Skip to content

chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 - #234

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-7.1.0
Open

chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0#234
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-7.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 10, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/setup-node from 7.0.0 to 7.1.0.

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0
f5894ea 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 7.0.0 to 7.1.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 10, 2026
@devin-ai-integration

devin-ai-integration Bot commented Oct 10, 2026

Copy link
Copy Markdown
Contributor

E2E review: no defects found

Tested SHA: f5894eaf0af2fa4a741956ace2cef998b54cfc7e (base main @ ec55a32). Scope: the PR changes one line, the actions/setup-node pin in .github/workflows/publish-npm.yml (v7.0.0 8207627 → v7.1.0 949feb2). It changes no runtime, CLI, SDK, MCP or browser code; src/, scripts/ and tests/ are byte-identical to base.

What actually ran (Linux x64, disposable, no credentials)

  • I checked the pins against upstream with git ls-remote https://github.com/actions/setup-node: refs/tags/v7.1.0 = 949feb2… (also current v7) and refs/tags/v7.0.0 = 8207627…. Both use node24. The only action.yml change is the node-version-file description, which now mentions mise.toml.
  • I ran the real action dist/setup/index.js (main) and dist/cache-save/index.js (post) on Node v24.21.0. The runner was simulated: RUNNER_TEMP/RUNNER_TOOL_CACHE, GITHUB_ENV/PATH/OUTPUT/STATE. Inputs matched the workflow (node-version: 22.18.0, registry-url: https://registry.npmjs.org). I ran v7.1.0 and the base v7.0.0.
  • After that I ran the workflow's next steps using the PATH and env that setup-node exported: npm install --global npm@11.5.1, bun install --frozen-lockfile --ignore-scripts, the read-only npm view existing-version check and bun run build. Finally I ran npm publish --dry-run, which used no token and uploaded nothing.
Journey Result
setup-node v7.1.0 installs Node 22.18.0 / npm 10.9.3 and puts it on PATH passed
.npmrc (//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}, registry=…) and NPM_CONFIG_USERCONFIG export passed, identical to v7.0.0
node-version output, post step (no cache configured → no-op) passed, identical to v7.0.0
npm 11.5.1 upgrade, bun install, build, npm publish --dry-run (betterwright@2.8.8, 186 files) passed under both versions
Base vs PR diff of PATH / env / outputs / .npmrc / npm config identical
Local lint / typecheck / check:versions passed
Local test:unit 1322 pass / 24 skip / 2 fail. Both failures are in chromium-package.test.ts and come from my environment, not the PR (see below)
PR CI (Node tests, Worker copies in sync, 6× cross-platform unit tests, dependency audit) 9/9 passed
Real trusted publish (OIDC → npm) blocked: production publish, deliberately not run

Recording (MP4, 36 s, tested SHA f5894ea). It runs v7.0.0 then v7.1.0 and ends with "IDENTICAL runner outputs/env/.npmrc": e2e-pr234-f5894ea-setup-node-v7.1.0.mp4. GitHub cannot host the MP4 directly from this tool, so this link opens as a Devin attachment and may need Devin sign-in. The same recording as a preview:

E2E recording preview

Findings

  • No confirmed bugs, so there is no fix PR.
  • Environment issues, not caused by this PR:
    • The two local unit-test failures happen because scripts/chromium/package-runtime.py uses hashlib.file_digest, which needs Python ≥3.11, and this VM has Python 3.10.12. The same tests pass in CI.
    • setup-node's manifest fetch from actions/node-versions hit GitHub's unauthenticated API rate limit, because no token was supplied locally. v7.1.0's new retry (3 attempts) and its fallback to nodejs.org/dist both worked as expected. On Actions, github.token avoids the rate limit.
  • Not tested:
    • the real GitHub-hosted runner run of publish-npm.yml, which only triggers on release or dispatch
    • the OIDC Trusted Publishing upload
    • the browser integration suite inside the publish job, because setup-node does not affect it

Ready for a human decision on merging; this review does not merge.

Written by Devin

@devin-ai-integration

devin-ai-integration Bot commented Oct 10, 2026

Copy link
Copy Markdown
Contributor

I found no defects in PR #234 at f5894ea, so there is no fix PR. The setup-node v7.1.0 step produced the same results as v7.0.0 when I ran them side by side. The report is posted on the PR as comment 6092221308.

How it was tested: I downloaded the setup-node action at both pinned commits and checked them against the upstream v7.0.0 and v7.1.0 tags. I ran each version's main and post steps on a simulated GitHub runner, with the same inputs publish-npm.yml uses. I then ran the workflow steps that follow it, up to npm publish --dry-run (no token, nothing uploaded). Both versions gave the same PATH, env, outputs and .npmrc. All 9 CI checks on the PR passed, and local lint, typecheck and version checks passed.

Issues caused by my environment, not the PR:

  • 2 local unit-test failures in chromium-package.test.ts: a packaging script needs Python 3.11 and this VM has 3.10. The same tests pass in CI.
  • setup-node rate limit: the action hit GitHub's API rate limit because no token was supplied locally. It retried and fell back to downloading Node from nodejs.org, which worked.

Not tested:

  • A real publish-npm.yml run on a GitHub-hosted runner (it only runs on release or manual dispatch).
  • The actual npm publish through Trusted Publishing.
  • The publish job's browser integration suite, which this change doesn't affect.

Video:

  • The 36-second MP4 is attached here. On the PR it's a Devin attachment link, which may need Devin sign-in, because I couldn't attach the MP4 to GitHub directly.
  • The comment also embeds an animated WebP version.
  • I confirmed the comment was posted but couldn't open either link to check it renders. The VM can't reach app.devin.ai, and GitHub's API was rate-limited.

Merging is your call; I haven't approved or merged anything.

This response includes attachments — view them in Devin

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants