.6.18"
-    unpipe "1.0.0"
-
-body-parser@^2.0.1:
-  version "2.0.1"
-  resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-2.0.1.tgz#979de4a43468c5624403457fd6d45f797faffbaf"
-  integrity sha512-PagxbjvuPH6tv0f/kdVbFGcb79D236SLcDTs6DrQ7GizJ88S1UWP4nMXFEo/I4fdhGRGabvFfFjVGm3M7U8JwA==
-  dependencies:
-    bytes "3.1.2"
-    content-type "~1.0.5"
-    debug "3.1.0"
-    destroy "1.2.0"
-    http-errors "2.0.0"
-    iconv-lite "0.5.2"
-    on-finished "2.4.1"
-    qs "6.13.0"
-    raw-body "^3.0.0"
-    type-is "~1.6.18"
-    unpipe "1.0.0"
-
-bytes@3.1.2, bytes@^3.1.2:
-  version "3.1.2"
-  resolved "https://registry.yarnpkg.com/bytes/-/bytes-3.1.2.tgz#8b0beeb98605adf1b128fa4386403c009e0221a5"
-  integrity sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==
-
-call-bind@^1.0.7:
-  version "1.0.7"
-  resolved "https://registry.yarnpkg.com/call-bind/-/call-bind-1.0.7.tgz#06016599c40c56498c18769d2730be242b6fa3b9"
-  integrity sha512-GHTSNSYICQ7scH7sZ+M2rFopRoLh8t2bLSW6BbgrtLsahOIB5iyAVJf9GjWK3cYTDaMj4XdBpM1cA6pIS0Kv2w==
-  dependencies:
-    es-define-property "^1.0.0"
-    es-errors "^1.3.0"
-    function-bind "^1.1.2"
-    get-intrinsic "^1.2.4"
-    set-function-length "^1.2.1"
-
-content-disposition@^0.5.4:
-  version "0.5.4"
-  resolved "https://registry.yarnpkg.com/content-disposition/-/content-disposition-0.5.4.tgz#8b82b4efac82512a02bb0b1dcec9d2c5e8eb5bfe"
-  integrity sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==
-  dependencies:
-    safe-buffer "5.2.1"
-
-content-disposition@^1.0.0:
-  version "1.0.0"
-  resolved "https://registry.yarnpkg.com/content-disposition/-/content-disposition-1.0.0.tgz#844426cb398f934caefcbb172200126bc7ceace2"
-  integrity sha512-Au9nRL8VNUut/XSzbQA38+M78dzP4D+eqg3gfJHMIHHYa3bg067xj1KxMUWj+VULbiZMowKngFFbKczUrNJ1mg==
-  dependencies:
-    safe-buffer "5.2.1"
-
-content-type@^1.0.5, content-type@~1.0.4, content-type@~1.0.5:
-  version "1.0.5"
-  resolved "https://registry.yarnpkg.com/content-type/-/content-type-1.0.5.tgz#8b773162656d1d1086784c8f23a54ce6d73d7918"
-  integrity sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==
-
-cookie-signature@^1.0.7, cookie-signature@^1.2.1:
-  version "1.2.1"
-  resolved "https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.2.1.tgz#790dea2cce64638c7ae04d9fabed193bd7ccf3b4"
-  integrity sha512-78KWk9T26NhzXtuL26cIJ8/qNHANyJ/ZYrmEXFzUmhZdjpBv+DlWlOANRTGBt48YcyslsLrj0bMLFTmXvLRCOw==
-
-cookie@0.6.0:
-  version "0.6.0"
-  resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.6.0.tgz#2798b04b071b0ecbff0dbb62a505a8efa4e19051"
-  integrity sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==
-
-cookie@^0.5.0:
-  version "0.5.0"
-  resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.5.0.tgz#d1f5d71adec6558c58f389987c366aa47e994f8b"
-  integrity sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==
-
-debug@2.6.9:
-  version "2.6.9"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-2.6.9.tgz#5d128515df134ff327e90a4c93f4e077a536341f"
-  integrity sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==
-  dependencies:
-    ms "2.0.0"
-
-debug@3.1.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-3.1.0.tgz#5bb5a0672628b64149566ba16819e61518c67261"
-  integrity sha512-OX8XqP7/1a9cqkxYw2yXss15f26NKWBpDXQd0/uK/KPqdQhxbPa994hnzjcE2VqQpDslf55723cKPUOGSmMY3g==
-  dependencies:
-    ms "2.0.0"
-
-debug@4.3.6:
-  version "4.3.6"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.6.tgz#2ab2c38fbaffebf8aa95fdfe6d88438c7a13c52b"
-  integrity sha512-O/09Bd4Z1fBrU4VzkhFqVgpPzaGbw6Sm9FEkBT1A/YBXQFGuuSxa1dN2nxgxS34JmKXqYx8CZAwEVoJFImUXIg==
-  dependencies:
-    ms "2.1.2"
-
-debug@^4.0.0, debug@^4.3.5:
-  version "4.3.7"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.7.tgz#87945b4151a011d76d95a198d7111c865c360a52"
-  integrity sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==
-  dependencies:
-    ms "^2.1.3"
-
-define-data-property@^1.1.4:
-  version "1.1.4"
-  resolved "https://registry.yarnpkg.com/define-data-property/-/define-data-property-1.1.4.tgz#894dc141bb7d3060ae4366f6a0107e68fbe48c5e"
-  integrity sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==
-  dependencies:
-    es-define-property "^1.0.0"
-    es-errors "^1.3.0"
-    gopd "^1.0.1"
-
-depd@2.0.0, depd@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/depd/-/depd-2.0.0.tgz#b696163cc757560d09cf22cc8fad1571b79e76df"
-  integrity sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==
-
-depd@~1.1.2:
-  version "1.1.2"
-  resolved "https://registry.yarnpkg.com/depd/-/depd-1.1.2.tgz#9bcd52e14c097763e749b274c4346ed2e560b5a9"
-  integrity sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==
-
-destroy@1.2.0, destroy@^1.1.0, destroy@^1.2.0:
-  version "1.2.0"
-  resolved "https://registry.yarnpkg.com/destroy/-/destroy-1.2.0.tgz#4803735509ad8be552934c67df614f94e66fa015"
-  integrity sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==
-
-ee-first@1.1.1, ee-first@^1.1.1:
-  version "1.1.1"
-  resolved "https://registry.yarnpkg.com/ee-first/-/ee-first-1.1.1.tgz#590c61156b0ae2f4f0255732a158b266bc56b21d"
-  integrity sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==
-
-encodeurl@^2.0.0, encodeurl@~2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/encodeurl/-/encodeurl-2.0.0.tgz#7b8ea898077d7e409d3ac45474ea38eaf0857a58"
-  integrity sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==
-
-encodeurl@~1.0.2:
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/encodeurl/-/encodeurl-1.0.2.tgz#ad3ff4c86ec2d029322f5a02c3a9a606c95b3f59"
-  integrity sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==
-
-es-define-property@^1.0.0:
-  version "1.0.0"
-  resolved "https://registry.yarnpkg.com/es-define-property/-/es-define-property-1.0.0.tgz#c7faefbdff8b2696cf5f46921edfb77cc4ba3845"
-  integrity sha512-jxayLKShrEqqzJ0eumQbVhTYQM27CfT1T35+gCgDFoL82JLsXqTJ76zv6A0YLOgEnLUMvLzsDsGIrl8NFpT2gQ==
-  dependencies:
-    get-intrinsic "^1.2.4"
-
-es-errors@^1.3.0:
-  version "1.3.0"
-  resolved "https://registry.yarnpkg.com/es-errors/-/es-errors-1.3.0.tgz#05f75a25dab98e4fb1dcd5e1472c0546d5057c8f"
-  integrity sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==
-
-escape-html@^1.0.3, escape-html@~1.0.3:
-  version "1.0.3"
-  resolved "https://registry.yarnpkg.com/escape-html/-/escape-html-1.0.3.tgz#0258eae4d3d0c0974de1c169188ef0051d1d1988"
-  integrity sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==
-
-etag@^1.8.1, etag@~1.8.1:
-  version "1.8.1"
-  resolved "https://registry.yarnpkg.com/etag/-/etag-1.8.1.tgz#41ae2eeb65efa62268aebfea83ac7d79299b0887"
-  integrity sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==
-
-express@^5.0.0:
-  version "5.0.0"
-  resolved "https://registry.yarnpkg.com/express/-/express-5.0.0.tgz#744f9ec86025a01aeca99e4300aa4fc050d493c7"
-  integrity sha512-V4UkHQc+B7ldh1YC84HCXHwf60M4BOMvp9rkvTUWCK5apqDC1Esnbid4wm6nFyVuDy8XMfETsJw5lsIGBWyo0A==
-  dependencies:
-    accepts "^2.0.0"
-    body-parser "^2.0.1"
-    content-disposition "^1.0.0"
-    content-type "~1.0.4"
-    cookie "0.6.0"
-    cookie-signature "^1.2.1"
-    debug "4.3.6"
-    depd "2.0.0"
-    encodeurl "~2.0.0"
-    escape-html "~1.0.3"
-    etag "~1.8.1"
-    finalhandler "^2.0.0"
-    fresh "2.0.0"
-    http-errors "2.0.0"
-    merge-descriptors "^2.0.0"
-    methods "~1.1.2"
-    mime-types "^3.0.0"
-    on-finished "2.4.1"
-    once "1.4.0"
-    parseurl "~1.3.3"
-    proxy-addr "~2.0.7"
-    qs "6.13.0"
-    range-parser "~1.2.1"
-    router "^2.0.0"
-    safe-buffer "5.2.1"
-    send "^1.1.0"
-    serve-static "^2.1.0"
-    setprototypeof "1.2.0"
-    statuses "2.0.1"
-    type-is "^2.0.0"
-    utils-merge "1.0.1"
-    vary "~1.1.2"
-
-finalhandler@^1.2.0:
-  version "1.3.1"
-  resolved "https://registry.yarnpkg.com/finalhandler/-/finalhandler-1.3.1.tgz#0c575f1d1d324ddd1da35ad7ece3df7d19088019"
-  integrity sha512-6BN9trH7bp3qvnrRyzsBz+g3lZxTNZTbVO2EV1CS0WIcDbawYVdYvGflME/9QP0h0pYlCDBCTjYa9nZzMDpyxQ==
-  dependencies:
-    debug "2.6.9"
-    encodeurl "~2.0.0"
-    escape-html "~1.0.3"
-    on-finished "2.4.1"
-    parseurl "~1.3.3"
-    statuses "2.0.1"
-    unpipe "~1.0.0"
-
-finalhandler@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/finalhandler/-/finalhandler-2.0.0.tgz#9d3c79156dfa798069db7de7dd53bc37546f564b"
-  integrity sha512-MX6Zo2adDViYh+GcxxB1dpO43eypOGUOL12rLCOTMQv/DfIbpSJUy4oQIIZhVZkH9e+bZWKMon0XHFEju16tkQ==
-  dependencies:
-    debug "2.6.9"
-    encodeurl "~1.0.2"
-    escape-html "~1.0.3"
-    on-finished "2.4.1"
-    parseurl "~1.3.3"
-    statuses "2.0.1"
-    unpipe "~1.0.0"
-
-forwarded@0.2.0, forwarded@^0.2.0:
-  version "0.2.0"
-  resolved "https://registry.yarnpkg.com/forwarded/-/forwarded-0.2.0.tgz#2269936428aad4c15c7ebe9779a84bf0b2a81811"
-  integrity sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==
-
-fresh@0.5.2, fresh@^0.5.2:
-  version "0.5.2"
-  resolved "https://registry.yarnpkg.com/fresh/-/fresh-0.5.2.tgz#3d8cadd90d976569fa835ab1f8e4b23a105605a7"
-  integrity sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==
-
-fresh@2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/fresh/-/fresh-2.0.0.tgz#8dd7df6a1b3a1b3a5cf186c05a5dd267622635a4"
-  integrity sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==
-
-function-bind@^1.1.2:
-  version "1.1.2"
-  resolved "https://registry.yarnpkg.com/function-bind/-/function-bind-1.1.2.tgz#2c02d864d97f3ea6c8830c464cbd11ab6eab7a1c"
-  integrity sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==
-
-get-intrinsic@^1.1.3, get-intrinsic@^1.2.4:
-  version "1.2.4"
-  resolved "https://registry.yarnpkg.com/get-intrinsic/-/get-intrinsic-1.2.4.tgz#e385f5a4b5227d449c3eabbad05494ef0abbeadd"
-  integrity sha512-5uYhsJH8VJBTv7oslg4BznJYhDoRI6waYCxMmCdnTrcCrHA/fCFKoTFz2JKKE0HdDFUF7/oQuhzumXJK7paBRQ==
-  dependencies:
-    es-errors "^1.3.0"
-    function-bind "^1.1.2"
-    has-proto "^1.0.1"
-    has-symbols "^1.0.3"
-    hasown "^2.0.0"
-
-gopd@^1.0.1:
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/gopd/-/gopd-1.0.1.tgz#29ff76de69dac7489b7c0918a5788e56477c332c"
-  integrity sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==
-  dependencies:
-    get-intrinsic "^1.1.3"
-
-has-property-descriptors@^1.0.2:
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz#963ed7d071dc7bf5f084c5bfbe0d1b6222586854"
-  integrity sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==
-  dependencies:
-    es-define-property "^1.0.0"
-
-has-proto@^1.0.1:
-  version "1.0.3"
-  resolved "https://registry.yarnpkg.com/has-proto/-/has-proto-1.0.3.tgz#b31ddfe9b0e6e9914536a6ab286426d0214f77fd"
-  integrity sha512-SJ1amZAJUiZS+PhsVLf5tGydlaVB8EdFpaSO4gmiUKUOxk8qzn5AIy4ZeJUmh22znIdk/uMAUT2pl3FxzVUH+Q==
-
-has-symbols@^1.0.3:
-  version "1.0.3"
-  resolved "https://registry.yarnpkg.com/has-symbols/-/has-symbols-1.0.3.tgz#bb7b2c4349251dce87b125f7bdf874aa7c8b39f8"
-  integrity sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==
-
-hasown@^2.0.0:
-  version "2.0.2"
-  resolved "https://registry.yarnpkg.com/hasown/-/hasown-2.0.2.tgz#003eaf91be7adc372e84ec59dc37252cedb80003"
-  integrity sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==
-  dependencies:
-    function-bind "^1.1.2"
-
-http-errors@2.0.0, http-errors@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/http-errors/-/http-errors-2.0.0.tgz#b7774a1486ef73cf7667ac9ae0858c012c57b9d3"
-  integrity sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==
-  dependencies:
-    depd "2.0.0"
-    inherits "2.0.4"
-    setprototypeof "1.2.0"
-    statuses "2.0.1"
-    toidentifier "1.0.1"
-
-http-errors@^1.8.0:
-  version "1.8.1"
-  resolved "https://registry.yarnpkg.com/http-errors/-/http-errors-1.8.1.tgz#7c3f28577cbc8a207388455dbd62295ed07bd68c"
-  integrity sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==
-  dependencies:
-    depd "~1.1.2"
-    inherits "2.0.4"
-    setprototypeof "1.2.0"
-    statuses ">= 1.5.0 < 2"
-    toidentifier "1.0.1"
-
-iconv-lite@0.4.24:
-  version "0.4.24"
-  resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.4.24.tgz#2022b4b25fbddc21d2f524974a474aafe733908b"
-  integrity sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==
-  dependencies:
-    safer-buffer ">= 2.1.2 < 3"
-
-iconv-lite@0.5.2:
-  version "0.5.2"
-  resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.5.2.tgz#af6d628dccfb463b7364d97f715e4b74b8c8c2b8"
-  integrity sha512-kERHXvpSaB4aU3eANwidg79K8FlrN77m8G9V+0vOR3HYaRifrlwMEpT7ZBJqLSEIHnEgJTHcWK82wwLwwKwtag==
-  dependencies:
-    safer-buffer ">= 2.1.2 < 3"
-
-iconv-lite@0.6.3, iconv-lite@^0.6.0:
-  version "0.6.3"
-  resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.6.3.tgz#a52f80bf38da1952eb5c681790719871a1a72501"
-  integrity sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==
-  dependencies:
-    safer-buffer ">= 2.1.2 < 3.0.0"
-
-inherits@2.0.4, inherits@^2.0.4:
-  version "2.0.4"
-  resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.4.tgz#0fa2c64f932917c3433a0ded55363aae37416b7c"
