[Snyk] Security upgrade @actions/cache from 3.2.213 to 4.0.0

[adityamaru]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Predictable Value Range from Previous Values SNYK-JS-FORMDATA-10841150	863

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[cursor]

Bug: Cache Version Mismatch Causes Dependency Issues

The @actions/cache dependency has an inconsistent version specification: package.json pins it to an exact version (4.0.0), but package-lock.json uses a caret range (^4.0.0). This mismatch can lead to different versions being installed across environments, causing inconsistent dependency resolution and potentially undermining the intent of an exact version.

package.json#L15-L16

setup-bazel/package.json

Lines 15 to 16 in 4ceaa18

	"dependencies": {
	"@actions/cache": "4.0.0",

package-lock.json#L11-L12

setup-bazel/package-lock.json

Lines 11 to 12 in 4ceaa18

	"dependencies": {
	"@actions/cache": "^4.0.0",

Fix in Cursor • Fix in Web

---

Bug: Version Constraint Mismatch Causes Dependency Issues

Version constraint mismatch between package.json and package-lock.json: package.json specifies an exact version (e.g., "4.0.0"), while package-lock.json indicates a caret range (e.g., "^4.0.0"). This inconsistency can lead to different dependency installations depending on whether npm install or npm ci is used.

package-lock.json#L11-L12

setup-bazel/package-lock.json

Lines 11 to 12 in 4ceaa18

	"dependencies": {
	"@actions/cache": "^4.0.0",

Fix in Cursor • Fix in Web

---

Was this report helpful? Give feedback by reacting with 👍 or 👎