Repository navigation
chore(deps): bump actions/setup-node from 4 to 7 - #865
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Dependency verification: NEEDS A HUMAN DECISIONRisk tier high (release-tooling) · ecosystems: github-actions · head Decisions for a humanVerification is complete for these items. Each one needs a choice, not more checks.
Updates
What the verifier checked
Already failing on
|
| Check | Kind | Base | PR | Outcome |
|---|---|---|---|---|
| The release npm job installs npm 11 and publishes through OIDC with the .npmrc that setup-node writes | guard | pass | pass | holds on both |
| npm 11 reads the release job's .npmrc with no unknown-config warning | discriminating | fail | pass | proven (fails on base, passes on PR) |
| setup-node turns on no npm cache in the release npm jobs | guard | pass | pass | holds on both |
Impact review
actions/setup-node moves from the floating @v4 (v4.4.0) to the floating @v7 (v7.1.0 today) in dev-server-ui.yml and in the release-ldcli-npm jobs of release-please.yml and manual-publish.yml. v5 moves to node24 and adds automatic npm caching from package.json packageManager. v6.1.0 removes always-auth. v7.0.0 moves to ES modules, adds cache outputs, and stops exporting the dummy NODE_AUTH_TOKEN when registry-url is set. v7.1.0 adds mise.toml, absolute node-version-file paths, and Node version validation with manifest retry. The release npm jobs reach the NODE_AUTH_TOKEN and always-auth changes. Generated checks ran the real setup-node, the real Update npm step against registry.npmjs.org, and the real publish script with OIDC against a local registry. The publish works on v4.4.0 and v7.1.0, and only v7.1.0 removes npm's always-auth warning (proven). No automatic cache reaches the release jobs. PR CI ran v7.1.0 in dev-server-ui.yml on the PR head and passed.
- actions/setup-node v4 (v4.4.0)..v7 (v7.1.0): v5.0.0: node24 runtime, runner v2.327.1 or later; automatic caching when package.json has a packageManager field, new input package-manager-cache (default true) (#1348). v6.0.0: automatic caching only for npm (#1374). v6.1.0: always-auth input and .npmrc line removed (#1436);
@actions/cache4.1. v6.2.0:@actions/cache5.0.1, docs. v6.3.0: devEngines.runtime preferred for node-version-file: package.json (#1283); mirror-url bearer fix (#1467); uuid replaced. v6.4.0:@actionsdependency updates. v6.5.0:@actions/cache5.1.0, undici and fast-xml-parser overrides. v7.0.0: ESM migration (#1574); outputs cache-primary-key and cache-matched-key (#1577); the dummy NODE_AUTH_TOKEN export is removed (#1558, README: npm Trusted Publishing is not affected); mirrorToken only when given (#1548); cache write denied is logged (#1569). v7.1.0: mise.toml support (#1421), absolute paths in node-version-file (#1633), Node version validation and manifest fetch retry (#1580),@actions/cache6.2.0 (#1584). (breaking) (source) - Used in:
.github/workflows/dev-server-ui.yml,.github/workflows/release-please.yml,.github/workflows/manual-publish.yml,.github/actions/publish-npm/action.yml,scripts/publish-npm.sh - Upstream behavior changes that reach ldcli: yes
- Note: The release-ldcli-npm jobs set registry-url and pass no NODE_AUTH_TOKEN. With v4.4.0, later steps get NODE_AUTH_TOKEN=XXXXX-XXXXX-XXXXX-XXXXX (release run 35993978650 shows it). With v7.1.0, NODE_AUTH_TOKEN is not set, so npm reads the literal ${NODE_AUTH_TOKEN} from the .npmrc. The guard ran the real job steps on both versions: npm install -g npm@11.6.2 worked against registry.npmjs.org, and scripts/publish-npm.sh exchanged the OIDC token and uploaded with the exchanged token. npm 11.6.2 replaces the configured token with the OIDC token before it publishes (lib/utils/oidc.js). The check removed --provenance, because provenance needs Sigstore, and setup-node does not take part in it. (generated/setup-node-release-npm-publish.sh, Remove dummy NODE_AUTH_TOKEN export actions/setup-node#1558, https://github.com/launchdarkly/ldcli/actions/runs/35993978650)
- Note: v4.4.0 writes always-auth=false into the .npmrc, and npm 11 prints 'Unknown user config "always-auth". This will stop working in the next major version of npm.' in every release npm job (release run 35993978650). v7.1.0 does not write it (discriminating check, proven). (generated/setup-node-npmrc-no-unknown-config.sh, Remove always-auth configuration handling from action actions/setup-node#1436)
- Note: Automatic npm caching (v5 and v6) does not reach ldcli. The root package.json has no packageManager or devEngines.packageManager field, and the release npm jobs set no cache input, so the release jobs restore no cache (guard). dev-server-ui.yml already sets cache: npm. ldcli does not set package-manager-cache, the new input with default true. (generated/setup-node-no-auto-cache-in-release.sh, package.json, Enhance caching in setup-node with automatic package manager detection actions/setup-node#1348)
- Note: The v7.1.0 Node version validation (#1580) accepts the versions that ldcli passes: 20.x in the release npm jobs (the guard installed Node 20 with the real v7.1.0 code) and lts/* in dev-server-ui.yml (PR CI run 38592842219 resolved Node 24.21.0 and restored the npm cache under the existing key node-cache-Linux-x64-npm-eceb8374…). ldcli does not use node-version-file, mise.toml, or devEngines. (https://github.com/launchdarkly/ldcli/actions/runs/38592842219, Add Node version validation and manifest fetch retry actions/setup-node#1580)
- Note: No step reads a setup-node output, so the new cache outputs change nothing. The release npm jobs still pin Node 20.x, which is end of life. That is not a change in this PR. (.github/workflows/release-please.yml, .github/workflows/manual-publish.yml)
- Note: The release workflows have not run the npm job since 2026-09-24. A manual-publish run with dry-run-npm: false and dry_run: true runs setup-node v7 and the Update npm step in release-ldcli-npm, and scripts/publish-npm.sh then skips the publish. (.github/workflows/manual-publish.yml)
Check details
pr-state
- Branch is 6 commit(s) behind
main. The checks ran on the PR merged into the currentmain.
ci-status
Workflows that PR CI must run on 2c4558a, and their runs on that commit:
| Workflow | Event | Run | Result |
|---|---|---|---|
.github/workflows/dependency-scan.yml |
pull_request | 38592842313 2026-10-14 | pass: success |
.github/workflows/dev-server-ui.yml |
pull_request | 38592842219 2026-10-14 | pass: success |
.github/workflows/go.yml |
pull_request | 38592842438 2026-10-14 | pass: success |
.github/workflows/lint-pr-title.yml |
pull_request_target | 38592883176 2026-10-14 | pass: success |
- Check
Cursor Bugbot: success - Check
Do Not Merge checker: success - Check
Require additional human oversight on bot PRs: success - Check
semgrep-cloud-platform/scan: success
upstream-changes
actions/setup-nodev4 → v7: actions/setup-node, 64 commits, 157 files, notes: release notes, full range, mentions: breaking (4), security (3), requirements (5)- Correction: this check reads the floating
@v7ref as 7.0.0. Its saved notes stop at v7.0.0 and skip v7.1.0, the release that@v7points to. They also include v4.0.1 to v4.4.0, whichmainalready has. So "full range" is not correct here. The impact review covers the real range, v4.4.0 to v7.1.0.
actionlint
.github/workflows/go.yml:29:13: the runner of "actions/setup-python@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue [action]
.github/workflows/release-please.yml:60:14: label "ubuntu-22.04-8core-32gb" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-2019", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "ubuntu-20.04", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file [runner-label]
actions-coverage
| Action | Change | Used in | Runs on PR CI? | Upstream action.yml |
|---|---|---|---|---|
actions/setup-node |
v4 (v4.4.0) → v7 (v7.1.0) | .github/workflows/dev-server-ui.yml, .github/workflows/manual-publish.yml, .github/workflows/release-please.yml | partly, not .github/workflows/manual-publish.yml, .github/workflows/release-please.yml | inputs used: cache, node-version, registry-url; outputs read: none; runtime node20 → node24 |
generated: setup-node-release-npm-publish
With actions/setup-node@v7 (v7.1.0), the release-ldcli-npm job got: NODE_AUTH_TOKEN not set. .npmrc: //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}.
The Update npm step installed npm 11.6.2 from registry.npmjs.org with that .npmrc. scripts/publish-npm.sh then exchanged the OIDC token and uploaded the package with the exchanged token.
generated: setup-node-npmrc-no-unknown-config
With actions/setup-node@v7 (v7.1.0), npm 11.6.2 reads the generated .npmrc with no unknown-config warning.
generated: setup-node-no-auto-cache-in-release
package.json has no packageManager or devEngines.packageManager field, and the release npm jobs set no cache input, so setup-node does not restore an npm cache there.
Generated by scripts/dependency-pr/verify.sh (profile full) at 2026-10-17T00:36:25Z. The verifier does not approve or merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/setup-node from 4 to 7.
Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
949feb2Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)7207c4fchore: update dependencies and add license files (#1642)54337e0Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)fb54fa8Bump jest-each from 30.4.1 to 30.5.2 (#1636)7f84f1dBump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)0c54c7bBump@typescript-eslint/parserfrom 8.62.0 to 8.70.0 (#1615)a829419Bump@types/semverfrom 7.7.1 to 7.8.0 (#1616)680d1e4Support absolute paths in node-version-file (#1633)db0fb3aBump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)94196eeBump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Overview
Upgrades
actions/setup-nodefrom v4 to v7 in three GitHub Actions workflows: dev-server UI CI, manual npm publish, and release-please npm publish.Node version pins and inputs are unchanged (
lts/*with npm cache in dev-server UI; Node 20.x withregistry-urlon the publish jobs). This is a Dependabot-style action version bump only—no workflow logic or step ordering changes.Reviewed by Cursor Bugbot for commit 2c4558a. Bugbot is set up for automated code reviews on this repo. Configure here.