build(deps): bump pnpm/action-setup from 6 to 6.0.9 - #26
Conversation
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 6 to 6.0.9. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@v6...v6.0.9) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![dojo-code-reviewer[bot]](https://avatars.githubusercontent.com/in/3092887?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Approved
Approved — no findings. Confidence: 5.00/5.00.
Walkthrough
main branch directly. The repository's GitFlow policy expects feature branches to target develop first (feature → develop → main). Since this is an automated dependency update from Dependabot, we proceed with the review, but highlight this deviation for governance tracking.
Review Walkthrough
This PR updates the GitHub Action pnpm/action-setup from version v6 to v6.0.9 across all of the repository's CI/CD workflows. This patch update fixes several bugs, including resolving issues with self-updating pnpm on Windows, correcting output paths, and updating the bootstrapped pnpm binary.
Areas Reviewed
We reviewed all files modified in this pull request:
.github/workflows/ci.yml(CI workflow).github/workflows/mcp-e2e.yml(End-to-End test workflow).github/workflows/release.yml(Release and deployment workflow)
Safety Rationale
This change is safe to merge because it is a backward-compatible patch version upgrade of a standard, trusted setup action (pnpm/action-setup). Pinning the action to a patch release (v6.0.9) rather than a floating major tag (v6) improves the predictability and security of the dependency installation step in all workflows.
Approved — no findings.
Bumps pnpm/action-setup from 6 to 6.0.9.
Release notes
Sourced from pnpm/action-setup's releases.
... (truncated)
Commits
62bce64fix: extract pnpm version from packageManager field instead of returning unde...58e6119feat!: replace bundled pnpm binary with npm + lockfile bootstrap (#212)2e223e0chore(workflows): adding pr-check.yaml to validate dist folder (#213)fc06bc1feat!: run the action on Node.js 24 (#205)b906affRevert "feat!: run the action on Node.js 24 (#205)"Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)