Repository navigation
build(deps): bump actions/setup-node from 7.0.0 to 7.1.0 - #375
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 7.0.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this PR and didn't find any bugs. It's a routine pin bump, but every path is covered by CODEOWNERS and one of the changed files is the release workflow, so a human look would still be worthwhile.
What was reviewed:
- Both
actions/setup-nodepins inrelease.ymlandtest.ymlchange only the SHA and the# v7.1.0comment. The other step inputs are unchanged (node-version,package-manager-cache: falsein release,cache: 'yarn'in test). - I couldn't check from here that
949feb2413d6458794dcd2491c4babbbce0c15c1is the commit the upstreamv7.1.0tag points to. That's worth confirming, because the release job runs withid-token: write.
Extended reasoning...
The change updates the pinned actions/setup-node commit SHA from v7.0.0 to v7.1.0 in .github/workflows/release.yml and .github/workflows/test.yml. Nothing else in either workflow changes. The security-sensitive surface is the CI supply chain: the release job has id-token: write for npm trusted publishing and later gets a GitHub app token. I'm deferring for two reasons: .github/CODEOWNERS assigns every path (*) to three owning teams, and this review couldn't confirm that the new SHA matches the upstream v7.1.0 tag.
Bumps actions/setup-node from 7.0.0 to 7.1.0.
Release notes
Sourced from actions/setup-node's releases.
Commits
949feb2Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)7207c4fchore: update dependencies and add license files (#1642)54337e0Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)fb54fa8Bump jest-each from 30.4.1 to 30.5.2 (#1636)7f84f1dBump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)0c54c7bBump@typescript-eslint/parserfrom 8.62.0 to 8.70.0 (#1615)a829419Bump@types/semverfrom 7.7.1 to 7.8.0 (#1616)680d1e4Support absolute paths in node-version-file (#1633)db0fb3aBump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)94196eeBump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)