Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download (#1165 )

* fix #174 * npm audit fix
Bump form-data to fix critical vulnerabilities #182 & #183 (#1163 )
2025-08-09 10:02:08 +00:00 · 2025-08-04 14:25:53 -05:00 · 2025-07-30 15:19:20 -05:00 · 2025-07-29 12:04:01 -05:00 · 2025-07-24 17:40:39 -05:00 · 2025-07-23 13:32:04 -05:00
50 changed files with 4492 additions and 1592 deletions
--- a/.github/workflows/e2e-cache-freethreaded.yml
+++ b/.github/workflows/e2e-cache-freethreaded.yml
@ -58,7 +58,7 @@ jobs:
            macos-latest,
            macos-13
          ]
-        python-version: [3.13.0t, 3.13.1t, 3.13.2t]
+        python-version: [3.13.1t, 3.13.2t, 3.13.5t]
    steps:
      - uses: actions/checkout@v4
      - name: Setup Python
@ -148,7 +148,7 @@ jobs:
            macos-latest,
            macos-13
          ]
-        python-version: [3.13.0t, 3.13.1t, 3.13.2t]
+        python-version: [3.13.1t, 3.13.2t, 3.13.5t]
    steps:
      - uses: actions/checkout@v4
      - name: Setup Python
@ -162,3 +162,60 @@ jobs:
        run: curl https://raw.githubusercontent.com/pypa/pipenv/master/get-pipenv.py | python
      - name: Install dependencies
        run: pipenv install requests
+
+  python-pip-dependencies-caching-with-pip-version:
+    name: Test pip (Python ${{ matrix.python-version}}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          [
+            ubuntu-latest,
+            ubuntu-22.04,
+            ubuntu-24.04-arm,
+            ubuntu-22.04-arm,
+            windows-latest,
+            macos-latest,
+            macos-13
+          ]
+        python-version: [3.13.0t, 3.13.1t, 3.13.2t]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: ./
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: 'pip'
+          pip-version: '25.0.1'
+      - name: Install dependencies
+        run: pip install numpy pandas requests
+
+  python-pip-dependencies-caching-path-with-pip-version:
+    name: Test pip (Python ${{ matrix.python-version}}, ${{ matrix.os }}, caching path)
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          [
+            ubuntu-latest,
+            ubuntu-22.04,
+            ubuntu-24.04-arm,
+            ubuntu-22.04-arm,
+            windows-latest,
+            macos-latest,
+            macos-13
+          ]
+        python-version: [3.13.0t, 3.13.1t, 3.13.2t]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: ./
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: 'pip'
+          cache-dependency-path: __tests__/data/requirements.txt
+          pip-version: '25.0.1'
+      - name: Install dependencies
+        run: pip install numpy pandas requests
--- a/.github/workflows/e2e-cache.yml
+++ b/.github/workflows/e2e-cache.yml
@ -78,8 +78,12 @@ jobs:
            python-version: pypy-3.11-v7.x
          - os: ubuntu-22.04
            python-version: pypy-3.11-v7.x
+          - os: ubuntu-22.04-arm
+            python-version: pypy-3.10-v7.x
          - os: ubuntu-22.04-arm
            python-version: pypy-3.11-v7.x
+          - os: ubuntu-22.04-arm
+            python-version: pypy-3.10-v7.x
    steps:
      - uses: actions/checkout@v4
      - name: Setup Python
@ -245,3 +249,60 @@ jobs:
          }
      - name: Run Python Script
        run: pipenv run python test-pipenv.py
+
+  python-pip-dependencies-caching-with-pip-version:
+    name: Test pip (Python ${{ matrix.python-version}}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          [
+            ubuntu-latest,
+            ubuntu-24.04-arm,
+            ubuntu-22.04,
+            ubuntu-22.04-arm,
+            windows-latest,
+            macos-latest,
+            macos-13
+          ]
+        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: ./
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: 'pip'
+          pip-version: '25.0.1'
+      - name: Install dependencies
+        run: pip install numpy pandas requests
+
+  python-pip-dependencies-caching-path-with-pip-version:
+    name: Test pip (Python ${{ matrix.python-version}}, ${{ matrix.os }}, caching path)
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          [
+            ubuntu-latest,
+            ubuntu-24.04-arm,
+            ubuntu-22.04,
+            ubuntu-22.04-arm,
+            windows-latest,
+            macos-latest,
+            macos-13
+          ]
+        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: ./
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: 'pip'
+          cache-dependency-path: __tests__/data/requirements.txt
+          pip-version: '25.0.1'
+      - name: Install dependencies
+        run: pip install numpy pandas requests
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@ -19,7 +19,6 @@ jobs:
      matrix:
        operating-system:
          [
-            ubuntu-20.04,
            windows-latest,
            ubuntu-22.04,
            ubuntu-22.04-arm,
@ -39,7 +38,7 @@ jobs:
      - name: Verify 3.9.13
        run: python __tests__/verify-python.py 3.9.13

-      - name: Run with setup-python 3.9.13
+      - name: Run with setup-python 3.10.11
        uses: ./
        with:
          python-version: 3.10.11
@ -90,6 +89,7 @@ jobs:
          python-version: '<3.13'
      - name: Verify <3.13
        run: python __tests__/verify-python.py 3.12
+
      - name: Test Raw Endpoint Access
        run: |
          curl -L https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json | jq empty
--- a/.github/workflows/test-graalpy.yml
+++ b/.github/workflows/test-graalpy.yml
@ -21,7 +21,6 @@ jobs:
        os:
          [
            macos-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            ubuntu-24.04-arm,
@ -77,7 +76,6 @@ jobs:
        os:
          [
            macos-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            ubuntu-24.04-arm,
--- a/.github/workflows/test-pypy.yml
+++ b/.github/workflows/test-pypy.yml
@ -24,7 +24,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            ubuntu-24.04-arm,
@ -89,7 +88,6 @@ jobs:
          - macos-13
          - macos-14
          - macos-15
-          - windows-2019
          - windows-2022
          - windows-2025
          - ubuntu-22.04
@ -142,7 +140,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            ubuntu-24.04-arm,
@ -177,7 +174,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            ubuntu-24.04-arm,
@ -220,7 +216,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            ubuntu-24.04-arm,
--- a/.github/workflows/test-python-freethreaded.yml
+++ b/.github/workflows/test-python-freethreaded.yml
@ -24,7 +24,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -62,7 +61,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -103,7 +101,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -142,7 +139,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -184,7 +180,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -226,7 +221,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -248,6 +242,86 @@ jobs:
        with:
          python-version-file: .tool-versions

+  setup-versions-from-pipfile-with-python_version:
+    name: Setup ${{ matrix.python }} ${{ matrix.os }} Pipfile
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          [
+            macos-latest,
+            windows-latest,
+            ubuntu-22.04,
+            ubuntu-22.04-arm,
+            macos-13,
+            ubuntu-latest,
+            ubuntu-24.04-arm
+          ]
+        python: [3.13t, 3.14t-dev]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: build-version-file ${{ matrix.python }}
+        run: |
+          echo '[requires]
+            python_version = "${{ matrix.python }}"
+          ' > Pipfile
+
+      - name: setup-python ${{ matrix.python }}
+        id: setup-python
+        uses: ./
+        with:
+          python-version-file: Pipfile
+
+      - name: Check python-path
+        run: ./__tests__/check-python-path.sh '${{ steps.setup-python.outputs.python-path }}'
+        shell: bash
+
+      - name: Run simple code
+        run: python -c 'import math; print(math.factorial(5))'
+
+  setup-versions-from-pipfile-with-python_full_version:
+    name: Setup ${{ matrix.python }} ${{ matrix.os }} .tool-versions file
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          [
+            macos-latest,
+            windows-latest,
+            ubuntu-22.04,
+            ubuntu-22.04-arm,
+            macos-13,
+            ubuntu-latest,
+            ubuntu-24.04-arm
+          ]
+        python: [3.13.0t, 3.13.1t, 3.13.2t, 3.14t-dev]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: build-version-file ${{ matrix.python }}
+        run: |
+          echo '[requires]
+            python_full_version = "${{ matrix.python }}"
+          ' > Pipfile
+
+      - name: setup-python ${{ matrix.python }}
+        id: setup-python
+        uses: ./
+        with:
+          python-version-file: Pipfile
+
+      - name: Check python-path
+        run: ./__tests__/check-python-path.sh '${{ steps.setup-python.outputs.python-path }}'
+        shell: bash
+
+      - name: Run simple code
+        run: python -c 'import math; print(math.factorial(5))'
+
  setup-pre-release-version-from-manifest:
    name: Setup 3.14.0-alpha.6 ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
@ -258,7 +332,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -371,7 +444,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -461,7 +533,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
--- a/.github/workflows/test-python.yml
+++ b/.github/workflows/test-python.yml
@ -24,7 +24,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -69,7 +68,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -117,7 +115,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -163,7 +160,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -214,7 +210,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -265,7 +260,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -290,6 +284,106 @@ jobs:
        with:
          python-version-file: .tool-versions

+  setup-versions-from-pipfile-with-python_version:
+    name: Setup ${{ matrix.python }} ${{ matrix.os }} Pipfile with python_version
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          [
+            macos-latest,
+            windows-latest,
+            ubuntu-22.04,
+            ubuntu-22.04-arm,
+            macos-13,
+            ubuntu-latest,
+            ubuntu-24.04-arm
+          ]
+        python: [3.9.13, 3.10.11, 3.11.9, 3.13.2]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: build-version-file ${{ matrix.python }}
+        run: |
+          echo '[requires]
+            python_version = "${{ matrix.python }}"
+          ' > Pipfile
+
+      - name: setup-python ${{ matrix.python }}
+        id: setup-python
+        uses: ./
+        with:
+          python-version-file: Pipfile
+
+      - name: Check python-path
+        run: ./__tests__/check-python-path.sh '${{ steps.setup-python.outputs.python-path }}'
+        shell: bash
+
+      - name: Validate version
+        run: |
+          $pythonVersion = (python --version)
+          if ("Python ${{ matrix.python }}".replace("==", "") -ne "$pythonVersion"){
+            Write-Host "The current version is $pythonVersion; expected version is ${{ matrix.python }}"
+            exit 1
+          }
+          $pythonVersion
+        shell: pwsh
+
+      - name: Run simple code
+        run: python -c 'import math; print(math.factorial(5))'
+
+  setup-versions-from-pipfile-with-python_full_version:
+    name: Setup ${{ matrix.python }} ${{ matrix.os }} Pipfile with python_full_version
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          [
+            macos-latest,
+            windows-latest,
+            ubuntu-22.04,
+            ubuntu-22.04-arm,
+            macos-13,
+            ubuntu-latest,
+            ubuntu-24.04-arm
+          ]
+        python: [3.9.13, 3.10.11, 3.11.9, 3.13.2]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: build-version-file ${{ matrix.python }}
+        run: |
+          echo '[requires]
+            python_full_version = "${{ matrix.python }}"
+          ' > Pipfile
+
+      - name: setup-python ${{ matrix.python }}
+        id: setup-python
+        uses: ./
+        with:
+          python-version-file: Pipfile
+
+      - name: Check python-path
+        run: ./__tests__/check-python-path.sh '${{ steps.setup-python.outputs.python-path }}'
+        shell: bash
+
+      - name: Validate version
+        run: |
+          $pythonVersion = (python --version)
+          if ("Python ${{ matrix.python }}".replace("==", "") -ne "$pythonVersion"){
+            Write-Host "The current version is $pythonVersion; expected version is ${{ matrix.python }}"
+            exit 1
+          }
+          $pythonVersion
+        shell: pwsh
+
+      - name: Run simple code
+        run: python -c 'import math; print(math.factorial(5))'
+
  setup-pre-release-version-from-manifest:
    name: Setup 3.14.0-alpha.6 ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
@ -300,7 +394,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
@ -419,7 +512,6 @@ jobs:
          [
            macos-latest,
            windows-latest,
-            ubuntu-20.04,
            ubuntu-22.04,
            ubuntu-22.04-arm,
            macos-13,
--- a/.licenses/npm/@actions/tool-cache.dep.yml
+++ b/.licenses/npm/@actions/tool-cache.dep.yml
@ -1,6 +1,6 @@
 ---
 name: "@actions/tool-cache"
-version: 2.0.1
+version: 2.0.2
 type: npm
 summary: Actions tool-cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/tool-cache
--- a/.licenses/npm/brace-expansion.dep.yml
+++ b/.licenses/npm/brace-expansion.dep.yml
@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 1.1.11
+version: 1.1.12
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion
--- a/.licenses/npm/call-bind-apply-helpers.dep.yml
+++ b/.licenses/npm/call-bind-apply-helpers.dep.yml
@ -1,16 +1,16 @@
 ---
-name: uuid
-version: 3.4.0
+name: call-bind-apply-helpers
+version: 1.0.2
 type: npm
-summary: RFC4122 (v1, v4, and v5) UUIDs
-homepage: https://github.com/uuidjs/uuid#readme
+summary: Helper functions around Function call/apply/bind, for use in `call-bind`
+homepage: https://github.com/ljharb/call-bind-apply-helpers#readme
 license: mit
 licenses:
- sources: LICENSE.md
+- sources: LICENSE
  text: |
-    The MIT License (MIT)
+    MIT License

