Migrate to ESM and upgrade dependencies by gowridurgad · Pull Request #1574 · actions/setup-node

gowridurgad · 2026-06-26T08:33:01Z

Description:
Migrates setup-node from CommonJS to ECMAScript Modules (ESM)

Related issue:
Add link to the related issue.

Check list:

Mark if documentation changes are required.
Mark if tests were added or updated to cover the changes.

Copilot

Pull request overview

This PR migrates the setup-node codebase and tooling from CommonJS to ESM, aligning runtime behavior (NodeNext resolution + import.meta.url) with updated dependencies and ESM-compatible lint/test configuration.

Changes:

Switch TypeScript compilation to module: NodeNext and update internal relative imports to include .js extensions.
Migrate Jest and ESLint configuration to ESM-friendly setups (flat ESLint config + TS Jest config + ESM mocking patterns).
Upgrade Actions/toolkit and related dependencies, and refresh licensed metadata accordingly.

Reviewed changes

Copilot reviewed 73 out of 85 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tsconfig.json	Switch TS module output to NodeNext and exclude jest config from compilation.
src/util.ts	Update `catch` clause style while keeping behavior unchanged.
src/setup-node.ts	Update entrypoint import to ESM-friendly `.js` specifier.
src/main.ts	Convert internal imports to `.js` and replace `__dirname` usage with `import.meta.url` resolution.
src/distributions/v8-canary/canary_builds.ts	Update internal imports to `.js` specifiers.
src/distributions/rc/rc_builds.ts	Update internal imports to `.js` specifiers.
src/distributions/official_builds/official_builds.ts	Update internal imports to `.js` specifiers.
src/distributions/nightly/nightly_builds.ts	Update internal imports to `.js` specifiers.
src/distributions/installer-factory.ts	Update internal imports to `.js` specifiers.
src/distributions/base-distribution.ts	Update imports for ESM and replace `__dirname` usage with `import.meta.url` resolution.
src/distributions/base-distribution-prerelease.ts	Update internal imports to `.js` specifiers.
src/cache-utils.ts	Update internal import to `.js` and fix async command output usage (`await`).
src/cache-save.ts	Update internal imports to `.js` specifiers.
src/cache-restore.ts	Update internal imports to `.js` specifiers.
package.json	Mark package as ESM, update scripts, and upgrade dependencies/tooling.
jest.config.ts	Add ESM-compatible Jest configuration using `ts-jest` with `useESM`.
jest.config.js	Remove legacy CommonJS Jest configuration.
eslint.config.mjs	Add flat ESLint config in ESM format.
dist/setup/package.json	Add package boundary metadata for the bundled setup entrypoint.
dist/cache-save/package.json	Add package boundary metadata for the bundled post-action entrypoint.
.prettierrc.json	Add Prettier configuration in JSON format.
.prettierrc.js	Remove legacy CommonJS Prettier configuration.
.licensed.yml	Update allowed/reviewed licenses and normalize indentation for reviewed packages.
.eslintrc.js	Remove legacy ESLint config (replaced by flat config).
.eslintignore	Remove legacy ignore file (handled via flat config ignores).
tests/rc-installer.test.ts	Update tests for ESM execution + ESM-safe mocking/import patterns.
tests/problem-matcher.test.ts	Update tests to use ESM JSON import attributes and Jest globals.
tests/official-installer.test.ts	Update tests for ESM execution + ESM-safe mocking/import patterns.
tests/nightly-installer.test.ts	Update tests for ESM execution + ESM-safe mocking/import patterns.
tests/mock/glob-mock.test.ts	Update internal test import to `.js` specifier and Jest globals.
tests/main.test.ts	Update tests for ESM execution + ESM-safe mocking/import patterns.
tests/canary-installer.test.ts	Update tests for ESM execution + ESM-safe mocking/import patterns.
tests/cache-utils.test.ts	Update tests to mock `@actions/exec.getExecOutput` and align with async command execution.
tests/cache-save.test.ts	Update tests for ESM execution + ESM-safe mocking/import patterns.
tests/cache-restore.test.ts	Update tests for ESM execution + ESM-safe mocking/import patterns.
tests/authutil.test.ts	Update tests for ESM execution + ESM-safe mocking/import patterns.
.licenses/npm/xml-naming.dep.yml	Normalize license metadata formatting (homepage field).
.licenses/npm/wrappy.dep.yml	Remove license metadata entry (dependency resolution changed).
.licenses/npm/universal-user-agent.dep.yml	Update license metadata to match upgraded dependency version/content.
.licenses/npm/strnum.dep.yml	Update license metadata formatting/version alignment.
.licenses/npm/semver.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/semver-6.3.1.dep.yml	Remove old semver v6 license metadata entry.
.licenses/npm/once.dep.yml	Remove license metadata entry (dependency resolution changed).
.licenses/npm/minimatch-3.1.5.dep.yml	Add license metadata for additional minimatch version present in resolution.
.licenses/npm/minimatch-10.2.5.dep.yml	Add license metadata for upgraded minimatch version present in resolution.
.licenses/npm/json-with-bigint.dep.yml	Update license metadata to match dependency name/version/copyright.
.licenses/npm/fast-xml-parser.dep.yml	Update license metadata formatting/version alignment.
.licenses/npm/fast-content-type-parse.dep.yml	Update license metadata to match new dependency and reviewed status.
.licenses/npm/deprecation.dep.yml	Remove license metadata entry (dependency resolution changed).
.licenses/npm/brace-expansion-5.0.6.dep.yml	Update license metadata to match resolved dependency content.
.licenses/npm/brace-expansion-1.1.13.dep.yml	Add license metadata for additional brace-expansion version present in resolution.
.licenses/npm/before-after-hook.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/balanced-match-4.0.4.dep.yml	Add license metadata for additional balanced-match version present in resolution.
.licenses/npm/balanced-match-1.0.2.dep.yml	Add license metadata for additional balanced-match version present in resolution.
.licenses/npm/@typespec/ts-http-runtime.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@octokit/types.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@octokit/types-13.10.0.dep.yml	Remove old `@octokit/types` license metadata entry.
.licenses/npm/@octokit/request.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@octokit/request-error.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@octokit/plugin-rest-endpoint-methods.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@octokit/plugin-paginate-rest.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@octokit/openapi-types.dep.yml	Update license metadata to match upgraded dependency version/content.
.licenses/npm/@octokit/graphql.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@octokit/endpoint.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@octokit/core.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@octokit/auth-token.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@nodable/entities.dep.yml	Update license metadata formatting/version alignment.
.licenses/npm/@azure/storage-common.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@azure/storage-blob.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@azure/core-xml.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@azure/core-rest-pipeline.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@azure/core-http-compat.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@azure/abort-controller.dep.yml	Add license metadata for newly present dependency in resolution.
.licenses/npm/@actions/tool-cache.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@actions/io.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@actions/http-client-4.0.1.dep.yml	Update license metadata to match upgraded dependency version/content.
.licenses/npm/@actions/glob-0.7.0.dep.yml	Update license metadata to match upgraded dependency version/content.
.licenses/npm/@actions/glob-0.6.1.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@actions/github.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@actions/exec.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@actions/core.dep.yml	Update license metadata to match upgraded dependency version.
.licenses/npm/@actions/cache.dep.yml	Update license metadata to match upgraded dependency version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

#11) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://github.com/actions/setup-node) | action | major | `v6.4.0` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](actions/setup-node@v6.5.0...v7.0.0) #### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@gowridurgad](https://github.com/gowridurgad) in [#1577](actions/setup-node#1577) - Migrate to ESM and upgrade dependencies by [@gowridurgad](https://github.com/gowridurgad) in [#1574](actions/setup-node#1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@gowridurgad](https://github.com/gowridurgad) in [#1558](actions/setup-node#1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@deiga](https://github.com/deiga) in [#1548](actions/setup-node#1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1536](actions/setup-node#1536) - docs: Update restore-only cache documentation by [@priya-kinthali](https://github.com/priya-kinthali) in [#1550](actions/setup-node#1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1567](actions/setup-node#1567) ##### Dependency update: - Upgrade [@actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@jasongin](https://github.com/jasongin) in [#1569](actions/setup-node#1569) #### New Contributors - [@chiranjib-swain](https://github.com/chiranjib-swain) made their first contribution in [#1536](actions/setup-node#1536) - [@deiga](https://github.com/deiga) made their first contribution in [#1548](actions/setup-node#1548) - [@jasongin](https://github.com/jasongin) made their first contribution in [#1569](actions/setup-node#1569) **Full Changelog**: <actions/setup-node@v6...v7.0.0> ### [`v6.5.0`](https://github.com/actions/setup-node/releases/tag/v6.5.0) [Compare Source](actions/setup-node@v6.4.0...v6.5.0) #### What's Changed - Update [@actions/cache](https://github.com/actions/cache) to 5.1.0 and add security overrides for undici and fast-xml-parser by [@HarithaVattikuti](https://github.com/HarithaVattikuti) in [#1579](actions/setup-node#1579) **Full Changelog**: <actions/setup-node@v6.4.0...v6.5.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.ajgon.casa/deedee/schemas/pulls/11

matkoniecz · 2026-07-17T17:30:40Z

this got listed as breaking change in https://github.com/actions/setup-node#breaking-changes-in-v7 - any idea what is the proper way to check is it a breaking change in openstreetmap/id-tagging-schema#2574 and potentially mitigate it?

https://github.com/actions/setup-node#breaking-changes-in-v7 does not have much info or migration steps

@gowridurgad

…roup (#558) Bumps the all-actions group with 1 update: [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/setup-node` from **6** to **7** ## Release notes *Sourced from [actions/setup-node's releases](https://github.com/actions/setup-node/releases).* > ## v7.0.0 > > ## What's Changed > > ### Enhancements > - Add `cache-primary-key` and `cache-matched-key` as outputs by [@gowridurgad](https://github.com/gowridurgad) in [actions/setup-node#1577](actions/setup-node#1577) > - Migrate to ESM and upgrade dependencies by [@gowridurgad](https://github.com/gowridurgad) in [actions/setup-node#1574](actions/setup-node#1574) > > ### Bug fixes > - Remove dummy `NODE_AUTH_TOKEN` export by [@gowridurgad](https://github.com/gowridurgad) in [actions/setup-node#1558](actions/setup-node#1558) > - Only use `mirrorToken` in `getManifest` if it's provided by [@deiga](https://github.com/deiga) in [actions/setup-node#1548](actions/setup-node#1548) > > ### Documentation updates > - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@chiranjib-swain](https://github.com/chiranjib-swain) in [actions/setup-node#1536](actions/setup-node#1536) > - Update restore-only cache documentation by [@priya-kinthali](https://github.com/priya-kinthali) in [actions/setup-node#1550](actions/setup-node#1550) > - Update caching recommendations to mitigate cache poisoning risks by [@chiranjib-swain](https://github.com/chiranjib-swain) in [actions/setup-node#1567](actions/setup-node#1567) > > ### Dependency update > - Upgrade `@actions/cache` to 5.1.0, log cache write denied by [@jasongin](https://github.com/jasongin) in [actions/setup-node#1569](actions/setup-node#1569) > > ### New Contributors > - @chiranjib-swain (#1536) > - @deiga (#1548) > - @jasongin (#1569) > > **Full Changelog:** actions/setup-node@v6...v7.0.0 > > ## v6.5.0 > - Update `@actions/cache` to 5.1.0 and add security overrides for `undici` and `fast-xml-parser`. > > **Full Changelog:** actions/setup-node@v6.4.0...v6.5.0 > > ## v6.4.0 > - Upgrade `@actions` dependencies. > - Update Node.js versions in `versions.yml` and bump package to v6.4.0. > > ## v6.3.0 > - Support parsing `devEngines` field. > > ... (remaining release notes truncated exactly as in the original) ## Commits - `8207627` Migrate to ESM and upgrade dependencies (#1574) - `04be95c` Add cache-primary-key and cache-matched-key as outputs (#1577) - `7c2c68d` Update caching recommendations to mitigate cache poisoning risks (#1567) - `6a61c03` Merge pull request #1569 - `30eb73b` Resolve high-severity audit issues - `4e1a87a` Update dist - `360237f` Strict equality - `4f8aac5` Bump `@actions/cache` to 5.1.0 - `f4a67bb` Only use `mirrorToken` in `getManifest` if it's provided (#1548) - `0355742` Remove dummy `NODE_AUTH_TOKEN` export (#1558) - Additional commits viewable in the compare view. --- Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. ## Dependabot commands and options - `@dependabot rebase` - `@dependabot recreate` - `@dependabot show <dependency name> ignore conditions` - `@dependabot ignore <dependency name> major version` - `@dependabot ignore <dependency name> minor version` - `@dependabot ignore <dependency name>` - `@dependabot unignore <dependency name>` - `@dependabot unignore <dependency name> <ignore condition>`

