build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 - #563
build(deps): bump actions/setup-node from 6.4.0 to 7.0.0#563dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
Closing in favor of #594. This PR only updates
Merging this as-is would have left the bootstrap job on v7 while every job that matters stayed on v6.4.0 — the same sibling-reference-drift failure mode Separately, compared v7.0.0 against the parallel v6.5.0 release (published 5 minutes apart) before choosing either: v7.0.0's changelog (ESM migration, unused new outputs, a #594 bumps all three references to v6.5.0 instead, with the full comparison recorded there. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
…osite-action sibling gap (#594) Dependabot opened PR #563 proposing a major bump to actions/setup-node v7.0.0, but only updated ci.yml's one direct `uses:` reference. The repo has two more references Dependabot's github-actions ecosystem scanner structurally cannot see (it only scans .github/workflows/*.yml, not composite action definitions under .github/actions/): the shared .github/actions/setup/action.yml composite (used by the security and quality jobs -- the substantive CI work) and the disabled Cloudflare Pages deploy workflow. Merging #563 as-is would have left the small workflow-policy job's bootstrap on v7 while every other job's actual setup-node execution stayed on v6.4.0 -- exactly the sibling-reference drift class this repo's own DEPENDABOT-TRIAGE.md already documents an incident for with codeql-action, just via a different root cause (a Dependabot scanner blind spot rather than a missing group config). Compared v7.0.0 against the parallel v6.5.0 release (published five minutes apart, confirmed via the GitHub Releases API) before choosing either: v7.0.0's changelog is an ESM migration (invisible to a plain `uses:` consumer), new unused cache-key outputs, a mirrorToken fix for an input this repo never sets, and removal of a dummy NODE_AUTH_TOKEN export this repo never reads -- zero functional benefit here, for the review burden of a major bump. v6.5.0 backports the one change that does matter, @actions/cache 5.1.0 plus security overrides for undici and fast-xml-parser, onto the existing v6.x line with no other change. Bumped all three references (ci.yml, the composite action, and the disabled Cloudflare workflow, kept consistent for whenever it's re-enabled) to the verified v6.5.0 commit SHA. PR #563 closed in favor of this PR, with the full comparison recorded there.
1 participant
Bumps actions/setup-node from 6.4.0 to 7.0.0.
Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)