chore(deps): update actions/setup-node action to v7 by renovate[bot] · Pull Request #27 · wave-av/wave-profiles

renovate · 2026-07-16T07:13:29Z

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	major	`v6.4.0` → `v7.0.0`

Release Notes

actions/setup-node (actions/setup-node)

`v7.0.0`

Compare Source

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in #1577
Migrate to ESM and upgrade dependencies by @gowridurgad in #1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in #1558
Only use mirrorToken in getManifest if it's provided by @deiga in #1548

Documentation updates:

Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in #1536
docs: Update restore-only cache documentation by @priya-kinthali in #1550
docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in #1567

Dependency update:

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in #1569

New Contributors

@chiranjib-swain made their first contribution in #1536
@deiga made their first contribution in #1548
@jasongin made their first contribution in #1569

Full Changelog: actions/setup-node@v6...v7.0.0

`v6.5.0`

Compare Source

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in #1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-07-16T07:13:34Z

⚠️ No Changeset found

Latest commit: cb5a2ad

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

cursor

Risk: low. Approved — this is a narrow CI-only bump of actions/setup-node to v7 in the governance-enforce workflow. Cursor Bugbot was not present on this PR; no reviewers assigned.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

greptile-apps · 2026-08-14T16:35:01Z

PR author is in the excluded authors list.

devin-ai-integration

Devin Review found 1 potential issue.

devin-ai-integration · 2026-08-14T16:35:28Z

          fetch-depth: 0
          persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0


🔍 Major-version bump of setup-node may change default Node/runtime expectations

This is a major version jump (v6 -> v7) of actions/setup-node, pinned by SHA. Major releases of this action have historically changed the runner Node runtime and default behaviors (e.g. default caching/npm registry handling, minimum runner version). The workflow still pins node-version: "22" and relies on the action writing no .npmrc (the enforce step creates its own .npmrc with NODE_AUTH_TOKEN at .github/workflows/governance-enforce.yml:36-38), so behavior should hold, but it is worth confirming against the v7 release notes that (a) the pinned SHA matches the v7.0.0 tag and (b) v7 doesn't alter registry/.npmrc handling in a way that conflicts with the isolated install step. This is the only setup-node usage in the repo, so no version skew with other workflows.

Was this helpful? React with 👍 or 👎 to provide feedback.

macroscopeapp · 2026-08-14T16:37:27Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR is a one-line update to a pinned CI action, and the workflow’s Node, authentication, and caching behavior remains materially unchanged. Because it modifies an explicitly owner-routed governance workflow outside the author’s ownership, review by the designated team is warranted.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

No code changes detected at 5e95677. Prior analysis still applies.

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

codeant-ai · 2026-08-24T03:24:44Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

codeant-ai · 2026-08-27T00:42:41Z