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://github.com/actions/setup-node) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](actions/setup-node@v7.0.0...v7.0.0) #### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@gowridurgad](https://github.com/gowridurgad) in [#1577](actions/setup-node#1577) - Migrate to ESM and upgrade dependencies by [@gowridurgad](https://github.com/gowridurgad) in [#1574](actions/setup-node#1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@gowridurgad](https://github.com/gowridurgad) in [#1558](actions/setup-node#1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@deiga](https://github.com/deiga) in [#1548](actions/setup-node#1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1536](actions/setup-node#1536) - docs: Update restore-only cache documentation by [@priya-kinthali](https://github.com/priya-kinthali) in [#1550](actions/setup-node#1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1567](actions/setup-node#1567) ##### Dependency update: - Upgrade [@actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@jasongin](https://github.com/jasongin) in [#1569](actions/setup-node#1569) #### New Contributors - [@chiranjib-swain](https://github.com/chiranjib-swain) made their first contribution in [#1536](actions/setup-node#1536) - [@deiga](https://github.com/deiga) made their first contribution in [#1548](actions/setup-node#1548) - [@jasongin](https://github.com/jasongin) made their first contribution in [#1569](actions/setup-node#1569) **Full Changelog**: <actions/setup-node@v6...v7.0.0> ### [`v7`](actions/setup-node@v6.5.0...v7.0.0) [Compare Source](actions/setup-node@v6.5.0...v7.0.0) ### [`v6.5.0`](https://github.com/actions/setup-node/releases/tag/v6.5.0) [Compare Source](actions/setup-node@v6.4.0...v6.5.0) #### What's Changed - Update [@actions/cache](https://github.com/actions/cache) to 5.1.0 and add security overrides for undici and fast-xml-parser by [@HarithaVattikuti](https://github.com/HarithaVattikuti) in [#1579](actions/setup-node#1579) **Full Changelog**: <actions/setup-node@v6.4.0...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-node/releases/tag/v6.4.0) [Compare Source](actions/setup-node@v6.3.0...v6.4.0) #### What's Changed ##### Dependency updates: - Upgrade [@actions](https://github.com/actions) dependencies by [@Copilot](https://github.com/Copilot) in [#1525](actions/setup-node#1525) - Update Node.js versions in versions.yml and bump package to v6.4.0 by [@priya-kinthali](https://github.com/priya-kinthali) in [#1533](actions/setup-node#1533) #### New Contributors - [@Copilot](https://github.com/Copilot) made their first contribution in [#1525](actions/setup-node#1525) **Full Changelog**: <actions/setup-node@v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-node/releases/tag/v6.3.0) [Compare Source](actions/setup-node@v6.2.0...v6.3.0) #### What's Changed ##### Enhancements: - Support parsing `devEngines` field by [@susnux](https://github.com/susnux) in [#1283](actions/setup-node#1283) > When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. ##### Dependency updates: - Fix npm audit issues by [@gowridurgad](https://github.com/gowridurgad) in [#1491](actions/setup-node#1491) - Replace uuid with crypto.randomUUID() by [@trivikr](https://github.com/trivikr) in [#1378](actions/setup-node#1378) - Upgrade minimatch from 3.1.2 to 3.1.5 by [@dependabot](https://github.com/dependabot) in [#1498](actions/setup-node#1498) ##### Bug fixes: - Remove hardcoded bearer for mirror-url [@marco-ippolito](https://github.com/marco-ippolito) in [#1467](actions/setup-node#1467) - Scope test lockfiles by package manager and update cache tests by [@gowridurgad](https://github.com/gowridurgad) in [#1495](actions/setup-node#1495) #### New Contributors - [@susnux](https://github.com/susnux) made their first contribution in [#1283](actions/setup-node#1283) **Full Changelog**: <actions/setup-node@v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-node/releases/tag/v6.2.0) [Compare Source](actions/setup-node@v6.1.0...v6.2.0) #### What's Changed ##### Documentation - Documentation update related to absence of Lockfile by [@mahabaleshwars](https://github.com/mahabaleshwars) in [#1454](actions/setup-node#1454) - Correct mirror option typos by [@MikeMcC399](https://github.com/MikeMcC399) in [#1442](actions/setup-node#1442) - Readme update on checkout version v6 by [@deining](https://github.com/deining) in [#1446](actions/setup-node#1446) - Readme typo fixes [@munyari](https://github.com/munyari) in [#1226](actions/setup-node#1226) - Advanced document update on checkout version v6 by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1468](actions/setup-node#1468) ##### Dependency updates: - Upgrade [@actions/cache](https://github.com/actions/cache) to v5.0.1 by [@salmanmkc](https://github.com/salmanmkc) in [#1449](actions/setup-node#1449) #### New Contributors - [@mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#1454](actions/setup-node#1454) - [@MikeMcC399](https://github.com/MikeMcC399) made their first contribution in [#1442](actions/setup-node#1442) - [@deining](https://github.com/deining) made their first contribution in [#1446](actions/setup-node#1446) - [@munyari](https://github.com/munyari) made their first contribution in [#1226](actions/setup-node#1226) **Full Changelog**: <actions/setup-node@v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-node/releases/tag/v6.1.0) [Compare Source](actions/setup-node@v6...v6.1.0) #### What's Changed ##### Enhancement: - Remove always-auth configuration handling by [@priyagupta108](https://github.com/priyagupta108) in [#1436](actions/setup-node#1436) ##### Dependency updates: - Upgrade [@actions/cache](https://github.com/actions/cache) from 4.0.3 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1384](actions/setup-node#1384) - Upgrade actions/checkout from 5 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#1439](actions/setup-node#1439) - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#1435](actions/setup-node#1435) ##### Documentation update: - Add example for restore-only cache in documentation by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1419](actions/setup-node#1419) **Full Changelog**: <actions/setup-node@v6...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). Reviewed-on: https://gitea.com/gitea/runner/pulls/1094 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://github.com/actions/setup-node) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](actions/setup-node@v7.0.0...v7.0.0) ##### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@gowridurgad](https://github.com/gowridurgad) in [#1577](actions/setup-node#1577) - Migrate to ESM and upgrade dependencies by [@gowridurgad](https://github.com/gowridurgad) in [#1574](actions/setup-node#1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@gowridurgad](https://github.com/gowridurgad) in [#1558](actions/setup-node#1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@deiga](https://github.com/deiga) in [#1548](actions/setup-node#1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1536](actions/setup-node#1536) - docs: Update restore-only cache documentation by [@priya-kinthali](https://github.com/priya-kinthali) in [#1550](actions/setup-node#1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1567](actions/setup-node#1567) ##### Dependency update: - Upgrade [@actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@jasongin](https://github.com/jasongin) in [#1569](actions/setup-node#1569) ##### New Contributors - [@chiranjib-swain](https://github.com/chiranjib-swain) made their first contribution in [#1536](actions/setup-node#1536) - [@deiga](https://github.com/deiga) made their first contribution in [#1548](actions/setup-node#1548) - [@jasongin](https://github.com/jasongin) made their first contribution in [#1569](actions/setup-node#1569) **Full Changelog**: <actions/setup-node@v6...v7.0.0> ### [`v7`](actions/setup-node@v6.5.0...v7.0.0) [Compare Source](actions/setup-node@v6.5.0...v7.0.0) ### [`v6.5.0`](https://github.com/actions/setup-node/releases/tag/v6.5.0) [Compare Source](actions/setup-node@v6.4.0...v6.5.0) ##### What's Changed - Update [@actions/cache](https://github.com/actions/cache) to 5.1.0 and add security overrides for undici and fast-xml-parser by [@HarithaVattikuti](https://github.com/HarithaVattikuti) in [#1579](actions/setup-node#1579) **Full Changelog**: <actions/setup-node@v6.4.0...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-node/releases/tag/v6.4.0) [Compare Source](actions/setup-node@v6.3.0...v6.4.0) ##### What's Changed ##### Dependency updates: - Upgrade [@actions](https://github.com/actions) dependencies by [@Copilot](https://github.com/Copilot) in [#1525](actions/setup-node#1525) - Update Node.js versions in versions.yml and bump package to v6.4.0 by [@priya-kinthali](https://github.com/priya-kinthali) in [#1533](actions/setup-node#1533) ##### New Contributors - [@Copilot](https://github.com/Copilot) made their first contribution in [#1525](actions/setup-node#1525) **Full Changelog**: <actions/setup-node@v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-node/releases/tag/v6.3.0) [Compare Source](actions/setup-node@v6.2.0...v6.3.0) ##### What's Changed ##### Enhancements: - Support parsing `devEngines` field by [@susnux](https://github.com/susnux) in [#1283](actions/setup-node#1283) > When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. ##### Dependency updates: - Fix npm audit issues by [@gowridurgad](https://github.com/gowridurgad) in [#1491](actions/setup-node#1491) - Replace uuid with crypto.randomUUID() by [@trivikr](https://github.com/trivikr) in [#1378](actions/setup-node#1378) - Upgrade minimatch from 3.1.2 to 3.1.5 by [@dependabot](https://github.com/dependabot) in [#1498](actions/setup-node#1498) ##### Bug fixes: - Remove hardcoded bearer for mirror-url [@marco-ippolito](https://github.com/marco-ippolito) in [#1467](actions/setup-node#1467) - Scope test lockfiles by package manager and update cache tests by [@gowridurgad](https://github.com/gowridurgad) in [#1495](actions/setup-node#1495) ##### New Contributors - [@susnux](https://github.com/susnux) made their first contribution in [#1283](actions/setup-node#1283) **Full Changelog**: <actions/setup-node@v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-node/releases/tag/v6.2.0) [Compare Source](actions/setup-node@v6.1.0...v6.2.0) ##### What's Changed ##### Documentation - Documentation update related to absence of Lockfile by [@mahabaleshwars](https://github.com/mahabaleshwars) in [#1454](actions/setup-node#1454) - Correct mirror option typos by [@MikeMcC399](https://github.com/MikeMcC399) in [#1442](actions/setup-node#1442) - Readme update on checkout version v6 by [@deining](https://github.com/deining) in [#1446](actions/setup-node#1446) - Readme typo fixes [@munyari](https://github.com/munyari) in [#1226](actions/setup-node#1226) - Advanced document update on checkout version v6 by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1468](actions/setup-node#1468) ##### Dependency updates: - Upgrade [@actions/cache](https://github.com/actions/cache) to v5.0.1 by [@salmanmkc](https://github.com/salmanmkc) in [#1449](actions/setup-node#1449) ##### New Contributors - [@mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#1454](actions/setup-node#1454) - [@MikeMcC399](https://github.com/MikeMcC399) made their first contribution in [#1442](actions/setup-node#1442) - [@deining](https://github.com/deining) made their first contribution in [#1446](actions/setup-node#1446) - [@munyari](https://github.com/munyari) made their first contribution in [#1226](actions/setup-node#1226) **Full Changelog**: <actions/setup-node@v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-node/releases/tag/v6.1.0) [Compare Source](actions/setup-node@v6...v6.1.0) #### What's Changed ##### Enhancement: - Remove always-auth configuration handling by [@priyagupta108](https://github.com/priyagupta108) in [#1436](actions/setup-node#1436) ##### Dependency updates: - Upgrade [@actions/cache](https://github.com/actions/cache) from 4.0.3 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1384](actions/setup-node#1384) - Upgrade actions/checkout from 5 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#1439](actions/setup-node#1439) - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#1435](actions/setup-node#1435) ##### Documentation update: - Add example for restore-only cache in documentation by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1419](actions/setup-node#1419) **Full Changelog**: <actions/setup-node@v6...