-    Copyright (c) 2010-2016 Robert Kieffer and other contributors
+    Copyright (c) 2024 Jordan Harband

    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
@ -29,11 +29,4 @@ licenses:
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE.
-notices:
- sources: AUTHORS
-  text: |-
-    Robert Kieffer <robert@broofa.com>
-    Christoph Tavan <dev@tavan.de>
-    AJ ONeal <coolaj86@gmail.com>
-    Vincent Voyer <vincent@zeroload.net>
-    Roman Shtylman <shtylman@gmail.com>
+notices: []
--- a/.licenses/npm/dunder-proto.dep.yml
+++ b/.licenses/npm/dunder-proto.dep.yml
@ -0,0 +1,32 @@
+---
+name: dunder-proto
+version: 1.0.1
+type: npm
+summary: If available, the `Object.prototype.__proto__` accessor and mutator, call-bound
+homepage: https://github.com/es-shims/dunder-proto#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2024 ECMAScript Shims
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/es-define-property.dep.yml
+++ b/.licenses/npm/es-define-property.dep.yml
@ -0,0 +1,32 @@
+---
+name: es-define-property
+version: 1.0.1
+type: npm
+summary: "`Object.defineProperty`, but not IE 8's broken one."
+homepage: https://github.com/ljharb/es-define-property#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2024 Jordan Harband
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/es-errors.dep.yml
+++ b/.licenses/npm/es-errors.dep.yml
@ -0,0 +1,32 @@
+---
+name: es-errors
+version: 1.3.0
+type: npm
+summary: A simple cache for a few of the JS Error constructors.
+homepage: https://github.com/ljharb/es-errors#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2024 Jordan Harband
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/es-object-atoms.dep.yml
+++ b/.licenses/npm/es-object-atoms.dep.yml
@ -0,0 +1,32 @@
+---
+name: es-object-atoms
+version: 1.1.1
+type: npm
+summary: 'ES Object-related atoms: Object, ToObject, RequireObjectCoercible'
+homepage: https://github.com/ljharb/es-object-atoms#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2024 Jordan Harband
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/es-set-tostringtag.dep.yml
+++ b/.licenses/npm/es-set-tostringtag.dep.yml
@ -0,0 +1,32 @@
+---
+name: es-set-tostringtag
+version: 2.1.0
+type: npm
+summary: A helper to optimistically set Symbol.toStringTag, when possible.
+homepage: https://github.com/es-shims/es-set-tostringtag#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2022 ECMAScript Shims
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/form-data-2.5.5.dep.yml
+++ b/.licenses/npm/form-data-2.5.5.dep.yml
@ -1,10 +1,10 @@
 ---
 name: form-data
-version: 2.5.1
+version: 2.5.5
 type: npm
 summary: A library to create readable "multipart/form-data" streams. Can be used to
  submit forms and file uploads to other web applications.
-homepage: https://github.com/form-data/form-data#readme
+homepage:
 license: mit
 licenses:
 - sources: License
--- a/.licenses/npm/form-data-4.0.4.dep.yml
+++ b/.licenses/npm/form-data-4.0.4.dep.yml
@ -1,10 +1,10 @@
 ---
 name: form-data
-version: 4.0.0
+version: 4.0.4
 type: npm
 summary: A library to create readable "multipart/form-data" streams. Can be used to
  submit forms and file uploads to other web applications.
-homepage: https://github.com/form-data/form-data#readme
+homepage:
 license: mit
 licenses:
 - sources: License
@ -28,6 +28,6 @@ licenses:
     LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     THE SOFTWARE.
- sources: Readme.md
+- sources: README.md
  text: Form-Data is released under the [MIT](License) license.
 notices: []
--- a/.licenses/npm/function-bind.dep.yml
+++ b/.licenses/npm/function-bind.dep.yml
@ -0,0 +1,32 @@
+---
+name: function-bind
+version: 1.1.2
+type: npm
+summary: Implementation of Function.prototype.bind
+homepage: https://github.com/Raynos/function-bind
+license: mit
+licenses:
+- sources: LICENSE
+  text: |+
+    Copyright (c) 2013 Raynos.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+    THE SOFTWARE.
+
+notices: []
+...
--- a/.licenses/npm/get-intrinsic.dep.yml
+++ b/.licenses/npm/get-intrinsic.dep.yml
@ -0,0 +1,33 @@
+---
+name: get-intrinsic
+version: 1.3.0
+type: npm
+summary: Get and robustly cache all JS language-level intrinsics at first require
+  time
+homepage: https://github.com/ljharb/get-intrinsic#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2020 Jordan Harband
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/get-proto.dep.yml
+++ b/.licenses/npm/get-proto.dep.yml
@ -0,0 +1,32 @@
+---
+name: get-proto
+version: 1.0.1
+type: npm
+summary: Robustly get the [[Prototype]] of an object
+homepage: https://github.com/ljharb/get-proto#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2025 Jordan Harband
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/gopd.dep.yml
+++ b/.licenses/npm/gopd.dep.yml
@ -0,0 +1,32 @@
+---
+name: gopd
+version: 1.2.0
+type: npm
+summary: "`Object.getOwnPropertyDescriptor`, but accounts for IE's broken implementation."
+homepage: https://github.com/ljharb/gopd#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2022 Jordan Harband
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/has-symbols.dep.yml
+++ b/.licenses/npm/has-symbols.dep.yml
@ -0,0 +1,32 @@
+---
+name: has-symbols
+version: 1.1.0
+type: npm
+summary: Determine if the JS environment has Symbol support. Supports spec, or shams.
+homepage: https://github.com/ljharb/has-symbols#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2016 Jordan Harband
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/has-tostringtag.dep.yml
+++ b/.licenses/npm/has-tostringtag.dep.yml
@ -0,0 +1,33 @@
+---
+name: has-tostringtag
+version: 1.0.2
+type: npm
+summary: Determine if the JS environment has `Symbol.toStringTag` support. Supports
+  spec, or shams.
+homepage: https://github.com/inspect-js/has-tostringtag#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2021 Inspect JS
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/hasown.dep.yml
+++ b/.licenses/npm/hasown.dep.yml
@ -0,0 +1,32 @@
+---
+name: hasown
+version: 2.0.2
+type: npm
+summary: A robust, ES3 compatible, "has own property" predicate.
+homepage: https://github.com/inspect-js/hasOwn#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) Jordan Harband and contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/lru-cache.dep.yml
+++ b/.licenses/npm/lru-cache.dep.yml
@ -1,26 +0,0 @@
---
-name: lru-cache
-version: 6.0.0
-type: npm
-summary: A cache object that deletes the least-recently-used items.
-homepage: 
-license: isc
-licenses:
- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []
--- a/.licenses/npm/math-intrinsics.dep.yml
+++ b/.licenses/npm/math-intrinsics.dep.yml
@ -0,0 +1,32 @@
+---
+name: math-intrinsics
+version: 1.1.0
+type: npm
+summary: ES Math-related intrinsics and helpers, robustly cached.
+homepage: https://github.com/es-shims/math-intrinsics#readme
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2024 ECMAScript Shims
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.licenses/npm/safe-buffer.dep.yml
+++ b/.licenses/npm/safe-buffer.dep.yml
@ -0,0 +1,34 @@
+---
+name: safe-buffer
+version: 5.2.1
+type: npm
+summary: Safer Node.js Buffer API
+homepage: https://github.com/feross/safe-buffer
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    The MIT License (MIT)
+
+    Copyright (c) Feross Aboukhadijeh
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+    THE SOFTWARE.
+- sources: README.md
+  text: MIT. Copyright (C) [Feross Aboukhadijeh](http://feross.org)
+notices: []
--- a/.licenses/npm/semver-7.7.1.dep.yml
+++ b/.licenses/npm/semver-7.7.1.dep.yml
@ -1,6 +1,6 @@
 ---
 name: semver
-version: 7.6.0
+version: 7.7.1
 type: npm
 summary: The semantic version parser used by npm.
 homepage:
--- a/.licenses/npm/undici.dep.yml
+++ b/.licenses/npm/undici.dep.yml
@ -1,6 +1,6 @@
 ---
 name: undici
-version: 5.28.5
+version: 5.29.0
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org
--- a/.licenses/npm/uuid-8.3.2.dep.yml
+++ b/.licenses/npm/uuid-8.3.2.dep.yml
@ -3,7 +3,7 @@ name: uuid
 version: 8.3.2
 type: npm
 summary: RFC4122 (v1, v4, and v5) UUIDs
-homepage: https://github.com/uuidjs/uuid#readme
+homepage:
 license: mit
 licenses:
 - sources: LICENSE.md
--- a/.licenses/npm/yallist.dep.yml
+++ b/.licenses/npm/yallist.dep.yml
@ -1,26 +0,0 @@
---
-name: yallist
-version: 4.0.0
-type: npm
-summary: Yet Another Linked List
-homepage: 
-license: isc
-licenses:
- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []
--- a/README.md
+++ b/README.md
@ -94,6 +94,8 @@ steps:

 >The requirements file format allows for specifying dependency versions using logical operators (for example chardet>=3.0.4) or specifying dependencies without any versions. In this case the pip install -r requirements.txt command will always try to install the latest available package version. To be sure that the cache will be used, please stick to a specific dependency version and update it manually if necessary.

+>The `setup-python` action does not handle authentication for pip when installing packages from private repositories. For help, refer [pip’s VCS support documentation](https://pip.pypa.io/en/stable/topics/vcs-support/) or visit the [pip repository](https://github.com/pypa/pip).
+
 See examples of using `cache` and `cache-dependency-path` for `pipenv` and `poetry` in the section: [Caching packages](docs/advanced-usage.md#caching-packages) of the [Advanced usage](docs/advanced-usage.md) guide.

 ## Advanced usage
@ -108,6 +110,7 @@ See examples of using `cache` and `cache-dependency-path` for `pipenv` and `poet
 - [Using `setup-python` with a self-hosted runner](docs/advanced-usage.md#using-setup-python-with-a-self-hosted-runner)
 - [Using `setup-python` on GHES](docs/advanced-usage.md#using-setup-python-on-ghes)
 - [Allow pre-releases](docs/advanced-usage.md#allow-pre-releases)
+- [Using the pip-version input](docs/advanced-usage.md#using-the-pip-version-input)

 ## Recommended permissions

--- a/tests/data/poetry.lock
+++ b/tests/data/poetry.lock
@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.1.3 and should not be changed by hand.

 [[package]]
 name = "altgraph"
@ -6,6 +6,7 @@ version = "0.17.4"
 description = "Python graph (network) package"
 optional = false
 python-versions = "*"
+groups = ["main"]
 files = [
    {file = "altgraph-0.17.4-py2.py3-none-any.whl", hash = "sha256:642743b4750de17e655e6711601b077bc6598dbfa3ba5fa2b2a35ce12b508dff"},
    {file = "altgraph-0.17.4.tar.gz", hash = "sha256:1b5afbb98f6c4dcadb2e2ae6ab9fa994bbb8c1d75f4fa96d340f9437ae454406"},
@ -17,6 +18,7 @@ version = "4.0.1"
 description = "the modular source code checker: pep8 pyflakes and co"
 optional = false
 python-versions = ">=3.6"
+groups = ["main"]
 files = [
    {file = "flake8-4.0.1-py2.py3-none-any.whl", hash = "sha256:479b1304f72536a55948cb40a32dce8bb0ffe3501e26eaf292c7e60eb5e0428d"},
    {file = "flake8-4.0.1.tar.gz", hash = "sha256:806e034dda44114815e23c16ef92f95c91e4c71100ff52813adf7132a6ad870d"},
@ -33,6 +35,8 @@ version = "8.5.0"
 description = "Read metadata from Python packages"
 optional = false
 python-versions = ">=3.8"
+groups = ["main"]
+markers = "python_version == \"3.9\""
 files = [
    {file = "importlib_metadata-8.5.0-py3-none-any.whl", hash = "sha256:45e54197d28b7a7f1559e60b95e7c567032b602131fbd588f1497f47880aa68b"},
    {file = "importlib_metadata-8.5.0.tar.gz", hash = "sha256:71522656f0abace1d072b9e5481a48f07c138e00f079c38c8f883823f9c26bd7"},
@ -42,12 +46,12 @@ files = [
 zipp = ">=3.20"

 [package.extras]
-check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1)"]
+check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\""]
 cover = ["pytest-cov"]
 doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
 enabler = ["pytest-enabler (>=2.2)"]
 perf = ["ipython"]
-test = ["flufl.flake8", "importlib-resources (>=1.3)", "jaraco.test (>=5.4)", "packaging", "pyfakefs", "pytest (>=6,!=8.1.*)", "pytest-perf (>=0.9.2)"]
+test = ["flufl.flake8", "importlib-resources (>=1.3) ; python_version < \"3.9\"", "jaraco.test (>=5.4)", "packaging", "pyfakefs", "pytest (>=6,!=8.1.*)", "pytest-perf (>=0.9.2)"]
 type = ["pytest-mypy"]

 [[package]]
@ -56,6 +60,8 @@ version = "1.16.3"
 description = "Mach-O header analysis and editing"
 optional = false
 python-versions = "*"
+groups = ["main"]
+markers = "sys_platform == \"darwin\""
 files = [
    {file = "macholib-1.16.3-py2.py3-none-any.whl", hash = "sha256:0e315d7583d38b8c77e815b1ecbdbf504a8258d8b3e17b61165c6feb60d18f2c"},
    {file = "macholib-1.16.3.tar.gz", hash = "sha256:07ae9e15e8e4cd9a788013d81f5908b3609aa76f9b1421bae9c4d7606ec86a30"},
@ -70,6 +76,7 @@ version = "0.6.1"
 description = "McCabe checker, plugin for flake8"
 optional = false
 python-versions = "*"
+groups = ["main"]
 files = [
    {file = "mccabe-0.6.1-py2.py3-none-any.whl", hash = "sha256:ab8a6258860da4b6677da4bd2fe5dc2c659cff31b3ee4f7f5d64e79735b80d42"},
    {file = "mccabe-0.6.1.tar.gz", hash = "sha256:dd8d182285a0fe56bace7f45b5e7d1a6ebcbf524e8f3bd87eb0f125271b8831f"},
@ -81,6 +88,7 @@ version = "24.2"
 description = "Core utilities for Python packages"
 optional = false
 python-versions = ">=3.8"
+groups = ["main"]
 files = [
    {file = "packaging-24.2-py3-none-any.whl", hash = "sha256:09abb1bccd265c01f4a3aa3f7a7db064b36514d2cba19a2f694fe6150451a759"},
    {file = "packaging-24.2.tar.gz", hash = "sha256:c228a6dc5e932d346bc5739379109d49e8853dd8223571c7c5b55260edc0b97f"},
@ -92,6 +100,8 @@ version = "2024.8.26"
 description = "Python PE parsing module"
 optional = false
 python-versions = ">=3.6.0"
+groups = ["main"]
+markers = "sys_platform == \"win32\""
 files = [
    {file = "pefile-2024.8.26-py3-none-any.whl", hash = "sha256:76f8b485dcd3b1bb8166f1128d395fa3d87af26360c2358fb75b80019b957c6f"},
    {file = "pefile-2024.8.26.tar.gz", hash = "sha256:3ff6c5d8b43e8c37bb6e6dd5085658d658a7a0bdcd20b6a07b1fcfc1c4e9d632"},
@ -103,6 +113,7 @@ version = "2.8.0"
 description = "Python style guide checker"
 optional = false
 python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+groups = ["main"]
 files = [
    {file = "pycodestyle-2.8.0-py2.py3-none-any.whl", hash = "sha256:720f8b39dde8b293825e7ff02c475f3077124006db4f440dcbc9a20b76548a20"},
    {file = "pycodestyle-2.8.0.tar.gz", hash = "sha256:eddd5847ef438ea1c7870ca7eb78a9d47ce0cdb4851a5523949f2601d0cbbe7f"},
@ -114,6 +125,7 @@ version = "2.4.0"
 description = "passive checker of Python programs"
 optional = false
 python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*"
+groups = ["main"]
 files = [
    {file = "pyflakes-2.4.0-py2.py3-none-any.whl", hash = "sha256:3bb3a3f256f4b7968c9c788781e4ff07dce46bdf12339dcda61053375426ee2e"},
    {file = "pyflakes-2.4.0.tar.gz", hash = "sha256:05a85c2872edf37a4ed30b0cce2f6093e1d0581f8c19d7393122da7e25b2b24c"},
@ -125,6 +137,7 @@ version = "6.10.0"
 description = "PyInstaller bundles a Python application and all its dependencies into a single package."
 optional = false
 python-versions = "<3.14,>=3.8"
+groups = ["main"]
 files = [
    {file = "pyinstaller-6.10.0-py3-none-macosx_10_13_universal2.whl", hash = "sha256:d60fb22859e11483af735aec115fdde09467cdbb29edd9844839f2c920b748c0"},
    {file = "pyinstaller-6.10.0-py3-none-manylinux2014_aarch64.whl", hash = "sha256:46d75359668993ddd98630a3669dc5249f3c446e35239b43bc7f4155bc574748"},
@ -160,6 +173,7 @@ version = "2025.1"
 description = "Community maintained hooks for PyInstaller"
 optional = false
 python-versions = ">=3.8"
+groups = ["main"]
 files = [
    {file = "pyinstaller_hooks_contrib-2025.1-py3-none-any.whl", hash = "sha256:d3c799470cbc0bda60dcc8e6b4ab976777532b77621337f2037f558905e3a8e9"},
    {file = "pyinstaller_hooks_contrib-2025.1.tar.gz", hash = "sha256:130818f9e9a0a7f2261f1fd66054966a3a50c99d000981c5d1db11d3ad0c6ab2"},
@ -176,6 +190,8 @@ version = "0.2.3"
 description = "A (partial) reimplementation of pywin32 using ctypes/cffi"
 optional = false
 python-versions = ">=3.6"
+groups = ["main"]
+markers = "sys_platform == \"win32\""
 files = [
    {file = "pywin32-ctypes-0.2.3.tar.gz", hash = "sha256:d162dc04946d704503b2edc4d55f3dba5c1d539ead017afa00142c38b9885755"},
    {file = "pywin32_ctypes-0.2.3-py3-none-any.whl", hash = "sha256:8a1513379d709975552d202d942d9837758905c8d01eb82b8bcc30918929e7b8"},
@ -183,23 +199,24 @@ files = [

 [[package]]
 name = "setuptools"
-version = "75.3.2"
+version = "80.9.0"
 description = "Easily download, build, install, upgrade, and uninstall Python packages"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
+groups = ["main"]
 files = [
-    {file = "setuptools-75.3.2-py3-none-any.whl", hash = "sha256:90ab613b6583fc02d5369cbca13ea26ea0e182d1df2d943ee9cbe81d4c61add9"},
-    {file = "setuptools-75.3.2.tar.gz", hash = "sha256:3c1383e1038b68556a382c1e8ded8887cd20141b0eb5708a6c8d277de49364f5"},
+    {file = "setuptools-80.9.0-py3-none-any.whl", hash = "sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922"},
+    {file = "setuptools-80.9.0.tar.gz", hash = "sha256:f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c"},
 ]

 [package.extras]
-check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1)", "ruff (>=0.5.2)"]
-core = ["importlib-metadata (>=6)", "importlib-resources (>=5.10.2)", "jaraco.collections", "jaraco.functools", "jaraco.text (>=3.7)", "more-itertools", "more-itertools (>=8.8)", "packaging", "packaging (>=24)", "platformdirs (>=4.2.2)", "tomli (>=2.0.1)", "wheel (>=0.43.0)"]
+check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\"", "ruff (>=0.8.0) ; sys_platform != \"cygwin\""]
+core = ["importlib_metadata (>=6) ; python_version < \"3.10\"", "jaraco.functools (>=4)", "jaraco.text (>=3.7)", "more_itertools", "more_itertools (>=8.8)", "packaging (>=24.2)", "platformdirs (>=4.2.2)", "tomli (>=2.0.1) ; python_version < \"3.11\"", "wheel (>=0.43.0)"]
 cover = ["pytest-cov"]
 doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "pygments-github-lexers (==0.0.5)", "pyproject-hooks (!=1.1)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-favicon", "sphinx-inline-tabs", "sphinx-lint", "sphinx-notfound-page (>=1,<2)", "sphinx-reredirects", "sphinxcontrib-towncrier", "towncrier (<24.7)"]
 enabler = ["pytest-enabler (>=2.2)"]
-test = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "ini2toml[lite] (>=0.14)", "jaraco.develop (>=7.21)", "jaraco.envs (>=2.2)", "jaraco.path (>=3.2.0)", "jaraco.test (>=5.5)", "packaging (>=23.2)", "pip (>=19.1)", "pyproject-hooks (!=1.1)", "pytest (>=6,!=8.1.*)", "pytest-home (>=0.5)", "pytest-perf", "pytest-subprocess", "pytest-timeout", "pytest-xdist (>=3)", "ruff (<=0.7.1)", "tomli-w (>=1.0.0)", "virtualenv (>=13.0.0)", "wheel (>=0.44.0)"]
-type = ["importlib-metadata (>=7.0.2)", "jaraco.develop (>=7.21)", "mypy (==1.12.*)", "pytest-mypy"]
+test = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "ini2toml[lite] (>=0.14)", "jaraco.develop (>=7.21) ; python_version >= \"3.9\" and sys_platform != \"cygwin\"", "jaraco.envs (>=2.2)", "jaraco.path (>=3.7.2)", "jaraco.test (>=5.5)", "packaging (>=24.2)", "pip (>=19.1)", "pyproject-hooks (!=1.1)", "pytest (>=6,!=8.1.*)", "pytest-home (>=0.5)", "pytest-perf ; sys_platform != \"cygwin\"", "pytest-subprocess", "pytest-timeout", "pytest-xdist (>=3)", "tomli-w (>=1.0.0)", "virtualenv (>=13.0.0)", "wheel (>=0.44.0)"]
+type = ["importlib_metadata (>=7.0.2) ; python_version < \"3.10\"", "jaraco.develop (>=7.21) ; sys_platform != \"cygwin\"", "mypy (==1.14.*)", "pytest-mypy"]

