Context
The @actions/toolkit packages have shipped new majors that are ESM-only:
Their transitive deps (@actions/exec@3, @actions/http-client@4, @actions/io@3) are also ESM-only.
Problem
Our build uses @vercel/ncc in default CJS mode. When Dependabot bumped @actions/core to 3.0.1 (PR #119, failing CI run), the build broke with:
Error: Module not found: Error: Package path . is not exported from package .../node_modules/@actions/core
(see exports field in .../node_modules/@actions/core/package.json)
…because the package no longer exposes a CJS entry point and ncc cannot resolve it from a CJS bundle.
Short-term workaround
Pin @actions/core back to 2.0.x (and reject the Dependabot major bump for now), which keeps the whole @actions/* graph on the prior CJS majors and the existing ncc CJS bundle working.
Long-term fix
Migrate the build to ESM and bump all four @actions/* packages together to their new ESM majors:
@actions/core → ^3@actions/cache → ^6@actions/github → ^9@actions/tool-cache → ^4
Per the ncc README, if the entry is .mjs or a .js file inside a "type": "module" package boundary, ncc auto-emits an ESM bundle. Concretely:
- Add
"type": "module" to package.json.
- Bump all four
@actions/* deps to the new majors.
- Verify
pnpm run build produces a working ESM bundle in dist/index.js and dist/save/index.js.
- Verify
action.yml (runs.using: node24, main: dist/index.js, post: dist/save/index.js) still loads correctly.
ncc has known mixed-graph caveats (vercel/ncc#1163) where a require() is emitted for an ESM module — but since the new toolkit majors are uniformly ESM, the graph should now be coherent. If ncc still misbehaves, we may want to evaluate switching the bundler to esbuild or tsup, both of which handle ESM/CJS interop more reliably.
References
Context
The
@actions/toolkitpackages have shipped new majors that are ESM-only:@actions/core@3.0.1—"type": "module",exportsexposes onlyimport@actions/cache@6.0.0—"type": "module"@actions/github@9.1.1—"type": "module"@actions/tool-cache@4.0.0—"type": "module"Their transitive deps (
@actions/exec@3,@actions/http-client@4,@actions/io@3) are also ESM-only.Problem
Our build uses
@vercel/nccin default CJS mode. When Dependabot bumped@actions/coreto3.0.1(PR #119, failing CI run), the build broke with:…because the package no longer exposes a CJS entry point and ncc cannot resolve it from a CJS bundle.
Short-term workaround
Pin
@actions/coreback to2.0.x(and reject the Dependabot major bump for now), which keeps the whole@actions/*graph on the prior CJS majors and the existing ncc CJS bundle working.Long-term fix
Migrate the build to ESM and bump all four
@actions/*packages together to their new ESM majors:@actions/core→^3@actions/cache→^6@actions/github→^9@actions/tool-cache→^4Per the ncc README, if the entry is
.mjsor a.jsfile inside a"type": "module"package boundary, ncc auto-emits an ESM bundle. Concretely:"type": "module"topackage.json.@actions/*deps to the new majors.pnpm run buildproduces a working ESM bundle indist/index.jsanddist/save/index.js.action.yml(runs.using: node24,main: dist/index.js,post: dist/save/index.js) still loads correctly.ncc has known mixed-graph caveats (vercel/ncc#1163) where a
require()is emitted for an ESM module — but since the new toolkit majors are uniformly ESM, the graph should now be coherent. If ncc still misbehaves, we may want to evaluate switching the bundler toesbuildortsup, both of which handle ESM/CJS interop more reliably.References