Skip to content

build(deps): bump actions/setup-node from 6.3.0 to 7.0.0 - #114

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-7.0.0
Open

build(deps): bump actions/setup-node from 6.3.0 to 7.0.0#114
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-7.0.0

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubJul 22, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/setup-node from 6.3.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump actions/setup-node from 6.3.0 to 7.0.0
36b6754
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.3.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v6.3.0...v7.0.0)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update an action file major Pull requests with breakable changes labels Jul 22, 2026
@dependabot
dependabotBot requested a review from a team as a code ownerJuly 22, 2026 07:14
@dependabot
dependabotBot requested review from jyuliya and nurislam03July 22, 2026 07:14
@dependabotdependabotBot added dependencies Pull requests that update an action file major Pull requests with breakable changes labels Jul 22, 2026
@dependabotdependabotBot mentioned this pull request Jul 22, 2026
Closed
@robertvangor

robertvangor commented Aug 23, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Pi Dependabot assessment

Dependency and version movement

  • Single, ungrouped GitHub Actions update: actions/setup-node 6.3.0 -> 7.0.0.
  • Application diff changes only .github/workflows/node.js.yml and .github/workflows/publish-npm.yml; package.json and package-lock.json are unchanged.
  • Upstream setup-node v7 production roots resolve to @actions/cache 6.1.0, @actions/core 3.0.1, @actions/exec 3.0.0, @actions/github 9.1.1, @actions/glob 0.7.0, @actions/http-client 4.0.1, @actions/io 3.0.2, @actions/tool-cache 4.0.0, and semver 7.8.5.
  • Key upstream transitive movements are Octokit 5.x -> 7.x, undici 5.29.0/6.23.0 -> 6.27.0, Azure storage/core 12.29.1/1.22.2 -> 12.31.0/1.23.0, fast-xml-parser 5.4.1 -> 5.7.2, fast-xml-builder 1.0.0 -> 1.2.0, and minimatch 3.1.5 -> 10.2.5 on the upgraded glob path.
  • The upstream action package-lock.json is the resolved graph for the bundled action; the application lockfile has no setup-node dependency movement.

Authoritative changelog / advisory links

Application usage and potentially disruptive effects

  • v7 migrates action internals to ESM and adds cache-primary-key/cache-matched-key outputs; no consumed action inputs changed.
  • The action metadata remains runs.using=node24, as in v6.3.0, so the runner requirement is not a new incremental requirement for this PR.
  • v7 removes the dummy NODE_AUTH_TOKEN fallback. The publish workflow uses registry-url with id-token: write and no NODE_AUTH_TOKEN, matching npm Trusted Publisher/OIDC behavior; legacy registry-url workflows relying on the dummy value could differ.
  • The workflows do not configure mirror or cache outputs. The application has no packageManager or devEngines.packageManager, so automatic npm caching is disabled unless explicitly enabled.
  • The application source/runtime paths do not import or otherwise use setup-node; impact is limited to CI and release publishing.

Validation

  • command: PR identity/head recheck via gh api; result: passed; details: PR 114 open; author app/dependabot/dependabot[bot]; base main at 8381180; head branch and SHA match the frozen snapshot.
  • command: Existing GitHub checks via gh pr checks 114; result: passed; details: All 9 checks passed: Node.js build on 20.x, 22.x, 24.x; Required files Backstage/CODEOWNERS/Dependabot/Readme; Socket Security Project Report and Pull Request Alerts.
  • command: npm ci --ignore-scripts --no-audit; result: passed; details: 561 packages installed from the application package-lock.json.
  • command: npm run lint; result: passed; details: ESLint completed successfully.
  • command: npm test; result: passed; details: 6 test suites and 158 tests passed; build compiled 9 source files.
  • command: npm ls --all and npm ls --all --omit=dev; result: passed; details: Resolved application dependency graph has no invalid or missing entries.
  • command: npm audit --omit=dev --audit-level=high; result: passed; details: 0 production vulnerabilities.
  • command: npm audit --audit-level=high; result: baseline findings; details: Full application audit reports 5 pre-existing dev/tooling findings (brace-expansion, js-yaml, linkify-it, markdown-it); the PR changes no application dependency files.
  • command: Ruby YAML parse of both changed workflow files; result: passed; details: node.js.yml and publish-npm.yml parsed successfully; actionlint was unavailable.
  • command: git diff --check and final worktree/remote inspection; result: passed; details: Worktree clean; diff is the original two setup-node ref changes; remote branch matches final head SHA.
  • command: upstream setup-node v6.3.0/v7.0.0 lockfile and production graph comparison; result: passed; details: Resolved roots and key transitive versions were inspected from the upstream package-lock.json; v7 has a newer graph and current upstream audit residuals are recorded in residualRisks.

Conversation state / unresolved concerns

  • None reported.

Change risk: 5/10 — A semver-major CI action changes its internal ESM runtime, bundled toolkit graph, cache outputs, and registry authentication fallback, and it is used in the release publishing workflow. Risk is bounded because the application diff is only two action references, node24 was already required by v6.3.0, no inputs are removed, and all CI/tests pass.

Remediation importance: 6/10 — This is reachable CI/CD supply-chain and npm release-publishing infrastructure, and v7 removes older action dependency findings, but it does not change application runtime code or production package dependencies and is not itself an application vulnerability fix.

Final exact head SHA:36b6754b7d7db03ad2b5455e6f167c38bc342de6

Dev deployment evidence

  • Not confirmed for final SHA 36b6754
  • Reason: Deployment confirmation failed safely: this PR is an open Dependabot workflow-only change in an npm library repository, not a containerized service. No exact-SHA GitHub deployment exists, no package release at the requested SHA exists, and no dev-de1 workload/image metadata maps to the repository or requested SHA. Since there is no mapped workload, an image/digest/namespace/workload/observed commit and descendant containment proof cannot be supplied.
  • [2026-08-23T16:08:40Z] GitHub PR metadata (gh pr view / GitHub API): PR build(deps): bump actions/setup-node from 6.3.0 to 7.0.0 #114 is OPEN, head is exactly 36b6754, base is main, and mergedAt/mergeCommit are null.
  • [2026-08-23T16:08:40Z] Local git ancestry check: requested SHA is not an ancestor of origin/main (origin/main=460b0d6c97977d190a17b8609fd17856469017be); only the Dependabot branch contains the requested SHA in the fetched refs.
  • [2026-08-23T16:08:40Z] catalog-info.yaml identifies Staffbase/plugins-sdk-nodejs as a Backstage Component with spec.type=library; the repository has package.json and no Dockerfile, Helm, Kustomize, or deployment manifest.
  • [2026-08-23T16:08:40Z] git show of the exact SHA: two files changed, .github/workflows/node.js.yml and .github/workflows/publish-npm.yml; both changes are actions/setup-node v6.3.0 -> v7.0.0. No runtime source or image build changed.
  • [2026-08-23T16:08:40Z] Exact-SHA GitHub Actions query returned one run: Node.js CI pull_request run 29899469009 at the requested SHA, completed SUCCESS. This is CI evidence only, not deployment evidence.
  • [2026-08-23T16:08:40Z] Exact-SHA GitHub deployments query returned count=0. The repository's relevant delivery workflows are Node.js CI and Publish to NPM Registry; Publish is release-triggered and there is no Kubernetes deployment workflow.
  • [2026-08-23T16:08:40Z] npm registry evidence: @staffbase/staffbase-plugin-sdk latest is 1.3.9, modified/published 2026-07-23; release tag 1.3.9 points to 511987e, not the requested SHA.
  • [2026-08-23T16:11:21Z] Read-only kubectl against context dev-de1 scanned 372 Deployments, 146 StatefulSets, 21 DaemonSets, 318 Jobs, and 27 CronJobs: repo/package identity matches (plugins-sdk-nodejs, staffbase-plugin-sdk) = 0; workload name/image matches for sdk|nodejs = 0.
  • [2026-08-23T16:11:21Z] Read-only kubectl exact-SHA scan found 0 matches for the full requested SHA or 36b6754 in workload objects and 0 matches in pod objects. No namespace, workload, image, digest, or observed commit can therefore be attributed to this PR.
  • [2026-08-23T16:11:21Z] No candidate workload or progressing rollout was found; rollout polling was not applicable rather than skipped for a transient Kubernetes state.

Status: blocked

check_after: not set (exact deployment not confirmed)

Residual risks / blocking reason

  • The frozen upstream v7.0.0 production graph currently audits with two findings: undici 6.27.0 affected by advisories requiring 6.28.0 for the affected APIs, and brace-expansion 5.0.6 affected by current DoS advisories requiring later patched versions. No newer setup-node v7 tag was available during intake; these are bundled action residuals, not application lockfile dependencies.
  • The full application audit has five pre-existing dev/tooling findings; production-only audit is clean and the PR did not alter dependencies.
  • GitHub review remains required from the requested Product · Actions team/users; this worker did not bypass or resolve that review requirement.
  • Deployment/dev confirmation is intentionally not claimed; the parent read-only operations worker must verify it.

@robertvangorrobertvangor added the dev Pull Requests that deployed to dev label Aug 23, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nurislam03nurislam03Awaiting requested review from nurislam03nurislam03 is a code owner automatically assigned from Staffbase/product-actions
@jyuliyajyuliyaAwaiting requested review from jyuliyajyuliya is a code owner automatically assigned from Staffbase/product-actions

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependenciesPull requests that update an action filedevPull Requests that deployed to devmajorPull requests with breakable changes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@robertvangor