 [[package]]
 name = "zipp"
@ -207,20 +224,22 @@ version = "3.20.2"
 description = "Backport of pathlib-compatible object wrapper for zip files"
 optional = false
 python-versions = ">=3.8"
+groups = ["main"]
+markers = "python_version == \"3.9\""
 files = [
    {file = "zipp-3.20.2-py3-none-any.whl", hash = "sha256:a817ac80d6cf4b23bf7f2828b7cabf326f15a001bea8b1f9b49631780ba28350"},
    {file = "zipp-3.20.2.tar.gz", hash = "sha256:bc9eb26f4506fda01b81bcde0ca78103b6e62f991b381fec825435c836edbc29"},
 ]

 [package.extras]
-check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1)"]
+check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\""]
 cover = ["pytest-cov"]
 doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
 enabler = ["pytest-enabler (>=2.2)"]
-test = ["big-O", "importlib-resources", "jaraco.functools", "jaraco.itertools", "jaraco.test", "more-itertools", "pytest (>=6,!=8.1.*)", "pytest-ignore-flaky"]
+test = ["big-O", "importlib-resources ; python_version < \"3.9\"", "jaraco.functools", "jaraco.itertools", "jaraco.test", "more-itertools", "pytest (>=6,!=8.1.*)", "pytest-ignore-flaky"]
 type = ["pytest-mypy"]

 [metadata]
-lock-version = "2.0"
-python-versions = ">=3.8,<3.14"
-content-hash = "6db8fff0987f3dadb02cbf0e510a2d04b01ab2dc6d7b0fb32a0e33a8d30b3a58"
+lock-version = "2.1"
+python-versions = ">=3.9,<3.14"
+content-hash = "9a14798bf374c540031f893ff18f9b187bd984391e9da99d13c0e6710b7de09e"
--- a/tests/data/pyproject.toml
+++ b/tests/data/pyproject.toml
@ -5,13 +5,13 @@ description = ""
 authors = ["Your Name <you@example.com>"]

 [tool.poetry.dependencies]
-python = ">=3.8,<3.14"
+python = ">=3.9,<3.14"
 flake8 = "^4.0.1"
 pyinstaller = "6.10.0"
-
+setuptools = ">=78.1.1" 

 [tool.poetry.dev-dependencies]

 [build-system]
 requires = ["poetry-core>=1.0.0"]
-build-backend = "poetry.core.masonry.api"
+build-backend = "poetry.core.masonry.api"
--- a/tests/data/requirements-linux.txt
+++ b/tests/data/requirements-linux.txt
@ -1,7 +1,7 @@
 certifi==2020.6.20
 chardet==3.0.4
 docutils==0.16
-idna==2.10
+idna==3.7
 Kivy==2.0.0rc3
 Kivy-Garden==0.1.4
 packaging==20.7
--- a/tests/data/requirements.txt
+++ b/tests/data/requirements.txt
@ -8,7 +8,7 @@ docutils==0.16

 future==0.18.2; python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2'

-idna==2.9
+idna==3.7

 itsdangerous==1.1.0

--- a/tests/install-python.test.ts
+++ b/tests/install-python.test.ts
@ -8,10 +8,29 @@ import * as tc from '@actions/tool-cache';

 jest.mock('@actions/http-client');
 jest.mock('@actions/tool-cache');
-
-const mockManifest = [{version: '1.0.0'}];
+jest.mock('@actions/tool-cache', () => ({
+  getManifestFromRepo: jest.fn()
+}));
+const mockManifest = [
+  {
+    version: '1.0.0',
+    stable: true,
+    files: [
+      {
+        filename: 'tool-v1.0.0-linux-x64.tar.gz',
+        platform: 'linux',
+        arch: 'x64',
+        download_url: 'https://example.com/tool-v1.0.0-linux-x64.tar.gz'
+      }
+    ]
+  }
+];

 describe('getManifest', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
  it('should return manifest from repo', async () => {
    (tc.getManifestFromRepo as jest.Mock).mockResolvedValue(mockManifest);
    const manifest = await getManifest();
--- a/tests/setup-python.test.ts
+++ b/tests/setup-python.test.ts
@ -0,0 +1,149 @@
+import * as core from '@actions/core';
+import * as fs from 'fs';
+import * as path from 'path';
+import {cacheDependencies} from '../src/setup-python';
+import {getCacheDistributor} from '../src/cache-distributions/cache-factory';
+
+jest.mock('fs', () => {
+  const actualFs = jest.requireActual('fs');
+  return {
+    ...actualFs,
+    promises: {
+      access: jest.fn(),
+      mkdir: jest.fn(),
+      copyFile: jest.fn(),
+      writeFile: jest.fn(),
+      appendFile: jest.fn()
+    }
+  };
+});
+jest.mock('@actions/core');
+jest.mock('../src/cache-distributions/cache-factory');
+
+const mockedFsPromises = fs.promises as jest.Mocked<typeof fs.promises>;
+const mockedCore = core as jest.Mocked<typeof core>;
+const mockedGetCacheDistributor = getCacheDistributor as jest.Mock;
+
+describe('cacheDependencies', () => {
+  const mockRestoreCache = jest.fn();
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.GITHUB_ACTION_PATH = '/github/action';
+    process.env.GITHUB_WORKSPACE = '/github/workspace';
+
+    mockedCore.getInput.mockReturnValue('nested/deps.lock');
+
+    // Simulate file exists by resolving access without error
+    mockedFsPromises.access.mockImplementation(async p => {
+      const pathStr = typeof p === 'string' ? p : p.toString();
+      if (pathStr === '/github/action/nested/deps.lock') {
+        return Promise.resolve();
+      }
+      // Simulate directory doesn't exist to test mkdir
+      if (pathStr === path.dirname('/github/workspace/nested/deps.lock')) {
+        return Promise.reject(new Error('no dir'));
+      }
+      return Promise.resolve();
+    });
+
+    // Simulate mkdir success
+    mockedFsPromises.mkdir.mockResolvedValue(undefined);
+
+    // Simulate copyFile success
+    mockedFsPromises.copyFile.mockResolvedValue(undefined);
+
+    mockedGetCacheDistributor.mockReturnValue({restoreCache: mockRestoreCache});
+  });
+
+  it('copies the dependency file and resolves the path with directory structure', async () => {
+    await cacheDependencies('pip', '3.12');
+
+    const sourcePath = path.resolve('/github/action', 'nested/deps.lock');
+    const targetPath = path.resolve('/github/workspace', 'nested/deps.lock');
+
+    expect(mockedFsPromises.access).toHaveBeenCalledWith(
+      sourcePath,
+      fs.constants.F_OK
+    );
+    expect(mockedFsPromises.mkdir).toHaveBeenCalledWith(
+      path.dirname(targetPath),
+      {
+        recursive: true
+      }
+    );
+    expect(mockedFsPromises.copyFile).toHaveBeenCalledWith(
+      sourcePath,
+      targetPath
+    );
+    expect(mockedCore.info).toHaveBeenCalledWith(
+      `Copied ${sourcePath} to ${targetPath}`
+    );
+    expect(mockedCore.info).toHaveBeenCalledWith(
+      `Resolved cache-dependency-path: nested/deps.lock`
+    );
+    expect(mockRestoreCache).toHaveBeenCalled();
+  });
+
+  it('warns if the dependency file does not exist', async () => {
+    // Simulate file does not exist by rejecting access
+    mockedFsPromises.access.mockRejectedValue(new Error('file not found'));
+
+    await cacheDependencies('pip', '3.12');
+
+    expect(mockedCore.warning).toHaveBeenCalledWith(
+      expect.stringContaining('does not exist')
+    );
+    expect(mockedFsPromises.copyFile).not.toHaveBeenCalled();
+    expect(mockRestoreCache).toHaveBeenCalled();
+  });
+
+  it('warns if file copy fails', async () => {
+    // Simulate copyFile failure
+    mockedFsPromises.copyFile.mockRejectedValue(new Error('copy failed'));
+
+    await cacheDependencies('pip', '3.12');
+
+    expect(mockedCore.warning).toHaveBeenCalledWith(
+      expect.stringContaining('Failed to copy file')
+    );
+    expect(mockRestoreCache).toHaveBeenCalled();
+  });
+
+  it('skips path logic if no input is provided', async () => {
+    mockedCore.getInput.mockReturnValue('');
+
+    await cacheDependencies('pip', '3.12');
+
+    expect(mockedFsPromises.copyFile).not.toHaveBeenCalled();
+    expect(mockedCore.warning).not.toHaveBeenCalled();
+    expect(mockRestoreCache).toHaveBeenCalled();
+  });
+
+  it('does not copy if dependency file is already inside the workspace but still sets resolved path', async () => {
+    // Simulate cacheDependencyPath inside workspace
+    mockedCore.getInput.mockReturnValue('deps.lock');
+
+    // Override sourcePath and targetPath to be equal
+    const actionPath = '/github/workspace'; // same path for action and workspace
+    process.env.GITHUB_ACTION_PATH = actionPath;
+    process.env.GITHUB_WORKSPACE = actionPath;
+
+    // access resolves to simulate file exists
+    mockedFsPromises.access.mockResolvedValue();
+
+    await cacheDependencies('pip', '3.12');
+
+    const sourcePath = path.resolve(actionPath, 'deps.lock');
+    const targetPath = sourcePath; // same path
+
+    expect(mockedFsPromises.copyFile).not.toHaveBeenCalled();
+    expect(mockedCore.info).toHaveBeenCalledWith(
+      `Dependency file is already inside the workspace: ${sourcePath}`
+    );
+    expect(mockedCore.info).toHaveBeenCalledWith(
+      `Resolved cache-dependency-path: deps.lock`
+    );
+    expect(mockRestoreCache).toHaveBeenCalled();
+  });
+});
--- a/tests/utils.test.ts
+++ b/tests/utils.test.ts
@ -10,8 +10,9 @@ import {
  validatePythonVersionFormatForPyPy,
  isCacheFeatureAvailable,
  getVersionInputFromFile,
-  getVersionInputFromPlainFile,
+  getVersionsInputFromPlainFile,
  getVersionInputFromTomlFile,
+  getVersionInputFromPipfileFile,
  getNextPageUrl,
  isGhes,
  IS_WINDOWS,
@ -24,10 +25,10 @@ jest.mock('@actions/core');

 describe('validatePythonVersionFormatForPyPy', () => {
  it.each([
-    ['3.6', true],
-    ['3.7', true],
-    ['3.6.x', false],
-    ['3.7.x', false],
+    ['3.12', true],
+    ['3.13', true],
+    ['3.12.x', false],
+    ['3.13.x', false],
    ['3.x', false],
    ['3', false]
  ])('%s -> %s', (input, expected) => {
@ -95,24 +96,52 @@ const tempDir = path.join(
 );

