Repository navigation
ci: bump actions/setup-node from 7.0.0 to 7.1.0 - #457
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 7.0.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
This PR does not match any of the 1 configured review trigger rule. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM. This is a routine bump of actions/setup-node from v7.0.0 to v7.1.0, and every reference stays pinned to a full commit SHA.
What was reviewed:
- All four
setup-nodereferences: two inci.yml, one inrelease-node-sdk.ymland one inrelease.yml. Each moves to the same SHA,949feb2…, with a matching# v7.1.0comment. - No
with:inputs changed (node-version, cache, cache-dependency-path, registry-url), and the publish job keeps its OIDC and provenance setup as it was. - The new SHA matches the v7.1.0 head commit named in the upstream release notes. I couldn't check it against the upstream tag from here.
Extended reasoning...
The change only touches GitHub Actions workflow files. It swaps one pinned action SHA for another in four places, and no inputs or application code change. The only sensitive area is supply chain: the npm publish workflow uses this action with id-token: write. That risk is limited because the action stays pinned to an immutable commit SHA. No CODEOWNERS file covers these paths, and nobody has raised an objection on the PR, so this is a mechanical version bump that a human doesn't need to look at closely.
Bumps actions/setup-node from 7.0.0 to 7.1.0.
Release notes
Sourced from actions/setup-node's releases.
Commits
949feb2Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)7207c4fchore: update dependencies and add license files (#1642)54337e0Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)fb54fa8Bump jest-each from 30.4.1 to 30.5.2 (#1636)7f84f1dBump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)0c54c7bBump@typescript-eslint/parserfrom 8.62.0 to 8.70.0 (#1615)a829419Bump@types/semverfrom 7.7.1 to 7.8.0 (#1616)680d1e4Support absolute paths in node-version-file (#1633)db0fb3aBump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)94196eeBump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)