Bump actions/cache from 5.0.5 to 6.1.0

[dependabot]

Bumps actions/cache from 5.0.5 to 6.1.0.

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in actions/cache#1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

• Update packages, migrate to ESM by @​Samirat in actions/cache#1760

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in actions/cache#1775

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache's changelog.

6.1.0

• Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token
• Switch redundant "Cache save failed" warning to debug log in save-only

6.0.0

• Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
• Migrated to ESM module system
• Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

• Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
• Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
• Bump fast-xml-parser to v5.5.6

5.0.3

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

5.0.2

• Bump @actions/cache to v5.0.3 #1692

5.0.1

• Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

4.3.0

• Bump @actions/cache to v4.1.0

4.2.4

• Bump @actions/cache to v4.0.5

4.2.3

• Bump @actions/cache to v4.0.3 (obfuscates SAS token in debug logs for cache entries)

4.2.2

... (truncated)

Commits

• 55cc834 Merge pull request #1768 from jasongin/readonly-cache
• d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
• 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
• e9b91fd Prettier fixes
• e4884b8 Rebuild dist
• 10baf01 Fixed licenses
• e39b386 Fix test mock return order
• b692820 PR feedback
• 6074912 Rebuild dist bundles as ESM to match type:module
• 5a912e8 Fix lint and jest issues
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

Code Review: Bump actions/cache to v6.1.0

This PR is a single-line version bump in .github/workflows/trivy-dependency-scan.yaml, changing actions/cache@v5.0.5 → actions/cache@v6.1.0.

Code Quality

• ✅ Style/formatting: Consistent with existing YAML conventions in the file (same indentation, quoting style unchanged).
• ✅ No commented-out code.
• ✅ N/A — meaningful variable names: No variables introduced.
• ✅ DRY: No duplication introduced; this is the only actions/cache reference in this workflow file.
• ⚠️ Defects/logic errors: No logic changes. One note: actions/cache jumped a major version (v5 → v6), not a patch/minor bump. Major version bumps for GitHub Actions can include breaking changes (e.g., changed default behavior for cache restore/save, Node.js runtime version requirements, or input/output changes). Since network access is unavailable in this review, I can't confirm the v6 release notes, but I'd flag this as worth a sanity check — e.g., confirm the runner's Node version supports the action (actions v6 generally requires Node 24-compatible runners) and confirm cache key/path semantics didn't change. Given this is likely an automated Dependabot bump (see companion commit 4e0f32c Bump actions/cache from 5.0.5 to 6.1.0), it's probably safe, but worth letting CI run green before merging.
• ✅ CLAUDE.md consideration: No changes to .claude/CLAUDE.md in this diff; not applicable here.

Testing

• ✅ N/A: CI-only config change; no application code touched. The workflow itself running successfully on this PR is the effective test.
• N/A for unit/integration tests, edge cases, coverage — no source code changed.

Documentation

• ✅ N/A: No README/API doc/CHANGELOG updates needed for a workflow dependency bump of this size.
• ✅ No markdown files changed.

Security

• ✅ No hardcoded credentials.
• ✅ No input validation concerns — static workflow config.
• ✅ No error handling concerns.
• ✅ No sensitive data in logs.
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff.

Summary

Low-risk, mechanical dependency bump. No blocking issues found. Only recommendation: verify the trivy-dependency-scan workflow run succeeds post-merge, since this is a major-version jump for actions/cache (v5→v6) rather than a routine patch bump.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter