Bump actions/setup-node from 6 to 7 by dependabot[bot] · Pull Request #105 · github/issue-parser

dependabot · 2026-11-02T12:36:09Z

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in actions/setup-node#1577

Migrate to ESM and upgrade dependencies by @gowridurgad in actions/setup-node#1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in actions/setup-node#1558

Only use mirrorToken in getManifest if it's provided by @deiga in actions/setup-node#1548

Documentation updates:

Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in actions/setup-node#1536

docs: Update restore-only cache documentation by @priya-kinthali in actions/setup-node#1550

docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in actions/setup-node#1567

Dependency update:

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-node#1569

New Contributors

@chiranjib-swain made their first contribution in actions/setup-node#1536

@deiga made their first contribution in actions/setup-node#1548

@jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

Upgrade @actions dependencies by @Copilot in actions/setup-node#1525

Update Node.js versions in versions.yml and bump package to v6.4.0 by @priya-kinthali in actions/setup-node#1533

New Contributors

@Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

Support parsing devEngines field by @susnux in actions/setup-node#1283

... (truncated)

Commits

949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
7207c4f chore: update dependencies and add license files (#1642)
54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
0c54c7b Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
a829419 Bump @types/semver from 7.7.1 to 7.8.0 (#1616)
680d1e4 Support absolute paths in node-version-file (#1633)
db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-11-02T12:40:36Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5	0	0	0.06s
❌ ACTION	zizmor	5	1	0	0.26s
✅ JSON	jsonlint	23	0	0	0.27s
✅ JSON	npm-package-json-lint	yes	no	no	0.94s
✅ JSON	prettier	23	0	0	1.34s
✅ JSON	v8r	23	0	0	14.77s
✅ MARKDOWN	markdownlint	1	0	0	1.15s
✅ REPOSITORY	betterleaks	yes	no	no	0.85s
✅ REPOSITORY	checkov	yes	no	no	21.0s
✅ REPOSITORY	gitleaks	yes	no	no	1.08s
✅ REPOSITORY	git_diff	yes	no	no	0.01s
✅ REPOSITORY	grype	yes	no	no	108.36s
❌ REPOSITORY	osv-scanner	yes	63	no	1.79s
✅ REPOSITORY	secretlint	yes	no	no	0.98s
✅ REPOSITORY	syft	yes	no	no	3.04s
✅ REPOSITORY	trivy-sbom	yes	no	no	2.38s
✅ REPOSITORY	trufflehog	yes	no	no	14.65s
✅ TYPESCRIPT	eslint	8	0	0	6.48s
✅ TYPESCRIPT	prettier	8	0	0	0.93s
✅ YAML	prettier	19	0	0	0.67s
✅ YAML	v8r	19	0	0	10.75s
✅ YAML	yamllint	19	0	0	0.65s

Detailed Issues

❌ REPOSITORY / osv-scanner - 63 errors

Scanning dir .
Starting filesystem walk for root: /
Scanned package-lock.json file and found 527 packages
End status: 53 dirs visited, 189 inodes visited, 1 Extract calls, 82.430522ms elapsed, 82.430753ms wall time

Total 21 packages affected by 63 known vulnerabilities (3 Critical, 34 High, 24 Medium, 2 Low, 0 Unknown) from 1 ecosystem.
62 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE                        | VERSION | FIXED VERSION | SOURCE            |
+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+
| https://osv.dev/GHSA-4x5r-pxfx-6jf8 | 3.2  | npm       | @babel/core (dev)              | 7.29.0  | 7.29.6        | package-lock.json |
| https://osv.dev/GHSA-p498-v437-472g | 5.7  | npm       | @humanfs/node (dev)            | 0.16.7  | 0.16.8        | package-lock.json |
| https://osv.dev/GHSA-w5vr-8v7q-w6rv | 6.6  | npm       | baseline-browser-mapping (dev) | 2.10.9  | 2.11.0        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.16        | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.19        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.13        | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.17        | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.21        | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.20        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.18        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.2         | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.5         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.0.3         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.3         | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.7         | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.6         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.4         | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.7         | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.10        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.12        | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.11        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-73wf-gq98-2v4g | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-c83g-rgw3-j3cx | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-gcqx-w48m-w2h4 | 5.3  | npm       | deepmerge (dev)                | 4.3.1   | --            | package-lock.json |
| https://osv.dev/GHSA-3g3m-2fjr-6pw4 | 6.3  | npm       | glob (dev)                     | 10.5.0  | 14.0.2        | package-lock.json |
| https://osv.dev/GHSA-2qvq-rjwj-gvw9 | 4.7  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-2w6w-674q-4c4q | 9.8  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-3mfm-83xf-c92r | 8.1  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-442j-39wm-28r2 | 3.7  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-7rx3-28cr-v5wh | 4.8  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-8r5x-fm3f-whwj | 9.8  | npm       | handlebars (dev)               | 4.7.8   | 4.7.10        | package-lock.json |
| https://osv.dev/GHSA-9cx6-37pm-9jff | 7.5  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-p8wg-vrv2-v86f | 9.2  | npm       | handlebars (dev)               | 4.7.8   | 4.7.10        | package-lock.json |
| https://osv.dev/GHSA-xhpv-hc6g-r9c6 | 8.1  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-xjpj-3mr7-gcpf | 8.2  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-xw65-4hp5-5hc7 | 4.7  | npm       | handlebars (dev)               | 4.7.8   | 4.7.10        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.2        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.1        | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.2         | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.1         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash (dev)                   | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash (dev)                   | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-g3hv-75wg-m249 | 6.9  | npm       | minimatch (dev)                | 10.2.4  | 11.0.1        | package-lock.json |
| https://osv.dev/GHSA-g3hv-75wg-m249 | 6.9  | npm       | minimatch (dev)                | 3.1.5   | 11.0.1        | package-lock.json |
| https://osv.dev/GHSA-23c5-xmqv-rm74 | 7.5  | npm       | minimatch (dev)                | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-3ppc-4f35-3m26 | 8.7  | npm       | minimatch (dev)                | 9.0.3   | 9.0.6         | package-lock.json |
| https://osv.dev/GHSA-7r86-cg39-jmmj | 7.5  | npm       | minimatch (dev)                | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-g3hv-75wg-m249 | 6.9  | npm       | minimatch (dev)                | 9.0.3   | 11.0.1        | package-lock.json |
| https://osv.dev/GHSA-g3hv-75wg-m249 | 6.9  | npm       | minimatch (dev)                | 9.0.9   | 11.0.1        | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)                     | 8.3.2   | 11.1.1        | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                           | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/check-dist.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,TYPESCRIPT_ES,TYPESCRIPT_PRETTIER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 2, 2026

dependabot Bot requested a review from ncalteen as a code owner November 2, 2026 12:36

dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Nov 2, 2026

Navigation Menu

Repository navigation

Bump actions/setup-node from 6 to 7 - #105

Bump actions/setup-node from 6 to 7#105
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-7

dependabot Bot commented on behalf of github Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 2, 2026

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

v6.5.0

What's Changed

v6.4.0

What's Changed

Dependency updates:

New Contributors

v6.3.0

What's Changed

Enhancements:

Uh oh!

github-actions Bot commented Nov 2, 2026

❌MegaLinter analysis: Error

Detailed Issues

Notices

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants