Repository navigation
ci: bump actions/setup-node from 7.0.0 to 7.1.0 - #82
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 7.0.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Claude finished @dependabot[bot]'s task in 1m 16s —— View job Dependency review:
|
| 7.1.0 change | Impact here |
|---|---|
Support for mise.toml (#1421) |
None — no node-version-file input is used anywhere; all three workflows pass an explicit node-version. |
Absolute paths in node-version-file (#1633) |
None — same reason. |
| Node version validation + manifest fetch retry (#1580) | Low risk / mild win. The only behavioural change that touches this repo. Inputs here are plain majors ('22', '24', and the ['22','24'] matrix) — the least likely form to trip stricter validation. The manifest fetch retry should make flaky runner setups slightly more reliable. |
@actions/cache → 6.2.0 (#1584) |
Watch item. Only ci.yml:34 uses cache: 'npm'. A cache-library bump can change the key/version namespace, so the first run on main after merge may be a one-time cache miss (slower npm ci, nothing worse). release.yml and update-catalog.yml don't enable caching, so they're untouched. |
| "NODE_AUTH_TOKEN behavior change" (#1593) | None from this PR. It's listed under Documentation updates — it documents the existing v7.0.0 behaviour rather than introducing a change in 7.1.0. release.yml authenticates via npm Trusted Publishing (OIDC), not NODE_AUTH_TOKEN, and that path is unchanged. |
Everything else in the notes is the action's own devDependency churn, which doesn't reach consumers.
Node floor consistency
Unaffected by this bump, but checked per the review brief — the floor is coherent:
package.jsonengines.node:>=22;@types/node:^22.0.0(tracks the floor, correct)ci.ymlmatrix low end:'22'✅ ·update-catalog.yml:'22'✅release.yml:'24'— deliberately newer, build/publish only, as documented inCLAUDE.md
No drift, and no major version slipped past the Dependabot @types/node ignore rule.
Suggested follow-up
Nothing blocking. The CI matrix (Node 22 + 24, build + test + .mcpb smoke test) exercises this action on every PR, so a green run on this PR is sufficient evidence. If npm ci on the first post-merge main run is noticeably slower than usual, that's the expected one-time cache-key reset from the @actions/cache bump, not a regression.
· branch
Bumps actions/setup-node from 7.0.0 to 7.1.0.
Release notes
Sourced from actions/setup-node's releases.
Commits
949feb2Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)7207c4fchore: update dependencies and add license files (#1642)54337e0Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)fb54fa8Bump jest-each from 30.4.1 to 30.5.2 (#1636)7f84f1dBump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)0c54c7bBump@typescript-eslint/parserfrom 8.62.0 to 8.70.0 (#1615)a829419Bump@types/semverfrom 7.7.1 to 7.8.0 (#1616)680d1e4Support absolute paths in node-version-file (#1633)db0fb3aBump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)94196eeBump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)