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). Reviewed-on: https://gitea.com/gitea/docs/pulls/467 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://github.com/actions/setup-node) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](actions/setup-node@v7.0.0...v7.0.0) ##### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@gowridurgad](https://github.com/gowridurgad) in [#1577](actions/setup-node#1577) - Migrate to ESM and upgrade dependencies by [@gowridurgad](https://github.com/gowridurgad) in [#1574](actions/setup-node#1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@gowridurgad](https://github.com/gowridurgad) in [#1558](actions/setup-node#1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@deiga](https://github.com/deiga) in [#1548](actions/setup-node#1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1536](actions/setup-node#1536) - docs: Update restore-only cache documentation by [@priya-kinthali](https://github.com/priya-kinthali) in [#1550](actions/setup-node#1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1567](actions/setup-node#1567) ##### Dependency update: - Upgrade [@actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@jasongin](https://github.com/jasongin) in [#1569](actions/setup-node#1569) ##### New Contributors - [@chiranjib-swain](https://github.com/chiranjib-swain) made their first contribution in [#1536](actions/setup-node#1536) - [@deiga](https://github.com/deiga) made their first contribution in [#1548](actions/setup-node#1548) - [@jasongin](https://github.com/jasongin) made their first contribution in [#1569](actions/setup-node#1569) **Full Changelog**: <actions/setup-node@v6...v7.0.0> ### [`v7`](actions/setup-node@v6.5.0...v7.0.0) [Compare Source](actions/setup-node@v6.5.0...v7.0.0) ### [`v6.5.0`](https://github.com/actions/setup-node/releases/tag/v6.5.0) [Compare Source](actions/setup-node@v6.4.0...v6.5.0) ##### What's Changed - Update [@actions/cache](https://github.com/actions/cache) to 5.1.0 and add security overrides for undici and fast-xml-parser by [@HarithaVattikuti](https://github.com/HarithaVattikuti) in [#1579](actions/setup-node#1579) **Full Changelog**: <actions/setup-node@v6.4.0...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-node/releases/tag/v6.4.0) [Compare Source](actions/setup-node@v6.3.0...v6.4.0) ##### What's Changed ##### Dependency updates: - Upgrade [@actions](https://github.com/actions) dependencies by [@Copilot](https://github.com/Copilot) in [#1525](actions/setup-node#1525) - Update Node.js versions in versions.yml and bump package to v6.4.0 by [@priya-kinthali](https://github.com/priya-kinthali) in [#1533](actions/setup-node#1533) ##### New Contributors - [@Copilot](https://github.com/Copilot) made their first contribution in [#1525](actions/setup-node#1525) **Full Changelog**: <actions/setup-node@v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-node/releases/tag/v6.3.0) [Compare Source](actions/setup-node@v6.2.0...v6.3.0) ##### What's Changed ##### Enhancements: - Support parsing `devEngines` field by [@susnux](https://github.com/susnux) in [#1283](actions/setup-node#1283) > When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. ##### Dependency updates: - Fix npm audit issues by [@gowridurgad](https://github.com/gowridurgad) in [#1491](actions/setup-node#1491) - Replace uuid with crypto.randomUUID() by [@trivikr](https://github.com/trivikr) in [#1378](actions/setup-node#1378) - Upgrade minimatch from 3.1.2 to 3.1.5 by [@dependabot](https://github.com/dependabot) in [#1498](actions/setup-node#1498) ##### Bug fixes: - Remove hardcoded bearer for mirror-url [@marco-ippolito](https://github.com/marco-ippolito) in [#1467](actions/setup-node#1467) - Scope test lockfiles by package manager and update cache tests by [@gowridurgad](https://github.com/gowridurgad) in [#1495](actions/setup-node#1495) ##### New Contributors - [@susnux](https://github.com/susnux) made their first contribution in [#1283](actions/setup-node#1283) **Full Changelog**: <actions/setup-node@v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-node/releases/tag/v6.2.0) [Compare Source](actions/setup-node@v6.1.0...v6.2.0) ##### What's Changed ##### Documentation - Documentation update related to absence of Lockfile by [@mahabaleshwars](https://github.com/mahabaleshwars) in [#1454](actions/setup-node#1454) - Correct mirror option typos by [@MikeMcC399](https://github.com/MikeMcC399) in [#1442](actions/setup-node#1442) - Readme update on checkout version v6 by [@deining](https://github.com/deining) in [#1446](actions/setup-node#1446) - Readme typo fixes [@munyari](https://github.com/munyari) in [#1226](actions/setup-node#1226) - Advanced document update on checkout version v6 by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1468](actions/setup-node#1468) ##### Dependency updates: - Upgrade [@actions/cache](https://github.com/actions/cache) to v5.0.1 by [@salmanmkc](https://github.com/salmanmkc) in [#1449](actions/setup-node#1449) ##### New Contributors - [@mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#1454](actions/setup-node#1454) - [@MikeMcC399](https://github.com/MikeMcC399) made their first contribution in [#1442](actions/setup-node#1442) - [@deining](https://github.com/deining) made their first contribution in [#1446](actions/setup-node#1446) - [@munyari](https://github.com/munyari) made their first contribution in [#1226](actions/setup-node#1226) **Full Changelog**: <actions/setup-node@v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-node/releases/tag/v6.1.0) [Compare Source](actions/setup-node@v6...v6.1.0) ##### What's Changed ##### Enhancement: - Remove always-auth configuration handling by [@priyagupta108](https://github.com/priyagupta108) in [#1436](actions/setup-node#1436) ##### Dependency updates: - Upgrade [@actions/cache](https://github.com/actions/cache) from 4.0.3 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1384](actions/setup-node#1384) - Upgrade actions/checkout from 5 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#1439](actions/setup-node#1439) - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#1435](actions/setup-node#1435) ##### Documentation update: - Add example for restore-only cache in documentation by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1419](actions/setup-node#1419) **Full Changelog**: <actions/setup-node@v6...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). Reviewed-on: https://gitea.com/gitea/blog/pulls/546 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>

gowridurgad · 2026-07-22T07:20:07Z

Hi @matkoniecz, thanks for calling this out. We've updated the README in PR #1593 to clarify this. The ESM migration in V7 is an internal change only and does not affect action inputs, outputs, or behavior for consuming workflows, so it should not affect openstreetmap/id-tagging-schema. No migration steps are needed for this change

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. Release notes *Sourced from [actions/setup-node's releases](https://github.com/actions/setup-node/releases).* > v7.0.0 > ------ > > What's Changed > -------------- > > ### Enhancements: > > * Add cache-primary-key and cache-matched-key as outputs by [`@gowridurgad`](https://github.com/gowridurgad) in [actions/setup-node#1577](https://redirect.github.com/actions/setup-node/pull/1577) > * Migrate to ESM and upgrade dependencies by [`@gowridurgad`](https://github.com/gowridurgad) in [actions/setup-node#1574](https://redirect.github.com/actions/setup-node/pull/1574) > > ### Bug fixes: > > * Remove dummy NODE\_AUTH\_TOKEN export by [`@gowridurgad`](https://github.com/gowridurgad) in [actions/setup-node#1558](https://redirect.github.com/actions/setup-node/pull/1558) > * Only use `mirrorToken` in `getManifest` if it's provided by [`@deiga`](https://github.com/deiga) in [actions/setup-node#1548](https://redirect.github.com/actions/setup-node/pull/1548) > > ### Documentation updates: > > * Add documentation for publishing to npm with Trusted Publisher (OIDC) by [`@chiranjib-swain`](https://github.com/chiranjib-swain) in [actions/setup-node#1536](https://redirect.github.com/actions/setup-node/pull/1536) > * docs: Update restore-only cache documentation by [`@priya-kinthali`](https://github.com/priya-kinthali) in [actions/setup-node#1550](https://redirect.github.com/actions/setup-node/pull/1550) > * docs: Update caching recommendations to mitigate cache poisoning risks by [`@chiranjib-swain`](https://github.com/chiranjib-swain) in [actions/setup-node#1567](https://redirect.github.com/actions/setup-node/pull/1567) > > ### Dependency update: > > * Upgrade `@actions/cache` to 5.1.0, log cache write denied by [`@jasongin`](https://github.com/jasongin) in [actions/setup-node#1569](https://redirect.github.com/actions/setup-node/pull/1569) > > New Contributors > ---------------- > > * [`@chiranjib-swain`](https://github.com/chiranjib-swain) made their first contribution in [actions/setup-node#1536](https://redirect.github.com/actions/setup-node/pull/1536) > * [`@deiga`](https://github.com/deiga) made their first contribution in [actions/setup-node#1548](https://redirect.github.com/actions/setup-node/pull/1548) > * [`@jasongin`](https://github.com/jasongin) made their first contribution in [actions/setup-node#1569](https://redirect.github.com/actions/setup-node/pull/1569) > > **Full Changelog**: <actions/setup-node@v6...v7.0.0> > > v6.5.0 > ------ > > What's Changed > -------------- > > * Update `@actions/cache` to 5.1.0 and add security overrides for undici and fast-xml-parser by [`@HarithaVattikuti`](https://github.com/HarithaVattikuti) in [actions/setup-node#1579](https://redirect.github.com/actions/setup-node/pull/1579) > > **Full Changelog**: <actions/setup-node@v6.4.0...v6.5.0> Commits * [`8207627`](actions/setup-node@8207627) Migrate to ESM and upgrade dependencies ([#1574](https://redirect.github.com/actions/setup-node/issues/1574)) * [`04be95c`](actions/setup-node@04be95c) Add cache-primary-key and cache-matched-key as outputs ([#1577](https://redirect.github.com/actions/setup-node/issues/1577)) * [`7c2c68d`](actions/setup-node@7c2c68d) docs: Update caching recommendations to mitigate cache poisoning risks ([#1567](https://redirect.github.com/actions/setup-node/issues/1567)) * [`6a61c03`](actions/setup-node@6a61c03) Merge pull request [#1569](https://redirect.github.com/actions/setup-node/issues/1569) from jasongin/update-actions-cache-5.1.0 * [`30eb73b`](actions/setup-node@30eb73b) Resolve high-severity audit issues * [`4e1a87a`](actions/setup-node@4e1a87a) Update dist * [`360237f`](actions/setup-node@360237f) Strict equality * [`4f8aac5`](actions/setup-node@4f8aac5) Bump `@actions/cache` to 5.1.0, log cache write denied * [`f4a67bb`](actions/setup-node@f4a67bb) Only use `mirrorToken` in `getManifest` if it's provided ([#1548](https://redirect.github.com/actions/setup-node/issues/1548)) * [`0355742`](actions/setup-node@0355742) Remove dummy NODE\_AUTH\_TOKEN export ([#1558](https://redirect.github.com/actions/setup-node/issues/1558)) * Additional commits viewable in [compare view](actions/setup-node@48b55a0...8207627) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/setup-node&package-manager=github\_actions&previous-version=6.4.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