-  integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==
-
-ipaddr.js@1.9.1:
-  version "1.9.1"
-  resolved "https://registry.yarnpkg.com/ipaddr.js/-/ipaddr.js-1.9.1.tgz#bff38543eeb8984825079ff3a2a8e6cbd46781b3"
-  integrity sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==
-
-ipaddr.js@^2.2.0:
-  version "2.2.0"
-  resolved "https://registry.yarnpkg.com/ipaddr.js/-/ipaddr.js-2.2.0.tgz#d33fa7bac284f4de7af949638c9d68157c6b92e8"
-  integrity sha512-Ag3wB2o37wslZS19hZqorUnrnzSkpOVy+IiiDEiTqNubEYpYuHWIf6K4psgN2ZWKExS4xhVCrRVfb/wfW8fWJA==
-
-is-promise@4.0.0:
-  version "4.0.0"
-  resolved "https://registry.yarnpkg.com/is-promise/-/is-promise-4.0.0.tgz#42ff9f84206c1991d26debf520dd5c01042dd2f3"
-  integrity sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==
-
-media-typer@0.3.0:
-  version "0.3.0"
-  resolved "https://registry.yarnpkg.com/media-typer/-/media-typer-0.3.0.tgz#8710d7af0aa626f8fffa1ce00168545263255748"
-  integrity sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==
-
-media-typer@^1.1.0:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/media-typer/-/media-typer-1.1.0.tgz#6ab74b8f2d3320f2064b2a87a38e7931ff3a5561"
-  integrity sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==
-
-merge-descriptors@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/merge-descriptors/-/merge-descriptors-2.0.0.tgz#ea922f660635a2249ee565e0449f951e6b603808"
-  integrity sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==
-
-methods@^1.1.2, methods@~1.1.2:
-  version "1.1.2"
-  resolved "https://registry.yarnpkg.com/methods/-/methods-1.1.2.tgz#5529a4d67654134edcc5266656835b0f851afcee"
-  integrity sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==
-
-mime-db@1.52.0:
-  version "1.52.0"
-  resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.52.0.tgz#bbabcdc02859f4987301c856e3387ce5ec43bf70"
-  integrity sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==
-
-mime-db@^1.51.0, mime-db@^1.53.0:
-  version "1.53.0"
-  resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.53.0.tgz#3cb63cd820fc29896d9d4e8c32ab4fcd74ccb447"
-  integrity sha512-oHlN/w+3MQ3rba9rqFr6V/ypF10LSkdwUysQL7GkXoTgIWeV+tcXGA852TBxH+gsh8UWoyhR1hKcoMJTuWflpg==
-
-mime-types@^2.1.35, mime-types@~2.1.24, mime-types@~2.1.34:
-  version "2.1.35"
-  resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a"
-  integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==
-  dependencies:
-    mime-db "1.52.0"
-
-mime-types@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-3.0.0.tgz#148453a900475522d095a445355c074cca4f5217"
-  integrity sha512-XqoSHeCGjVClAmoGFG3lVFqQFRIrTVw2OH3axRqAcfaw+gHWIfnASS92AV+Rl/mk0MupgZTRHQOjxY6YVnzK5w==
-  dependencies:
-    mime-db "^1.53.0"
-
-mime@1.6.0, mime@^1.6.0:
-  version "1.6.0"
-  resolved "https://registry.yarnpkg.com/mime/-/mime-1.6.0.tgz#32cd9e5c64553bd58d19a568af452acff04981b1"
-  integrity sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==
-
-ms@2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/ms/-/ms-2.0.0.tgz#5608aeadfc00be6c2901df5f9861788de0d597c8"
-  integrity sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==
-
-ms@2.1.2:
-  version "2.1.2"
-  resolved "https://registry.yarnpkg.com/ms/-/ms-2.1.2.tgz#d09d1f357b443f493382a8eb3ccd183872ae6009"
-  integrity sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==
-
-ms@2.1.3, ms@^2.1.2, ms@^2.1.3:
-  version "2.1.3"
-  resolved "https://registry.yarnpkg.com/ms/-/ms-2.1.3.tgz#574c8138ce1d2b5861f0b44579dbadd60c6615b2"
-  integrity sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==
-
-negotiator@0.6.3, negotiator@^0.6.3:
-  version "0.6.3"
-  resolved "https://registry.yarnpkg.com/negotiator/-/negotiator-0.6.3.tgz#58e323a72fedc0d6f9cd4d31fe49f51479590ccd"
-  integrity sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==
-
-negotiator@^1.0.0:
-  version "1.0.0"
-  resolved "https://registry.yarnpkg.com/negotiator/-/negotiator-1.0.0.tgz#b6c91bb47172d69f93cfd7c357bbb529019b5f6a"
-  integrity sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==
-
-object-inspect@^1.13.1:
-  version "1.13.2"
-  resolved "https://registry.yarnpkg.com/object-inspect/-/object-inspect-1.13.2.tgz#dea0088467fb991e67af4058147a24824a3043ff"
-  integrity sha512-IRZSRuzJiynemAXPYtPe5BoI/RESNYR7TYm50MC5Mqbd3Jmw5y790sErYw3V6SryFJD64b74qQQs9wn5Bg/k3g==
-
-on-finished@2.4.1, on-finished@^2.4.0, on-finished@^2.4.1:
-  version "2.4.1"
-  resolved "https://registry.yarnpkg.com/on-finished/-/on-finished-2.4.1.tgz#58c8c44116e54845ad57f14ab10b03533184ac3f"
-  integrity sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==
-  dependencies:
-    ee-first "1.1.1"
-
-once@1.4.0:
-  version "1.4.0"
-  resolved "https://registry.yarnpkg.com/once/-/once-1.4.0.tgz#583b1aa775961d4b113ac17d9c50baef9dd76bd1"
-  integrity sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==
-  dependencies:
-    wrappy "1"
-
-parseurl@^1.3.3, parseurl@~1.3.3:
-  version "1.3.3"
-  resolved "https://registry.yarnpkg.com/parseurl/-/parseurl-1.3.3.tgz#9da19e7bee8d12dff0513ed5b76957793bc2e8d4"
-  integrity sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==
-
-path-to-regexp@^8.0.0:
-  version "8.1.0"
-  resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-8.1.0.tgz#4d687606ed0be8ed512ba802eb94d620cb1a86f0"
-  integrity sha512-Bqn3vc8CMHty6zuD+tG23s6v2kwxslHEhTj4eYaVKGIEB+YX/2wd0/rgXLFD9G9id9KCtbVy/3ZgmvZjpa0UdQ==
-
-proxy-addr@^2.0.7, proxy-addr@~2.0.7:
-  version "2.0.7"
-  resolved "https://registry.yarnpkg.com/proxy-addr/-/proxy-addr-2.0.7.tgz#f19fe69ceab311eeb94b42e70e8c2070f9ba1025"
-  integrity sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==
-  dependencies:
-    forwarded "0.2.0"
-    ipaddr.js "1.9.1"
-
-qs@6.13.0, qs@^6.8.0:
-  version "6.13.0"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.13.0.tgz#6ca3bd58439f7e245655798997787b0d88a51906"
-  integrity sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==
-  dependencies:
-    side-channel "^1.0.6"
-
-range-parser@^1.2.1, range-parser@~1.2.1:
-  version "1.2.1"
-  resolved "https://registry.yarnpkg.com/range-parser/-/range-parser-1.2.1.tgz#3cf37023d199e1c24d1a55b84800c2f3e6468031"
-  integrity sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==
-
-raw-body@2.5.2, raw-body@^2.4.1:
-  version "2.5.2"
-  resolved "https://registry.yarnpkg.com/raw-body/-/raw-body-2.5.2.tgz#99febd83b90e08975087e8f1f9419a149366b68a"
-  integrity sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==
-  dependencies:
-    bytes "3.1.2"
-    http-errors "2.0.0"
-    iconv-lite "0.4.24"
-    unpipe "1.0.0"
-
-raw-body@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/raw-body/-/raw-body-3.0.0.tgz#25b3476f07a51600619dae3fe82ddc28a36e5e0f"
-  integrity sha512-RmkhL8CAyCRPXCE28MMH0z2PNWQBNk2Q09ZdxM9IOOXwxwZbN+qbWaatPkdkWIKL2ZVDImrN/pK5HTRz2PcS4g==
-  dependencies:
-    bytes "3.1.2"
-    http-errors "2.0.0"
-    iconv-lite "0.6.3"
-    unpipe "1.0.0"
-
-router@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/router/-/router-2.0.0.tgz#8692720b95de83876870d7bc638dd3c7e1ae8a27"
-  integrity sha512-dIM5zVoG8xhC6rnSN8uoAgFARwTE7BQs8YwHEvK0VCmfxQXMaOuA1uiR1IPwsW7JyK5iTt7Od/TC9StasS2NPQ==
-  dependencies:
-    array-flatten "3.0.0"
-    is-promise "4.0.0"
-    methods "~1.1.2"
-    parseurl "~1.3.3"
-    path-to-regexp "^8.0.0"
-    setprototypeof "1.2.0"
-    utils-merge "1.0.1"
-
-safe-buffer@5.2.1, safe-buffer@^5.2.1:
-  version "5.2.1"
-  resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz#1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6"
-  integrity sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==
-
-"safer-buffer@>= 2.1.2 < 3", "safer-buffer@>= 2.1.2 < 3.0.0", safer-buffer@^2.1.2:
-  version "2.1.2"
-  resolved "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
-  integrity sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==
-
-send@0.19.0, send@^0.19.0:
-  version "0.19.0"
-  resolved "https://registry.yarnpkg.com/send/-/send-0.19.0.tgz#bbc5a388c8ea6c048967049dbeac0e4a3f09d7f8"
-  integrity sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw==
-  dependencies:
-    debug "2.6.9"
-    depd "2.0.0"
-    destroy "1.2.0"
-    encodeurl "~1.0.2"
-    escape-html "~1.0.3"
-    etag "~1.8.1"
-    fresh "0.5.2"
-    http-errors "2.0.0"
-    mime "1.6.0"
-    ms "2.1.3"
-    on-finished "2.4.1"
-    range-parser "~1.2.1"
-    statuses "2.0.1"
-
-send@^1.0.0, send@^1.1.0:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/send/-/send-1.1.0.tgz#4efe6ff3bb2139b0e5b2648d8b18d4dec48fc9c5"
-  integrity sha512-v67WcEouB5GxbTWL/4NeToqcZiAWEq90N888fczVArY8A79J0L4FD7vj5hm3eUMua5EpoQ59wa/oovY6TLvRUA==
-  dependencies:
-    debug "^4.3.5"
-    destroy "^1.2.0"
-    encodeurl "^2.0.0"
-    escape-html "^1.0.3"
-    etag "^1.8.1"
-    fresh "^0.5.2"
-    http-errors "^2.0.0"
-    mime-types "^2.1.35"
-    ms "^2.1.3"
-    on-finished "^2.4.1"
-    range-parser "^1.2.1"
-    statuses "^2.0.1"
-
-serve-static@^1.15.0:
-  version "1.16.2"
-  resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-1.16.2.tgz#b6a5343da47f6bdd2673848bf45754941e803296"
-  integrity sha512-VqpjJZKadQB/PEbEwvFdO43Ax5dFBZ2UECszz8bQ7pi7wt//PWe1P6MN7eCnjsatYtBT6EuiClbjSWP2WrIoTw==
-  dependencies:
-    encodeurl "~2.0.0"
-    escape-html "~1.0.3"
-    parseurl "~1.3.3"
-    send "0.19.0"
-
-serve-static@^2.1.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-2.1.0.tgz#1b4eacbe93006b79054faa4d6d0a501d7f0e84e2"
-  integrity sha512-A3We5UfEjG8Z7VkDv6uItWw6HY2bBSBJT1KtVESn6EOoOr2jAxNhxWCLY3jDE2WcuHXByWju74ck3ZgLwL8xmA==
-  dependencies:
-    encodeurl "^2.0.0"
-    escape-html "^1.0.3"
-    parseurl "^1.3.3"
-    send "^1.0.0"
-
-set-function-length@^1.2.1:
-  version "1.2.2"
-  resolved "https://registry.yarnpkg.com/set-function-length/-/set-function-length-1.2.2.tgz#aac72314198eaed975cf77b2c3b6b880695e5449"
-  integrity sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==
-  dependencies:
-    define-data-property "^1.1.4"
-    es-errors "^1.3.0"
-    function-bind "^1.1.2"
-    get-intrinsic "^1.2.4"
-    gopd "^1.0.1"
-    has-property-descriptors "^1.0.2"
-
-setprototypeof@1.2.0, setprototypeof@^1.2.0:
-  version "1.2.0"
-  resolved "https://registry.yarnpkg.com/setprototypeof/-/setprototypeof-1.2.0.tgz#66c9a24a73f9fc28cbe66b09fed3d33dcaf1b424"
-  integrity sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==
-
-side-channel@^1.0.6:
-  version "1.0.6"
-  resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.0.6.tgz#abd25fb7cd24baf45466406b1096b7831c9215f2"
-  integrity sha512-fDW/EZ6Q9RiO8eFG8Hj+7u/oW+XrPTIChwCOM2+th2A6OblDtYYIpve9m+KvI9Z4C9qSEXlaGR6bTEYHReuglA==
-  dependencies:
-    call-bind "^1.0.7"
-    es-errors "^1.3.0"
-    get-intrinsic "^1.2.4"
-    object-inspect "^1.13.1"
-
-statuses@2.0.1, statuses@^2.0.1:
-  version "2.0.1"
-  resolved "https://registry.yarnpkg.com/statuses/-/statuses-2.0.1.tgz#55cb000ccf1d48728bd23c685a063998cf1a1b63"
-  integrity sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==
-
-"statuses@>= 1.5.0 < 2":
-  version "1.5.0"
-  resolved "https://registry.yarnpkg.com/statuses/-/statuses-1.5.0.tgz#161c7dac177659fd9811f43771fa99381478628c"
-  integrity sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==
-
-toidentifier@1.0.1:
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/toidentifier/-/toidentifier-1.0.1.tgz#3be34321a88a820ed1bd80dfaa33e479fbb8dd35"
-  integrity sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==
-
-type-is@^1.6.18, type-is@~1.6.18:
-  version "1.6.18"
-  resolved "https://registry.yarnpkg.com/type-is/-/type-is-1.6.18.tgz#4e552cd05df09467dcbc4ef739de89f2cf37c131"
-  integrity sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==
-  dependencies:
-    media-typer "0.3.0"
-    mime-types "~2.1.24"
-
-type-is@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/type-is/-/type-is-2.0.0.tgz#7d249c2e2af716665cc149575dadb8b3858653af"
-  integrity sha512-gd0sGezQYCbWSbkZr75mln4YBidWUN60+devscpLF5mtRDUpiaTvKpBNrdaCvel1NdR2k6vclXybU5fBd2i+nw==
-  dependencies:
-    content-type "^1.0.5"
-    media-typer "^1.1.0"
-    mime-types "^3.0.0"
-
-unpipe@1.0.0, unpipe@~1.0.0:
-  version "1.0.0"
-  resolved "https://registry.yarnpkg.com/unpipe/-/unpipe-1.0.0.tgz#b2bf4ee8514aae6165b4817829d21b2ef49904ec"
-  integrity sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==
-
-utils-merge@1.0.1, utils-merge@^1.0.1:
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/utils-merge/-/utils-merge-1.0.1.tgz#9f95710f50a267947b2ccc124741c1028427e713"
-  integrity sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==
-
-vary@^1.1.2, vary@~1.1.2:
-  version "1.1.2"
-  resolved "https://registry.yarnpkg.com/vary/-/vary-1.1.2.tgz#2299f02c6ded30d4a5961b0b9f74524a18f634fc"
-  integrity sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==
-
-wrappy@1:
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/wrappy/-/wrappy-1.0.2.tgz#b5243d8f3ec1aa35f1364605bc0d1036e30ab69f"
-  integrity sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==

__tests__/data/yarn/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "yarn-fixture",
+  "engines": {
+    "node": "^24.0.0"
+  },
+  "dependencies": {
+    "accepts": "^1.3.8",
+    "array-flatten": "^3.0.0",
+    "bytes": "^3.1.2",
+    "content-disposition": "^0.5.4"
+  }
+}

__tests__/data/yarn/yarn.lock

@@ -0,0 +1,50 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+accepts@^1.3.8:
+  version "1.3.8"
+  resolved "https://registry.yarnpkg.com/accepts/-/accepts-1.3.8.tgz#0bf0be125b67014adcb0b0921e62db7bffe16b2e"
+  integrity sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==
+  dependencies:
+    mime-types "~2.1.34"
+    negotiator "0.6.3"
+
+array-flatten@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/array-flatten/-/array-flatten-3.0.0.tgz#6428ca2ee52c7b823192ec600fa3ed2f157cd541"
+  integrity sha512-zPMVc3ZYlGLNk4mpK1NzP2wg0ml9t7fUgDsayR5Y5rSzxQilzR9FGu/EH2jQOcKSAeAfWeylyW8juy3OkWRvNA==
+
+bytes@^3.1.2:
+  version "3.1.2"
+  resolved "https://registry.yarnpkg.com/bytes/-/bytes-3.1.2.tgz#8b0beeb98605adf1b128fa4386403c009e0221a5"
+  integrity sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==
+
+content-disposition@^0.5.4:
+  version "0.5.4"
+  resolved "https://registry.yarnpkg.com/content-disposition/-/content-disposition-0.5.4.tgz#8b82b4efac82512a02bb0b1dcec9d2c5e8eb5bfe"
+  integrity sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==
+  dependencies:
+    safe-buffer "5.2.1"
+
+mime-db@1.52.0:
+  version "1.52.0"
+  resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.52.0.tgz#bbabcdc02859f4987301c856e3387ce5ec43bf70"
+  integrity sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==
+
+mime-types@~2.1.34:
+  version "2.1.35"
+  resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a"
+  integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==
+  dependencies:
+    mime-db "1.52.0"
+
+negotiator@0.6.3:
+  version "0.6.3"
+  resolved "https://registry.yarnpkg.com/negotiator/-/negotiator-0.6.3.tgz#58e323a72fedc0d6f9cd4d31fe49f51479590ccd"
+  integrity sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==
+
+safe-buffer@5.2.1:
+  version "5.2.1"
+  resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz#1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6"
+  integrity sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==

__tests__/main.test.ts

@@ -1,43 +1,125 @@
-import * as cache from '@actions/cache';
+import {
-import * as core from '@actions/core';
+  jest,
-import * as exec from '@actions/exec';
+  describe,
-import * as io from '@actions/io';
+  it,
-import * as tc from '@actions/tool-cache';
+  expect,
-
+  beforeEach,
+  afterEach,
+  afterAll
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
 import fs from 'fs';
-import osm from 'os';
 import path from 'path';
+import osm from 'os';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+// Mock @actions modules before importing anything that depends on them
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/exec', () => ({
+  exec: jest.fn(),
+  getExecOutput: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/tool-cache', () => ({
+  find: jest.fn(),
+  findAllVersions: jest.fn(),
+  downloadTool: jest.fn(),
+  extractTar: jest.fn(),
+  extractZip: jest.fn(),
+  extractXar: jest.fn(),
+  extract7z: jest.fn(),
+  cacheDir: jest.fn(),
+  cacheFile: jest.fn(),
+  getManifestFromRepo: jest.fn(),
+  findFromManifest: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/cache', () => ({
+  saveCache: jest.fn(),
+  restoreCache: jest.fn(),
+  isFeatureAvailable: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/io', () => ({
+  which: jest.fn(),
+  mkdirP: jest.fn(),
+  rmRF: jest.fn(),
+  mv: jest.fn(),
+  cp: jest.fn()
+}));
+
+// Pre-import real util before mocking so we can spread it
+const realUtil = await import('../src/util.js');
+
+jest.unstable_mockModule('../src/util.js', () => ({
+  ...realUtil,
+  getNodeVersionFromFile: jest.fn(realUtil.getNodeVersionFromFile)
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const exec = await import('@actions/exec');
+const tc = await import('@actions/tool-cache');
+const cache = await import('@actions/cache');
+const io = await import('@actions/io');
+const main = await import('../src/main.js');
+const util = await import('../src/util.js');
+const {default: OfficialBuilds} =
+  await import('../src/distributions/official_builds/official_builds.js');
 
 import each from 'jest-each';
 
-import OfficialBuilds from '../src/distributions/official_builds/official_builds';
-import * as main from '../src/main';
-import * as util from '../src/util';
-
 describe('main tests', () => {
   let inputs = {} as any;
   let os = {} as any;
 
-  let infoSpy: jest.SpyInstance;
+  let infoSpy: jest.Mock;
-  let warningSpy: jest.SpyInstance;
+  let warningSpy: jest.Mock;
-  let saveStateSpy: jest.SpyInstance;
+  let saveStateSpy: jest.Mock;
-  let inSpy: jest.SpyInstance;
+  let inSpy: jest.Mock;
-  let setOutputSpy: jest.SpyInstance;
+  let setOutputSpy: jest.Mock;
-  let startGroupSpy: jest.SpyInstance;
+  let startGroupSpy: jest.Mock;
-  let endGroupSpy: jest.SpyInstance;
+  let endGroupSpy: jest.Mock;
 
-  let whichSpy: jest.SpyInstance;
+  let whichSpy: jest.Mock;
 
-  let existsSpy: jest.SpyInstance;
+  let existsSpy: jest.Mock;
 
-  let getExecOutputSpy: jest.SpyInstance;
+  let getExecOutputSpy: jest.Mock;
 
-  let getNodeVersionFromFileSpy: jest.SpyInstance;
+  let getNodeVersionFromFileSpy: jest.Mock;
-  let cnSpy: jest.SpyInstance;
+  let cnSpy: jest.SpiedFunction<typeof process.stdout.write>;
-  let findSpy: jest.SpyInstance;
+  let findSpy: jest.Mock;
-  let isCacheActionAvailable: jest.SpyInstance;
+  let isCacheActionAvailable: jest.Mock;
 
-  let setupNodeJsSpy: jest.SpyInstance;
+  let setupNodeJsSpy: jest.SpiedFunction<
+    typeof OfficialBuilds.prototype.setupNodeJs
+  >;
 
   beforeEach(() => {
     inputs = {};
@@ -48,37 +130,34 @@ describe('main tests', () => {
     process.env['GITHUB_WORKSPACE'] = path.join(__dirname, 'data');
     process.env['GITHUB_PATH'] = ''; // Stub out ENV file functionality so we can verify it writes to standard out
     process.env['GITHUB_OUTPUT'] = ''; // Stub out ENV file functionality so we can verify it writes to standard out
-    infoSpy = jest.spyOn(core, 'info');
+    infoSpy = core.info as jest.Mock;
     infoSpy.mockImplementation(() => {});
-    setOutputSpy = jest.spyOn(core, 'setOutput');
+    setOutputSpy = core.setOutput as jest.Mock;
     setOutputSpy.mockImplementation(() => {});
-    warningSpy = jest.spyOn(core, 'warning');
+    warningSpy = core.warning as jest.Mock;
     warningSpy.mockImplementation(() => {});
-    saveStateSpy = jest.spyOn(core, 'saveState');
+    saveStateSpy = core.saveState as jest.Mock;
     saveStateSpy.mockImplementation(() => {});
-    startGroupSpy = jest.spyOn(core, 'startGroup');
+    startGroupSpy = core.startGroup as jest.Mock;
     startGroupSpy.mockImplementation(() => {});
-    endGroupSpy = jest.spyOn(core, 'endGroup');
+    endGroupSpy = core.endGroup as jest.Mock;
     endGroupSpy.mockImplementation(() => {});
-    inSpy = jest.spyOn(core, 'getInput');
+    inSpy = core.getInput as jest.Mock;
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
-    whichSpy = jest.spyOn(io, 'which');
+    whichSpy = io.which as jest.Mock;
 
-    getExecOutputSpy = jest.spyOn(exec, 'getExecOutput');
+    getExecOutputSpy = exec.getExecOutput as jest.Mock;
 
-    findSpy = jest.spyOn(tc, 'find');
+    findSpy = tc.find as jest.Mock;
 
-    isCacheActionAvailable = jest.spyOn(cache, 'isFeatureAvailable');
+    isCacheActionAvailable = cache.isFeatureAvailable as jest.Mock;
 
     cnSpy = jest.spyOn(process.stdout, 'write');
-    cnSpy.mockImplementation(line => {
+    cnSpy.mockImplementation(() => true);
-      // uncomment to debug
-      process.stderr.write('write:' + line + '\n');
-    });
 
     setupNodeJsSpy = jest.spyOn(OfficialBuilds.prototype, 'setupNodeJs');
-    setupNodeJsSpy.mockImplementation(() => {});
+    setupNodeJsSpy.mockImplementation(async () => {});
   });
 
   afterEach(() => {
@@ -93,32 +172,37 @@ describe('main tests', () => {
   }, 100000);
 
   describe('getNodeVersionFromFile', () => {
+    beforeEach(() => {
+      (util.getNodeVersionFromFile as jest.Mock).mockImplementation(
+        realUtil.getNodeVersionFromFile as any
+      );
+    });
+
     each`
-      contents                                                 | expected
+      contents                                                                                   | expected
-      ${'12'}                                                  | ${'12'}
+      ${'12'}                                                                                    | ${'12'}
-      ${'12.3'}                                                | ${'12.3'}
+      ${'12.3'}                                                                                  | ${'12.3'}
-      ${'12.3.4'}                                              | ${'12.3.4'}
+      ${'12.3.4'}                                                                                | ${'12.3.4'}
-      ${'v12.3.4'}                                             | ${'12.3.4'}
+      ${'v12.3.4'}                                                                               | ${'12.3.4'}
-      ${'lts/erbium'}                                          | ${'lts/erbium'}
+      ${'lts/erbium'}                                                                            | ${'lts/erbium'}
-      ${'lts/*'}                                               | ${'lts/*'}
+      ${'lts/*'}                                                                                 | ${'lts/*'}
-      ${'nodejs 12.3.4'}                                       | ${'12.3.4'}
+      ${'nodejs 12.3.4'}                                                                         | ${'12.3.4'}
-      ${'ruby 2.3.4\nnodejs 12.3.4\npython 3.4.5'}             | ${'12.3.4'}
+      ${'ruby 2.3.4\nnodejs 12.3.4\npython 3.4.5'}                                               | ${'12.3.4'}
-      ${''}                                                    | ${''}
+      ${''}                                                                                      | ${''}
-      ${'unknown format'}                                      | ${'unknown format'}
+      ${'unknown format'}                                                                        | ${'unknown format'}
-      ${'  14.1.0  '}                                          | ${'14.1.0'}
+      ${'  14.1.0  '}                                                                            | ${'14.1.0'}
-      ${'{"volta": {"node": ">=14.0.0 <=17.0.0"}}'}            | ${'>=14.0.0 <=17.0.0'}
+      ${'{}'}                                                                                    | ${null}
-      ${'{"volta": {"extends": "./package.json"}}'}            | ${'18.0.0'}
+      ${'{"volta": {"node": ">=14.0.0 <=17.0.0"}}'}                                              | ${'>=14.0.0 <=17.0.0'}
-      ${'{"engines": {"node": "17.0.0"}}'}                     | ${'17.0.0'}
+      ${'{"volta": {"extends": "./package.json"}}'}                                              | ${'18.0.0'}
-      ${'[tools]\ngo="latest"\nnode = "24.10"'}                | ${'24.10'}
+      ${'{"engines": {"node": "17.0.0"}}'}                                                       | ${'17.0.0'}
-      ${'[tools]\nnode = { version = "22.20" }'}               | ${'22.20'}
+      ${'{"devEngines": {"runtime": {"name": "node", "version": "22.0.0"}}}'}                    | ${'22.0.0'}
-      ${'[tools]\nnode = { postinstall = "corepack enable" }'} | ${null}
+      ${'{"devEngines": {"runtime": [{"name": "bun"}, {"name": "node", "version": "22.0.0"}]}}'} | ${'22.0.0'}
-      ${'{}'}                                                  | ${null}
+    `.it('parses "$contents"', ({contents, expected}: any) => {
-    `.it('parses "$contents"', ({contents, expected}) => {
       const existsSpy = jest.spyOn(fs, 'existsSync');
       existsSpy.mockImplementation(() => true);
 
       const readFileSpy = jest.spyOn(fs, 'readFileSync');
-      readFileSpy.mockImplementation(filePath => {
+      readFileSpy.mockImplementation((filePath: any) => {
         if (
           typeof filePath === 'string' &&
           path.basename(filePath) === 'package.json'
@@ -140,8 +224,10 @@ describe('main tests', () => {
       [{node: '16.0.2', npm: '7.3.3', yarn: '2.22.11'}],
       [{node: '14.0.1', npm: '8.1.0', yarn: '3.2.1'}],
       [{node: '17.0.2', npm: '6.3.3', yarn: ''}]
-    ])('Tools versions %p', async obj => {
+    ])('Tools versions %p', async (obj: any) => {
-      getExecOutputSpy.mockImplementation(async command => {
+      (
+        getExecOutputSpy as jest.Mock<typeof exec.getExecOutput>
+      ).mockImplementation(async (command: string) => {
         if (Reflect.has(obj, command) && !obj[command]) {
           return {
             stdout: '',
@@ -153,14 +239,14 @@ describe('main tests', () => {
         return {stdout: obj[command], stderr: '', exitCode: 0};
       });
 
-      whichSpy.mockImplementation(cmd => {
+      whichSpy.mockImplementation((cmd: any) => {
         return `some/${cmd}/path`;
       });
 
       await util.printEnvDetailsAndSetOutput();
 
       expect(setOutputSpy).toHaveBeenCalledWith('node-version', obj['node']);
-      Object.getOwnPropertyNames(obj).forEach(name => {
+      Object.getOwnPropertyNames(obj).forEach((name: any) => {
         if (!obj[name]) {
           expect(infoSpy).toHaveBeenCalledWith(
             `[warning]${name} does not exist`
@@ -176,11 +262,16 @@ describe('main tests', () => {
       delete inputs['node-version'];
       inputs['node-version-file'] = '.nvmrc';
 
-      getNodeVersionFromFileSpy = jest.spyOn(util, 'getNodeVersionFromFile');
+      getNodeVersionFromFileSpy = util.getNodeVersionFromFile as jest.Mock;
+      getNodeVersionFromFileSpy.mockImplementation(
+        realUtil.getNodeVersionFromFile as any
+      );
     });
 
     afterEach(() => {
-      getNodeVersionFromFileSpy.mockRestore();
+      getNodeVersionFromFileSpy.mockImplementation(
+        realUtil.getNodeVersionFromFile as any
+      );
     });
 
     it('does not read node-version-file if node-version is provided', async () => {
@@ -239,8 +330,8 @@ describe('main tests', () => {
 
       // Assert
       expect(getNodeVersionFromFileSpy).toHaveBeenCalled();
-      expect(cnSpy).toHaveBeenCalledWith(
+      expect(core.setFailed as jest.Mock).toHaveBeenCalledWith(
-        `::error::The specified node version file at: ${versionFilePath} does not exist${osm.EOL}`
+        `The specified node version file at: ${versionFilePath} does not exist`
       );
     });
   });
@@ -250,7 +341,7 @@ describe('main tests', () => {
       inputs['node-version'] = '12';
       inputs['cache'] = 'npm';
 
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
 
       const toolPath = path.normalize('/cache/node/12.16.1/x64');
       findSpy.mockImplementation(() => toolPath);
@@ -270,7 +361,7 @@ describe('main tests', () => {
       inputs['node-version'] = '12';
       inputs['cache'] = 'npm';
 
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
 
       const toolPath = path.normalize('/cache/node/12.16.1/x64');
       findSpy.mockImplementation(() => toolPath);
@@ -293,7 +384,7 @@ describe('main tests', () => {
       inputs['cache'] = '';
       isCacheActionAvailable.mockImplementation(() => true);
 
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
       const readFileSpy = jest.spyOn(fs, 'readFileSync');
       readFileSpy.mockImplementation(() =>
         JSON.stringify({
@@ -311,7 +402,7 @@ describe('main tests', () => {
       inputs['cache'] = '';
       isCacheActionAvailable.mockImplementation(() => true);
 
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
       const readFileSpy = jest.spyOn(fs, 'readFileSync');
       readFileSpy.mockImplementation(() =>
         JSON.stringify({
@@ -331,7 +422,7 @@ describe('main tests', () => {
       inputs['cache'] = '';
       isCacheActionAvailable.mockImplementation(() => true);
 
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
       const readFileSpy = jest.spyOn(fs, 'readFileSync');
       readFileSpy.mockImplementation(() =>
         JSON.stringify({
@@ -349,7 +440,7 @@ describe('main tests', () => {
     it('Should not enable caching if packageManager is "pnpm@8.0.0" and cache input is not provided', async () => {
       inputs['package-manager-cache'] = 'true';
       inputs['cache'] = '';
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
       const readFileSpy = jest.spyOn(fs, 'readFileSync');
       readFileSpy.mockImplementation(() =>
         JSON.stringify({
@@ -365,7 +456,7 @@ describe('main tests', () => {
     it('Should not enable caching if devEngines.packageManager.name is "pnpm"', async () => {
       inputs['package-manager-cache'] = 'true';
       inputs['cache'] = '';
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
       const readFileSpy = jest.spyOn(fs, 'readFileSync');
       readFileSpy.mockImplementation(() =>
         JSON.stringify({
@@ -383,7 +474,7 @@ describe('main tests', () => {
     it('Should not enable caching if devEngines.packageManager is array without "npm"', async () => {
       inputs['package-manager-cache'] = 'true';
       inputs['cache'] = '';
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
       const readFileSpy = jest.spyOn(fs, 'readFileSync');
       readFileSpy.mockImplementation(() =>
         JSON.stringify({
@@ -401,7 +492,7 @@ describe('main tests', () => {
     it('Should not enable caching if packageManager field is missing in package.json and cache input is not provided', async () => {
       inputs['package-manager-cache'] = 'true';
       inputs['cache'] = '';
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
       const readFileSpy = jest.spyOn(fs, 'readFileSync');
       readFileSpy.mockImplementation(() =>
         JSON.stringify({
@@ -417,7 +508,7 @@ describe('main tests', () => {
     it('Should skip caching when package-manager-cache is false', async () => {
       inputs['package-manager-cache'] = 'false';
       inputs['cache'] = '';
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
       await main.run();
       expect(saveStateSpy).not.toHaveBeenCalled();
     });
@@ -425,7 +516,7 @@ describe('main tests', () => {
     it('Should enable caching with cache input explicitly provided', async () => {
       inputs['package-manager-cache'] = 'true';
       inputs['cache'] = 'npm';
-      inSpy.mockImplementation(name => inputs[name]);
+      inSpy.mockImplementation((name: any) => inputs[name]);
       isCacheActionAvailable.mockImplementation(() => true);
       await main.run();
       expect(saveStateSpy).toHaveBeenCalledWith(expect.anything(), 'npm');

__tests__/mock/glob-mock.test.ts

@@ -1,4 +1,5 @@
-import {MockGlobber} from './glob-mock';
+import {describe, it, expect} from '@jest/globals';
+import {MockGlobber} from './glob-mock.js';
 
 describe('mocked globber tests', () => {
   it('globber should return generator', async () => {

__tests__/nightly-installer.test.ts

@@ -1,51 +1,160 @@
-import * as core from '@actions/core';
+import {
-import * as io from '@actions/io';
+  jest,
-import * as tc from '@actions/tool-cache';
+  describe,
-import * as httpm from '@actions/http-client';
+  it,
-import * as exec from '@actions/exec';
+  expect,
-import * as cache from '@actions/cache';
+  beforeEach,
+  afterEach,
+  afterAll
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
 import fs from 'fs';
 import cp from 'child_process';
 import osm from 'os';
 import path from 'path';
-import * as main from '../src/main';
-import * as auth from '../src/authutil';
-import {INodeVersion} from '../src/distributions/base-models';
 
-import nodeTestManifest from './data/versions-manifest.json';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
-import nodeTestDist from './data/node-dist-index.json';
+
-import nodeTestDistNightly from './data/node-nightly-index.json';
+// Mock @actions modules before importing anything that depends on them
-import nodeTestDistRc from './data/node-rc-index.json';
+jest.unstable_mockModule('@actions/core', () => ({
-import nodeV8CanaryTestDist from './data/v8-canary-dist-index.json';
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/io', () => ({
+  which: jest.fn(),
+  mkdirP: jest.fn(),
+  rmRF: jest.fn(),
+  mv: jest.fn(),
+  cp: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/tool-cache', () => ({
+  find: jest.fn(),
+  findAllVersions: jest.fn(),
+  downloadTool: jest.fn(),
+  extractTar: jest.fn(),
+  extractZip: jest.fn(),
+  extractXar: jest.fn(),
+  extract7z: jest.fn(),
+  cacheDir: jest.fn(),
+  cacheFile: jest.fn(),
+  getManifestFromRepo: jest.fn(),
+  findFromManifest: jest.fn(),
+  HTTPError: class HTTPError extends Error {
+    readonly httpStatusCode: number;
+    constructor(httpStatusCode?: number) {
+      super(`Unexpected HTTP response: ${httpStatusCode}`);
+      this.httpStatusCode = httpStatusCode ?? 0;
+    }
+  }
+}));
+
+const _mockGetJson = jest.fn();
+jest.unstable_mockModule('@actions/http-client', () => ({
+  HttpClient: jest.fn().mockImplementation(() => ({
+    getJson: _mockGetJson
+  }))
+}));
+
+jest.unstable_mockModule('@actions/exec', () => ({
+  exec: jest.fn(),
+  getExecOutput: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/cache', () => ({
+  saveCache: jest.fn(),
+  restoreCache: jest.fn(),
+  isFeatureAvailable: jest.fn()
+}));
+
+const realAuth = await import('../src/authutil.js');
+jest.unstable_mockModule('../src/authutil.js', () => ({
+  ...realAuth,
+  configAuthentication: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const io = await import('@actions/io');
+const tc = await import('@actions/tool-cache');
+const httpm = await import('@actions/http-client');
+const exec = await import('@actions/exec');
+const cache = await import('@actions/cache');
+const main = await import('../src/main.js');
+const auth = await import('../src/authutil.js');
+
+const {default: nodeTestManifest} = await import(
+  './data/versions-manifest.json',
+  {with: {type: 'json'}}
+);
+const {default: nodeTestDist} = await import('./data/node-dist-index.json', {
+  with: {type: 'json'}
+});
+const {default: nodeTestDistNightly} = await import(
+  './data/node-nightly-index.json',
+  {with: {type: 'json'}}
+);
+const {default: nodeTestDistRc} = await import('./data/node-rc-index.json', {
+  with: {type: 'json'}
+});
+const {default: nodeV8CanaryTestDist} = await import(
+  './data/v8-canary-dist-index.json',
+  {with: {type: 'json'}}
+);
+
+import type {INodeVersion} from '../src/distributions/base-models.js';
 
 describe('setup-node', () => {
   let inputs = {} as any;
   let os = {} as any;
 
