LadyK-21 · pull · Apr 21, 2026 · Mar 14, 2026 · Mar 14, 2026 · Mar 14, 2026
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/core/RELEASES.md b/packages/core/RELEASES.md
@@ -1,5 +1,9 @@
 # @actions/core Releases
 
+## 3.0.1
+
+- Bump `undici` from `6.23.0` to `6.24.1` [#2348](https://github.com/actions/toolkit/pull/2348)
+
 ## 3.0.0
 
 - **Breaking change**: Package is now ESM-only

diff --git a/packages/core/package-lock.json b/packages/core/package-lock.json
diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@actions/core",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Actions core lib",
   "keywords": [
     "github",

diff --git a/packages/github/RELEASES.md b/packages/github/RELEASES.md
@@ -1,5 +1,9 @@
 # @actions/github Releases
 
+### 9.1.1
+
+- Bump `undici` from `6.23.0` to `6.24.0` [#2346](https://github.com/actions/toolkit/pull/2346)
+
 ### 9.1.0
 
 - Append `actions_orchestration_id` to user-agent when the `ACTIONS_ORCHESTRATION_ID` environment variable is set [#2364](https://github.com/actions/toolkit/pull/2364)

diff --git a/packages/github/package-lock.json b/packages/github/package-lock.json
diff --git a/packages/github/package.json b/packages/github/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@actions/github",
-  "version": "9.1.0",
+  "version": "9.1.1",
   "description": "Actions github lib",
   "keywords": [
     "github",

diff --git a/packages/glob/RELEASES.md b/packages/glob/RELEASES.md
@@ -1,5 +1,11 @@
 # @actions/glob Releases
 
+## 0.7.0
+
+- Bump `minimatch` from `^3.0.4` to `^10.2.5` [#2355](https://github.com/actions/toolkit/pull/2355)
+- Bump `undici` from `6.23.0` to `6.24.0` [#2345](https://github.com/actions/toolkit/pull/2345)
+- Bump `brace-expansion` in `/packages/glob` [#2369](https://github.com/actions/toolkit/pull/2369)
+
 ## 0.6.1
 
 - Fix a bad import for `minimatch`

diff --git a/packages/glob/__tests__/internal-pattern.test.ts b/packages/glob/__tests__/internal-pattern.test.ts
@@ -303,7 +303,7 @@ describe('pattern', () => {
     expect(pattern.match(`${root}foo/bar/baz`)).toBeFalsy()
     pattern = new Pattern(`${root}foo/b[!]r/b*`)
     expect(pattern.searchPath).toBe(`${root}foo${path.sep}b!r`)
-    expect(pattern.match(`${root}foo/b!r/baz`)).toBeTruthy()
+    expect(pattern.match(`${root}foo/b!r/baz`)).toBeFalsy()
     pattern = new Pattern(`${root}foo/b[[]ar/b*`)
     expect(pattern.searchPath).toBe(`${root}foo${path.sep}b[ar`)
     expect(pattern.match(`${root}foo/b[ar/baz`)).toBeTruthy()
@@ -340,9 +340,18 @@ describe('pattern', () => {
       pattern = new Pattern('C:/foo/b\\[a]r/b*')
       expect(pattern.searchPath).toBe(`C:\\foo\\b\\ar`)
       expect(pattern.match('C:/foo/b/ar/baz')).toBeTruthy()
+
+      // Regression testing for minimatch v3
+      // Historically, minimatch/glob had a bug when parsing a character class
+      // containing an escaped '!' (e.g. `[\\!]`). In some cases, the internal
+      // pattern construction would incorrectly insert the literal string
+      // "undefined" into the generated pattern/segment, which could make a
+      // pattern intended to match `b[\\!]r` also match a path segment like
+      // `b[undefined/!]r`. This test ensures that a pattern with a literal
+      // `[\\!]` in the directory name does *not* match such malformed paths.
       pattern = new Pattern('C:/foo/b[\\!]r/b*')
       expect(pattern.searchPath).toBe('C:\\foo\\b[\\!]r')
-      expect(pattern.match('C:/foo/b[undefined/!]r/baz')).toBeTruthy() // Note, "undefined" substr to accommodate a bug in Minimatch when nocase=true
+      expect(pattern.match('C:/foo/b[undefined/!]r/baz')).toBeFalsy()
     }
   })
 })

diff --git a/packages/glob/package-lock.json b/packages/glob/package-lock.json
diff --git a/packages/glob/package.json b/packages/glob/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@actions/glob",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "preview": true,
   "description": "Actions glob lib",
   "keywords": [
@@ -45,6 +45,6 @@
   },
   "dependencies": {
     "@actions/core": "^3.0.0",
-    "minimatch": "^3.0.4"
+    "minimatch": "^10.2.5"
   }
 }
diff --git a/packages/glob/src/internal-pattern.ts b/packages/glob/src/internal-pattern.ts
@@ -2,14 +2,10 @@ import * as os from 'os'
 import * as path from 'path'
 import * as pathHelper from './internal-path-helper.js'
 import assert from 'assert'
-import minimatch from 'minimatch'
+import {Minimatch, type MinimatchOptions} from 'minimatch'
 import {MatchKind} from './internal-match-kind.js'
 import {Path} from './internal-path.js'
 
-type IMinimatch = minimatch.IMinimatch
-type IMinimatchOptions = minimatch.IOptions
-const {Minimatch} = minimatch
-
 const IS_WINDOWS = process.platform === 'win32'
 
 export class Pattern {
@@ -38,7 +34,7 @@ export class Pattern {
   /**
    * The Minimatch object used for matching
    */
-  private readonly minimatch: IMinimatch
+  private readonly minimatch: Minimatch
 
   /**
    * Used to workaround a limitation with Minimatch when determining a partial
@@ -126,7 +122,7 @@ export class Pattern {
     this.isImplicitPattern = isImplicitPattern
 
     // Create minimatch
-    const minimatchOptions: IMinimatchOptions = {
+    const minimatchOptions: MinimatchOptions = {
       dot: true,
       nobrace: true,
       nocase: IS_WINDOWS,

diff --git a/packages/http-client/RELEASES.md b/packages/http-client/RELEASES.md
@@ -1,5 +1,9 @@
 # Releases
 
+## 4.0.1
+
+- Bump `undici` from `6.23.0` to `6.24.0` [#2347](https://github.com/actions/toolkit/pull/2347)
+
 ## 4.0.0
 
 - **Breaking change**: Package is now ESM-only

diff --git a/packages/http-client/package-lock.json b/packages/http-client/package-lock.json
diff --git a/packages/http-client/package.json b/packages/http-client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@actions/http-client",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Actions Http Client",
   "keywords": [
     "github",