pelonducks25-crypto · 2026-07-26T21:31:54Z

 - mit
 - cc0-1.0
 - unlicense
+ - blueoak-1.0.0


runertime17@gmail.com

pelonducks25-crypto · 2026-07-26T21:32:54Z

@@ -1,51 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.


```
autonoma

pelonducks25-crypto · 2026-07-26T21:33:54Z

@@ -1,51 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports={
-extends: [


@SJuarezVazquez

pelonducks25-crypto · 2026-07-26T21:34:12Z

@@ -1,51 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports={


operacional

pelonducks25-crypto · 2026-07-26T21:35:06Z

 reviewed:
 npm:
- - "@actions/http-client"
+ - "@actions/http-client"


Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. Release notes *Sourced from [actions/setup-node's releases](https://github.com/actions/setup-node/releases).* > v7.0.0 > ------ > > What's Changed > -------------- > > ### Enhancements: > > * Add cache-primary-key and cache-matched-key as outputs by [`@gowridurgad`](https://github.com/gowridurgad) in [actions/setup-node#1577](https://redirect.github.com/actions/setup-node/pull/1577) > * Migrate to ESM and upgrade dependencies by [`@gowridurgad`](https://github.com/gowridurgad) in [actions/setup-node#1574](https://redirect.github.com/actions/setup-node/pull/1574) > > ### Bug fixes: > > * Remove dummy NODE\_AUTH\_TOKEN export by [`@gowridurgad`](https://github.com/gowridurgad) in [actions/setup-node#1558](https://redirect.github.com/actions/setup-node/pull/1558) > * Only use `mirrorToken` in `getManifest` if it's provided by [`@deiga`](https://github.com/deiga) in [actions/setup-node#1548](https://redirect.github.com/actions/setup-node/pull/1548) > > ### Documentation updates: > > * Add documentation for publishing to npm with Trusted Publisher (OIDC) by [`@chiranjib-swain`](https://github.com/chiranjib-swain) in [actions/setup-node#1536](https://redirect.github.com/actions/setup-node/pull/1536) > * docs: Update restore-only cache documentation by [`@priya-kinthali`](https://github.com/priya-kinthali) in [actions/setup-node#1550](https://redirect.github.com/actions/setup-node/pull/1550) > * docs: Update caching recommendations to mitigate cache poisoning risks by [`@chiranjib-swain`](https://github.com/chiranjib-swain) in [actions/setup-node#1567](https://redirect.github.com/actions/setup-node/pull/1567) > > ### Dependency update: > > * Upgrade `@actions/cache` to 5.1.0, log cache write denied by [`@jasongin`](https://github.com/jasongin) in [actions/setup-node#1569](https://redirect.github.com/actions/setup-node/pull/1569) > > New Contributors > ---------------- > > * [`@chiranjib-swain`](https://github.com/chiranjib-swain) made their first contribution in [actions/setup-node#1536](https://redirect.github.com/actions/setup-node/pull/1536) > * [`@deiga`](https://github.com/deiga) made their first contribution in [actions/setup-node#1548](https://redirect.github.com/actions/setup-node/pull/1548) > * [`@jasongin`](https://github.com/jasongin) made their first contribution in [actions/setup-node#1569](https://redirect.github.com/actions/setup-node/pull/1569) > > **Full Changelog**: <actions/setup-node@v6...v7.0.0> > > v6.5.0 > ------ > > What's Changed > -------------- > > * Update `@actions/cache` to 5.1.0 and add security overrides for undici and fast-xml-parser by [`@HarithaVattikuti`](https://github.com/HarithaVattikuti) in [actions/setup-node#1579](https://redirect.github.com/actions/setup-node/pull/1579) > > **Full Changelog**: <actions/setup-node@v6.4.0...v6.5.0> Commits * [`8207627`](actions/setup-node@8207627) Migrate to ESM and upgrade dependencies ([#1574](https://redirect.github.com/actions/setup-node/issues/1574)) * [`04be95c`](actions/setup-node@04be95c) Add cache-primary-key and cache-matched-key as outputs ([#1577](https://redirect.github.com/actions/setup-node/issues/1577)) * [`7c2c68d`](actions/setup-node@7c2c68d) docs: Update caching recommendations to mitigate cache poisoning risks ([#1567](https://redirect.github.com/actions/setup-node/issues/1567)) * [`6a61c03`](actions/setup-node@6a61c03) Merge pull request [#1569](https://redirect.github.com/actions/setup-node/issues/1569) from jasongin/update-actions-cache-5.1.0 * [`30eb73b`](actions/setup-node@30eb73b) Resolve high-severity audit issues * [`4e1a87a`](actions/setup-node@4e1a87a) Update dist * [`360237f`](actions/setup-node@360237f) Strict equality * [`4f8aac5`](actions/setup-node@4f8aac5) Bump `@actions/cache` to 5.1.0, log cache write denied * [`f4a67bb`](actions/setup-node@f4a67bb) Only use `mirrorToken` in `getManifest` if it's provided ([#1548](https://redirect.github.com/actions/setup-node/issues/1548)) * [`0355742`](actions/setup-node@0355742) Remove dummy NODE\_AUTH\_TOKEN export ([#1558](https://redirect.github.com/actions/setup-node/issues/1558)) * Additional commits viewable in [compare view](actions/setup-node@48b55a0...8207627) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/setup-node&package-manager=github\_actions&previous-version=6.4.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates all 8 call sites: ci.yml (4 jobs), license-check.yml, publish-gpr.yml, release.yml, upstream-contract.yml. v6 and v7 declare identical inputs and both run on node24; outputs are additive only. The ESM migration (actions/setup-node#1574) also bumped every bundled @actions/* toolkit across major boundaries, and added a missing `await` in cache-utils.ts that makes the previously-dead "Could not get npm cache folder path" guard live. No job on the PR exercises setup-node — they are all path-skipped — so the first real execution is the Release run on main.

@gowridurgad

@gowridurgad

##### [vv7.0.0](https://github.com/actions/setup-node/releases/tag/v7.0.0) ##### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@gowridurgad](https://github.com/gowridurgad) in [#1577](actions/setup-node#1577) - Migrate to ESM and upgrade dependencies by [@gowridurgad](https://github.com/gowridurgad) in [#1574](actions/setup-node#1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@gowridurgad](https://github.com/gowridurgad) in [#1558](actions/setup-node#1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@deiga](https://github.com/deiga) in [#1548](actions/setup-node#1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1536](actions/setup-node#1536) - docs: Update restore-only cache documentation by [@priya-kinthali](https://github.com/priya-kinthali) in [#1550](actions/setup-node#1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#1567](actions/setup-node#1567) ##### Dependency update: - Upgrade [@actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@jasongin](https://github.com/jasongin) in [#1569](actions/setup-node#1569) ##### New Contributors - [@chiranjib-swain](https://github.com/chiranjib-swain) made their first contribution in [#1536](actions/setup-node#1536) - [@deiga](https://github.com/deiga) made their first contribution in [#1548](actions/setup-node#1548) - [@jasongin](https://github.com/jasongin) made their first contribution in [#1569](actions/setup-node#1569) **Full Changelog**: <actions/setup-node@v6...v7.0.0> ##### [vv7](actions/setup-node@v6.5.0...v7.0.0) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Migrate to ESM
5f2bece