-  let inSpy: jest.SpyInstance;
+  let inSpy: jest.Mock;
-  let findSpy: jest.SpyInstance;
+  let findSpy: jest.Mock;
-  let findAllVersionsSpy: jest.SpyInstance;
+  let findAllVersionsSpy: jest.Mock;
-  let cnSpy: jest.SpyInstance;
+  let cnSpy: jest.SpiedFunction<typeof process.stdout.write>;
-  let logSpy: jest.SpyInstance;
+  let logSpy: jest.Mock;
-  let warningSpy: jest.SpyInstance;
+  let warningSpy: jest.Mock;
-  let getManifestSpy: jest.SpyInstance;
+  let addPathSpy: jest.Mock;
-  let getDistSpy: jest.SpyInstance;
+  let setFailedSpy: jest.Mock;
-  let platSpy: jest.SpyInstance;
+  let getManifestSpy: jest.Mock;
-  let archSpy: jest.SpyInstance;
+  let getDistSpy: jest.Mock;
-  let dlSpy: jest.SpyInstance;
+  let platSpy: jest.SpiedFunction<typeof osm.platform>;
-  let exSpy: jest.SpyInstance;
+  let archSpy: jest.SpiedFunction<typeof osm.arch>;
-  let cacheSpy: jest.SpyInstance;
+  let dlSpy: jest.Mock;
-  let dbgSpy: jest.SpyInstance;
+  let exSpy: jest.Mock;
-  let whichSpy: jest.SpyInstance;
+  let cacheSpy: jest.Mock;
-  let existsSpy: jest.SpyInstance;
+  let dbgSpy: jest.Mock;
-  let mkdirpSpy: jest.SpyInstance;
+  let whichSpy: jest.Mock;
-  let cpSpy: jest.SpyInstance;
+  let existsSpy: jest.SpiedFunction<typeof fs.existsSync>;
-  let execSpy: jest.SpyInstance;
+  let mkdirpSpy: jest.Mock;
-  let authSpy: jest.SpyInstance;
+  let cpSpy: jest.Mock;
-  let parseNodeVersionSpy: jest.SpyInstance;
+  let execSpy: jest.SpiedFunction<typeof cp.execSync>;
-  let isCacheActionAvailable: jest.SpyInstance;
+  let authSpy: jest.Mock;
-  let getExecOutputSpy: jest.SpyInstance;
+  let parseNodeVersionSpy: jest.Mock;
-  let getJsonSpy: jest.SpyInstance;
+  let isCacheActionAvailable: jest.Mock;
+  let getExecOutputSpy: jest.Mock;
+  let getJsonSpy: jest.Mock;
 
   beforeEach(() => {
     // @actions/core
@@ -54,8 +163,8 @@ describe('setup-node', () => {
     process.env['GITHUB_OUTPUT'] = ''; // Stub out ENV file functionality so we can verify it writes to standard out
     process.env['RUNNER_TEMP'] = '/runner_temp';
     inputs = {};
-    inSpy = jest.spyOn(core, 'getInput');
+    inSpy = core.getInput as jest.Mock;
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
     // node
     os = {};
@@ -66,30 +175,33 @@ describe('setup-node', () => {
     execSpy = jest.spyOn(cp, 'execSync');
 
     // @actions/tool-cache
-    findSpy = jest.spyOn(tc, 'find');
+    findSpy = tc.find as jest.Mock;
-    findAllVersionsSpy = jest.spyOn(tc, 'findAllVersions');
+    findAllVersionsSpy = tc.findAllVersions as jest.Mock;
-    dlSpy = jest.spyOn(tc, 'downloadTool');
+    dlSpy = tc.downloadTool as jest.Mock;
-    exSpy = jest.spyOn(tc, 'extractTar');
+    exSpy = tc.extractTar as jest.Mock;
-    cacheSpy = jest.spyOn(tc, 'cacheDir');
+    cacheSpy = tc.cacheDir as jest.Mock;
-    getManifestSpy = jest.spyOn(tc, 'getManifestFromRepo');
+    getManifestSpy = tc.getManifestFromRepo as jest.Mock;
 
     // http-client
-    getJsonSpy = jest.spyOn(httpm.HttpClient.prototype, 'getJson');
+    getJsonSpy = _mockGetJson;
+    (httpm.HttpClient as jest.Mock).mockImplementation(() => ({
+      getJson: _mockGetJson
+    }));
 
     // io
-    whichSpy = jest.spyOn(io, 'which');
+    whichSpy = io.which as jest.Mock;
     existsSpy = jest.spyOn(fs, 'existsSync');
-    mkdirpSpy = jest.spyOn(io, 'mkdirP');
+    mkdirpSpy = io.mkdirP as jest.Mock;
-    cpSpy = jest.spyOn(io, 'cp');
+    cpSpy = io.cp as jest.Mock;
 
     // @actions/tool-cache
-    isCacheActionAvailable = jest.spyOn(cache, 'isFeatureAvailable');
+    isCacheActionAvailable = cache.isFeatureAvailable as jest.Mock;
 
     // disable authentication portion for installer tests
-    authSpy = jest.spyOn(auth, 'configAuthentication');
+    authSpy = auth.configAuthentication as jest.Mock;
     authSpy.mockImplementation(() => {});
 
-    getJsonSpy.mockImplementation(url => {
+    getJsonSpy.mockImplementation((url: any) => {
       let res: any;
       if (url.includes('/rc')) {
         res = <INodeVersion[]>nodeTestDistRc;
@@ -106,28 +218,18 @@ describe('setup-node', () => {
 
     // writes
     cnSpy = jest.spyOn(process.stdout, 'write');
-    logSpy = jest.spyOn(core, 'info');
+    logSpy = core.info as jest.Mock;
-    dbgSpy = jest.spyOn(core, 'debug');
+    dbgSpy = core.debug as jest.Mock;
-    warningSpy = jest.spyOn(core, 'warning');
+    warningSpy = core.warning as jest.Mock;
-    cnSpy.mockImplementation(line => {
+    addPathSpy = core.addPath as jest.Mock;
-      // uncomment to debug
+    setFailedSpy = core.setFailed as jest.Mock;
-      // process.stderr.write('write:' + line + '\n');
+    cnSpy.mockImplementation(() => true);
-    });
+    logSpy.mockImplementation(() => {});
-    logSpy.mockImplementation(line => {
+    dbgSpy.mockImplementation(() => {});
-      // uncomment to debug
+    warningSpy.mockImplementation(() => {});
-      // process.stderr.write('log:' + line + '\n');
-    });
-    dbgSpy.mockImplementation(msg => {
-      // uncomment to see debug output
-      // process.stderr.write(msg + '\n');
-    });
-    warningSpy.mockImplementation(msg => {
-      // uncomment to debug
-      // process.stderr.write('log:' + msg + '\n');
-    });
 
     // @actions/exec
-    getExecOutputSpy = jest.spyOn(exec, 'getExecOutput');
+    getExecOutputSpy = exec.getExecOutput as jest.Mock;
     getExecOutputSpy.mockImplementation(() => 'v16.15.0');
   });
 
@@ -202,7 +304,7 @@ describe('setup-node', () => {
     inputs['node-version'] = '16-nightly';
     os['arch'] = 'x64';
 
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
     const toolPath = path.normalize(
       '/cache/node/16.0.0-nightly20210417bc31dc0e0f/x64'
@@ -224,7 +326,7 @@ describe('setup-node', () => {
     );
 
     const expPath = path.join(toolPath, 'bin');
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(expPath);
   });
 
   it('handles unhandled find error and reports error', async () => {
@@ -244,7 +346,7 @@ describe('setup-node', () => {
 
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith('::error::' + errMsg + osm.EOL);
+    expect(setFailedSpy).toHaveBeenCalledWith(errMsg);
   });
 
   it('falls back to a version from node dist', async () => {
@@ -274,7 +376,7 @@ describe('setup-node', () => {
 
     expect(dlSpy).toHaveBeenCalled();
     expect(exSpy).toHaveBeenCalled();
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(expPath);
   });
 
   it('windows: falls back to exe version if not in manifest and not in node dist', async () => {
@@ -296,8 +398,8 @@ describe('setup-node', () => {
     findSpy.mockImplementation(() => '');
     findAllVersionsSpy.mockImplementation(() => []);
 
-    dlSpy.mockImplementation(async url => {
+    dlSpy.mockImplementation(async (url: any) => {
-      if (workingUrls.includes(url)) {
+      if (workingUrls.includes(url as string)) {
         return '/some/temp/path';
       }
 
@@ -312,10 +414,10 @@ describe('setup-node', () => {
 
     await main.run();
 
-    workingUrls.forEach(url => {
+    workingUrls.forEach((url: any) => {
       expect(dlSpy).toHaveBeenCalledWith(url, undefined, undefined);
     });
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${toolPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(toolPath);
   });
 
   it('linux: does not fall back to exe version if not in manifest and not in node dist', async () => {
@@ -337,8 +439,8 @@ describe('setup-node', () => {
     findSpy.mockImplementation(() => '');
     findAllVersionsSpy.mockImplementation(() => []);
 
-    dlSpy.mockImplementation(async url => {
+    dlSpy.mockImplementation(async (url: any) => {
-      if (workingUrls.includes(url)) {
+      if (workingUrls.includes(url as string)) {
         return '/some/temp/path';
       }
 
@@ -353,12 +455,10 @@ describe('setup-node', () => {
 
     await main.run();
 
-    workingUrls.forEach(url => {
+    workingUrls.forEach((url: any) => {
       expect(dlSpy).not.toHaveBeenCalledWith(url);
     });
-    expect(cnSpy).toHaveBeenCalledWith(
+    expect(setFailedSpy).toHaveBeenCalledWith('Unexpected HTTP response: 404');
-      `::error::Unexpected HTTP response: 404${osm.EOL}`
-    );
   });
 
   it('does not find a version that does not exist', async () => {
@@ -372,8 +472,8 @@ describe('setup-node', () => {
     findAllVersionsSpy.mockImplementation(() => []);
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith(
+    expect(setFailedSpy).toHaveBeenCalledWith(
-      `::error::Unable to find Node version '${versionSpec}' for platform ${os.platform} and architecture ${os.arch}.${osm.EOL}`
+      `Unable to find Node version '${versionSpec}' for platform ${os.platform} and architecture ${os.arch}.`
     );
   });
 
@@ -396,7 +496,7 @@ describe('setup-node', () => {
     });
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith(`::error::${errMsg}${osm.EOL}`);
+    expect(setFailedSpy).toHaveBeenCalledWith(errMsg);
   });
 
   it('acquires specified architecture of node', async () => {
@@ -420,7 +520,6 @@ describe('setup-node', () => {
         darwin: 'darwin',
         win32: 'win'
       }[os.platform];
-
       inputs['node-version'] = version;
       inputs['architecture'] = arch;
       inputs['token'] = 'faketoken';
@@ -465,7 +564,6 @@ describe('setup-node', () => {
         darwin: 'darwin',
         win32: 'win'
       }[os.platform];
-
       inputs['node-version'] = version;
       inputs['architecture'] = arch;
       inputs['token'] = 'faketoken';
@@ -541,9 +639,7 @@ describe('setup-node', () => {
         );
         expect(logSpy).toHaveBeenCalledWith('Extracting ...');
         expect(logSpy).toHaveBeenCalledWith('Adding to the cache ...');
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
 
@@ -573,9 +669,7 @@ describe('setup-node', () => {
         // assert
         expect(findAllVersionsSpy).toHaveBeenCalled();
         expect(logSpy).toHaveBeenCalledWith(`Found in cache @ ${toolPath}`);
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
 
@@ -641,9 +735,7 @@ describe('setup-node', () => {
         );
         expect(logSpy).toHaveBeenCalledWith('Extracting ...');
         expect(logSpy).toHaveBeenCalledWith('Adding to the cache ...');
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
   });

__tests__/official-installer.test.ts

@@ -1,51 +1,163 @@
-import * as core from '@actions/core';
+import {
-import * as io from '@actions/io';
+  jest,
-import * as tc from '@actions/tool-cache';
+  describe,
-import * as httpm from '@actions/http-client';
+  it,
-import * as exec from '@actions/exec';
+  expect,
-import * as cache from '@actions/cache';
+  beforeEach,
+  afterEach,
+  afterAll
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
 import fs from 'fs';
 import cp from 'child_process';
 import osm from 'os';
 import path from 'path';
-import * as main from '../src/main';
-import * as auth from '../src/authutil';
-import OfficialBuilds from '../src/distributions/official_builds/official_builds';
-import {INodeVersion} from '../src/distributions/base-models';
 
-import nodeTestManifest from './data/versions-manifest.json';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
-import nodeTestDist from './data/node-dist-index.json';
+
-import nodeTestDistNightly from './data/node-nightly-index.json';
+// Mock @actions modules before importing anything that depends on them
-import nodeTestDistRc from './data/node-rc-index.json';
+jest.unstable_mockModule('@actions/core', () => ({
-import nodeV8CanaryTestDist from './data/v8-canary-dist-index.json';
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/io', () => ({
+  which: jest.fn(),
+  mkdirP: jest.fn(),
+  rmRF: jest.fn(),
+  mv: jest.fn(),
+  cp: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/tool-cache', () => ({
+  find: jest.fn(),
+  findAllVersions: jest.fn(),
+  downloadTool: jest.fn(),
+  extractTar: jest.fn(),
+  extractZip: jest.fn(),
+  extractXar: jest.fn(),
+  extract7z: jest.fn(),
+  cacheDir: jest.fn(),
+  cacheFile: jest.fn(),
+  getManifestFromRepo: jest.fn(),
+  findFromManifest: jest.fn(),
+  HTTPError: class HTTPError extends Error {
+    readonly httpStatusCode: number;
+    constructor(httpStatusCode?: number) {
+      super(`Unexpected HTTP response: ${httpStatusCode}`);
+      this.httpStatusCode = httpStatusCode ?? 0;
+    }
+  }
+}));
+
+const _mockGetJson = jest.fn();
+jest.unstable_mockModule('@actions/http-client', () => ({
+  HttpClient: jest.fn().mockImplementation(() => ({
+    getJson: _mockGetJson
+  }))
+}));
+
+jest.unstable_mockModule('@actions/exec', () => ({
+  exec: jest.fn(),
+  getExecOutput: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/cache', () => ({
+  saveCache: jest.fn(),
+  restoreCache: jest.fn(),
+  isFeatureAvailable: jest.fn()
+}));
+
+// Pre-import real authutil before mocking
+const realAuth = await import('../src/authutil.js');
+jest.unstable_mockModule('../src/authutil.js', () => ({
+  ...realAuth,
+  configAuthentication: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const io = await import('@actions/io');
+const tc = await import('@actions/tool-cache');
+const httpm = await import('@actions/http-client');
+const exec = await import('@actions/exec');
+const cache = await import('@actions/cache');
+const main = await import('../src/main.js');
+const auth = await import('../src/authutil.js');
+const {default: OfficialBuilds} =
+  await import('../src/distributions/official_builds/official_builds.js');
+
+const {default: nodeTestManifest} = await import(
+  './data/versions-manifest.json',
+  {with: {type: 'json'}}
+);
+const {default: nodeTestDist} = await import('./data/node-dist-index.json', {
+  with: {type: 'json'}
+});
+const {default: nodeTestDistNightly} = await import(
+  './data/node-nightly-index.json',
+  {with: {type: 'json'}}
+);
+const {default: nodeTestDistRc} = await import('./data/node-rc-index.json', {
+  with: {type: 'json'}
+});
+const {default: nodeV8CanaryTestDist} = await import(
+  './data/v8-canary-dist-index.json',
+  {with: {type: 'json'}}
+);
+
+import type {INodeVersion} from '../src/distributions/base-models.js';
+import type {IToolRelease} from '@actions/tool-cache';
 
 describe('setup-node', () => {
-  let build: OfficialBuilds;
+  let build: InstanceType<typeof OfficialBuilds>;
   let inputs = {} as any;
   let os = {} as any;
 
