chore: bump actions/cache from 5.0.5 to 6.1.0

[dependabot]

Bumps actions/cache from 5.0.5 to 6.1.0.

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in actions/cache#1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

• Update packages, migrate to ESM by @​Samirat in actions/cache#1760

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in actions/cache#1775

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

1. Switch to a new branch from main.
2. Run npm test to ensure all tests are passing.
3. Update the version in https://github.com/actions/cache/blob/main/package.json.
4. Run npm run build to update the compiled files.
5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
6. Run licensed cache to update the license report.
7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
8. Commit your changes and push your branch upstream.
9. Open a pull request against main and get it reviewed and merged.
10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

• Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token
• Switch redundant "Cache save failed" warning to debug log in save-only

6.0.0

• Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
• Migrated to ESM module system
• Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

• Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
• Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
• Bump fast-xml-parser to v5.5.6

5.0.3

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

5.0.2

... (truncated)

Commits

• 55cc834 Merge pull request #1768 from jasongin/readonly-cache
• d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
• 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
• e9b91fd Prettier fixes
• e4884b8 Rebuild dist
• 10baf01 Fixed licenses
• e39b386 Fix test mock return order
• b692820 PR feedback
• 6074912 Rebuild dist bundles as ESM to match type:module
• 5a912e8 Fix lint and jest issues
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[kriscendobot]

MERGE-NOW

Head reviewed: 2a655a0d51ce983b1e87b94330f5a85906ec5907

This upgrades all four actions/cache call sites from 5.0.5 to 6.1.0. The live llm base still has 5.0.5 at all four sites (three in ci.yml, one in ocapn-guile-interop.yml), so this is not superseded. The PR changes workflow pins only.

Pin provenance (resolved 2026-08-05 UTC): actions/cache tag v5.0.5 resolves to outgoing commit 27d5ce7f107fe9357f9df03efb73ab90386fccae; tag v6.1.0 resolves to incoming commit 55cc8345863c7cc4c66a329aec7e433d2d1c52a9. Both are lightweight tags in the expected actions/cache repository and exactly match the workflow comments and pins. GitHub published the v6.1.0 release at 2026-06-26T19:17:06Z, so its seven-day maturity floor passed at 2026-07-03T19:17:06Z.

Runtime transitive set: the upstream lockfile moves 25 production entries: @actions/cache 5.0.5→6.1.0; nested semver added at 7.8.5; @actions/core 2.0.3→3.0.1; @actions/exec 2.0.0→3.0.0; @actions/glob 0.5.1→0.6.1; @actions/http-client 3.0.2→4.0.1; @actions/io 2.0.0→3.0.2; @azure/abort-controller 1.1.0 removed; @azure/core-client 1.10.1→1.10.2; @azure/core-http-compat 2.3.1→2.4.0; @azure/core-rest-pipeline 1.22.2→1.24.0; @azure/core-xml 1.5.0→1.5.1; @azure/storage-blob 12.30.0→12.32.0; @azure/storage-common 12.2.0→12.4.0; @nodable/entities added at 2.2.0; @typespec/ts-http-runtime 0.3.5→0.3.6; anynum added at 1.0.1; fast-xml-builder 1.1.4→1.2.0; fast-xml-parser 5.5.6→5.9.2; is-unsafe added at 1.0.1; path-expression-matcher 1.1.3→1.5.0; top-level semver 6.3.1 removed; strnum 2.1.2→2.4.1; undici 6.24.1→6.27.0; and xml-naming added at 0.1.0. The freshest npm runtime version is nested semver@7.8.5 (2026-06-19T18:32:48.972Z), older than the action release. All incoming licenses are MIT or ISC, with no license regression, and nothing is within 24 hours of publication.