gowridurgad requested a review from a team as a code owner June 26, 2026 08:33

CopilotAI review requested due to automatic review settings June 26, 2026 08:33

Copilotstarted reviewing on behalf of gowridurgad June 26, 2026 08:33 View session

CopilotAI reviewed Jun 26, 2026
View reviewed changes

Comment threadpackage.json Outdated

updated package.json version
b8f1143

gowridurgad self-assigned this Jul 6, 2026

gowridurgad added 3 commits July 6, 2026 13:31

Update README for v6 and clean up dev dependencies
6cc5bc9

Remove unused ts-node
f491c59

Merge branch 'main' into esm-migration-node
0b42139

gowridurgad force-pushed the esm-migration-node branch from 01bf383 to 0b42139Compare July 8, 2026 15:32

priyagupta108 previously approved these changes Jul 9, 2026
View reviewed changes

fix audit issue
3c62118

gowridurgad dismissed priyagupta108’s stale review via 3c62118July 9, 2026 13:52

priyagupta108 approved these changes Jul 9, 2026
View reviewed changes

priya-kinthali approved these changes Jul 10, 2026
View reviewed changes

HarithaVattikuti approved these changes Jul 14, 2026
View reviewed changes

HarithaVattikuti merged commit 8207627 into actions:mainJul 14, 2026
231 checks passed

claudeBot mentioned this pull request Jul 14, 2026
chore(deps): update actions/setup-node action to v7 cbcoutinho/nextcloud-mcp-server#1073
Merged
1 task

mes-botBot mentioned this pull request Jul 14, 2026
chore(deps): bump actions/setup-node from 6 to 7 sympoies/symphony-board#570
Merged

HarithaVattikuti mentioned this pull request Jul 14, 2026
Automatic update of configuration files from 07/12/2026 #1581
Closed

giordano-lucas mentioned this pull request Jul 18, 2026
build(deps): bump actions/setup-node from 6 to 7 nottelabs/browserarena#31
Closed

claudeBot mentioned this pull request Jul 21, 2026
chore(deps): bump actions/setup-node from 6 to 7 everybody-eats-nz/volunteer-portal#1128
Merged

claudeBot mentioned this pull request Jul 21, 2026
chore(deps): bump actions/setup-node from 6 to 7 Bad3r/nix-R2-CloudFlare-Flake#115
Merged

github-actionsBot mentioned this pull request Jul 25, 2026
chore(deps): Bump the all-dependencies group with 3 updates ddteeter/agentic-guardrails-scaffolding#9
Merged

pelonducks25-crypto approved these changes Jul 26, 2026
View reviewed changes

pelonducks25-crypto suggested changes Jul 26, 2026
View reviewed changes

BohdanMoroz11 mentioned this pull request Jul 26, 2026
chore(deps): update actions/setup-node action to v7 BohdanMoroz11/personal-website#47
Merged
1 task

chybisov mentioned this pull request Jul 27, 2026
chore: bump packages lifinance/sdk#435
Merged
3 tasks

mshanemc mentioned this pull request Jul 28, 2026
chore(deps): bump actions/setup-node to v7 across workflows - W-23489769 forcedotcom/salesforcedx-vscode#7908
Merged

github-actionsBot mentioned this pull request Jul 29, 2026
Update actions/setup-node action to v7 claytono/infra#2653
Merged
1 task

cs3gallery mentioned this pull request Jul 30, 2026
ci(deps): Bump the github-actions group with 3 updates ZenixSolutions/lumics-mcp#6
Merged

chapplehub mentioned this pull request Jul 31, 2026
chore(deps): update actions/setup-node action to v7 chapplehub/estimate-management-system#732
Merged
1 task

ChelseaKR mentioned this pull request Jul 31, 2026
ci: bump actions/setup-node from 6.4.0 to 7.0.0 ChelseaKR/swelter#124
Merged

rtibblesbot mentioned this pull request Aug 1, 2026
Bump actions/setup-node from 6 to 7 in the github group across 1 directory learningequality/le-utils#230
Merged

AquilaXk mentioned this pull request Aug 1, 2026
chore(deps): bump actions/setup-node from 5.0.0 to 7.0.0 AquilaXk/aquila-blog#1477
Merged
20 tasks

masutaka mentioned this pull request Aug 2, 2026
build(deps): bump actions/setup-node from 6 to 7 masutaka/masutaka-feed#247
Merged

This was referenced Aug 5, 2026
chore(deps): bump the ci-actions group across 1 directory with 2 updates CaesiumY/CaesiumY.github.io#126
Merged
Bump actions/setup-node from 6.4.0 to 7.0.0 HillwoodPark/gcp-logger#164
Merged

github-actionsBot mentioned this pull request Aug 21, 2026
Bump actions/setup-node from 6 to 7 austenstone/copilot-cli#82
Open

robertvangor mentioned this pull request Aug 23, 2026
build(deps): bump actions/setup-node from 6.3.0 to 7.0.0 Staffbase/plugins-sdk-nodejs#114
Open

Baukebrenninkmeijer mentioned this pull request Aug 28, 2026
chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 orq-ai/orq-cli#50
Merged

Navigation Menu

Uh oh!

Migrate to ESM and upgrade dependencies - #1574

Migrate to ESM and upgrade dependencies#1574
HarithaVattikuti merged 6 commits into
actions:mainfrom
gowridurgad:esm-migration-node

gowridurgad commented Jun 26, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

Uh oh!

Uh oh!

matkoniecz commented Jul 17, 2026•
edited
Loading

Uh oh!

gowridurgad commented Jul 22, 2026

Uh oh!

pelonducks25-cryptoJul 26, 2026

Uh oh!

pelonducks25-cryptoJul 26, 2026

Uh oh!

pelonducks25-cryptoJul 26, 2026

Uh oh!

pelonducks25-cryptoJul 26, 2026

Uh oh!

pelonducks25-cryptoJul 26, 2026

Uh oh!

pelonducks25-cryptoJul 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

		@@ -1,51 +0,0 @@
		// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.

		@@ -1,51 +0,0 @@
		// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
		module.exports={

Uh oh!

Conversation

gowridurgad commented Jun 26, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

matkoniecz commented Jul 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gowridurgad commented Jul 22, 2026

Uh oh!

pelonducks25-cryptoJul 26, 2026

Choose a reason for hiding this comment

Uh oh!

pelonducks25-cryptoJul 26, 2026

Choose a reason for hiding this comment

Uh oh!

pelonducks25-cryptoJul 26, 2026

Choose a reason for hiding this comment

Uh oh!

pelonducks25-cryptoJul 26, 2026

Choose a reason for hiding this comment

Uh oh!

pelonducks25-cryptoJul 26, 2026

Choose a reason for hiding this comment

Uh oh!

pelonducks25-cryptoJul 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

matkoniecz commented Jul 17, 2026•
edited
Loading