Skip to content

Update dependency @actions/core to v3#573

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/actions-core-3.x
Open

Update dependency @actions/core to v3#573
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/actions-core-3.x

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 7, 2026

This PR contains the following updates:

Package Change Age Confidence
@actions/core (source) ^1.11.1^3.0.0 age confidence

Release Notes

actions/toolkit (@​actions/core)

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.3

  • Bump @actions/http-client to 3.0.2

v2.0.1

v2.0.0


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/actions-core-3.x branch 30 times, most recently from d30525e to 4a97a8e Compare February 8, 2026 05:38
@renovate renovate bot force-pushed the renovate/actions-core-3.x branch 4 times, most recently from 77372d7 to 3e2ba37 Compare February 14, 2026 17:20
@renovate renovate bot force-pushed the renovate/actions-core-3.x branch 11 times, most recently from a22f054 to 8db0cc2 Compare March 4, 2026 11:51
@@ -12,7 +12,7 @@
},
"dependencies": {
"@actions/artifact": "^6.0.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: A deep import from @actions/core/lib/summary.js will fail at runtime because v3.0.0 of the package is ESM-only and does not export this internal path.
Severity: CRITICAL

Suggested Fix

Update the import statement to use the main package entry point, which is a supported public API. Change the import from import type { SummaryTableRow } from '@actions/core/lib/summary.js'; to import type { SummaryTableRow } from '@actions/core';.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/actions/package.json#L14

Potential issue: The code imports a type using a deep path: `import type {
SummaryTableRow } from '@actions/core/lib/summary.js';`. While this compiles
successfully due to the `"moduleResolution": "bundler"` setting, it will cause a runtime
failure. The build configuration marks `@actions/core` as an external package, so the
import is resolved by Node.js when the action runs. The updated v3.0.0 of
`@actions/core` is ESM-only and does not expose this internal path in its `package.json`
exports map. This will result in an `ERR_PACKAGE_PATH_NOT_EXPORTED` error, causing the
GitHub Action to crash on startup.

Did we get this right? 👍 / 👎 to inform future reviews.

@renovate renovate bot force-pushed the renovate/actions-core-3.x branch 8 times, most recently from defc4e1 to 5e7e3ec Compare March 4, 2026 19:00
@renovate renovate bot force-pushed the renovate/actions-core-3.x branch from 5e7e3ec to ae0dfb9 Compare March 4, 2026 19:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants