build(deps): bump actions/setup-node in / - #35
Conversation
Bumps the major-version-updates/actions/setup-node group with 1 update: [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Looks good, straightforward version bump. Checked that the SHA pin (820762786026740c76f36085b0efc47a31fe5020) matches the v7.0.0 tag and the comment is updated consistently; no other lines in the workflow changed.
Extended reasoning...
Overview
The change is a one-line dependabot PR bumping the pinned commit SHA (and version comment) for actions/setup-node in .github/workflows/test.yml from v6.4.0 to v7.0.0. No other workflow logic, permissions, or steps are modified.
Security risks
The action remains pinned to a full commit SHA rather than a mutable tag, which is the recommended security practice and is preserved here. The new SHA corresponds to the official actions/setup-node v7.0.0 release commit as referenced in the PR's changelog. There is no expansion of permissions, secrets usage, or new steps introduced. Supply-chain risk is inherent to trusting the upstream action at all, but that risk is unchanged by this bump and mitigated by the SHA pinning convention already in place.
Level of scrutiny
This warrants minimal scrutiny: it's an automated dependency bump limited to a single pinned SHA and its accompanying comment in a CI workflow file, following the existing pin-by-SHA convention. No CODEOWNERS restriction was found for this path, and no application code, auth, or data-handling logic is touched.
Other factors
No bugs were reported by the bug hunting system, and my own review of the diff confirms it is a single, self-contained, mechanical change with no ambiguity.
1 participant
Bumps the major-version-updates/actions/setup-node group with 1 update: actions/setup-node.
Updates
actions/setup-nodefrom 6.4.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions