Uh oh!
There was an error while loading. Please reload this page.
Migrate to ESM and upgrade dependencies - #752
Conversation
There was a problem hiding this comment.
Pull request overview
This PR migrates the action’s TypeScript codebase to ESM (NodeNext) and updates the toolchain/configuration to support ESM linting and testing, alongside a broad dependency refresh.
Changes:
- Switch TypeScript compilation to
NodeNextand update internal imports /__dirnameusage for ESM. - Replace legacy ESLint/Jest/Prettier configs with ESM-friendly equivalents and update tests to ESM mocking patterns.
- Bump runtime/dev dependencies and refresh
licensedmetadata to match new dependency graph.
Reviewed changes
Copilot reviewed 67 out of 78 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tsconfig.json | Switch TS module system to NodeNext |
| tsconfig.eslint.json | Add dedicated TS config for ESLint |
| src/setup-dotnet.ts | Update imports and ESM path resolution |
| src/installer.ts | Update imports and ESM path resolution |
| src/cache-utils.ts | Update relative import to .js specifier |
| src/cache-save.ts | Update relative imports to .js specifiers |
| src/cache-restore.ts | Update relative imports to .js specifiers |
| package.json | Mark package as ESM; bump deps/scripts |
| jest.config.ts | New TS-based Jest config for ESM + ts-jest |
| jest.config.js | Remove legacy CommonJS Jest config |
| eslint.config.mjs | New flat ESLint config for ESM/TS |
| dist/setup/package.json | Mark bundled setup output as ESM |
| dist/cache-save/package.json | Mark bundled post step output as ESM |
| .prettierrc.json | Add JSON-based Prettier config |
| .prettierrc.js | Remove legacy CommonJS Prettier config |
| .licenses/npm/yallist.dep.yml | Remove outdated licensed entry |
| .licenses/npm/wrappy.dep.yml | Remove outdated licensed entry |
| .licenses/npm/universal-user-agent.dep.yml | Update licensed metadata for new version |
| .licenses/npm/semver.dep.yml | Update licensed metadata for new version |
| .licenses/npm/semver-7.6.0.dep.yml | Remove outdated licensed entry |
| .licenses/npm/once.dep.yml | Remove outdated licensed entry |
| .licenses/npm/ms.dep.yml | Update licensed metadata for new version |
| .licenses/npm/minimatch-3.1.5.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/minimatch-10.2.5.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/lru-cache.dep.yml | Remove outdated licensed entry |
| .licenses/npm/json-with-bigint.dep.yml | Update licensed metadata for dependency change |
| .licenses/npm/fast-xml-parser.dep.yml | Update licensed metadata for new version |
| .licenses/npm/deprecation.dep.yml | Remove outdated licensed entry |
| .licenses/npm/debug.dep.yml | Update licensed metadata for new version |
| .licenses/npm/content-type.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/brace-expansion-5.0.6.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/brace-expansion-1.1.15.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/before-after-hook.dep.yml | Update licensed metadata for new version |
| .licenses/npm/balanced-match-4.0.4.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/balanced-match-1.0.2.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/@typespec/ts-http-runtime.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/types.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/types-13.10.0.dep.yml | Remove outdated licensed entry |
| .licenses/npm/@octokit/request.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/request-error.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/plugin-rest-endpoint-methods.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/plugin-paginate-rest.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/openapi-types.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/graphql.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/endpoint.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/core.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/auth-token.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/storage-common.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/storage-blob.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/core-xml.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/core-rest-pipeline.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/core-http-compat.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/core-client.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/abort-controller.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/@actions/io.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/http-client-4.0.1.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/glob-0.7.0.dep.yml | Correct/update licensed metadata entry |
| .licenses/npm/@actions/glob-0.6.1.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/github.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/exec.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/core.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/cache.dep.yml | Update licensed metadata for new version |
| .licensed.yml | Allow/review new licenses introduced by bumps |
| .eslintrc.js | Remove legacy ESLint config |
| .eslintignore | Remove legacy ESLint ignore file |
| tests/setup-dotnet.test.ts | Convert tests to ESM module mocking/imports |
| tests/latest-version.test.ts | Convert tests to ESM module mocking/imports |
| tests/installer.test.ts | Convert tests to ESM module mocking/imports |
| tests/installation-scripts.test.ts | Fix __dirname usage for ESM tests |
| tests/csc.test.ts | Update JSON import + TS indexing workaround |
| tests/cache-utils.test.ts | Convert tests to ESM module mocking/imports |
| tests/cache-save.test.ts | Convert tests to ESM module mocking/imports |
| tests/cache-restore.test.ts | Convert tests to ESM module mocking/imports |
| tests/authutil.test.ts | Fix __dirname usage + ESM import specifiers |
| tests/snapshots/authutil.test.ts.snap | Update snapshot header text |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
716782d to
876a438CompareFrulfump
commented
Jun 26, 2026
This should fix #731 |
Frulfump
commented
Jun 26, 2026
https://github.com/actions/setup-dotnet/actions/runs/28232146400/job/83638225574#step:9:1 Reports 18 moderate severity vulns so would be good to fix those as well. |
3d1f979 to
d4356c9CompareFrulfump
commented
Jul 9, 2026
This is clean now https://github.com/actions/setup-dotnet/actions/runs/28840313597/job/85532800573#step:9:1 reports 0 vulns nice job! |
8578015Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
8578015 to
095bad8Compare095bad8 to
3c38197CompareUh oh!
There was an error while loading. Please reload this page.
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.4.0 to 6.0.0. Release notes *Sourced from [actions/setup-dotnet's releases](https://github.com/actions/setup-dotnet/releases).* > v6.0.0 > ------ > > What's Changed > -------------- > > * Migrate to ESM and upgrade dependencies by [`@priyagupta108`](https://github.com/priyagupta108) in [actions/setup-dotnet#752](https://redirect.github.com/actions/setup-dotnet/pull/752) > * Bump actions/checkout from 6.0.3 to 7.0.0 by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-dotnet#751](https://redirect.github.com/actions/setup-dotnet/pull/751) > * chore(deps): bump `@actions/cache` to 6.2.0 by [`@philip-gai`](https://github.com/philip-gai) in [actions/setup-dotnet#756](https://redirect.github.com/actions/setup-dotnet/pull/756) > > New Contributors > ---------------- > > * [`@philip-gai`](https://github.com/philip-gai) made their first contribution in [actions/setup-dotnet#756](https://redirect.github.com/actions/setup-dotnet/pull/756) > > **Full Changelog**: <actions/setup-dotnet@v5...v6.0.0> Commits * [`a98b568`](actions/setup-dotnet@a98b568) chore(deps): bump `@actions/cache` to 6.2.0 ([#756](https://redirect.github.com/actions/setup-dotnet/issues/756)) * [`afb2931`](actions/setup-dotnet@afb2931) Bump actions/checkout from 6.0.3 to 7.0.0 ([#751](https://redirect.github.com/actions/setup-dotnet/issues/751)) * [`6df8cef`](actions/setup-dotnet@6df8cef) Migrate to ESM and upgrade dependencies ([#752](https://redirect.github.com/actions/setup-dotnet/issues/752)) * See full diff in [compare view](actions/setup-dotnet@26b0ec1...a98b568) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Description:
Convert to ESM, update imports/tests/configs for ESM, and bump dependencies.
Related issue:
#731
Check list: