Merge ead69d56d0 into c882bffdbd

Replace uuid with crypto.randomUUID() (#1378 )
* Replace uuid with crypto.randomUUID() * chore: license cache * chore: update files in dist * fix: edits during resolve
2026-06-08 13:33:47 +08:00 · 2026-02-26 16:14:47 -03:00 · 2026-02-26 13:09:52 -06:00 · 2026-02-23 12:10:57 -06:00 · 2026-02-19 11:58:14 -06:00 · 2026-02-10 09:37:41 -06:00
15 changed files with 55205 additions and 694 deletions
--- a/.github/workflows/versions.yml
+++ b/.github/workflows/versions.yml
@@ -168,6 +168,21 @@ jobs:
      - name: Verify node
        run: __tests__/verify-node.sh 24

+  version-file-dev-engines:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup node from node version file
+        uses: ./
+        with:
+          node-version-file: '__tests__/data/package-dev-engines.json'
+      - name: Verify node
+        run: __tests__/verify-node.sh 20
+
  version-file-volta:
    runs-on: ${{ matrix.os }}
    strategy:
--- a/.licensed.yml
+++ b/.licensed.yml
@@ -12,4 +12,5 @@ allowed:
  - unlicense

 reviewed:
-  npm:
+  npm:
+     - "@actions/http-client"
--- a/.licenses/npm/@actions/http-client-3.0.2.dep.yml
+++ b/.licenses/npm/@actions/http-client-3.0.2.dep.yml
@@ -1,10 +1,10 @@
 ---
 name: "@actions/http-client"
-version: 3.0.0
+version: 3.0.2
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client
-license: mit
+license: other
 licenses:
 - sources: LICENSE
  text: |
--- a/.licenses/npm/fast-xml-parser.dep.yml
+++ b/.licenses/npm/fast-xml-parser.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.3.3
+version: 5.3.4
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:
--- a/.licenses/npm/undici-5.29.0.dep.yml
+++ b/.licenses/npm/undici-5.29.0.dep.yml
--- a/.licenses/npm/undici-6.23.0.dep.yml
+++ b/.licenses/npm/undici-6.23.0.dep.yml
@@ -0,0 +1,34 @@
+---
+name: undici
+version: 6.23.0
+type: npm
+summary: An HTTP/1.1 client, written from scratch for Node.js
+homepage: https://undici.nodejs.org
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) Matteo Collina and Undici contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: MIT
+notices: []
--- a/tests/data/package-dev-engines.json
+++ b/tests/data/package-dev-engines.json
@@ -0,0 +1,11 @@
+{
+  "engines": {
+    "node": "^19"
+  },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": "^20"
+    }
+  }
+}
--- a/tests/main.test.ts
+++ b/tests/main.test.ts
@@ -94,22 +94,24 @@ describe('main tests', () => {

  describe('getNodeVersionFromFile', () => {
    each`
-      contents                                     | expected
-      ${'12'}                                      | ${'12'}
-      ${'12.3'}                                    | ${'12.3'}
-      ${'12.3.4'}                                  | ${'12.3.4'}
-      ${'v12.3.4'}                                 | ${'12.3.4'}
-      ${'lts/erbium'}                              | ${'lts/erbium'}
-      ${'lts/*'}                                   | ${'lts/*'}
-      ${'nodejs 12.3.4'}                           | ${'12.3.4'}
-      ${'ruby 2.3.4\nnodejs 12.3.4\npython 3.4.5'} | ${'12.3.4'}
-      ${''}                                        | ${''}
-      ${'unknown format'}                          | ${'unknown format'}
-      ${'  14.1.0  '}                              | ${'14.1.0'}
-      ${'{"volta": {"node": ">=14.0.0 <=17.0.0"}}'}| ${'>=14.0.0 <=17.0.0'}
-      ${'{"volta": {"extends": "./package.json"}}'}| ${'18.0.0'}
-      ${'{"engines": {"node": "17.0.0"}}'}         | ${'17.0.0'}
-      ${'{}'}                                      | ${null}
+      contents                                                                                   | expected
+      ${'12'}                                                                                    | ${'12'}
+      ${'12.3'}                                                                                  | ${'12.3'}
+      ${'12.3.4'}                                                                                | ${'12.3.4'}
+      ${'v12.3.4'}                                                                               | ${'12.3.4'}
+      ${'lts/erbium'}                                                                            | ${'lts/erbium'}
+      ${'lts/*'}                                                                                 | ${'lts/*'}
+      ${'nodejs 12.3.4'}                                                                         | ${'12.3.4'}
+      ${'ruby 2.3.4\nnodejs 12.3.4\npython 3.4.5'}                                               | ${'12.3.4'}
+      ${''}                                                                                      | ${''}
+      ${'unknown format'}                                                                        | ${'unknown format'}
+      ${'  14.1.0  '}                                                                            | ${'14.1.0'}
+      ${'{}'}                                                                                    | ${null}
+      ${'{"volta": {"node": ">=14.0.0 <=17.0.0"}}'}                                              | ${'>=14.0.0 <=17.0.0'}
+      ${'{"volta": {"extends": "./package.json"}}'}                                              | ${'18.0.0'}
+      ${'{"engines": {"node": "17.0.0"}}'}                                                       | ${'17.0.0'}
+      ${'{"devEngines": {"runtime": {"name": "node", "version": "22.0.0"}}}'}                    | ${'22.0.0'}
+      ${'{"devEngines": {"runtime": [{"name": "bun"}, {"name": "node", "version": "22.0.0"}]}}'} | ${'22.0.0'}
    `.it('parses "$contents"', ({contents, expected}) => {
      const existsSpy = jest.spyOn(fs, 'existsSync');
      existsSpy.mockImplementation(() => true);
@@ -133,10 +135,11 @@ describe('main tests', () => {

