PR #230 — dependency update review.

Package: actions/setup-node v6 → v7 (grouped update github, single member)
Semver risk: Major
Type: CI/release tooling (not a runtime dependency)
CI: All file linting failing — pre-existing repo-wide drift, not caused by this bump. All Python unit-test jobs (3.6–3.14) pass.

Changelog

• Breaking — dummy NODE_AUTH_TOKEN export removed (#1558). v6 always ran core.exportVariable('NODE_AUTH_TOKEN', process.env.NODE_AUTH_TOKEN || 'XXXXX-...'); v7 exports it only if already set. Upstream scopes the impact: legacy Yarn Classic and older Node/npm may fail, pnpm may warn — "npm Trusted Publishing (OIDC) is not affected, since it does not use NODE_AUTH_TOKEN."
• Breaking — ESM migration (#1574). No changes to inputs, outputs, or behavior; action.yml at v7 still declares runs.using: 'node24', same as v6.
• Deprecations: none.
• Security: no CVEs for v7.0.0 itself; @actions/cache → 5.1.0 pulls security overrides for undici and fast-xml-parser. Not exercised — this workflow does not enable caching.
• New peer deps / required inputs: none. Two additive outputs (cache-primary-key, cache-matched-key).

Compatibility

The only usage is .github/workflows/npm-publish.yml:15 (grep -rn setup-node .github/ returns one line). That workflow declares id-token: write # Required for npm trusted publishing (OIDC), and NODE_AUTH_TOKEN/NPM_TOKEN appear nowhere in the repo — a pure OIDC trusted-publishing setup, exactly the case upstream says is unaffected. No code changes required.

Notes

• Unverifiable by CI. npm-publish.yml triggers only on release: published, so no check in this PR runs actions/setup-node. Green CI shows the bump breaks nothing else; it is not evidence that publishing still works. The first real test is the next release — if make release-npm fails at the auth step, the symptom is npm failing to resolve ${NODE_AUTH_TOKEN} from the generated .npmrc; revert to actions/setup-node@v6.
• All file linting is unrelated. Every prek hook passes (including actionlint); the failure is the build hook regenerating js/package.json from the setuptools-scm version (0.2.18 → 0.2.19). PRs #231 and #202 fail with a byte-identical diff, so it blocks every open PR and should be fixed separately by committing the regenerated file.

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

Ran a dependency-update review pipeline over the version bump:

• Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
• Extracted the changelog and release notes across the version range
• Assessed compatibility with this project's usage and whether any code changes are required
• Treated CI as the primary safety net
• Scaled the review depth to the update's risk
• Chose the verdict from semver risk, changelog findings, and CI status