FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

chore(deps): bump actions/setup-node from 6 to 7 by dependabot[bot] · Pull Request #1018 · kosli-dev/cli · GitHub

/ cli Public

chore(deps): bump actions/setup-node from 6 to 7 - #1018

Merged
mbevc1 merged 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-7
Jul 14, 2026
ConversationCommits (1)ChecksFiles changed
Merged

chore(deps): bump actions/setup-node from 6 to 7#1018
mbevc1 merged 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-7

Conversation

dependabot Bot commented on behalf of github Jul 14, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/setup-node from 6 to 7.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

chore(deps): bump actions/setup-node from 6 to 7
30e2b08 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
dependabot Bot added dependencies Pull requests that update a dependency file github-actions labels Jul 14, 2026

claude Bot commented Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @dependabot[bot]'s task in 1m 10s —— View job

Dependency review: actions/setup-node v6 → v7

  • Identify changed dependency
  • Review v7 release notes / breaking changes
  • Check repo usage of the action
  • Flag risks and suggest follow-ups

Change: single line in .github/workflows/release.yml:162, actions/setup-node@v6 → @v7. This is the only use of the action in the repo.

Usage context: in the release job, right before GoReleaser. It sets Node 24 and writes an .npmrc for registry.npmjs.org (registry-url). npm publishing happens later via GoReleaser's after hook → scripts/npm-publish.sh, which runs npm publish --provenance (OIDC / Trusted Publisher — no NODE_AUTH_TOKEN is set anywhere in the workflow).

v7 assessment — low risk:

  • Major bump is mostly internal: migrated the action to ESM and upgraded its deps. No consumer-facing input changes; node-version and registry-url are both still supported.
  • New cache-primary-key / cache-matched-key outputs — purely additive, unused here (no cache: input).
  • Worth a glance: the v7 bug fix "Remove dummy NODE_AUTH_TOKEN export" (#1558). In v6 the action exported an empty NODE_AUTH_TOKEN; v7 no longer does. This repo authenticates to npm via OIDC provenance rather than a token, so it should be unaffected — but since the .npmrc generated by registry-url still contains _authToken=${NODE_AUTH_TOKEN}, it's the one behavior change touching this workflow.

Suggested follow-up:

  • Confirm the next release still publishes to npm cleanly (this only runs on tag push, so it isn't exercised by PR CI). A --dry-run snapshot release, or just watching the first real release.yml run post-merge, is enough to validate npm auth/provenance under v7.

No code changes needed — the bump is safe to merge; just keep an eye on the first release afterward.
· dependabot/github_actions/actions/setup-node-7

mbevc1 merged commit ddfb9b8 into main Jul 14, 2026
15 checks passed
mbevc1 deleted the dependabot/github_actions/actions/setup-node-7 branch July 14, 2026 15:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

mbevc1 mbevc1 approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github-actions

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

Back | FazBrowse Home | New Git URL