chore(deps): bump actions/cache from 4.3.0 to 6.1.0

[dependabot]

Bumps actions/cache from 4.3.0 to 6.1.0.

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in actions/cache#1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

• Update packages, migrate to ESM by @​Samirat in actions/cache#1760

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in actions/cache#1775

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

• Update ts-http-runtime dependency by @​yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

• Add release instructions and update maintainer docs by @​Link- in actions/cache#1696
• Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @​Link- in actions/cache#1697
• Fix workflow permissions and cleanup workflow names / formatting by @​Link- in actions/cache#1699
• docs: Update examples to use the latest version by @​XZTDean in actions/cache#1690
• Fix proxy integration tests by @​Link- in actions/cache#1701
• Fix cache key in examples.md for bun.lock by @​RyPeck in actions/cache#1722
• Update dependencies & patch security vulnerabilities by @​Link- in actions/cache#1738

New Contributors

• @​XZTDean made their first contribution in actions/cache#1690
• @​RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

1. Switch to a new branch from main.
2. Run npm test to ensure all tests are passing.
3. Update the version in https://github.com/actions/cache/blob/main/package.json.
4. Run npm run build to update the compiled files.
5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
6. Run licensed cache to update the license report.
7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
8. Commit your changes and push your branch upstream.
9. Open a pull request against main and get it reviewed and merged.
10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

• Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token
• Switch redundant "Cache save failed" warning to debug log in save-only

6.0.0

• Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
• Migrated to ESM module system
• Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

• Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
• Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
• Bump fast-xml-parser to v5.5.6

5.0.3

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

5.0.2

... (truncated)

Commits

• 55cc834 Merge pull request #1768 from jasongin/readonly-cache
• d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
• 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
• e9b91fd Prettier fixes
• e4884b8 Rebuild dist
• 10baf01 Fixed licenses
• e39b386 Fix test mock return order
• b692820 PR feedback
• 6074912 Rebuild dist bundles as ESM to match type:module
• 5a912e8 Fix lint and jest issues
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 27, 2026, 1:34 PM ET / 17:34 UTC.

ClawSweeper review

What this changes

Updates the CI workflow’s Cargo cache action from the pinned actions/cache v4.3.0 commit to the pinned v6.1.0 commit.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep this PR open for normal workflow review. The change is narrowly scoped and SHA-pinned, but the Node 24 Windows check failed while other checks were either successful or still running; the available context does not establish whether the failure is caused by actions/cache v6.1.0, so it should be diagnosed or rerun before merge.

Priority: P3
Reviewed head: 3ec4d726e5fd4eb2fd0977c4eb97584f86fee784

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and follows the repository’s SHA-pinning pattern, but confidence remains limited until the failed Windows job is explained or passes on rerun.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot CI-only PR does not change user-visible runtime behavior; the relevant proof is completion of the GitHub Actions matrix.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot CI-only PR does not change user-visible runtime behavior; the relevant proof is completion of the GitHub Actions matrix.
Evidence reviewed	3 items	Narrow pinned workflow change: The PR changes exactly one workflow reference: the Cache Cargo step moves from the full-SHA-pinned actions/cache v4.3.0 commit to the full-SHA-pinned v6.1.0 commit. Unresolved platform validation: The provided check state shows Node 24 check (windows-latest) failed, while 16 checks succeeded, 2 were skipped, and 3 remained in progress. No failure log was provided to attribute or rule out the cache-action major upgrade. Repository policy applied: The full repository AGENTS.md was supplied and read; it requires conservative review of workflow/package changes and asks for repository-script validation before handoff, which cannot be established from the incomplete failing Windows result.
Findings	None	None.
Security	None	None.

How this fits together

The CI workflow validates the Node package and native Rust components on Linux, macOS, and Windows. The Cargo cache step restores Rust dependencies before native checks, so its behavior affects CI reliability rather than the published package runtime.

flowchart LR
  Trigger[Pull request or main push] --> CI[CI validation jobs]
  CI --> Cache[Cargo dependency cache]
  Cache --> Native[Native Rust checks]
  Native --> Results[Platform check results]

Loading

Before merge

• Resolve merge risk (P1) - actions/cache v6 is a major CI action upgrade, and the unresolved Node 24 Windows failure could indicate an automation compatibility regression; merge only after its log or a clean rerun rules that out.
• Complete next step (P2) - A maintainer should review or rerun the failed Node 24 Windows job; no concrete file-level repair is established from the available result.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow surface	1 line changed in 1 workflow file	The proposed change is limited to the Cargo cache action pin, so the Windows job result is the decisive merge signal.
Check state	16 successful, 1 failed, 3 in progress, 2 skipped	The update has broad matrix coverage, but the failed Windows Node 24 job prevents a clean automation verdict.

Merge-risk options

Maintainer options:

1. Verify the Windows failure before merge (recommended)
   Inspect or rerun the Node 24 Windows job and retain the v6.1.0 SHA pin only if the required matrix completes without an action-related regression.
2. Pause the dependency bump
   Leave this PR open or replace it if the Windows log confirms that actions/cache v6 is incompatible with the current Cargo-cache workflow.

Technical review

Best possible solution:

Retain the full-SHA pin and merge after the Node 24 Windows failure is explained as unrelated or the updated workflow completes successfully across the required matrix.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR changes CI dependency pinning rather than reporting a user-facing bug. The relevant verification path is the GitHub Actions matrix, where one Windows job currently needs diagnosis.

Is this the best way to solve the issue?

Unclear: updating a SHA-pinned official cache action is a maintainable approach, but the current evidence is incomplete because the Node 24 Windows result is failing without an available diagnostic.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4e85b67664ec.

Labels

Label changes:

• add P3: This is a low-risk dependency-maintenance PR limited to CI workflow configuration.
• add merge-risk: 🚨 automation: A major version change to the CI cache action coincides with an unresolved Windows validation failure.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot CI-only PR does not change user-visible runtime behavior; the relevant proof is completion of the GitHub Actions matrix.

Label justifications:

• P3: This is a low-risk dependency-maintenance PR limited to CI workflow configuration.
• merge-risk: 🚨 automation: A major version change to the CI cache action coincides with an unresolved Windows validation failure.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot CI-only PR does not change user-visible runtime behavior; the relevant proof is completion of the GitHub Actions matrix.

Evidence

What I checked:

• Narrow pinned workflow change: The PR changes exactly one workflow reference: the Cache Cargo step moves from the full-SHA-pinned actions/cache v4.3.0 commit to the full-SHA-pinned v6.1.0 commit. (.github/workflows/ci.yml:146, 3ec4d726e5fd)
• Unresolved platform validation: The provided check state shows Node 24 check (windows-latest) failed, while 16 checks succeeded, 2 were skipped, and 3 remained in progress. No failure log was provided to attribute or rule out the cache-action major upgrade. (.github/workflows/ci.yml:146, 3ec4d726e5fd)
• Repository policy applied: The full repository AGENTS.md was supplied and read; it requires conservative review of workflow/package changes and asks for repository-script validation before handoff, which cannot be established from the incomplete failing Windows result. (AGENTS.md:1, 4e85b67664ec)

Likely related people:

• unidentified workflow owner: The available review context identifies the changed workflow path but does not include usable blame or commit-author provenance for the current Cargo cache step; route to the person who owns recent CI workflow changes. (role: recent workflow-area owner; confidence: low; commits: 4e85b67664ec; files: .github/workflows/ci.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Inspect the Node 24 Windows job log or rerun that job after the remaining checks finish.
• If the failure is action-related, provide the smallest compatible cache-action adjustment and rerun the full matrix.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Merged after exact-head dependency and CI verification.

Tested at exact head 3ec4d726e5fd4eb2fd0977c4eb97584f86fee784:

• GitHub CI: the complete Node 22/24, native, release-graph-smoke, coverage, benchmark, workflow-lint, CodeQL, clippy, and audit matrix is green
• The initial Windows Node 24 failure was the existing archive-policy timeout also observed on unrelated PR fix(release): publish validated artifact bytes #74; rerunning the failed job passed without changes
• Codex autoreview: clean, verified the pinned SHA is the official v6.1.0 release and the existing Cargo cache configuration remains compatible

Landed as 40925fca8ee5720a3fa55564c61624b09774cf9f. No dependency-specific CI failure remains.