-  let inSpy: jest.SpyInstance;
+  let inSpy: jest.Mock;
-  let findSpy: jest.SpyInstance;
+  let findSpy: jest.Mock;
-  let findAllVersionsSpy: jest.SpyInstance;
+  let findAllVersionsSpy: jest.Mock;
-  let cnSpy: jest.SpyInstance;
+  let cnSpy: jest.SpiedFunction<typeof process.stdout.write>;
-  let logSpy: jest.SpyInstance;
+  let logSpy: jest.Mock;
-  let warningSpy: jest.SpyInstance;
+  let warningSpy: jest.Mock;
-  let getManifestSpy: jest.SpyInstance;
+  let addPathSpy: jest.Mock;
-  let platSpy: jest.SpyInstance;
+  let setFailedSpy: jest.Mock;
-  let archSpy: jest.SpyInstance;
+  let getManifestSpy: jest.Mock;
-  let dlSpy: jest.SpyInstance;
+  let platSpy: jest.SpiedFunction<typeof osm.platform>;
-  let exSpy: jest.SpyInstance;
+  let archSpy: jest.SpiedFunction<typeof osm.arch>;
-  let cacheSpy: jest.SpyInstance;
+  let dlSpy: jest.Mock;
-  let dbgSpy: jest.SpyInstance;
+  let exSpy: jest.Mock;
-  let whichSpy: jest.SpyInstance;
+  let cacheSpy: jest.Mock;
-  let existsSpy: jest.SpyInstance;
+  let dbgSpy: jest.Mock;
-  let readFileSyncSpy: jest.SpyInstance;
+  let whichSpy: jest.Mock;
-  let mkdirpSpy: jest.SpyInstance;
+  let existsSpy: jest.SpiedFunction<typeof fs.existsSync>;
-  let execSpy: jest.SpyInstance;
+  let readFileSyncSpy: jest.Mock;
-  let authSpy: jest.SpyInstance;
+  let mkdirpSpy: jest.Mock;
-  let isCacheActionAvailable: jest.SpyInstance;
+  let execSpy: jest.SpiedFunction<typeof cp.execSync>;
-  let getExecOutputSpy: jest.SpyInstance;
+  let authSpy: jest.Mock;
-  let getJsonSpy: jest.SpyInstance;
+  let isCacheActionAvailable: jest.Mock;
+  let getExecOutputSpy: jest.Mock;
+  let getJsonSpy: jest.Mock;
 
   beforeEach(() => {
     // @actions/core
@@ -53,8 +165,8 @@ describe('setup-node', () => {
     process.env['GITHUB_PATH'] = ''; // Stub out ENV file functionality so we can verify it writes to standard out
     process.env['GITHUB_OUTPUT'] = ''; // Stub out ENV file functionality so we can verify it writes to standard out
     inputs = {};
-    inSpy = jest.spyOn(core, 'getInput');
+    inSpy = core.getInput as jest.Mock;
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
     // node
     os = {};
@@ -65,34 +177,61 @@ describe('setup-node', () => {
     execSpy = jest.spyOn(cp, 'execSync');
 
     // @actions/tool-cache
-    findSpy = jest.spyOn(tc, 'find');
+    findSpy = tc.find as jest.Mock;
-    findAllVersionsSpy = jest.spyOn(tc, 'findAllVersions');
+    findAllVersionsSpy = tc.findAllVersions as jest.Mock;
-    dlSpy = jest.spyOn(tc, 'downloadTool');
+    dlSpy = tc.downloadTool as jest.Mock;
-    exSpy = jest.spyOn(tc, 'extractTar');
+    exSpy = tc.extractTar as jest.Mock;
-    cacheSpy = jest.spyOn(tc, 'cacheDir');
+    cacheSpy = tc.cacheDir as jest.Mock;
-    getManifestSpy = jest.spyOn(tc, 'getManifestFromRepo');
+    getManifestSpy = tc.getManifestFromRepo as jest.Mock;
+
+    // Restore findFromManifest after clearMocks.
+    // In ESM, the real tc.findFromManifest uses os.platform() from its own
+    // module namespace, which jest.spyOn on our os import cannot override.
+    // So we provide a minimal reimplementation that uses the test's os var.
+    (tc.findFromManifest as jest.Mock).mockImplementation(
+      async (versionSpec: any, stable: any, manifest: any, archFilter: any) => {
+        const arch = archFilter || os['arch'] || 'x64';
+        const plat = os['platform'] || process.platform;
+        const semverModule = await import('semver');
+        for (const rel of manifest || []) {
+          if (
+            semverModule.default.satisfies(rel.version, versionSpec, {
+              includePrerelease: true
+            }) &&
+            rel.stable === stable
+          ) {
+            const file = rel.files.find(
+              (f: any) => f.arch === arch && f.platform === plat
+            );
+            if (file) return {...rel, files: [file]};
+          }
+        }
+        return undefined;
+      }
+    );
 
     // http-client
-    getJsonSpy = jest.spyOn(httpm.HttpClient.prototype, 'getJson');
+    getJsonSpy = _mockGetJson;
+    (httpm.HttpClient as jest.Mock).mockImplementation(() => ({
+      getJson: _mockGetJson
+    }));
 
     // io
-    whichSpy = jest.spyOn(io, 'which');
+    whichSpy = io.which as jest.Mock;
     existsSpy = jest.spyOn(fs, 'existsSync');
-    mkdirpSpy = jest.spyOn(io, 'mkdirP');
+    mkdirpSpy = io.mkdirP as jest.Mock;
 
     // @actions/tool-cache
-    isCacheActionAvailable = jest.spyOn(cache, 'isFeatureAvailable');
+    isCacheActionAvailable = cache.isFeatureAvailable as jest.Mock;
 
     // disable authentication portion for installer tests
-    authSpy = jest.spyOn(auth, 'configAuthentication');
+    authSpy = auth.configAuthentication as jest.Mock;
     authSpy.mockImplementation(() => {});
 
     // gets
-    getManifestSpy.mockImplementation(
+    getManifestSpy.mockImplementation(() => <IToolRelease[]>nodeTestManifest);
-      () => <tc.IToolRelease[]>nodeTestManifest
-    );
 
-    getJsonSpy.mockImplementation(url => {
+    getJsonSpy.mockImplementation((url: any) => {
       let res: any;
       if (url.includes('/rc')) {
         res = <INodeVersion[]>nodeTestDistRc;
@@ -107,28 +246,18 @@ describe('setup-node', () => {
 
     // writes
     cnSpy = jest.spyOn(process.stdout, 'write');
-    logSpy = jest.spyOn(core, 'info');
+    logSpy = core.info as jest.Mock;
-    dbgSpy = jest.spyOn(core, 'debug');
+    dbgSpy = core.debug as jest.Mock;
-    warningSpy = jest.spyOn(core, 'warning');
+    warningSpy = core.warning as jest.Mock;
-    cnSpy.mockImplementation(line => {
+    addPathSpy = core.addPath as jest.Mock;
-      // uncomment to debug
+    setFailedSpy = core.setFailed as jest.Mock;
-      process.stderr.write('write:' + line + '\n');
+    cnSpy.mockImplementation(() => true);
-    });
+    logSpy.mockImplementation(() => {});
-    logSpy.mockImplementation(line => {
+    dbgSpy.mockImplementation(() => {});
-      //   uncomment to debug
+    warningSpy.mockImplementation(() => {});
-      process.stderr.write('log:' + line + '\n');
-    });
-    dbgSpy.mockImplementation(msg => {
-      // uncomment to see debug output
-      // process.stderr.write(msg + '\n');
-    });
-    warningSpy.mockImplementation(msg => {
-      // uncomment to debug
-      // process.stderr.write('log:' + msg + '\n');
-    });
 
     // @actions/exec
-    getExecOutputSpy = jest.spyOn(exec, 'getExecOutput');
+    getExecOutputSpy = exec.getExecOutput as jest.Mock;
     getExecOutputSpy.mockImplementation(() => 'v16.15.0');
   });
 
@@ -156,7 +285,7 @@ describe('setup-node', () => {
     async (versionSpec, platform, expectedVersion, expectedLts) => {
       os.platform = platform;
       os.arch = 'x64';
-      const versions: tc.IToolRelease[] | null = await tc.getManifestFromRepo(
+      const versions: IToolRelease[] | null = await tc.getManifestFromRepo(
         'actions',
         'node-versions',
         'mocktoken'
@@ -187,7 +316,7 @@ describe('setup-node', () => {
   it('finds version in cache with stable not supplied', async () => {
     inputs['node-version'] = '12';
 
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
     const toolPath = path.normalize('/cache/node/12.16.1/x64');
     findSpy.mockImplementation(() => toolPath);
@@ -199,14 +328,14 @@ describe('setup-node', () => {
   it('finds version in cache and adds it to the path', async () => {
     inputs['node-version'] = '12';
 
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
     const toolPath = path.normalize('/cache/node/12.16.1/x64');
     findSpy.mockImplementation(() => toolPath);
     await main.run();
 
     const expPath = path.join(toolPath, 'bin');
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(expPath);
   });
 
   it('handles unhandled find error and reports error', async () => {
@@ -219,7 +348,7 @@ describe('setup-node', () => {
 
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith('::error::' + errMsg + osm.EOL);
+    expect(setFailedSpy).toHaveBeenCalledWith(errMsg);
   });
 
   //--------------------------------------------------
@@ -247,7 +376,7 @@ describe('setup-node', () => {
     const toolPath = path.normalize('/cache/node/12.16.2/x64');
     exSpy.mockImplementation(async () => '/some/other/temp/path');
     cacheSpy.mockImplementation(async () => toolPath);
-    whichSpy.mockImplementation(cmd => {
+    whichSpy.mockImplementation((cmd: any) => {
       return `some/${cmd}/path`;
     });
 
@@ -278,7 +407,7 @@ describe('setup-node', () => {
     expect(logSpy).toHaveBeenCalledWith(
       `Attempting to download ${versionSpec}...`
     );
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(expPath);
   });
 
   it('falls back to a version from node dist from mirror', async () => {
@@ -314,7 +443,7 @@ describe('setup-node', () => {
     );
     expect(dlSpy).toHaveBeenCalled();
     expect(exSpy).toHaveBeenCalled();
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(expPath);
   });
 
   it('falls back to a version from node dist', async () => {
@@ -348,7 +477,7 @@ describe('setup-node', () => {
     );
     expect(dlSpy).toHaveBeenCalled();
     expect(exSpy).toHaveBeenCalled();
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(expPath);
   });
 
   it('does not find a version that does not exist', async () => {
@@ -367,8 +496,8 @@ describe('setup-node', () => {
     expect(logSpy).toHaveBeenCalledWith(
       `Attempting to download ${versionSpec}...`
     );
-    expect(cnSpy).toHaveBeenCalledWith(
+    expect(setFailedSpy).toHaveBeenCalledWith(
-      `::error::Unable to find Node version '${versionSpec}' for platform ${os.platform} and architecture ${os.arch}.${osm.EOL}`
+      `Unable to find Node version '${versionSpec}' for platform ${os.platform} and architecture ${os.arch}.`
     );
   });
 
@@ -390,7 +519,7 @@ describe('setup-node', () => {
     });
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith(`::error::${errMsg}${osm.EOL}`);
+    expect(setFailedSpy).toHaveBeenCalledWith(errMsg);
   });
 
   it('reports when download failed but version exists', async () => {
@@ -583,7 +712,7 @@ describe('setup-node', () => {
       expect(logSpy).toHaveBeenCalledWith(
         `Attempting to download ${versionSpec}...`
       );
-      expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+      expect(addPathSpy).toHaveBeenCalledWith(expPath);
     });
 
     it('fallback to dist if manifest is not available', async () => {
@@ -626,7 +755,7 @@ describe('setup-node', () => {
       expect(logSpy).toHaveBeenCalledWith(
         `Attempting to download ${versionSpec}...`
       );
-      expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+      expect(addPathSpy).toHaveBeenCalledWith(expPath);
     });
   });
 
@@ -668,9 +797,7 @@ describe('setup-node', () => {
           `Found LTS release '${expectedVersion}' for Node version 'lts/${lts}'`
         );
         expect(logSpy).toHaveBeenCalledWith(`Found in cache @ ${toolPath}`);
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
 
@@ -728,9 +855,7 @@ describe('setup-node', () => {
         );
         expect(logSpy).toHaveBeenCalledWith('Extracting ...');
         expect(logSpy).toHaveBeenCalledWith('Adding to the cache ...');
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
 
@@ -750,8 +875,8 @@ describe('setup-node', () => {
       expect(dbgSpy).toHaveBeenCalledWith(
         'Getting manifest from actions/node-versions@main'
       );
-      expect(cnSpy).toHaveBeenCalledWith(
+      expect(setFailedSpy).toHaveBeenCalledWith(
-        `::error::Unable to parse LTS alias for Node version 'lts/'${osm.EOL}`
+        `Unable to parse LTS alias for Node version 'lts/'`
       );
     });
 
@@ -774,8 +899,8 @@ describe('setup-node', () => {
       expect(dbgSpy).toHaveBeenCalledWith(
         `LTS alias 'unknown' for Node version 'lts/unknown'`
       );
-      expect(cnSpy).toHaveBeenCalledWith(
+      expect(setFailedSpy).toHaveBeenCalledWith(
-        `::error::Unable to find LTS release 'unknown' for Node version 'lts/unknown'.${osm.EOL}`
+        `Unable to find LTS release 'unknown' for Node version 'lts/unknown'.`
       );
     });
 
@@ -799,9 +924,7 @@ describe('setup-node', () => {
       expect(dbgSpy).toHaveBeenCalledWith(
         'Getting manifest from actions/node-versions@main'
       );
-      expect(cnSpy).toHaveBeenCalledWith(
+      expect(setFailedSpy).toHaveBeenCalledWith('Unable to download manifest');
-        `::error::Unable to download manifest${osm.EOL}`
-      );
     });
   });
 
@@ -871,7 +994,6 @@ describe('setup-node', () => {
         darwin: 'darwin',
         win32: 'win'
       }[os.platform];
-
       inputs['node-version'] = version;
       inputs['architecture'] = arch;
       inputs['token'] = 'faketoken';