  describe('printEnvDetailsAndSetOutput', () => {
    it.each([
-      [{node: '12.0.2', npm: '6.3.3', yarn: '1.22.11'}],
-      [{node: '16.0.2', npm: '7.3.3', yarn: '2.22.11'}],
-      [{node: '14.0.1', npm: '8.1.0', yarn: '3.2.1'}],
-      [{node: '17.0.2', npm: '6.3.3', yarn: ''}]
+      [{node: '12.0.2', npm: '6.3.3', yarn: '1.22.11', pnpm: ''}],
+      [{node: '16.0.2', npm: '7.3.3', yarn: '2.22.11', pnpm: ''}],
+      [{node: '14.0.1', npm: '8.1.0', yarn: '3.2.1', pnpm: ''}],
+      [{node: '17.0.2', npm: '6.3.3', yarn: '', pnpm: ''}],
+      [{node: '24.10.0', npm: '11.6.1', yarn: '', pnpm: '10.18.3'}]
    ])('Tools versions %p', async obj => {
      getExecOutputSpy.mockImplementation(async command => {
        if (Reflect.has(obj, command) && !obj[command]) {
--- a/dist/cache-save/index.js
+++ b/dist/cache-save/index.js
--- a/dist/setup/index.js
+++ b/dist/setup/index.js
--- a/docs/advanced-usage.md
+++ b/docs/advanced-usage.md
@@ -90,21 +90,31 @@ steps:
 - run: npm test
 ```

-When using the `package.json` input, the action will look for `volta.node` first. If `volta.node` isn't defined, then it will look for `engines.node`.
+When using the `package.json` input, the action will look in the following fields for a specified Node version:
+1. It checks `volta.node` first.
+2. Then it checks `devEngines.runtime` for an entry with `"name": "node"`.
+3. Then it will look for `engines.node`.
+4. Otherwise it tries to resolve the file defined by [`volta.extends`](https://docs.volta.sh/advanced/workspaces)
+   and look for `volta.node`, `devEngines.runtime`, or `engines.node` recursively.
+

 ```json
 {
  "engines": {
-    "node": ">=16.0.0"
+    "node": "^22 || ^24"
+  },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": "^24.3"
+    }
  },
  "volta": {
-    "node": "16.0.0"
+    "node": "24.11.1"
  }
 }
 ```

-Otherwise, when [`volta.extends`](https://docs.volta.sh/advanced/workspaces) is defined, then it will resolve the corresponding file and look for `volta.node` or `engines.node` recursively.
-
 ## Architecture

 You can use any of the [supported operating systems](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners), and the compatible `architecture` can be selected using `architecture`. Values are `x86`, `x64`, `arm64`, `armv6l`, `armv7l`, `ppc64le`, `s390x` (not all of the architectures are available on all platforms).
@@ -470,7 +480,7 @@ Please refer to the [Ensuring workflow access to your package - Configuring a pa
 It is possible to use a private mirror hosting Node.js binaries. This mirror must be a full mirror of the official Node.js distribution.
 The mirror URL can be set using the `mirror` input.
 It is possible to specify a token to authenticate with the mirror using the `mirror-token` input.
-The token will be passed as a bearer token in the `Authorization` header.
+The token will be passed in the `Authorization` header.

