Consolidate the open Dependabot action bumps - #6
Merged
Conversation
Both open Dependabot pull requests moved one action of a CI that had drifted a major or more behind, so they land together instead of as two merges of the same file. actions/checkout v4 -> v7 and actions/setup-node v4 -> v7. Every major in this range is a Node runtime bump (node20 -> node24, requiring runner v2.327.1, which the hosted runners are past) plus an ESM migration internal to the action. setup-node v5 also began caching automatically when package.json declares a packageManager field, and v6 narrowed that to npm; no package.json here declares one, so the behavior is unchanged. Claude-Session: https://claude.ai/code/session_017mpHcHkfU5KmGntTgWwrvD
This was referenced Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the two open Dependabot pull requests. Neither carries a security
advisory — there are no open Dependabot alerts in this repository — but the CI
had drifted a major or more behind across the board, and merging them one at a
time means two passes over the same file.
actions/checkoutv4 -> v7 andactions/setup-nodev4 -> v7.Dependabot proposed the target majors it knew about when each pull request was
opened; where a newer major has landed since, the action goes to its current
release rather than to a version that is already behind.
Every major in this range is a Node runtime bump (node20 -> node24, requiring
runner v2.327.1, which the hosted runners are past) plus an ESM migration
internal to the action.
setup-nodev5 also began caching automatically whenpackage.jsondeclares apackageManagerfield, and v6 narrowed that to npm;no
package.jsonhere declares one, so the behavior is unchanged. Every steppasses only its version input, so no removed or renamed input applies.