 describe('Version from file test', () => {
-  it.each([getVersionInputFromPlainFile, getVersionInputFromFile])(
+  it.each([getVersionsInputFromPlainFile, getVersionInputFromFile])(
    'Version from plain file test',
    async _fn => {
      await io.mkdirP(tempDir);
      const pythonVersionFileName = 'python-version.file';
      const pythonVersionFilePath = path.join(tempDir, pythonVersionFileName);
-      const pythonVersionFileContent = '3.7';
+      const pythonVersionFileContent = '3.13';
      fs.writeFileSync(pythonVersionFilePath, pythonVersionFileContent);
      expect(_fn(pythonVersionFilePath)).toEqual([pythonVersionFileContent]);
    }
  );
+  it.each([getVersionsInputFromPlainFile, getVersionInputFromFile])(
+    'Versions from multiline plain file test',
+    async _fn => {
+      await io.mkdirP(tempDir);
+      const pythonVersionFileName = 'python-version.file';
+      const pythonVersionFilePath = path.join(tempDir, pythonVersionFileName);
+      const pythonVersionFileContent = '3.13\r\n3.12';
+      fs.writeFileSync(pythonVersionFilePath, pythonVersionFileContent);
+      expect(_fn(pythonVersionFilePath)).toEqual(['3.13', '3.12']);
+    }
+  );
+  it.each([getVersionsInputFromPlainFile, getVersionInputFromFile])(
+    'Version from complex plain file test',
+    async _fn => {
+      await io.mkdirP(tempDir);
+      const pythonVersionFileName = 'python-version.file';
+      const pythonVersionFilePath = path.join(tempDir, pythonVersionFileName);
+      const pythonVersionFileContent =
+        '3.13/envs/virtualenv\r# 3.12\n3.11\r\n3.10\r\n 3.9 \r\n';
+      fs.writeFileSync(pythonVersionFilePath, pythonVersionFileContent);
+      expect(_fn(pythonVersionFilePath)).toEqual([
+        '3.13',
+        '3.11',
+        '3.10',
+        '3.9'
+      ]);
+    }
+  );
  it.each([getVersionInputFromTomlFile, getVersionInputFromFile])(
    'Version from standard pyproject.toml test',
    async _fn => {
      await io.mkdirP(tempDir);
      const pythonVersionFileName = 'pyproject.toml';
      const pythonVersionFilePath = path.join(tempDir, pythonVersionFileName);
-      const pythonVersion = '>=3.7.0';
+      const pythonVersion = '>=3.13.0';
      const pythonVersionFileContent = `[project]\nrequires-python = "${pythonVersion}"`;
      fs.writeFileSync(pythonVersionFilePath, pythonVersionFileContent);
      expect(_fn(pythonVersionFilePath)).toEqual([pythonVersion]);
@ -124,7 +153,7 @@ describe('Version from file test', () => {
      await io.mkdirP(tempDir);
      const pythonVersionFileName = 'pyproject.toml';
      const pythonVersionFilePath = path.join(tempDir, pythonVersionFileName);
-      const pythonVersion = '>=3.7.0';
+      const pythonVersion = '>=3.13.0';
      const pythonVersionFileContent = `[tool.poetry.dependencies]\npython = "${pythonVersion}"`;
      fs.writeFileSync(pythonVersionFilePath, pythonVersionFileContent);
      expect(_fn(pythonVersionFilePath)).toEqual([pythonVersion]);
@ -145,9 +174,9 @@ describe('Version from file test', () => {
    async _fn => {
      const toolVersionFileName = '.tool-versions';
      const toolVersionFilePath = path.join(tempDir, toolVersionFileName);
-      const toolVersionContent = 'python 3.9.10\nnodejs 16';
+      const toolVersionContent = 'python 3.13.2\nnodejs 16';
      fs.writeFileSync(toolVersionFilePath, toolVersionContent);
-      expect(_fn(toolVersionFilePath)).toEqual(['3.9.10']);
+      expect(_fn(toolVersionFilePath)).toEqual(['3.13.2']);
    }
  );

@ -156,9 +185,9 @@ describe('Version from file test', () => {
    async _fn => {
      const toolVersionFileName = '.tool-versions';
      const toolVersionFilePath = path.join(tempDir, toolVersionFileName);
-      const toolVersionContent = '# python 3.8\npython 3.9';
+      const toolVersionContent = '# python 3.13\npython 3.12';
      fs.writeFileSync(toolVersionFilePath, toolVersionContent);
-      expect(_fn(toolVersionFilePath)).toEqual(['3.9']);
+      expect(_fn(toolVersionFilePath)).toEqual(['3.12']);
    }
  );

@ -167,9 +196,9 @@ describe('Version from file test', () => {
    async _fn => {
      const toolVersionFileName = '.tool-versions';
      const toolVersionFilePath = path.join(tempDir, toolVersionFileName);
-      const toolVersionContent = '  python   3.10  ';
+      const toolVersionContent = '  python   3.13  ';
      fs.writeFileSync(toolVersionFilePath, toolVersionContent);
-      expect(_fn(toolVersionFilePath)).toEqual(['3.10']);
+      expect(_fn(toolVersionFilePath)).toEqual(['3.13']);
    }
  );

@ -178,9 +207,9 @@ describe('Version from file test', () => {
    async _fn => {
      const toolVersionFileName = '.tool-versions';
      const toolVersionFilePath = path.join(tempDir, toolVersionFileName);
-      const toolVersionContent = 'python v3.9.10';
+      const toolVersionContent = 'python v3.13.2';
      fs.writeFileSync(toolVersionFilePath, toolVersionContent);
-      expect(_fn(toolVersionFilePath)).toEqual(['3.9.10']);
+      expect(_fn(toolVersionFilePath)).toEqual(['3.13.2']);
    }
  );

@ -189,9 +218,9 @@ describe('Version from file test', () => {
    async _fn => {
      const toolVersionFileName = '.tool-versions';
      const toolVersionFilePath = path.join(tempDir, toolVersionFileName);
-      const toolVersionContent = 'python pypy3.10-7.3.14';
+      const toolVersionContent = 'python pypy3.10-7.3.19';
      fs.writeFileSync(toolVersionFilePath, toolVersionContent);
-      expect(_fn(toolVersionFilePath)).toEqual(['pypy3.10-7.3.14']);
+      expect(_fn(toolVersionFilePath)).toEqual(['pypy3.10-7.3.19']);
    }
  );

@ -216,6 +245,44 @@ describe('Version from file test', () => {
      expect(_fn(toolVersionFilePath)).toEqual(['3.14t-dev']);
    }
  );
+
+  it.each([getVersionInputFromPipfileFile, getVersionInputFromFile])(
+    'Version from python_version in Pipfile',
+    async _fn => {
+      await io.mkdirP(tempDir);
+      const pythonVersionFileName = 'Pipfile';
+      const pythonVersionFilePath = path.join(tempDir, pythonVersionFileName);
+      const pythonVersion = '3.13';
+      const pythonVersionFileContent = `[requires]\npython_version = "${pythonVersion}"`;
+      fs.writeFileSync(pythonVersionFilePath, pythonVersionFileContent);
+      expect(_fn(pythonVersionFilePath)).toEqual([pythonVersion]);
+    }
+  );
+
+  it.each([getVersionInputFromPipfileFile, getVersionInputFromFile])(
+    'Version from python_full_version in Pipfile',
+    async _fn => {
+      await io.mkdirP(tempDir);
+      const pythonVersionFileName = 'Pipfile';
+      const pythonVersionFilePath = path.join(tempDir, pythonVersionFileName);
+      const pythonVersion = '3.13.0';
+      const pythonVersionFileContent = `[requires]\npython_full_version = "${pythonVersion}"`;
+      fs.writeFileSync(pythonVersionFilePath, pythonVersionFileContent);
+      expect(_fn(pythonVersionFilePath)).toEqual([pythonVersion]);
+    }
+  );
+
+  it.each([getVersionInputFromPipfileFile, getVersionInputFromFile])(
+    'Pipfile undefined version',
+    async _fn => {
+      await io.mkdirP(tempDir);
+      const pythonVersionFileName = 'Pipfile';
+      const pythonVersionFilePath = path.join(tempDir, pythonVersionFileName);
+      const pythonVersionFileContent = ``;
+      fs.writeFileSync(pythonVersionFilePath, pythonVersionFileContent);
+      expect(_fn(pythonVersionFilePath)).toEqual([]);
+    }
+  );
 });

 describe('getNextPageUrl', () => {
--- a/action.yml
+++ b/action.yml
@ -29,6 +29,8 @@ inputs:
  freethreaded:
    description: "When 'true', use the freethreaded version of Python."
    default: false
+  pip-version:
+    description: "Used to specify the version of pip to install with the Python. Supported format: major[.minor][.patch]."
 outputs:
  python-version:
    description: "The installed Python or PyPy version. Useful when given a version range as input."
--- a/dist/cache-save/index.js
+++ b/dist/cache-save/index.js
--- a/dist/setup/index.js
+++ b/dist/setup/index.js
--- a/docs/advanced-usage.md
+++ b/docs/advanced-usage.md
@ -22,6 +22,7 @@
    - [macOS](advanced-usage.md#macos)
 - [Using `setup-python` on GHES](advanced-usage.md#using-setup-python-on-ghes)
 - [Allow pre-releases](advanced-usage.md#allow-pre-releases)
+- [Using the pip-version input](advanced-usage.md#using-the-pip-version-input)

 ## Using the `python-version` input

@ -309,6 +310,15 @@ steps:
 - run: python my_script.py
 ```

+```yaml
+steps:
+- uses: actions/checkout@v4
+- uses: actions/setup-python@v5
+  with:
+    python-version-file: 'Pipfile' # Read python version from a file Pipfile
+- run: python my_script.py
+```
+
 ## Check latest version

 The `check-latest` flag defaults to `false`. Use the default or set `check-latest` to `false` if you prefer stability and if you want to ensure a specific `Python or PyPy` version is always used.
@ -411,7 +421,7 @@ steps:
 - run: pip install -e .
  # Or pip install -e '.[test]' to install test dependencies
 ```
-
+Note: cache-dependency-path supports files located outside the workspace root by copying them into the workspace to enable proper caching.
 # Outputs and environment variables

 ## Outputs
@ -643,3 +653,22 @@ jobs:
      - run: pipx run nox --error-on-missing-interpreters -s tests-${{ matrix.python_version }}
 ```

+## Using the pip-version input
+
+The `pip-version` input allows you to specify the desired version of **Pip** to use with the standard Python version.
+The version of Pip should be specified in the format `major`, `major.minor`, or `major.minor.patch` (for example: 25, 25.1, or 25.0.1).
+
+```yaml
+      steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+          pip-version: '25.0.1'
+      - name: Display Pip version
+        run: pip --version
+```
+> The `pip-version` input is supported only with standard Python versions. It is not available when using PyPy or GraalPy.
+
+> Using a specific or outdated version of pip may result in compatibility or security issues and can cause job failures. For best practices and guidance, refer to the official [pip documentation](https://pip.pypa.io/en/stable/).
--- a/package-lock.json
+++ b/package-lock.json
@ -15,14 +15,14 @@
        "@actions/glob": "^0.5.0",
        "@actions/http-client": "^2.2.3",
        "@actions/io": "^1.0.2",
-        "@actions/tool-cache": "^2.0.1",
+        "@actions/tool-cache": "^2.0.2",
        "@iarna/toml": "^3.0.0",
-        "semver": "^7.6.0"
+        "semver": "^7.7.1"
      },
      "devDependencies": {
        "@types/jest": "^29.5.12",
        "@types/node": "^20.11.25",
-        "@types/semver": "^7.5.8",
+        "@types/semver": "^7.7.0",
        "@typescript-eslint/eslint-plugin": "^5.54.0",
        "@typescript-eslint/parser": "^5.54.0",
        "@vercel/ncc": "^0.38.3",
@ -32,8 +32,8 @@
        "eslint-plugin-node": "^11.1.0",
        "jest": "^29.7.0",
        "jest-circus": "^29.7.0",
-        "prettier": "^2.8.4",
-        "ts-jest": "^29.1.2",
+        "prettier": "^3.5.3",
+        "ts-jest": "^29.3.2",
        "typescript": "^5.4.2"
      }
    },
@ -123,16 +123,16 @@
      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
    },
    "node_modules/@actions/tool-cache": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/tool-cache/-/tool-cache-2.0.1.tgz",
-      "integrity": "sha512-iPU+mNwrbA8jodY8eyo/0S/QqCKDajiR8OxWTnSk/SnYg0sj8Hp4QcUEVC1YFpHWXtrfbQrE13Jz4k4HXJQKcA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/tool-cache/-/tool-cache-2.0.2.tgz",
+      "integrity": "sha512-fBhNNOWxuoLxztQebpOaWu6WeVmuwa77Z+DxIZ1B+OYvGkGQon6kTVg6Z32Cb13WCuw0szqonK+hh03mJV7Z6w==",
+      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^1.2.6",
+        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.0.0",
        "@actions/http-client": "^2.0.1",
        "@actions/io": "^1.1.1",
-        "semver": "^6.1.0",
-        "uuid": "^3.3.2"
+        "semver": "^6.1.0"
      }
    },
    "node_modules/@actions/tool-cache/node_modules/semver": {
@ -205,12 +205,15 @@
      }
    },
    "node_modules/@azure/core-http/node_modules/form-data": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz",
-      "integrity": "sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
+      "license": "MIT",
      "dependencies": {
        "asynckit": "^0.4.0",
        "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
+        "hasown": "^2.0.2",
        "mime-types": "^2.1.12"
      },
      "engines": {
@ -1607,12 +1610,15 @@
      }
    },
    "node_modules/@types/node-fetch/node_modules/form-data": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz",
-      "integrity": "sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
+      "license": "MIT",
      "dependencies": {
        "asynckit": "^0.4.0",
        "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
+        "hasown": "^2.0.2",
        "mime-types": "^2.1.12"
      },
      "engines": {
@ -1620,10 +1626,11 @@
      }
    },
    "node_modules/@types/semver": {
-      "version": "7.5.8",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.5.8.tgz",
-      "integrity": "sha512-I8EUhyrgfLrcTkzV3TSsGyl1tSuPrEDzr0yd5m90UgNxQkyDXULk3b6MlQqTCpZpNtWe1K0hzclnZkTcLBe2UQ==",
-      "dev": true
+      "version": "7.7.0",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.0.tgz",
+      "integrity": "sha512-k107IF4+Xr7UHjwDc7Cfd6PRQfbdkiRabXGRjo07b4WyPahFBZCZ1sE+BNxYIJPPg73UkfOsVOLwqVc/6ETrIA==",
+      "dev": true,
+      "license": "MIT"
    },
    "node_modules/@types/stack-utils": {
      "version": "2.0.3",
@ -1985,6 +1992,13 @@
        "node": ">=8"
      }
    },
+    "node_modules/async": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
+      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/asynckit": {
      "version": "0.4.0",
      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
@ -2112,9 +2126,10 @@
      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
    },
    "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "license": "MIT",
      "dependencies": {
        "balanced-match": "^1.0.0",
        "concat-map": "0.0.1"
@ -2191,6 +2206,19 @@
      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
      "dev": true
    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/callsites": {
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
@ -2476,6 +2504,36 @@
        "node": ">=6.0.0"
      }
    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ejs": {
+      "version": "3.1.10",
+      "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.10.tgz",
+      "integrity": "sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "jake": "^10.8.5"
+      },
+      "bin": {
+        "ejs": "bin/cli.js"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
    "node_modules/electron-to-chromium": {
      "version": "1.4.587",
      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.587.tgz",
@ -2509,6 +2567,51 @@
        "is-arrayish": "^0.2.1"
      }
    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-set-tostringtag": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
+      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6",
+        "has-tostringtag": "^1.0.2",
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/escalade": {
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
@ -2974,6 +3077,39 @@
        "node": "^10.12.0 || >=12.0.0"
      }
    },
+    "node_modules/filelist": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.4.tgz",
+      "integrity": "sha512-w1cEuf3S+DrLCQL7ET6kz+gmlJdbq9J7yXCSjK/OZCPA+qEN1WyF4ZAf0YYJa4/shHJra2t/d/r8SV4Ji+x+8Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "minimatch": "^5.0.1"
+      }
+    },
+    "node_modules/filelist/node_modules/brace-expansion": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/filelist/node_modules/minimatch": {
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
+      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
    "node_modules/fill-range": {
      "version": "7.1.1",
      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@ -3023,13 +3159,17 @@
      "dev": true
    },
    "node_modules/form-data": {
-      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.1.tgz",
-      "integrity": "sha512-m21N3WOmEEURgk6B9GLOE4RuWOFf28Lhh9qGYeNlGq4VDXUlJy2th2slBNU8Gp8EzloYZOibZJ7t5ecIrFSjVA==",
+      "version": "2.5.5",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.5.tgz",
+      "integrity": "sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A==",
+      "license": "MIT",
      "dependencies": {
        "asynckit": "^0.4.0",
-        "combined-stream": "^1.0.6",
-        "mime-types": "^2.1.12"
+        "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
+        "hasown": "^2.0.2",
+        "mime-types": "^2.1.35",
+        "safe-buffer": "^5.2.1"
      },
      "engines": {
        "node": ">= 0.12"
@ -3059,7 +3199,6 @@
      "version": "1.1.2",
      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-      "dev": true,
      "funding": {
        "url": "https://github.com/sponsors/ljharb"
      }
@ -3082,6 +3221,30 @@
        "node": "6.* || 8.* || >= 10.*"
      }
    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
    "node_modules/get-package-type": {
      "version": "0.1.0",
      "resolved": "https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz",
@ -3091,6 +3254,19 @@
        "node": ">=8.0.0"
      }
    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/get-stream": {
      "version": "6.0.1",
      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
@ -3170,6 +3346,18 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
    "node_modules/graceful-fs": {
      "version": "4.2.11",
      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
@ -3191,11 +3379,38 @@
        "node": ">=8"
      }
    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-tostringtag": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
+      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
+      "license": "MIT",
+      "dependencies": {
+        "has-symbols": "^1.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
    "node_modules/hasown": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.0.tgz",
-      "integrity": "sha512-vUptKVTpIJhcczKBbgnS+RtcuYMB8+oNzPK2/Hp3hanz8JmpATdmmgLgSaadVREkDm+e2giHwY3ZRkyjSIDDFA==",
-      "dev": true,
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "license": "MIT",
      "dependencies": {
        "function-bind": "^1.1.2"
      },
@ -3446,6 +3661,25 @@
        "node": ">=8"
      }
    },
+    "node_modules/jake": {
+      "version": "10.9.2",
+      "resolved": "https://registry.npmjs.org/jake/-/jake-10.9.2.tgz",
+      "integrity": "sha512-2P4SQ0HrLQ+fw6llpLnOaGAvN2Zu6778SJMrCUwns4fOoG9ayrTiZk3VV8sCPkVZF8ab0zksVpS8FDY5pRCNBA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "async": "^3.2.3",
+        "chalk": "^4.0.2",
+        "filelist": "^1.0.4",
+        "minimatch": "^3.1.2"
+      },
+      "bin": {
+        "jake": "bin/cli.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
    "node_modules/jest": {
      "version": "29.7.0",
      "resolved": "https://registry.npmjs.org/jest/-/jest-29.7.0.tgz",
@ -4179,6 +4413,15 @@
        "tmpl": "1.0.5"
      }
    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
    "node_modules/merge-stream": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
@ -4569,15 +4812,16 @@
      }
    },
    "node_modules/prettier": {
-      "version": "2.8.8",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.8.8.tgz",
-      "integrity": "sha512-tdN8qQGvNjw4CHbY+XXk0JgCXn9QiF21a55rBe5LJAU+kDyC4WQn4+awm2Xfk2lQMk5fKup9XgzTZtGkjBdP9Q==",
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.5.3.tgz",
+      "integrity": "sha512-QQtaxnoDJeAkDvDKWCLiwIXkTgRhwYDEQCghU9Z6q03iyek/rxRh/2lC3HB7P8sWT2xC/y5JDctPLBIGzHKbhw==",
      "dev": true,
+      "license": "MIT",
      "bin": {
-        "prettier": "bin-prettier.js"
+        "prettier": "bin/prettier.cjs"
      },
      "engines": {
-        "node": ">=10.13.0"
+        "node": ">=14"
      },
      "funding": {
        "url": "https://github.com/prettier/prettier?sponsor=1"
@ -4806,18 +5050,36 @@
        "queue-microtask": "^1.2.2"
      }
    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
    "node_modules/sax": {
      "version": "1.3.0",
      "resolved": "https://registry.npmjs.org/sax/-/sax-1.3.0.tgz",
      "integrity": "sha512-0s+oAmw9zLl1V1cS9BtZN7JAd0cW5e0QH4W3LWEK6a4LaLEA2OTpGYWDY+6XasBLtz6wkm3u1xRw95mRuJ59WA=="
    },
    "node_modules/semver": {
-      "version": "7.6.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.0.tgz",
-      "integrity": "sha512-EnwXhrlwXMk9gKu5/flx5sv/an57AkRplG3hTK68W7FRDN+k+OWBj65M7719OkA82XLBxrcX0KSHj+X5COhOVg==",
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
+      "version": "7.7.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz",
+      "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==",
+      "license": "ISC",
      "bin": {
        "semver": "bin/semver.js"
      },
@ -4825,22 +5087,6 @@
        "node": ">=10"
      }
    },
-    "node_modules/semver/node_modules/lru-cache": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
-      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/semver/node_modules/yallist": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
-    },
    "node_modules/shebang-command": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
@ -5066,28 +5312,32 @@
      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="
    },
    "node_modules/ts-jest": {
-      "version": "29.1.2",
-      "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.1.2.tgz",
-      "integrity": "sha512-br6GJoH/WUX4pu7FbZXuWGKGNDuU7b8Uj77g/Sp7puZV6EXzuByl6JrECvm0MzVzSTkSHWTihsXt+5XYER5b+g==",
+      "version": "29.3.2",
+      "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.3.2.tgz",
+      "integrity": "sha512-bJJkrWc6PjFVz5g2DGCNUo8z7oFEYaz1xP1NpeDU7KNLMWPpEyV8Chbpkn8xjzgRDpQhnGMyvyldoL7h8JXyug==",
      "dev": true,
+      "license": "MIT",
      "dependencies": {
-        "bs-logger": "0.x",
-        "fast-json-stable-stringify": "2.x",
+        "bs-logger": "^0.2.6",
+        "ejs": "^3.1.10",
+        "fast-json-stable-stringify": "^2.1.0",
        "jest-util": "^29.0.0",
        "json5": "^2.2.3",
-        "lodash.memoize": "4.x",
-        "make-error": "1.x",
-        "semver": "^7.5.3",
-        "yargs-parser": "^21.0.1"
+        "lodash.memoize": "^4.1.2",
+        "make-error": "^1.3.6",
+        "semver": "^7.7.1",
+        "type-fest": "^4.39.1",
+        "yargs-parser": "^21.1.1"
      },
      "bin": {
        "ts-jest": "cli.js"
      },
      "engines": {
-        "node": "^16.10.0 || ^18.0.0 || >=20.0.0"
+        "node": "^14.15.0 || ^16.10.0 || ^18.0.0 || >=20.0.0"
      },
      "peerDependencies": {
        "@babel/core": ">=7.0.0-beta.0 <8",
+        "@jest/transform": "^29.0.0",
        "@jest/types": "^29.0.0",
        "babel-jest": "^29.0.0",
        "jest": "^29.0.0",
@ -5097,6 +5347,9 @@
        "@babel/core": {
          "optional": true
        },
+        "@jest/transform": {
+          "optional": true
+        },
        "@jest/types": {
          "optional": true
        },
@ -5108,6 +5361,19 @@
        }
      }
    },
+    "node_modules/ts-jest/node_modules/type-fest": {
+      "version": "4.40.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.40.0.tgz",
+      "integrity": "sha512-ABHZ2/tS2JkvH1PEjxFDTUWC8dB5OsIGZP4IFLhR293GqT5Y5qB1WwL2kMPYhQW9DVgVD8Hd7I8gjwPIf5GFkw==",
+      "dev": true,
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
    "node_modules/tslib": {
      "version": "2.6.2",
      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.6.2.tgz",
@ -5189,9 +5455,9 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.28.5",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.5.tgz",
-      "integrity": "sha512-zICwjrDrcrUE0pyyJc1I2QzBkLM8FINsgOrt6WjA+BgajVq9Nxu2PbFFXUrAggLfDXlZGZBVZYw7WNV5KiBiBA==",
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
      "license": "MIT",
      "dependencies": {
        "@fastify/busboy": "^2.0.0"
@ -5244,15 +5510,6 @@
        "punycode": "^2.1.0"
      }
    },
-    "node_modules/uuid": {
-      "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
-      "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==",
-      "deprecated": "Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.",
-      "bin": {
-        "uuid": "bin/uuid"
-      }
-    },
    "node_modules/v8-to-istanbul": {
      "version": "9.1.3",
      "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.1.3.tgz",
--- a/package.json
+++ b/package.json
@ -31,14 +31,14 @@
    "@actions/glob": "^0.5.0",
    "@actions/http-client": "^2.2.3",
    "@actions/io": "^1.0.2",
-    "@actions/tool-cache": "^2.0.1",
+    "@actions/tool-cache": "^2.0.2",
    "@iarna/toml": "^3.0.0",
-    "semver": "^7.6.0"
+    "semver": "^7.7.1"
  },
  "devDependencies": {
    "@types/jest": "^29.5.12",
    "@types/node": "^20.11.25",
-    "@types/semver": "^7.5.8",
+    "@types/semver": "^7.7.0",
    "@typescript-eslint/eslint-plugin": "^5.54.0",
    "@typescript-eslint/parser": "^5.54.0",
    "@vercel/ncc": "^0.38.3",
@ -48,8 +48,8 @@
    "eslint-plugin-node": "^11.1.0",
    "jest": "^29.7.0",
    "jest-circus": "^29.7.0",
-    "prettier": "^2.8.4",
-    "ts-jest": "^29.1.2",
+    "prettier": "^3.5.3",
+    "ts-jest": "^29.3.2",
    "typescript": "^5.4.2"
  }
 }
--- a/src/find-pypy.ts
+++ b/src/find-pypy.ts
@ -96,7 +96,10 @@ export async function findPyPyVersion(
    core.addPath(pythonLocation);
    core.addPath(_binDir);
  }
-  core.setOutput('python-version', 'pypy' + resolvedPyPyVersion);
+  core.setOutput(
+    'python-version',
+    `pypy${resolvedPythonVersion}-${resolvedPyPyVersion}`
+  );
  core.setOutput('python-path', pythonPath);

  return {resolvedPyPyVersion, resolvedPythonVersion};
--- a/src/find-python.ts
+++ b/src/find-python.ts
@ -8,6 +8,7 @@ import * as installer from './install-python';

 import * as core from '@actions/core';
 import * as tc from '@actions/tool-cache';
+import * as exec from '@actions/exec';

 // Python has "scripts" or "bin" directories where command-line tools that come with packages are installed.
 // This is where pip is, along with anything that pip installs.
@ -30,6 +31,27 @@ function binDir(installDir: string): string {
  }
 }

+async function installPip(pythonLocation: string) {
+  const pipVersion = core.getInput('pip-version');
+
+  // Validate pip-version format: major[.minor][.patch]
+  const versionRegex = /^\d+(\.\d+)?(\.\d+)?$/;
+  if (pipVersion && !versionRegex.test(pipVersion)) {
+    throw new Error(
+      `Invalid pip-version "${pipVersion}". Please specify a version in the format major[.minor][.patch].`
+    );
+  }
+
+  if (pipVersion) {
+    core.info(
+      `pip-version input is specified. Installing pip version ${pipVersion}`
+    );
+    await exec.exec(
+      `${pythonLocation}/python -m pip install --upgrade pip==${pipVersion} --disable-pip-version-check --no-warn-script-location`
+    );
+  }
+}
+
 export async function useCpythonVersion(
  version: string,
  architecture: string,
@ -49,8 +71,8 @@ export async function useCpythonVersion(
    // Use the freethreaded version if it was specified in the input, e.g., 3.13t
    freethreaded = true;
  }
-  core.debug(`Semantic version spec of ${version} is ${semanticVersionSpec}`);

+  core.debug(`Semantic version spec of ${version} is ${semanticVersionSpec}`);
  if (freethreaded) {
    // Free threaded versions use an architecture suffix like `x64-freethreaded`
    core.debug(`Using freethreaded version of ${semanticVersionSpec}`);
@ -154,15 +176,36 @@ export async function useCpythonVersion(
    if (IS_WINDOWS) {
      // Add --user directory
      // `installDir` from tool cache should look like $RUNNER_TOOL_CACHE/Python/<semantic version>/x64/
-      // So if `findLocalTool` succeeded above, we must have a conformant `installDir`
+      // Extract version details
      const version = path.basename(path.dirname(installDir));
      const major = semver.major(version);
      const minor = semver.minor(version);

+      const basePath = process.env['APPDATA'] || '';
+      let versionSuffix = `${major}${minor}`;
+      // Append '-32' for x86 architecture if Python version is >= 3.10
+      if (
+        architecture === 'x86' &&
+        (major > 3 || (major === 3 && minor >= 10))
+      ) {
+        versionSuffix += '-32';
+      } else if (architecture === 'arm64') {
+        versionSuffix += '-arm64';
+      }
+      // Append 't' for freethreaded builds
+      if (freethreaded) {
+        versionSuffix += 't';
+        if (architecture === 'x86-freethreaded') {
+          versionSuffix += '-32';
+        } else if (architecture === 'arm64-freethreaded') {
+          versionSuffix += '-arm64';
+        }
+      }
+      // Add user Scripts path
      const userScriptsDir = path.join(
-        process.env['APPDATA'] || '',
+        basePath,
        'Python',
-        `Python${major}${minor}`,
+        `Python${versionSuffix}`,
        'Scripts'
      );
      core.addPath(userScriptsDir);
@ -179,6 +222,9 @@ export async function useCpythonVersion(
  core.setOutput('python-version', pythonVersion);
  core.setOutput('python-path', pythonPath);

+  const binaryPath = IS_WINDOWS ? installDir : _binDir;
+  await installPip(binaryPath);
+
  return {impl: 'CPython', version: pythonVersion};
 }

--- a/src/install-python.ts
+++ b/src/install-python.ts
@ -5,6 +5,7 @@ import * as exec from '@actions/exec';
 import * as httpm from '@actions/http-client';
 import {ExecOptions} from '@actions/exec/lib/interfaces';
 import {IS_WINDOWS, IS_LINUX, getDownloadFileName} from './utils';
+import {IToolRelease} from '@actions/tool-cache';

 const TOKEN = core.getInput('token');
 const AUTH = !TOKEN ? undefined : `token ${TOKEN}`;
@ -31,14 +32,41 @@ export async function findReleaseFromManifest(

  return foundRelease;
 }
-
+function isIToolRelease(obj: any): obj is IToolRelease {
+  return (
+    typeof obj === 'object' &&
+    obj !== null &&
+    typeof obj.version === 'string' &&
+    typeof obj.stable === 'boolean' &&
+    Array.isArray(obj.files) &&
+    obj.files.every(
+      (file: any) =>
+        typeof file.filename === 'string' &&
+        typeof file.platform === 'string' &&
+        typeof file.arch === 'string' &&
+        typeof file.download_url === 'string'
+    )
+  );
+}
 export async function getManifest(): Promise<tc.IToolRelease[]> {
  try {
-    return await getManifestFromRepo();
+    const repoManifest = await getManifestFromRepo();
+    if (
+      Array.isArray(repoManifest) &&
+      repoManifest.length &&
+      repoManifest.every(isIToolRelease)
+    ) {
+      return repoManifest;
+    }
+    throw new Error(
+      'The repository manifest is invalid or does not include any valid tool release (IToolRelease) entries.'
+    );
  } catch (err) {
    core.debug('Fetching the manifest via the API failed.');
    if (err instanceof Error) {
      core.debug(err.message);
+    } else {
+      core.error('An unexpected error occurred while fetching the manifest.');
    }
  }
  return await getManifestFromURL();
@ -93,6 +121,9 @@ async function installPython(workingDirectory: string) {
 }

 export async function installCpythonFromRelease(release: tc.IToolRelease) {
+  if (!release.files || release.files.length === 0) {
+    throw new Error('No files found in the release to download.');
+  }
  const downloadUrl = release.files[0].download_url;

  core.info(`Download from "${downloadUrl}"`);
@ -113,9 +144,13 @@ export async function installCpythonFromRelease(release: tc.IToolRelease) {
  } catch (err) {
    if (err instanceof tc.HTTPError) {
      // Rate limit?
-      if (err.httpStatusCode === 403 || err.httpStatusCode === 429) {
+      if (err.httpStatusCode === 403) {
+        core.error(
+          `Received HTTP status code 403. This indicates a permission issue or restricted access.`
+        );
+      } else if (err.httpStatusCode === 429) {
        core.info(
-          `Received HTTP status code ${err.httpStatusCode}.  This usually indicates the rate limit has been exceeded`
+          `Received HTTP status code 429.  This usually indicates the rate limit has been exceeded`
        );
      } else {
        core.info(err.message);
--- a/src/setup-python.ts
+++ b/src/setup-python.ts
@ -11,7 +11,7 @@ import {
  logWarning,
  IS_MAC,
  getVersionInputFromFile,
-  getVersionInputFromPlainFile
+  getVersionsInputFromPlainFile
 } from './utils';

 function isPyPyVersion(versionSpec: string) {
@ -22,20 +22,69 @@ function isGraalPyVersion(versionSpec: string) {
  return versionSpec.startsWith('graalpy');
 }

-async function cacheDependencies(cache: string, pythonVersion: string) {
+export async function cacheDependencies(cache: string, pythonVersion: string) {