 ```yaml
 - uses: actions/setup-node@v6
--- a/package-lock.json
+++ b/package-lock.json
@@ -17,8 +17,7 @@
        "@actions/http-client": "^2.2.1",
        "@actions/io": "^1.0.2",
        "@actions/tool-cache": "^2.0.2",
-        "semver": "^7.6.3",
-        "uuid": "^11.1.0"
+        "semver": "^7.6.3"
      },
      "devDependencies": {
        "@types/jest": "^29.5.14",
@@ -80,13 +79,13 @@
      }
    },
    "node_modules/@actions/cache/node_modules/@actions/http-client": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.0.tgz",
-      "integrity": "sha512-1s3tXAfVMSz9a4ZEBkXXRQD4QhY3+GAsWSbaYpeknPOKEeyRiU3lH+bHiLMZdo2x/fIeQ/hscL1wCkDLVM2DZQ==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
+        "undici": "^6.23.0"
      }
    },
    "node_modules/@actions/cache/node_modules/@actions/io": {
@@ -104,6 +103,15 @@
        "semver": "bin/semver.js"
      }
    },
+    "node_modules/@actions/cache/node_modules/undici": {
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
    "node_modules/@actions/core": {
      "version": "1.11.1",
      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
@@ -1619,7 +1627,6 @@
      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz",
      "integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==",
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@octokit/auth-token": "^4.0.0",
        "@octokit/graphql": "^7.1.0",
@@ -1953,7 +1960,6 @@
      "integrity": "sha512-TiZzBSJja/LbhNPvk6yc0JrX9XqhQ0hdh6M2svYfsHGejaKFIAGd9MQ+ERIMzLGlN/kZoYIgdxFV0PuljTKXag==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@eslint-community/regexpp": "^4.4.0",
        "@typescript-eslint/scope-manager": "5.62.0",
@@ -1989,7 +1995,6 @@
      "integrity": "sha512-VlJEV0fOQ7BExOsHYAGrgbEiZoi8D+Bl2+f6V2RrXerRSylnp+ZBHmPvaIa8cz0Ajx7WO7Z5RqfgYg7ED1nRhA==",
      "dev": true,
      "license": "BSD-2-Clause",
-      "peer": true,
      "dependencies": {
        "@typescript-eslint/scope-manager": "5.62.0",
        "@typescript-eslint/types": "5.62.0",
@@ -2182,7 +2187,6 @@
      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "bin": {
        "acorn": "bin/acorn"
      },
@@ -2503,7 +2507,6 @@
        }
      ],
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "baseline-browser-mapping": "^2.9.0",
        "caniuse-lite": "^1.0.30001759",
@@ -2910,7 +2913,6 @@
      "deprecated": "This version is no longer supported. Please see https://eslint.org/version-support for other options.",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.2.0",
        "@eslint-community/regexpp": "^4.6.1",
@@ -3340,9 +3342,9 @@
      "license": "MIT"
    },
    "node_modules/fast-xml-parser": {
-      "version": "5.3.3",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.3.tgz",
-      "integrity": "sha512-2O3dkPAAC6JavuMm8+4+pgTk+5hoAs+CjZ+sWcQLkX9+/tHRuTkQh/Oaifr8qDmZ8iEHb771Ea6G8CdwkrgvYA==",
+      "version": "5.3.4",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.4.tgz",
+      "integrity": "sha512-EFd6afGmXlCx8H8WTZHhAoDaWaGyuIBoZJ2mknrNxug+aZKjkp0a0dlars9Izl+jF+7Gu1/5f/2h68cQpe0IiA==",
      "funding": [
        {
          "type": "github",
@@ -3950,7 +3952,6 @@
      "integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@jest/core": "^29.7.0",
        "@jest/types": "^29.6.3",
@@ -5789,7 +5790,6 @@
      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "dev": true,
      "license": "Apache-2.0",
-      "peer": true,
      "bin": {
        "tsc": "bin/tsc",
        "tsserver": "bin/tsserver"
@@ -5878,19 +5878,6 @@
        "punycode": "^2.1.0"
      }
    },
-    "node_modules/uuid": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
-      "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/esm/bin/uuid"
-      }
-    },
    "node_modules/v8-to-istanbul": {
      "version": "9.3.0",
      "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz",
--- a/package.json
+++ b/package.json
@@ -36,8 +36,7 @@
    "@actions/http-client": "^2.2.1",
    "@actions/io": "^1.0.2",
    "@actions/tool-cache": "^2.0.2",
-    "semver": "^7.6.3",
-    "uuid": "^11.1.0"
+    "semver": "^7.6.3"
  },
  "devDependencies": {
    "@types/jest": "^29.5.14",
--- a/src/distributions/base-distribution.ts
+++ b/src/distributions/base-distribution.ts
@@ -1,4 +1,3 @@
-import {v4 as uuidv4} from 'uuid';
 import * as tc from '@actions/tool-cache';
 import * as hc from '@actions/http-client';
 import * as core from '@actions/core';
@@ -103,7 +102,7 @@ export default abstract class BaseDistribution {
    const headers = {};

