fix(deps): update @actions/cache to 4.0.0

[MikeMcC399]

• supersedes PR fix(deps): update @actions/cache to 4.0.0 #1328

Issue

• GitHub has released a new version of the npm module @actions/cache with the deprecation notice:

The new service will gradually roll out as of February 1st, 2025. The legacy service will also be sunset on the same date. Changes in this release are fully backward compatible.

All previous versions of this package will be deprecated. We recommend upgrading to version 4.0.0 as soon as possible before February 1st, 2025.

The new version is @actions/[email protected]

See also @actions/cache Package Deprecation Notice. Upgrade to the latest 4.0.0 or higher before February 1st 2025.

Change

• Update to @actions/[email protected] and re-build the action.

Note

• Although fix(deps): update @actions/cache to 4.0.0 #1328 (review) referred to Snyk is surfacing a medium security violation in this new package https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116 if this PR is not merged, then the action will fail from Feb 1, 2025 onwards.

https://github.blog/changelog/2025-01-15-github-actions-ubuntu-20-runner-image-brownout-dates-and-other-breaking-changes

[cypress-app-bot]

• Create a Draft Pull Request if your PR is not ready for review. Mark the PR as Ready for Review when you're ready for a Cypress team member to review the PR.

[MikeMcC399]

• According to @actions/cache Package Deprecation Notice. Upgrade to the latest `4.0.0` or higher before February 1st 2025 actions/toolkit#1890 (reply in thread), it is not expected that the vulnerability will be resolved before Feb 1, 2025.

[jennifer-shehane]

@MikeMcC399 Thanks for staying on top of this!

[github-actions]

🎉 This PR is included in version 6.7.9 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[MikeMcC399]

@jennifer-shehane

Thanks for staying on top of this!

I'm not really happy that GitHub has based their new @actions/[email protected] on an Open Source Stack with transient dependencies that aren't being maintained. I guess they have also been operating under constraints and this is the best they can do at the moment. They did however say that they would work on an improvement - not before the deadline though.