Skip to content

chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 in the github-actions-minor-patch group - #82

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/github-actions-minor-patch-2f4c4b3894
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/github-actions-minor-patch-2f4c4b3894

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions-minor-patch group with 1 update: actions/setup-node.

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions-minor-patch group with 1 update: [actions/setup-node](https://github.com/actions/setup-node).


Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 14, 2026
@github-actions

Copy link
Copy Markdown

depsound · 1 dependency change · review the changes

  • gha:actions/setup-node 820762786026 → 949feb2413d6: generated code changed (dist/setup/index.js, +/-94,238 lines): outside the review surface, worth a look; mostly unreviewable at rest (both versions): 7.0MB of 7.7MB (91%) generated/binary/minified/oversized; expect the same on every bump. This is what the runner executes, so it weighs in full

Checked: the published artifact diff, pin grade, execution model, runner capability references (grep, evadable). Not checked: runtime behaviour, intent (an obfuscated payload reads as ordinary code), the permissions, secrets and trigger at each callsite, self-hosted runner reach, publish provenance. No advisory scan for 1 of these: OSV indexes none for that ecosystem.

Continue locally, the full per-file analysis and a grep-able workspace (trees + stats.json) are available for agent investigation:

go run github.com/rvagg/depsound/cmd/depsound@v0.35.1 gha:actions/setup-node 820762786026740c76f36085b0efc47a31fe5020 949feb2413d6458794dcd2491c4babbbce0c15c1
Or hand this PR to an agent: point it at the PR and the review skill for a proceed/hold call.

depsound · full report + logs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants