Cache v6.3.0 release

[Link-]

Summary

• Release @actions/cache 6.3.0.
• Include the Windows BSD tar scratch-file isolation fix from fix(cache): isolate Windows BSD tar temporary files #2497, which is already merged into main.
• Update compatible runtime and development dependencies, preserve Node 20 support, and resolve npm audit findings.
• Restore the 5.1.0, 5.2.0, and 5.3.0 changelog entries in packages/cache/RELEASES.md.

Changes

Each cache list or extract read now owns a unique scratch directory and cache.tar file. Cleanup is best-effort, so concurrent operations cannot race over shared temporary archives and a cleanup failure does not replace a successful result or the original tool error.

Dependency updates include:

• @actions/glob 0.7
• Node 20-compatible Azure ranges: @azure/core-rest-pipeline ~1.23.0 and @azure/storage-blob ~12.31.0
• semver 7.8.5
• refreshed type dependencies and package lockfile entries

Testing

• Cache TypeScript build on Node.js 20.20 and 24.21
• Full cache Jest suite on Node.js 20.20 and 24.21: 150 passed, 0 failed; 24 Windows-only cases skipped on Linux
• Targeted Prettier and ESLint checks
• Package audit at the moderate threshold: 0 vulnerabilities
• npm pack --dry-run

[Copilot]

Copilot review overview

🟡 Changes recommended

The dependency upgrade excludes Node 20, and duplicated release history should be corrected.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Azure dependency upgrade drops Node 20 support · New

What changed in this PR

Prepares the @actions/cache 6.3.0 release with dependency updates and release documentation.

Changes:

• Bumps package and lockfile versions to 6.3.0.
• Updates runtime and development dependencies.
• Documents Windows tar concurrency fixes and historical releases.

File	Summary
packages/​cache/​RELEASES.md	Adds 6.3.0 notes; contains duplicated historical entries.
packages/​cache/​package.json	Updates version and dependencies; introduces Node 20 incompatibility.
packages/​cache/​package-lock.json	Locks updated dependency versions and metadata.

Files not reviewed (1)

• packages/cache/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.