Bump @actions/cache to 5.1.0, log cache write denied (#746)

* Bump @actions/cache to 5.1.0, log cache write denied

* Add cache save failure test case

* Update dist

* Resolve high-severity audit issues

.licenses/npm/@actions/cache.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/cache"
-version: 5.0.5
+version: 5.1.0
 type: npm
 summary: Actions cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/cache

.licenses/npm/@fastify/busboy.dep.yml

@@ -1,30 +0,0 @@
----
-name: "@fastify/busboy"
-version: 2.1.1
-type: npm
-summary: A streaming parser for HTML form data for node.js
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |-
-    Copyright Brian White. All rights reserved.
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to
-    deal in the Software without restriction, including without limitation the
-    rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-    sell copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in
-    all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
-    IN THE SOFTWARE.
-notices: []

.licenses/npm/@nodable/entities.dep.yml

@@ -0,0 +1,11 @@
+---
+name: "@nodable/entities"
+version: 2.2.0
+type: npm
+summary: Entity parser for XML, HTML, External entites with security and NCR control
+homepage: 
+license: mit
+licenses:
+- sources: README.md
+  text: MIT
+notices: []

.licenses/npm/anynum.dep.yml

@@ -1,16 +1,17 @@
 ---
-name: undici
-version: 6.24.1
+name: anynum
+version: 1.0.1
 type: npm
-summary: An HTTP/1.1 client, written from scratch for Node.js
-homepage: https://undici.nodejs.org
+summary: Normalize all Unicode decimal digits (Devanagari, Arabic, Thai, etc.) to
+  ASCII numerals. Zero dependencies, performance-first.
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE
   text: |
     MIT License
 
-    Copyright (c) Matteo Collina and Undici contributors
+    Copyright (c) 2026 Natural Intelligence
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal

.licenses/npm/brace-expansion.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 1.1.13
+version: 1.1.15
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion

.licenses/npm/fast-xml-builder.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-builder
-version: 1.1.4
+version: 1.2.0
 type: npm
 summary: Build XML from JSON without C/C++ based libraries
 homepage: 

.licenses/npm/fast-xml-parser.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.5.11
+version: 5.9.2
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage: 

.licenses/npm/is-unsafe.dep.yml

@@ -0,0 +1,35 @@
+---
+name: is-unsafe
+version: 1.0.1
+type: npm
+summary: Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across
+  HTML, XML, SVG, SQL, SHELL, and REGEX contexts
+homepage: 
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2026 Natural Intelligence
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: MIT
+notices: []

.licenses/npm/path-expression-matcher.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: path-expression-matcher
-version: 1.4.0
+version: 1.5.0
 type: npm
 summary: Efficient path tracking and pattern matching for XML/JSON parsers
 homepage: https://github.com/NaturalIntelligence/path-expression-matcher#readme

.licenses/npm/strnum.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: strnum
-version: 2.2.3
+version: 2.4.1
 type: npm
 summary: Parse String to Number based on configuration
 homepage: 

.licenses/npm/undici.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 5.29.0
+version: 6.27.0
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org

.licenses/npm/xml-naming.dep.yml

@@ -0,0 +1,12 @@
+---
+name: xml-naming
+version: 0.1.0
+type: npm
+summary: Validates XML name productions — Name, NCName, QName, NMToken, NMTokens —
+  for XML 1.0 and 1.1
+homepage: 
+license: mit
+licenses:
+- sources: README.md
+  text: MIT
+notices: []

__tests__/cache-save.test.ts

@@ -3,6 +3,7 @@ import * as core from '@actions/core';
 import fs from 'node:fs';
 import {run} from '../src/cache-save';
 import {getNuGetFolderPath} from '../src/cache-utils';
+import {State} from '../src/constants';
 
 jest.mock('@actions/cache');
 jest.mock('@actions/core');
@@ -84,4 +85,22 @@ describe('cache-save tests', () => {
     expect(jest.mocked(core.getState)).toHaveBeenCalledTimes(2);
     expect(jest.mocked(cache.saveCache)).toHaveBeenCalled();
   });
+
+  it('does not fail and traces when saveCache returns -1', async () => {
+    jest.mocked(core.getBooleanInput).mockReturnValue(true);
+    jest.mocked(core.getState).mockImplementation(s => s);
+    jest.mocked(fs.existsSync).mockReturnValue(true);
+    jest.mocked(cache.saveCache).mockResolvedValue(-1);
+
+    await run();
+
+    expect(jest.mocked(core.setFailed)).not.toHaveBeenCalled();
+    expect(jest.mocked(cache.saveCache)).toHaveBeenCalled();
+    expect(jest.mocked(core.debug)).toHaveBeenCalledWith(
+      `Cache was not saved for the key: ${State.CachePrimaryKey}`
+    );
+    expect(jest.mocked(core.info)).not.toHaveBeenCalledWith(
+      `Cache saved with the key: ${State.CachePrimaryKey}`
+    );
+  });
 });

package.json

@@ -1,6 +1,6 @@
 {
   "name": "setup-dotnet",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "private": true,
   "description": "setup dotnet action",
   "main": "dist/setup/index.js",
@@ -29,14 +29,14 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^5.0.5",
+    "@actions/cache": "^5.1.0",
     "@actions/core": "^2.0.3",
     "@actions/exec": "^2.0.0",
     "@actions/github": "^6.0.0",
     "@actions/glob": "^0.5.1",
     "@actions/http-client": "^3.0.2",
     "@actions/io": "^2.0.0",
-    "fast-xml-parser": "^5.5.11",
+    "fast-xml-parser": "^5.9.2",
     "json5": "^2.2.3",
     "semver": "^7.6.0"
   },
@@ -60,6 +60,9 @@
     "typescript": "^5.9.2",
     "wget-improved": "^3.2.1"
   },
+  "overrides": {
+    "undici": "^6.24.1"
+  },
   "jest": {
     "testEnvironment": "node"
   }

src/cache-save.ts

@@ -47,7 +47,11 @@ const cachePackages = async () => {
   }
 
   const cacheId = await cache.saveCache([cachePath], primaryKey);
-  if (cacheId == -1) {
+  if (cacheId === -1) {
+    // saveCache returns -1 without throwing when the cache was not saved, e.g.
+    // a reserve collision or a read-only token (fork PR). @actions/cache has
+    // already logged the reason at the appropriate severity, so just trace it.
+    core.debug(`Cache was not saved for the key: ${primaryKey}`);
     return;
   }