    if (this.nodeInfo.mirrorToken) {
-      headers['Authorization'] = `Bearer ${this.nodeInfo.mirrorToken}`;
+      headers['Authorization'] = this.nodeInfo.mirrorToken;
    }

    const response = await this.httpClient.getJson<INodeVersion[]>(
@@ -185,7 +184,7 @@ export default abstract class BaseDistribution {
    const osArch: string = this.translateArchToDistUrl(arch);

    // Create temporary folder to download to
-    const tempDownloadFolder = `temp_${uuidv4()}`;
+    const tempDownloadFolder = `temp_${crypto.randomUUID()}`;
    const tempDirectory = process.env['RUNNER_TEMP'] || '';
    assert.ok(tempDirectory, 'Expected RUNNER_TEMP to be defined');
    const tempDir: string = path.join(tempDirectory, tempDownloadFolder);
--- a/src/util.ts
+++ b/src/util.ts
@@ -26,6 +26,18 @@ export function getNodeVersionFromFile(versionFilePath: string): string | null {
        return manifest.volta.node;
      }

+      // support devEngines from npm 11
+      if (manifest.devEngines?.runtime) {
+        // find an entry with name set to node and having set a version.
+        // the devEngines.runtime can either be an object or an array of objects
+        const nodeEntry = [manifest.devEngines.runtime]
+          .flat()
+          .find(({name, version}) => name?.toLowerCase() === 'node' && version);
+        if (nodeEntry) {
+          return nodeEntry.version;
+        }
+      }
+
      if (manifest.engines?.node) {
        return manifest.engines.node;
      }
@@ -62,7 +74,7 @@ export function getNodeVersionFromFile(versionFilePath: string): string | null {

 export async function printEnvDetailsAndSetOutput() {
  core.startGroup('Environment details');
-  const promises = ['node', 'npm', 'yarn'].map(async tool => {
+  const promises = ['node', 'npm', 'yarn', 'pnpm'].map(async tool => {
    const pathTool = await io.which(tool, false);
    const output = pathTool ? await getToolVersion(tool, ['--version']) : '';
Author	SHA1	Message	Date
Marina Skripnik	553d8ef2a4	Merge `ead69d56d0` into `c882bffdbd`	2026-02-26 16:14:47 -03:00
Trivikram Kamat	c882bffdbd	Replace uuid with crypto.randomUUID() (#1378 ) * Replace uuid with crypto.randomUUID() * chore: license cache * chore: update files in dist * fix: edits during resolve	2026-02-26 13:09:52 -06:00
Ferdinand Thiessen	774c1d6296	feat(node-version-file): support parsing `devEngines` field (#1283 ) * feat(node-version-file): support parsing `devEngines` field Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> * test: adjust for array like `devEngines` Co-authored-by: Grigory <grigory.orlov.set@gmail.com> Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> * ci(versions.yml): update actions and reduce duplicated tests Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> * docs: consolidate advanced usage Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> * chore: compile assets Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> --------- Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> Co-authored-by: Grigory <grigory.orlov.set@gmail.com>	2026-02-23 12:10:57 -06:00
Marco Ippolito	efcb663fc6	fix: remove hardcoded bearer (#1467 )	2026-02-19 11:58:14 -06:00
gowridurgad	d02c89dce7	Fix npm audit issues (#1491 ) Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-02-10 09:37:41 -06:00
Maryna S	ead69d56d0	Update dist files	2026-02-02 21:52:57 +02:00
Maryna S	43959a440a	Resolve merge conflicts	2026-02-02 21:46:00 +02:00
Maryna S	fc2e41dd00	Print pnpm in env details output	2025-10-30 15:10:30 +02:00