__tests__/problem-matcher.test.ts

@@ -1,4 +1,5 @@
-import tscMatcher from '../.github/tsc.json';
+import {describe, it, expect} from '@jest/globals';
+import tscMatcher from '../.github/tsc.json' with {type: 'json'};
 
 describe('problem matcher tests', () => {
   it('tsc: matches TypeScript "pretty" error message', () => {

__tests__/rc-installer.test.ts

@@ -1,46 +1,152 @@
-import * as core from '@actions/core';
+import {
-import * as io from '@actions/io';
+  jest,
-import * as tc from '@actions/tool-cache';
+  describe,
-import * as httpm from '@actions/http-client';
+  it,
-import * as exec from '@actions/exec';
+  expect,
-import * as cache from '@actions/cache';
+  beforeEach,
+  afterEach,
+  afterAll
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
 import fs from 'fs';
 import cp from 'child_process';
 import osm from 'os';
 import path from 'path';
-import * as main from '../src/main';
-import * as auth from '../src/authutil';
-import {INodeVersion} from '../src/distributions/base-models';
 
-import nodeTestDist from './data/node-dist-index.json';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
-import nodeTestDistNightly from './data/node-nightly-index.json';
+
-import nodeTestDistRc from './data/node-rc-index.json';
+// Mock @actions modules before importing anything that depends on them
-import nodeV8CanaryTestDist from './data/v8-canary-dist-index.json';
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/io', () => ({
+  which: jest.fn(),
+  mkdirP: jest.fn(),
+  rmRF: jest.fn(),
+  mv: jest.fn(),
+  cp: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/tool-cache', () => ({
+  find: jest.fn(),
+  findAllVersions: jest.fn(),
+  downloadTool: jest.fn(),
+  extractTar: jest.fn(),
+  extractZip: jest.fn(),
+  extractXar: jest.fn(),
+  extract7z: jest.fn(),
+  cacheDir: jest.fn(),
+  cacheFile: jest.fn(),
+  getManifestFromRepo: jest.fn(),
+  findFromManifest: jest.fn(),
+  HTTPError: class HTTPError extends Error {
+    readonly httpStatusCode: number;
+    constructor(httpStatusCode?: number) {
+      super(`Unexpected HTTP response: ${httpStatusCode}`);
+      this.httpStatusCode = httpStatusCode ?? 0;
+    }
+  }
+}));
+
+const _mockGetJson = jest.fn();
+jest.unstable_mockModule('@actions/http-client', () => ({
+  HttpClient: jest.fn().mockImplementation(() => ({
+    getJson: _mockGetJson
+  }))
+}));
+
+jest.unstable_mockModule('@actions/exec', () => ({
+  exec: jest.fn(),
+  getExecOutput: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/cache', () => ({
+  saveCache: jest.fn(),
+  restoreCache: jest.fn(),
+  isFeatureAvailable: jest.fn()
+}));
+
+const realAuth = await import('../src/authutil.js');
+jest.unstable_mockModule('../src/authutil.js', () => ({
+  ...realAuth,
+  configAuthentication: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const io = await import('@actions/io');
+const tc = await import('@actions/tool-cache');
+const httpm = await import('@actions/http-client');
+const exec = await import('@actions/exec');
+const cache = await import('@actions/cache');
+const main = await import('../src/main.js');
+const auth = await import('../src/authutil.js');
+
+const {default: nodeTestDist} = await import('./data/node-dist-index.json', {
+  with: {type: 'json'}
+});
+const {default: nodeTestDistNightly} = await import(
+  './data/node-nightly-index.json',
+  {with: {type: 'json'}}
+);
+const {default: nodeTestDistRc} = await import('./data/node-rc-index.json', {
+  with: {type: 'json'}
+});
+const {default: nodeV8CanaryTestDist} = await import(
+  './data/v8-canary-dist-index.json',
+  {with: {type: 'json'}}
+);
+
+import type {INodeVersion} from '../src/distributions/base-models.js';
 
 describe('setup-node', () => {
   let inputs = {} as any;
   let os = {} as any;
 
-  let inSpy: jest.SpyInstance;
+  let inSpy: jest.Mock;
-  let findSpy: jest.SpyInstance;
+  let findSpy: jest.Mock;
-  let findAllVersionsSpy: jest.SpyInstance;
+  let findAllVersionsSpy: jest.Mock;
-  let cnSpy: jest.SpyInstance;
+  let cnSpy: jest.SpiedFunction<typeof process.stdout.write>;
-  let logSpy: jest.SpyInstance;
+  let logSpy: jest.Mock;
-  let warningSpy: jest.SpyInstance;
+  let warningSpy: jest.Mock;
-  let platSpy: jest.SpyInstance;
+  let addPathSpy: jest.Mock;
-  let archSpy: jest.SpyInstance;
+  let setFailedSpy: jest.Mock;
-  let dlSpy: jest.SpyInstance;
+  let platSpy: jest.SpiedFunction<typeof osm.platform>;
-  let exSpy: jest.SpyInstance;
+  let archSpy: jest.SpiedFunction<typeof osm.arch>;
-  let cacheSpy: jest.SpyInstance;
+  let dlSpy: jest.Mock;
-  let dbgSpy: jest.SpyInstance;
+  let exSpy: jest.Mock;
-  let whichSpy: jest.SpyInstance;
+  let cacheSpy: jest.Mock;
-  let existsSpy: jest.SpyInstance;
+  let dbgSpy: jest.Mock;
-  let mkdirpSpy: jest.SpyInstance;
+  let whichSpy: jest.Mock;
-  let execSpy: jest.SpyInstance;
+  let existsSpy: jest.SpiedFunction<typeof fs.existsSync>;
-  let authSpy: jest.SpyInstance;
+  let mkdirpSpy: jest.Mock;
-  let isCacheActionAvailable: jest.SpyInstance;
+  let execSpy: jest.SpiedFunction<typeof cp.execSync>;
-  let getExecOutputSpy: jest.SpyInstance;
+  let authSpy: jest.Mock;
-  let getJsonSpy: jest.SpyInstance;
+  let isCacheActionAvailable: jest.Mock;
+  let getExecOutputSpy: jest.Mock;
+  let getJsonSpy: jest.Mock;
 
   beforeEach(() => {
     // @actions/core
@@ -48,8 +154,8 @@ describe('setup-node', () => {
     process.env['GITHUB_PATH'] = ''; // Stub out ENV file functionality so we can verify it writes to standard out
     process.env['GITHUB_OUTPUT'] = ''; // Stub out ENV file functionality so we can verify it writes to standard out
     inputs = {};
-    inSpy = jest.spyOn(core, 'getInput');
+    inSpy = core.getInput as jest.Mock;
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
     // node
     os = {};
@@ -60,30 +166,33 @@ describe('setup-node', () => {
     execSpy = jest.spyOn(cp, 'execSync');
 
     // @actions/tool-cache
-    findSpy = jest.spyOn(tc, 'find');
+    findSpy = tc.find as jest.Mock;
-    findAllVersionsSpy = jest.spyOn(tc, 'findAllVersions');
+    findAllVersionsSpy = tc.findAllVersions as jest.Mock;
-    dlSpy = jest.spyOn(tc, 'downloadTool');
+    dlSpy = tc.downloadTool as jest.Mock;
-    exSpy = jest.spyOn(tc, 'extractTar');
+    exSpy = tc.extractTar as jest.Mock;
-    cacheSpy = jest.spyOn(tc, 'cacheDir');
+    cacheSpy = tc.cacheDir as jest.Mock;
-    // getDistSpy = jest.spyOn(im, 'getVersionsFromDist');
+    // getDistSpy = jest.spyOn(im, 'getVersionsFromDist') as jest.Mock;
 
     // http-client
-    getJsonSpy = jest.spyOn(httpm.HttpClient.prototype, 'getJson');
+    getJsonSpy = _mockGetJson;
+    (httpm.HttpClient as jest.Mock).mockImplementation(() => ({
+      getJson: _mockGetJson
+    }));
 
     // io
-    whichSpy = jest.spyOn(io, 'which');
+    whichSpy = io.which as jest.Mock;
     existsSpy = jest.spyOn(fs, 'existsSync');
-    mkdirpSpy = jest.spyOn(io, 'mkdirP');
+    mkdirpSpy = io.mkdirP as jest.Mock;
 
     // @actions/tool-cache
-    isCacheActionAvailable = jest.spyOn(cache, 'isFeatureAvailable');
+    isCacheActionAvailable = cache.isFeatureAvailable as jest.Mock;
     isCacheActionAvailable.mockImplementation(() => false);
 
     // disable authentication portion for installer tests
-    authSpy = jest.spyOn(auth, 'configAuthentication');
+    authSpy = auth.configAuthentication as jest.Mock;
     authSpy.mockImplementation(() => {});
 
-    getJsonSpy.mockImplementation(url => {
+    getJsonSpy.mockImplementation((url: any) => {
       let res: any;
       if (url.includes('/rc')) {
         res = <INodeVersion[]>nodeTestDistRc;
@@ -98,28 +207,18 @@ describe('setup-node', () => {
 
     // writes
     cnSpy = jest.spyOn(process.stdout, 'write');
-    logSpy = jest.spyOn(core, 'info');
+    logSpy = core.info as jest.Mock;
-    dbgSpy = jest.spyOn(core, 'debug');
+    dbgSpy = core.debug as jest.Mock;
-    warningSpy = jest.spyOn(core, 'warning');
+    warningSpy = core.warning as jest.Mock;
-    cnSpy.mockImplementation(line => {
+    addPathSpy = core.addPath as jest.Mock;
-      // uncomment to debug
+    setFailedSpy = core.setFailed as jest.Mock;
-      // process.stderr.write('write:' + line + '\n');
+    cnSpy.mockImplementation(() => true);
-    });
+    logSpy.mockImplementation(() => {});
-    logSpy.mockImplementation(line => {
+    dbgSpy.mockImplementation(() => {});
-      // uncomment to debug
+    warningSpy.mockImplementation(() => {});
-      // process.stderr.write('log:' + line + '\n');
-    });
-    dbgSpy.mockImplementation(msg => {
-      // uncomment to see debug output
-      // process.stderr.write(msg + '\n');
-    });
-    warningSpy.mockImplementation(msg => {
-      // uncomment to debug
-      // process.stderr.write('log:' + msg + '\n');
-    });
 
     // @actions/exec
-    getExecOutputSpy = jest.spyOn(exec, 'getExecOutput');
+    getExecOutputSpy = exec.getExecOutput as jest.Mock;
     getExecOutputSpy.mockImplementation(() => 'v16.15.0-rc.1');
   });
 
@@ -152,7 +251,7 @@ describe('setup-node', () => {
   it('finds version in cache with stable not supplied', async () => {
     inputs['node-version'] = '12.0.0-rc.1';
 
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
     const toolPath = path.normalize('/cache/node/12.0.0-rc.1/x64');
     findSpy.mockImplementation(() => toolPath);
@@ -164,14 +263,14 @@ describe('setup-node', () => {
   it('finds version in cache and adds it to the path', async () => {
     inputs['node-version'] = '12.0.0-rc.1';
 
-    inSpy.mockImplementation(name => inputs[name]);
+    inSpy.mockImplementation((name: any) => inputs[name]);
 
     const toolPath = path.normalize('/cache/node/12.0.0-rc.1/x64');
     findSpy.mockImplementation(() => toolPath);
     await main.run();
 
     const expPath = path.join(toolPath, 'bin');
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(expPath);
   });
 
   it('handles unhandled find error and reports error', async () => {
@@ -184,7 +283,7 @@ describe('setup-node', () => {
 
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith('::error::' + errMsg + osm.EOL);
+    expect(setFailedSpy).toHaveBeenCalledWith(errMsg);
   });
 
   it('falls back to a version from node dist', async () => {
@@ -212,7 +311,7 @@ describe('setup-node', () => {
     expect(exSpy).toHaveBeenCalled();
     expect(logSpy).toHaveBeenCalledWith('Extracting ...');
     expect(logSpy).toHaveBeenCalledWith('Done');
-    expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    expect(addPathSpy).toHaveBeenCalledWith(expPath);
   });
 
   it('does not find a version that does not exist', async () => {
@@ -225,8 +324,8 @@ describe('setup-node', () => {
     findSpy.mockImplementation(() => '');
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith(
+    expect(setFailedSpy).toHaveBeenCalledWith(
-      `::error::Unable to find Node version '${versionSpec}' for platform ${os.platform} and architecture ${os.arch}.${osm.EOL}`
+      `Unable to find Node version '${versionSpec}' for platform ${os.platform} and architecture ${os.arch}.`
     );
   });
 
@@ -247,7 +346,7 @@ describe('setup-node', () => {
     });
     await main.run();
 
-    expect(cnSpy).toHaveBeenCalledWith(`::error::${errMsg}${osm.EOL}`);
+    expect(setFailedSpy).toHaveBeenCalledWith(errMsg);
   });
 
   it('acquires specified architecture of node', async () => {
@@ -263,7 +362,6 @@ describe('setup-node', () => {
         darwin: 'darwin',
         win32: 'win'
       }[os.platform];
-
       inputs['node-version'] = version;
       inputs['architecture'] = arch;
       inputs['token'] = 'faketoken';
@@ -334,9 +432,7 @@ describe('setup-node', () => {
         // assert
         expect(logSpy).toHaveBeenCalledWith('Extracting ...');
         expect(logSpy).toHaveBeenCalledWith('Adding to the cache ...');
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
 
@@ -370,9 +466,7 @@ describe('setup-node', () => {
 
         // assert
         expect(logSpy).toHaveBeenCalledWith(`Found in cache @ ${toolPath}`);
-        expect(cnSpy).toHaveBeenCalledWith(
+        expect(addPathSpy).toHaveBeenCalledWith(path.join(toolPath, 'bin'));
-          `::add-path::${path.join(toolPath, 'bin')}${osm.EOL}`
-        );
       }
     );
 
@@ -391,8 +485,8 @@ describe('setup-node', () => {
       await main.run();
 