Advisories: GitHub's Actions advisory query and OSV have no direct advisory for either actions/cache@5.0.5 or actions/cache@6.1.0. I also queried OSV for every production package/version on both sides and ran npm audit --omit=dev against both upstream lockfiles. The outgoing bundle has four brace-expansion@1.1.12 DoS advisories (GHSA-f886-m6hf-6m8v, GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895), fast-xml-builder GHSA-5wm8-gmm8-39j9, fast-xml-parser GHSA-jp2q-39xq-3w4g and GHSA-gh4j-gqv2-49f6, and seven undici@6.24.1 advisories (GHSA-p88m-4jfj-68fv, GHSA-vxpw-j846-p89q, GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m, GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm). The incoming bundle removes both XML packages' exposure and four of the seven undici advisories; it retains the same four brace advisories and the last three undici advisories.

The residuals are unreachable through this repository's consumed paths: brace-expansion is under @actions/glob and only sees the static path: values authored in these base-branch workflows, not PR-controlled data. The three residual undici advisories require the retry-interceptor or cookie parsing/serialization paths; actions/cache uses undici to talk to GitHub's fixed cache service and neither constructs a RetryAgent nor handles cookies. This is a strict directional improvement over 5.0.5, not new exposure.

Source read: I read the action commits and source/bundle delta from v5.0.5 through v6.1.0, plus the changed runtime packages. The major change upgrades the Actions toolkit packages and converts the bundle to ESM; v6.1.0 additionally treats read-only-token cache-save denial as a warning/non-fatal save. The action was already on Node 24 in v5, so the minimum runner remains 2.327.1; these workflows use GitHub-hosted runners. The only hand-written action source change is the save-only diagnostic adjustment. I found no new lifecycle install hook, telemetry, arbitrary endpoint, or unexpected process/file operation; the archive/tar process and manifest write remain part of the declared cache behavior. A scripts-disabled upstream install completed successfully.

CI: GitHub's check-runs endpoint reports 24 checks, zero pending and zero failing, on the reviewed head. That includes the full CI matrix, browser tests, OCapN Guile interop, build, and zizmor; representative run: https://github.com/endojs/endo-but-for-bots/actions/runs/30764361112.

Next step: merge through the conductor after a current maintainer approval. The approval gate remains intact.

[kriscendobot]

MERGE-NOW — actions/cache v5.0.5 → v6.1.0.

Base census: the live llm base still has all four actions/cache pins at v5.0.5; this is not superseded. The PR changes exactly those four workflow pins (three CI caches and the Guile-tarball cache), all from 27d5ce7f107fe9357f9df03efb73ab90386fccae to 55cc8345863c7cc4c66a329aec7e433d2d1c52a9. On 2026-08-05 I resolved refs/tags/v6.1.0 directly to that latter commit (and v5.0.5 to the former), so every SHA is on the claimed tag.

v6.1.0 was published 2026-06-26T19:17:06Z, clearing the seven-day maturity window. This is a GitHub Action pin update, so the project lockfile has no moved transitive set. I installed the action's own v6.1.0 production dependencies with scripts disabled and inspected its manifest, source, release diff, and bundled-dependency changes. The action runs Node 24 and communicates only with the configured GitHub cache service; v6.1.0 specifically handles a read-only cache-save denial without failing the job and removes a redundant save warning. It introduces no install hook, telemetry, filesystem write outside its cache purpose, or child-process invocation.

Advisory checks: GitHub Advisory search and OSV return no advisory for actions/cache. The action's production npm audit reports two residual transitive findings: brace-expansion (DoS) and undici@6.27.0 (three moderate request/response parsing issues). The outgoing action has those same two paths plus vulnerable fast-xml-builder and fast-xml-parser; this update removes the latter two, so the residuals satisfy the directional improvement test. The four consuming workflows provide static repository-controlled path/key inputs (not attacker-controlled glob patterns), and undici consumes cache-backend responses from GitHub's service rather than untrusted workflow input; those residual advisory paths are not reachable from this repository's action configuration.

CI is terminal green: all 24 check runs on 2a655a0d51ce983b1e87b94330f5a85906ec5907 succeeded, including check-action-pins and zizmor.

Next step: conduct through the maintainer-approval gate. The current review rollup has no maintainer approval, so merge is correctly blocked pending approval; no action is required from Dependabot.