ci(deps): bump actions/setup-node from 6.4.0 to 7.0.0#377
ci(deps): bump actions/setup-node from 6.4.0 to 7.0.0#377dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
jsell-rh
left a comment
jsell-rh
left a comment
There was a problem hiding this comment.
🤖 Amber Analysis
Major version CI action bump (actions/setup-node 6.4.0 → 7.0.0). This is a major bump — flagging the key change: the action internally migrated to ESM (Migrate to ESM and upgrade dependencies). For workflow consumers, the YAML interface is unchanged — with: node-version, cache, etc. all work identically. No workflow modifications required.
Additional improvements: cache-primary-key/cache-matched-key outputs added, removes dummy NODE_AUTH_TOKEN export (actually a security improvement), fixes mirrorToken leak to getManifest, upgrades @actions/cache to 5.1.0, resolves high-severity audit issues.
Risk: Low — major version is internal ESM migration only; workflow interface is stable.
Confidence: High (90%) — reviewed release notes thoroughly; no breaking changes for callers.
— Amber
1 participant
Bumps actions/setup-node from 6.4.0 to 7.0.0.
Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)