What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in #1577
• Migrate to ESM and upgrade dependencies by @gowridurgad in #1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in #1558
• Only use mirrorToken in getManifest if it's provided by @deiga in #1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in #1536
• docs: Update restore-only cache documentation by @priya-kinthali in #1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in #1567

Dependency update:

• Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in #1569

New Contributors

• @chiranjib-swain made their first contribution in #1536
• @deiga made their first contribution in #1548
• @jasongin made their first contribution in #1569

Full Changelog: v6...v7.0.0

What's Changed

• Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in #1579

Full Changelog: v6.4.0...v6.5.0

What's Changed

Dependency updates:

• Upgrade @actions dependencies by @Copilot in #1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @priya-kinthali in #1533

New Contributors

• @Copilot made their first contribution in #1525

Full Changelog: v6...v6.4.0

What's Changed

Enhancements:

• Support parsing devEngines field by @susnux in #1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

• Fix npm audit issues by @gowridurgad in #1491
• Replace uuid with crypto.randomUUID() by @trivikr in #1378
• Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in #1498

Bug fixes:

• Remove hardcoded bearer for mirror-url @marco-ippolito in #1467
• Scope test lockfiles by package manager and update cache tests by @gowridurgad in #1495

New Contributors

• @susnux made their first contribution in #1283

Full Changelog: v6...v6.3.0

What's Changed

Documentation

• Documentation update related to absence of Lockfile by @mahabaleshwars in #1454
• Correct mirror option typos by @MikeMcC399 in #1442
• Readme update on checkout version v6 by @deining in #1446
• Readme typo fixes @munyari in #1226
• Advanced document update on checkout version v6 by @aparnajyothi-y in #1468

Dependency updates:

• Upgrade @actions/cache to v5.0.1 by @salmanmkc in #1449

New Contributors

• @mahabaleshwars made their first contribution in #1454
• @MikeMcC399 made their first contribution in #1442
• @deining made their first contribution in #1446
• @munyari made their first contribution in #1226

Full Changelog: v6...v6.2.0

What's Changed

Enhancement:

• Remove always-auth configuration handling by @priyagupta108 in #1436

Dependency updates:

• Upgrade @actions/cache from 4.0.3 to 4.1.0 by @dependabot[bot] in #1384
• Upgrade actions/checkout from 5 to 6 by @dependabot[bot] in #1439
• Upgrade js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in #1435

Documentation update:

• Add example for restore-only cache in documentation by @aparnajyothi-y in #1419

Full Changelog: v6...v6.1.0

What's Changed

Breaking Changes

• Limit automatic caching to npm, update workflows and documentation by @priyagupta108 in #1374

Dependency Upgrades

• Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @dependabot[bot] in #1336
• Upgrade prettier from 2.8.8 to 3.6.2 by @dependabot[bot] in #1334
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot[bot] in #1362

Full Changelog: v5...v6.0.0

What's Changed

Breaking Changes

• Enhance caching in setup-node with automatic package manager detection by @priya-kinthali in #1348

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

• Upgrade action to use node24 by @salmanmkc in #1325

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

• Upgrade @octokit/request-error and @actions/github by @dependabot[bot] in #1227
• Upgrade uuid from 9.0.1 to 11.1.0 by @dependabot[bot] in #1273
• Upgrade undici from 5.28.5 to 5.29.0 by @dependabot[bot] in #1295
• Upgrade form-data to bring in fix for critical vulnerability by @gowridurgad in #1332
• Upgrade actions/checkout from 4 to 5 by @dependabot[bot] in #1345

New Contributors

• @priya-kinthali made their first contribution in #1348
• @salmanmkc made their first contribution in #1325

Full Changelog: v4...v5.0.0

What's Changed

• Add workflow file for publishing releases to immutable action package by @aparnajyothi-y in #1281

Full Changelog: v3...v3.9.1

What's Changed

• Upgrade @actions/cache to 4.0.3 by @gowridurgad in #1270
  In scope of this release we updated actions/cache package to ensure continued support and compatibility, as older versions of the package are now deprecated. For more information please refer to the toolkit/cache.

Full Changelog: v3...v3.9.0