  const cacheDependencyPath =
    core.getInput('cache-dependency-path') || undefined;
+  let resolvedDependencyPath: string | undefined = undefined;
+
+  if (cacheDependencyPath) {
+    const actionPath = process.env.GITHUB_ACTION_PATH || '';
+    const workspace = process.env.GITHUB_WORKSPACE || process.cwd();
+
+    const sourcePath = path.resolve(actionPath, cacheDependencyPath);
+    const relativePath = path.relative(actionPath, sourcePath);
+    const targetPath = path.resolve(workspace, relativePath);
+
+    try {
+      const sourceExists = await fs.promises
+        .access(sourcePath, fs.constants.F_OK)
+        .then(() => true)
+        .catch(() => false);
+
+      if (!sourceExists) {
+        core.warning(
+          `The resolved cache-dependency-path does not exist: ${sourcePath}`
+        );
+      } else {
+        if (sourcePath !== targetPath) {
+          const targetDir = path.dirname(targetPath);
+          // Create target directory if it doesn't exist
+          await fs.promises.mkdir(targetDir, {recursive: true});
+          // Copy file asynchronously
+          await fs.promises.copyFile(sourcePath, targetPath);
+          core.info(`Copied ${sourcePath} to ${targetPath}`);
+        } else {
+          core.info(
+            `Dependency file is already inside the workspace: ${sourcePath}`
+          );
+        }
+
+        resolvedDependencyPath = path
+          .relative(workspace, targetPath)
+          .replace(/\\/g, '/');
+        core.info(`Resolved cache-dependency-path: ${resolvedDependencyPath}`);
+      }
+    } catch (error) {
+      core.warning(
+        `Failed to copy file from ${sourcePath} to ${targetPath}: ${error}`
+      );
+    }
+  }
+
+  // Pass resolvedDependencyPath if available, else fallback to original input
+  const dependencyPathForCache = resolvedDependencyPath ?? cacheDependencyPath;
+
  const cacheDistributor = getCacheDistributor(
    cache,
    pythonVersion,
-    cacheDependencyPath
+    dependencyPathForCache
  );
  await cacheDistributor.restoreCache();
 }

 function resolveVersionInputFromDefaultFile(): string[] {
  const couples: [string, (versionFile: string) => string[]][] = [
-    ['.python-version', getVersionInputFromPlainFile]
+    ['.python-version', getVersionsInputFromPlainFile]
  ];
  for (const [versionFile, _fn] of couples) {
    logWarning(
--- a/src/utils.ts
+++ b/src/utils.ts
@ -228,7 +228,7 @@ function extractValue(obj: any, keys: string[]): string | undefined {
 * If none is present, returns an empty list.
 */
 export function getVersionInputFromTomlFile(versionFile: string): string[] {
-  core.debug(`Trying to resolve version form ${versionFile}`);
+  core.debug(`Trying to resolve version from ${versionFile}`);

  let pyprojectFile = fs.readFileSync(versionFile, 'utf8');
  // Normalize the line endings in the pyprojectFile
@ -269,13 +269,28 @@ export function getVersionInputFromTomlFile(versionFile: string): string[] {
 }

 /**
- * Python version extracted from a plain text file.
+ * Python versions extracted from a plain text file.
+ * - Resolves multiple versions from multiple lines.
+ * - Handles pyenv-virtualenv pointers (e.g. `3.10/envs/virtualenv`).
+ * - Ignores empty lines and lines starting with `#`
+ * - Trims whitespace.
 */
-export function getVersionInputFromPlainFile(versionFile: string): string[] {
-  core.debug(`Trying to resolve version form ${versionFile}`);
-  const version = fs.readFileSync(versionFile, 'utf8').trim();
-  core.info(`Resolved ${versionFile} as ${version}`);
-  return [version];
+export function getVersionsInputFromPlainFile(versionFile: string): string[] {
+  core.debug(`Trying to resolve versions from ${versionFile}`);
+  const content = fs.readFileSync(versionFile, 'utf8').trim();
+  const lines = content.split(/\r\n|\r|\n/);
+  const versions = lines
+    .map(line => {
+      if (line.startsWith('#') || line.trim() === '') {
+        return undefined;
+      }
+      let version: string = line.trim();
+      version = version.split('/')[0];
+      return version;
+    })
+    .filter(version => version !== undefined) as string[];
+  core.info(`Resolved ${versionFile} as ${versions.join(', ')}`);
+  return versions;
 }

 /**
@ -310,16 +325,56 @@ export function getVersionInputFromToolVersions(versionFile: string): string[] {
    return [];
  }
 }
+
 /**
- * Python version extracted from a plain, .tool-versions or TOML file.
+ * Python version extracted from the Pipfile file.
+ */
+export function getVersionInputFromPipfileFile(versionFile: string): string[] {
+  core.debug(`Trying to resolve version from ${versionFile}`);
+
+  if (!fs.existsSync(versionFile)) {
+    core.warning(`File ${versionFile} does not exist.`);
+    return [];
+  }
+  let pipfileFile = fs.readFileSync(versionFile, 'utf8');
+  // Normalize the line endings in the pipfileFile
+  pipfileFile = pipfileFile.replace(/\r\n/g, '\n');
+
+  const pipfileConfig = toml.parse(pipfileFile);
+  const keys = ['requires'];
+
+  if (!('requires' in pipfileConfig)) {
+    core.warning(`No Python version found in ${versionFile}`);
+    return [];
+  }
+  if ('python_full_version' in (pipfileConfig['requires'] as toml.JsonMap)) {
+    // specifies a full python version
+    keys.push('python_full_version');
+  } else {
+    keys.push('python_version');
+  }
+  const versions = [];
+  const version = extractValue(pipfileConfig, keys);
+  if (version !== undefined) {
+    versions.push(version);
+  }
+
+  core.info(`Extracted ${versions} from ${versionFile}`);
+  return versions;
+}
+
+/**
+ * Python version extracted from a plain, .tool-versions, Pipfile or TOML file.
 */
 export function getVersionInputFromFile(versionFile: string): string[] {
  if (versionFile.endsWith('.toml')) {
    return getVersionInputFromTomlFile(versionFile);
  } else if (versionFile.match('.tool-versions')) {
    return getVersionInputFromToolVersions(versionFile);
+  } else if (versionFile.match('Pipfile')) {
+    return getVersionInputFromPipfileFile(versionFile);
  } else {
-    return getVersionInputFromPlainFile(versionFile);
+    return getVersionsInputFromPlainFile(versionFile);
  }
 }
Author	SHA1	Message	Date
aparnajyothi-y	9322b3ca74	Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download (#1165 ) * fix #174 * npm audit fix	2025-08-04 14:25:53 -05:00
aparnajyothi-y	fbeb884f69	Bump form-data to fix critical vulnerabilities #182 & #183 (#1163 ) * fix dependabot alert#183 * command updates	2025-07-30 15:19:20 -05:00
dependabot[bot]	03bb6152f4	Bump idna from 2.9 to 3.7 in /__tests__/data (#843 ) Bumps [idna](https://github.com/kjd/idna) from 2.9 to 3.7. - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](https://github.com/kjd/idna/compare/v2.9...v3.7) --- updated-dependencies: - dependency-name: idna dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-07-29 12:04:01 -05:00
Aramís Segovia	36da51d563	Add version parsing from Pipfile (#1067 ) * feature: add version parsing from Pipfile * Update utils.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/utils.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/utils.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * chore: update dist/setup/index.js --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2025-07-24 17:40:39 -05:00
priya-kinthali	3c6f142cc0	update documentation (#1156 )	2025-07-23 13:32:04 -05:00
Marc Mueller	88ffd4d597	Include python version in PyPy python-version output (#1110 )	2025-07-21 14:01:05 -05:00
aparnajyothi-y	532b046aaf	Add Architecture-Specific PATH Management for Python with --user Flag on Windows (#1122 ) * logic to update install oath with --user flg * format update * format update * update * test job to validate --user flag installtion * updated the script * updated the yaml * update the inputs * updated script * update the correct script file name * updated script and yaml * npm run format-check * fix-test failures * path update * check failure fix * updated test * update free threaded version * updated the comments	2025-07-03 12:09:25 -05:00
aparnajyothi-y	1264885983	Enhance cache-dependency-path handling to support files outside the workspace root (#1128 ) * ehnace cache dependency path handling * logic update * npm run format-check * update cacheDependencies tests to cover resolved paths and copy edge cases * check failure fix * depricate-windows-2019 * refactored the code * Check failure fix	2025-06-24 23:40:44 -05:00
Priya Gupta	e9c40fbc2b	Add support for `pip-version` (#1129 ) * Add pip-version input * Update workflow files * Add documentation * Update workflow files	2025-06-19 22:09:35 -05:00
dependabot[bot]	5fa0ee6f38	Bump @actions/tool-cache from 2.0.1 to 2.0.2 (#1095 ) * Bump @actions/tool-cache from 2.0.1 to 2.0.2 Bumps [@actions/tool-cache](https://github.com/actions/toolkit/tree/HEAD/packages/tool-cache) from 2.0.1 to 2.0.2. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/tool-cache/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/tool-cache) --- updated-dependencies: - dependency-name: "@actions/tool-cache" dependency-version: 2.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Fix failures --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: HarithaVattikuti <73516759+HarithaVattikuti@users.noreply.github.com>	2025-06-18 17:01:16 -05:00
Kryštof Korb	5db1cf9a59	Enhance reading from .python-version (#787 ) * Enhance reading from .python-version * Fix typos * Fix lint * Add built files * Don't use EOL versions in `utils.test.ts` * Fix Prettier * Don't use unreleased versions in `utils.test.ts` * Update versions in `utils.test.ts` again	2025-05-21 16:19:28 -05:00
dependabot[bot]	a26af69be9	Bump ts-jest from 29.1.2 to 29.3.2 (#1081 ) Bumps [ts-jest](https://github.com/kulshekhar/ts-jest) from 29.1.2 to 29.3.2. - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/kulshekhar/ts-jest/compare/v29.1.2...v29.3.2) --- updated-dependencies: - dependency-name: ts-jest dependency-version: 29.3.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-23 21:42:27 -05:00
dependabot[bot]	30eafe9548	Bump prettier from 2.8.8 to 3.5.3 (#1046 ) * Bump prettier from 2.8.8 to 3.5.3 Bumps [prettier](https://github.com/prettier/prettier) from 2.8.8 to 3.5.3. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/2.8.8...3.5.3) --- updated-dependencies: - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Enable cancelled checks --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>	2025-04-22 11:07:10 -05:00
dependabot[bot]	5d95bc16d4	Bump semver and @types/semver (#1091 ) * Bump semver and @types/semver Bumps [semver](https://github.com/npm/node-semver) and [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver). These dependencies needed to be updated together. Updates `semver` from 7.6.0 to 7.7.1 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](https://github.com/npm/node-semver/compare/v7.6.0...v7.7.1) Updates `@types/semver` from 7.5.8 to 7.7.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver) --- updated-dependencies: - dependency-name: semver dependency-version: 7.7.1 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: "@types/semver" dependency-version: 7.7.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Fixed check failures --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: HarithaVattikuti <73516759+HarithaVattikuti@users.noreply.github.com>	2025-04-22 11:04:22 -05:00
aparnajyothi-y	6ed2c67c8a	Fix for Candidate Not Iterable Error (#1082 ) * candidates not iterable * update the error message * update error to debug * update debug to info * error message updates	2025-04-17 08:55:44 -05:00
aparnajyothi-y	e348410e00	Remove Ubuntu 20.04 from workflows due to deprecation from 2025-04-15 (#1065 ) * remove ubuntu-20.04 * check failure fix * remove spaces * npm run format-check	2025-04-11 13:36:23 -05:00