From b356064971ea6a327a72fa8ef0e105cd56cd55e5 Mon Sep 17 00:00:00 2001
From: Daniel Kennedy <danwkennedy@github.com>
Date: Tue, 27 Jan 2026 11:59:21 -0500
Subject: [PATCH] Bump `@actions/http-client` and `@actions/github` on all
 packages

---
 RELEASES.md       |  4 ++++
 package-lock.json | 23 ++++++++++++++++-------
 package.json      |  4 ++--
 3 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/RELEASES.md b/RELEASES.md
index 3acb9fd..c7a0c84 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -1,5 +1,9 @@
 # @actions/cache Releases
 
+### 5.0.4
+
+- Bump `@actions/http-client` to `3.0.2`
+
 ### 5.0.3
 
 Prevent retries for rate limited cache operations [2243](https://github.com/actions/toolkit/pull/2243).
diff --git a/package-lock.json b/package-lock.json
index 7bb974c..e907a98 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,18 +1,18 @@
 {
   "name": "@actions/cache",
-  "version": "5.0.2",
+  "version": "5.0.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/cache",
-      "version": "5.0.2",
+      "version": "5.0.4",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^2.0.0",
         "@actions/exec": "^2.0.0",
         "@actions/glob": "^0.5.0",
-        "@actions/http-client": "^3.0.1",
+        "@actions/http-client": "^3.0.2",
         "@actions/io": "^2.0.0",
         "@azure/abort-controller": "^1.1.0",
         "@azure/core-rest-pipeline": "^1.22.0",
@@ -92,13 +92,22 @@
       "license": "MIT"
     },
     "node_modules/@actions/http-client": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.1.tgz",
-      "integrity": "sha512-SbGS8c/vySbNO3kjFgSW77n83C4MQx/Yoe+b1hAdpuvfHxnkHzDq2pWljUpAA56Si1Gae/7zjeZsV0CYjmLo/w==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
+        "undici": "^6.23.0"
+      }
+    },
+    "node_modules/@actions/http-client/node_modules/undici": {
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
       }
     },
     "node_modules/@actions/io": {
diff --git a/package.json b/package.json
index eb7531e..77d1503 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@actions/cache",
-  "version": "5.0.3",
+  "version": "5.0.4",
   "preview": true,
   "description": "Actions cache lib",
   "keywords": [
@@ -41,7 +41,7 @@
     "@actions/exec": "^2.0.0",
     "@actions/glob": "^0.5.0",
     "@protobuf-ts/runtime-rpc": "^2.11.1",
-    "@actions/http-client": "^3.0.1",
+    "@actions/http-client": "^3.0.2",
     "@actions/io": "^2.0.0",
     "@azure/abort-controller": "^1.1.0",
     "@azure/core-rest-pipeline": "^1.22.0",