v3.0.0

Highlights

v3.0.0 is a major release that rewrites the action from the ground up. The installation logic is now implemented natively in TypeScript — the legacy shell/PowerShell scripts are no longer on the execution path — and the build toolchain has been hardened against supply-chain attacks.

Native TypeScript rewrite (#446)

The Bash (setup-chromedriver.sh) and PowerShell (setup-chromedriver.ps1) installers have been replaced by a native TypeScript implementation, split into focused modules under src/installer/:

• http.ts — fetchText / fetchJson with curl-like retry/redirect handling
• download.ts — ZIP download & extraction via @actions/tool-cache
• version.ts — Chrome version detection + Chrome-for-Testing JSON resolution with fallback
• unix.ts / windows.ts — platform-specific install (legacy < 115 / modern split)

Behavioral parity is preserved: install locations (/usr/local/bin/chromedriver, C:\SeleniumWebDrivers\ChromeDriver) are unchanged, and PATH resolution via the well-known install directory continues to work without an explicit core.addPath. The legacy shell scripts are retained for one release cycle as an emergency rollback option.

Supply-chain hardening

• Migrated from yarn to pnpm (#456) — install-time build scripts are blocked by default (allowBuilds), and freshly published versions are held back by a cooldown (minimumReleaseAge).
• All external actions in CI workflows are now pinned to a full commit SHA (#450).

ESM migration (#458, #439)

• The codebase moved from CommonJS to ESM, and @actions/tool-cache was upgraded from 2.x to 4.x.

Security fixes

• Fixed a command-injection vector in Windows version detection (env-passing).
• Fixed cross-drive move failure (EXDEV) on Windows via io.cp.
• Added retry-with-backoff to downloads.
• Overrode qs to 6.15.2 to resolve a DoS advisory (#457, #444).

Testing

• Container-compatibility tests are now a permanent PR gate (#453).
• Added install/smoke tests for legacy ChromeDriver (< 115) (#454).

---

Breaking Changes

• The action is now a native TypeScript / ESM implementation. The shell/PowerShell scripts are no longer executed (kept only for one-cycle rollback).
• Build/contribution workflow now requires pnpm (corepack enable) instead of yarn.

Note: The Node 24 runtime migration shipped in v2.4.0; there is no runtime change in v3.0.0.

Migration

Update your workflow reference to @v3. SHA pinning is recommended:

- uses: nanasess/setup-chromedriver@v3
# or, pinned:
- uses: nanasess/setup-chromedriver@<full-commit-sha> # v3.0.0

Repository changes (default branch & @master)

Note: The default branch has moved from master to main. This does not affect users referencing the action by a tag (@v3, @v3.0.0) or a commit SHA. If you reference the action by the master branch (uses: nanasess/setup-chromedriver@master), please migrate to @v3 (or pin a commit SHA): the master branch is now frozen, emits a runtime deprecation warning, and will not receive future updates.

---

What's Changed (since v2.4.0)

• feat: rewrite setup-chromedriver natively in TypeScript by @nanasess in #446
• build: migrate from yarn to pnpm for supply-chain hardening by @nanasess in #456
• build: migrate to ESM and update @actions/tool-cache to 4.x by @nanasess in #458, #439
• fix(security): override qs to 6.15.2 (DoS) by @nanasess in #457, #444
• chore(ci): pin all external actions to a full commit SHA by @nanasess in #450
• test(ci): make container-compatibility tests a permanent PR gate by @nanasess in #453
• test(ci): add legacy ChromeDriver (< 115) install/smoke tests by @nanasess in #454
• test: add contract tests by @nanasess in #437
• chore: remove unnecessary version field from package.json by @nanasess in #460
• fix(ci): remove invalid #sha pin from marketplace URL by @nanasess in #451
• chore(ci): update claude-code-action to v1 form by @nanasess in #448, #449
• docs(readme): update examples to @V3 and recommend SHA pinning by @nanasess in #455
• build(deps): dependency bumps by @dependabot in #438, #440, #441, #442, #443, #445