       // assert
-      expect(cnSpy).toHaveBeenCalledWith(
+      expect(setFailedSpy).toHaveBeenCalledWith(
-        `::error::Unable to find Node version '${versionSpec}' for platform ${os.platform} and architecture ${os.arch}.${osm.EOL}`
+        `Unable to find Node version '${versionSpec}' for platform ${os.platform} and architecture ${os.arch}.`
       );
     });
   });

action.yml

@@ -34,6 +34,10 @@ inputs:
 outputs:
   cache-hit:
     description: 'A boolean value to indicate if a cache was hit.'
+  cache-primary-key:
+    description: 'The key used to restore and save the cache.'
+  cache-matched-key:
+    description: 'The key of the cache that was restored. Empty when no cache is found.'
   node-version:
     description: 'The installed node version.'
 runs:

dist/cache-save/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

dist/setup/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

docs/advanced-usage.md

@@ -69,6 +69,7 @@ steps:
   with:
     node-version: '24'
     check-latest: true
+    package-manager-cache: false # Disable automatic npm caching if not required
 - run: npm ci
 - run: npm test
 ```
@@ -86,25 +87,36 @@ steps:
 - uses: actions/setup-node@v6
   with:
     node-version-file: '.nvmrc'
+    package-manager-cache: false # Disable automatic npm caching if not required
 - run: npm ci
 - run: npm test
 ```
 
-When using the `package.json` input, the action will look for `volta.node` first. If `volta.node` isn't defined, then it will look for `engines.node`.
+When using the `package.json` input, the action will look in the following fields for a specified Node version:
+1. It checks `volta.node` first.
+2. Then it checks `devEngines.runtime` for an entry with `"name": "node"`.
+3. Then it will look for `engines.node`.
+4. Otherwise it tries to resolve the file defined by [`volta.extends`](https://docs.volta.sh/advanced/workspaces)
+   and look for `volta.node`, `devEngines.runtime`, or `engines.node` recursively.
+
 
 ```json
 {
   "engines": {
-    "node": ">=16.0.0"
+    "node": "^22 || ^24"
+  },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": "^24.3"
+    }
   },
   "volta": {
-    "node": "16.0.0"
+    "node": "24.11.1"
   }
 }
 ```
 
-Otherwise, when [`volta.extends`](https://docs.volta.sh/advanced/workspaces) is defined, then it will resolve the corresponding file and look for `volta.node` or `engines.node` recursively.
-
 ## Architecture
 
 You can use any of the [supported operating systems](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners), and the compatible `architecture` can be selected using `architecture`. Values are `x86`, `x64`, `arm64`, `armv6l`, `armv7l`, `ppc64le`, `s390x` (not all of the architectures are available on all platforms).
@@ -121,6 +133,7 @@ jobs:
         with:
           node-version: '24'
           architecture: 'x64' # optional, x64 or x86. If not specified, x64 will be used by default
+          package-manager-cache: false # Disable automatic npm caching if not required
       - run: npm ci
       - run: npm test
 ```
@@ -141,6 +154,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: '24.0.0-v8-canary' # it will install the latest v8 canary release for node 24.0.0
+          package-manager-cache: false # Disable automatic npm caching if not required
       - run: npm ci
       - run: npm test
 ```
@@ -156,6 +170,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: '24-v8-canary' # it will install the latest v8 canary release for node 24
+          package-manager-cache: false # Disable automatic npm caching if not required
       - run: npm ci
       - run: npm test
 ```
@@ -172,6 +187,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: 'v24.0.0-v8-canary2025030537242e55ac'
+          package-manager-cache: false # Disable automatic npm caching if not required
       - run: npm ci
       - run: npm test
 ```
@@ -192,6 +208,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: '24-nightly' # it will install the latest nightly release for node 24
+          package-manager-cache: false # Disable automatic npm caching if not required
       - run: npm ci
       - run: npm test
 ```
@@ -208,6 +225,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: '24.0.0-nightly' # it will install the latest nightly release for node 24.0.0
+          package-manager-cache: false # Disable automatic npm caching if not required
       - run: npm ci
       - run: npm test
 ```
@@ -224,6 +242,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: '24.0.0-nightly202505066102159fa1'
+          package-manager-cache: false # Disable automatic npm caching if not required
       - run: npm ci
       - run: npm test
 ```
@@ -242,11 +261,12 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: '24.0.0-rc.4'
+          package-manager-cache: false # Disable automatic npm caching if not required
       - run: npm ci
       - run: npm test
 ```
 
-**Note:** Unlike nightly versions, which support version range specifiers, you must specify the exact version for a release candidate: `24.0.0-rc.4`.
+**Note**: Unlike nightly versions, which support version range specifiers, you must specify the exact version for a release candidate: `24.0.0-rc.4`.
 
 ## Caching packages data
 The action follows [actions/cache](https://github.com/actions/cache/blob/main/examples.md#node---npm) guidelines, and caches global cache on the machine instead of `node_modules`, so cache can be reused between different Node.js versions.
@@ -319,36 +339,52 @@ steps:
 - run: npm test
 ```
 
-**Restore-Only Cache**
+**Restore-only cache**
+
+You can restore caches without saving new entries, which helps reduce cache writes and storage usage in read-only cache workflows.
 
 ```yaml
-## In some workflows, you may want to restore a cache without saving it. This can help reduce cache writes and storage usage in workflows that only need to read from cache
+steps:
-jobs:
+- uses: actions/checkout@v6
-  build:
+# - uses: pnpm/action-setup@v6 
-    runs-on: ubuntu-latest
+#   with:
-    steps:
+#     version: 10
-      - uses: actions/checkout@v6
+
-      # Restore Node.js modules cache (restore-only)
+- name: Setup Node.js
-      - name: Restore Node modules cache
+  uses: actions/setup-node@v6
-        uses: actions/cache@v5
+  with:
-        id: cache-node-modules
+    node-version: '24'
-        with:
+    package-manager-cache: false # Disable automatic npm caching if not required
-          path: ~/.npm
+
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+- name: Normalize runner architecture
-          restore-keys: |
+  shell: bash
-            ${{ runner.os }}-node-
+  run: echo "ARCH=$(echo '${{ runner.arch }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
-      # Setup Node.js
+    
-      - name: Setup Node.js
+- name: Output of cache path
-        uses: actions/setup-node@v6
+  id: cachepath
-        with:
+  shell: bash
-          node-version: '24'
+  run: echo "path=$(npm config get cache)" >> $GITHUB_OUTPUT
-      # Install dependencies
+  # run: echo "path=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
-      - run: npm install
+  # For yarn workflow, output of yarn cache dir (v1) or yarn config get cacheFolder (v2+)
+  # run: echo "path=$(yarn cache dir)" >> $GITHUB_OUTPUT 
+    
+- name: Restore Node cache
+  uses: actions/cache/restore@v5
+  with:
+    path: ${{ steps.cachepath.outputs.path }}
+    key: node-cache-${{ runner.os }}-${{ env.ARCH }}-npm-${{ hashFiles('**/package-lock.json') }}
+    # key: node-cache-${{ runner.os }}-${{ env.ARCH }}-yarn-${{ hashFiles('**/yarn.lock') }}
+    # key: node-cache-${{ runner.os }}-${{ env.ARCH }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
+    
+- run: npm ci
+# - run: yarn install --frozen-lockfile # optional, --immutable
+# - run: pnpm install
 ```
+> **Note**: Uncomment the commands relevant to your project's package manager.
 
-> For more details related to cache scenarios, please refer [Node – npm](https://github.com/actions/cache/blob/main/examples.md#node---npm).
+> For more details related to cache scenarios, please refer [actions/cache/restore](https://github.com/actions/cache/tree/main/restore#only-restore-cache).
 
-## Multiple Operating Systems and Architectures
+## Multiple operating systems and architectures
 
 ```yaml
 jobs:
@@ -379,6 +415,7 @@ jobs:
         with:
           node-version: ${{ matrix.node_version }}
           architecture: ${{ matrix.architecture }}
+          package-manager-cache: false # Disable automatic npm caching if not required
       - run: npm ci
       - run: npm test
 ```
@@ -391,6 +428,7 @@ steps:
   with:
     node-version: '24.x'
     registry-url: 'https://registry.npmjs.org'
+    package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
 - run: npm ci
 - run: npm publish
   env:
@@ -398,6 +436,7 @@ steps:
 - uses: actions/setup-node@v6
   with:
     registry-url: 'https://npm.pkg.github.com'
+    package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
 - run: npm publish
   env:
     NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -411,6 +450,7 @@ steps:
   with:
     node-version: '24.x'
     registry-url: <registry url>
+    package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
 - run: yarn install --frozen-lockfile
 - run: yarn publish
   env:
@@ -418,6 +458,7 @@ steps:
 - uses: actions/setup-node@v6
   with:
     registry-url: 'https://npm.pkg.github.com'
+    package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
 - run: yarn publish
   env:
     NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -431,6 +472,7 @@ steps:
   with:
     node-version: '24.x'
     registry-url: 'https://registry.npmjs.org'
+    package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
 # Skip post-install scripts here, as a malicious
 # script could steal NODE_AUTH_TOKEN.
 - run: npm ci --ignore-scripts
@@ -450,6 +492,7 @@ steps:
 - uses: actions/setup-node@v6
   with:
     node-version: '24.x'
+    package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
 - name: Setup .yarnrc.yml
   run: |
     yarn config set npmScopes.my-org.npmRegistryServer "https://npm.pkg.github.com"
@@ -465,12 +508,54 @@ To access private GitHub Packages within the same organization, go to "Manage Ac
 
 Please refer to the [Ensuring workflow access to your package - Configuring a package's access control and visibility](https://docs.github.com/en/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility#ensuring-workflow-access-to-your-package) for more details.
 
+## Publishing to npm with Trusted Publisher (OIDC)
+
+npm supports Trusted Publishers, enabling packages to be published from GitHub Actions using OpenID Connect (OIDC) instead of long-lived npm tokens. This improves security by replacing static credentials with short-lived tokens, reducing the risk of credential leakage and simplifying authentication in CI/CD workflows.
+
+### Requirements
+
+Trusted publishing requires a compatible npm version:
+
+* **npm ≥ 11.5.1 (required)**
+* **Node.js 24 or newer (recommended)** — includes a compatible npm version by default
+
+> If npm is below 11.5.1, publishing will fail even if OIDC permissions are correctly configured.
+
+You must also configure a **Trusted Publisher** in npm for your package/scope that matches your GitHub repository and workflow (and optional environment, if used).
+
+> **Note**: In publishing workflows, set `package-manager-cache: false` because setup-node enables npm caching automatically when `package.json` specifies npm via `packageManager` or `devEngines.packageManager` (see [Running without a lockfile](#running-without-a-lockfile)), and a poisoned cache may expose credentials (including OIDC tokens) to attacker-controlled code.
+
+### Example workflow
+
+```yaml
+    permissions:
+      contents: read
+      id-token: write  # Required for OIDC
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
+
+      - run: npm ci
+      - run: npm run build --if-present
+      - run: npm publish
+```
+
+> **Note**: If the Trusted Publisher configuration (GitHub owner/repo/workflow file, and optional environment) does not match the workflow run identity exactly, publishing may fail with **E404 Not Found** even if the package exists on npm.
+
+For more details, see the [npm Trusted Publishers documentation](https://docs.npmjs.com/trusted-publishers) and the [GitHub Actions OpenID Connect (OIDC) overview](https://docs.github.com/en/actions/concepts/security/openid-connect).
+
 ## Use private mirror
 
 It is possible to use a private mirror hosting Node.js binaries. This mirror must be a full mirror of the official Node.js distribution.
 The mirror URL can be set using the `mirror` input.
 It is possible to specify a token to authenticate with the mirror using the `mirror-token` input.
-The token will be passed as a bearer token in the `Authorization` header.
+The token will be passed in the `Authorization` header.
 
 ```yaml
 - uses: actions/setup-node@v6
@@ -478,4 +563,5 @@ The token will be passed as a bearer token in the `Authorization` header.
     node-version: '24.x'
     mirror: 'https://nodejs.org/dist'
     mirror-token: 'your-mirror-token'
+    cache-package-manager: false # Disable automatic npm caching if not required
 ```

eslint.config.mjs

@@ -0,0 +1,74 @@
+// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
+import js from '@eslint/js';
+import tsParser from '@typescript-eslint/parser';
+import tsPlugin from '@typescript-eslint/eslint-plugin';
+import jest from 'eslint-plugin-jest';
+import n from 'eslint-plugin-n';
+import prettier from 'eslint-config-prettier';
+import globals from 'globals';
+
+export default [
+  {
+    ignores: ['**/*', '!src/**', '!__tests__/**']
+  },
+  js.configs.recommended,
+  {
+    files: ['**/*.ts'],
+    languageOptions: {
+      parser: tsParser,
+      ecmaVersion: 2022,
+      sourceType: 'module',
+      globals: {
+        ...globals.node,
+        ...globals.es2015
+      }
+    },
+    plugins: {
+      '@typescript-eslint': tsPlugin,
+      n
+    },
+    rules: {
+      ...tsPlugin.configs.recommended.rules,
+      '@typescript-eslint/no-require-imports': 'error',
+      '@typescript-eslint/no-non-null-assertion': 'off',
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-empty-function': 'off',
+      '@typescript-eslint/ban-ts-comment': [
+        'error',
+        {
+          'ts-ignore': 'allow-with-description'
+        }
+      ],
+      'no-console': 'error',
+      yoda: 'error',
+      'prefer-const': [
+        'error',
+        {
+          destructuring: 'all'
+        }
+      ],
+      'no-control-regex': 'off',
+      'no-constant-condition': ['error', {checkLoops: false}],
+      'no-undef': 'off',
+      'no-useless-assignment': 'off',
+      'n/no-extraneous-import': 'error'
+    }
+  },
+  {
+    files: ['**/*{test,spec}.ts'],
+    plugins: {jest},
+    languageOptions: {
+      globals: {
+        ...globals.jest
+      }
+    },
+    rules: {
+      ...jest.configs['flat/recommended'].rules,
+      '@typescript-eslint/no-unused-vars': 'off',
+      'jest/no-standalone-expect': 'off',
+      'jest/no-conditional-expect': 'off',
+      'no-console': 'off'
+    }
+  },
+  prettier
+];

jest.config.js

@@ -1,11 +0,0 @@
-module.exports = {
-  clearMocks: true,
-  moduleFileExtensions: ['js', 'ts'],
-  testEnvironment: 'node',
-  testMatch: ['**/*.test.ts'],
-  testRunner: 'jest-circus/runner',
-  transform: {
-    '^.+\\.ts$': 'ts-jest'
-  },
-  verbose: true
-}