From 54f4aec3a27a81a9a517615274426180d518f4ff Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 21:29:53 +0000 Subject: [PATCH 1/2] build(deps): Bump actions/setup-node from 7.0.0 to 7.1.0 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 7.0.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- .github/workflows/nightly-recovery.yml | 10 +++++----- .github/workflows/nightly.yml | 8 ++++---- .github/workflows/release-please.yml | 2 +- .github/workflows/release-recovery.yml | 10 +++++----- .github/workflows/release.yml | 10 +++++----- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 77e256e..830859d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -92,7 +92,7 @@ jobs: - name: Install Pinned Node if: steps.scope.outputs.full_ci == 'true' - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm diff --git a/.github/workflows/nightly-recovery.yml b/.github/workflows/nightly-recovery.yml index 26cf899..67564ef 100644 --- a/.github/workflows/nightly-recovery.yml +++ b/.github/workflows/nightly-recovery.yml @@ -77,7 +77,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: '${{ github.workflow_sha }}', fetch-depth: 0, persist-credentials: false} - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy @@ -302,7 +302,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: '${{ inputs.expected_sha }}', persist-credentials: false} - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy @@ -344,7 +344,7 @@ jobs: git merge-base --is-ancestor "${{ github.workflow_sha }}" origin/main [ "$(git rev-parse "refs/tags/$TAG^{}")" = "$SOURCE_SHA" ] git worktree add --quiet --detach release-source "$SOURCE_SHA" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy @@ -395,7 +395,7 @@ jobs: git merge-base --is-ancestor "${{ github.workflow_sha }}" origin/main [ "$(git rev-parse "refs/tags/$TAG^{}")" = "$SOURCE_SHA" ] git worktree add --quiet --detach release-source "$SOURCE_SHA" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy @@ -580,7 +580,7 @@ jobs: git merge-base --is-ancestor "${{ github.workflow_sha }}" origin/main [ "$(git rev-parse "refs/tags/$TAG^{}")" = "$SOURCE_SHA" ] git worktree add --quiet --detach release-source "$SOURCE_SHA" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 3e58ea8..934fa18 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -50,7 +50,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -154,7 +154,7 @@ jobs: with: ref: ${{ needs.prepare.outputs.source_sha }} persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -254,7 +254,7 @@ jobs: ref: ${{ needs.prepare.outputs.source_sha }} fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -391,7 +391,7 @@ jobs: git merge-base --is-ancestor "${{ github.workflow_sha }}" origin/main [ "$(git rev-parse "refs/tags/$TAG^{}")" = "$SOURCE_SHA" ] git worktree add --quiet --detach release-source "$SOURCE_SHA" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index fbe3fcc..19dbc5c 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -48,7 +48,7 @@ jobs: echo 'ready=true' >>"$GITHUB_OUTPUT" - name: Install pinned Node for release eligibility if: steps.gate.outputs.ready == 'true' - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 - name: Install locked release policy dependencies diff --git a/.github/workflows/release-recovery.yml b/.github/workflows/release-recovery.yml index b9ab9f5..74effa8 100644 --- a/.github/workflows/release-recovery.yml +++ b/.github/workflows/release-recovery.yml @@ -76,7 +76,7 @@ jobs: ref: '${{ github.workflow_sha }}' fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -226,7 +226,7 @@ jobs: git merge-base --is-ancestor "${{ github.workflow_sha }}" origin/main [ "$(git rev-parse "refs/tags/$TAG^{}")" = "$SOURCE_SHA" ] git worktree add --quiet --detach release-source "$SOURCE_SHA" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -288,7 +288,7 @@ jobs: git merge-base --is-ancestor "${{ github.workflow_sha }}" origin/main [ "$(git rev-parse "refs/tags/$TAG^{}")" = "$SOURCE_SHA" ] git worktree add --quiet --detach release-source "$SOURCE_SHA" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy @@ -334,7 +334,7 @@ jobs: git merge-base --is-ancestor "${{ github.workflow_sha }}" origin/main [ "$(git rev-parse "refs/tags/$TAG^{}")" = "$SOURCE_SHA" ] git worktree add --quiet --detach release-source "$SOURCE_SHA" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy @@ -387,7 +387,7 @@ jobs: git merge-base --is-ancestor "${{ github.workflow_sha }}" origin/main [ "$(git rev-parse "refs/tags/$TAG^{}")" = "$SOURCE_SHA" ] git worktree add --quiet --detach release-source "$SOURCE_SHA" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8f859ea..d74c06f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -261,7 +261,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -321,7 +321,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -358,7 +358,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -445,7 +445,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -480,7 +480,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm From 1fceb786a2ec34ac7c4ad965ab292b7ca63d8da7 Mon Sep 17 00:00:00 2001 From: jatmn Date: Sun, 18 Oct 2026 14:49:18 -0700 Subject: [PATCH 2/2] build(deps): sync setup-node 7.1.0 release pins Update the release tooling manifest, cargo-dist configuration, and workflow overlay pins to match the setup-node 7.1.0 workflow update. This resolves the pin-policy mismatch and prevents generation from restoring 7.0.0. Validation: existing workflow validator and git diff --check passed. The local full Linux preflight was explicitly waived by the maintainer for this pin-only fix; GitHub Actions will validate the submitted revision. Signed-off-by: jatmn --- dist-workspace.toml | 2 +- tools/release-please-policy/patch-dist-workflow.mjs | 10 +++++----- tools/release-tooling.json | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/dist-workspace.toml b/dist-workspace.toml index e529817..a251ae6 100644 --- a/dist-workspace.toml +++ b/dist-workspace.toml @@ -36,4 +36,4 @@ x86_64-pc-windows-msvc = "windows-2025" "actions/download-artifact" = "9000827ccba6bdab643e8b6fd33ac0654aef8333" # v8.0.2 "actions/attest-build-provenance" = "4d101475d8b20a2381f78447822ac1eab6504dd8" # v4.2.2 "actions/attest" = "1e69f48acb82d1966a394da916b4c1698aa569d6" # v4.2.2 -"actions/setup-node" = "820762786026740c76f36085b0efc47a31fe5020" # v7.0.0 +"actions/setup-node" = "949feb2413d6458794dcd2491c4babbbce0c15c1" # v7.1.0 diff --git a/tools/release-please-policy/patch-dist-workflow.mjs b/tools/release-please-policy/patch-dist-workflow.mjs index 8f4561b..61676b3 100644 --- a/tools/release-please-policy/patch-dist-workflow.mjs +++ b/tools/release-please-policy/patch-dist-workflow.mjs @@ -176,7 +176,7 @@ source = source.slice(0, hostStart) + ` # Assemble the complete non-publishable - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -236,7 +236,7 @@ source = source.slice(0, hostStart) + ` # Assemble the complete non-publishable - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -273,7 +273,7 @@ source = source.slice(0, hostStart) + ` # Assemble the complete non-publishable with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -360,7 +360,7 @@ source = source.slice(0, hostStart) + ` # Assemble the complete non-publishable with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm @@ -395,7 +395,7 @@ source = source.slice(0, hostStart) + ` # Assemble the complete non-publishable with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.20.0 cache: npm diff --git a/tools/release-tooling.json b/tools/release-tooling.json index 2188dc3..7726237 100644 --- a/tools/release-tooling.json +++ b/tools/release-tooling.json @@ -18,7 +18,7 @@ }, "actions": { "checkout": "3d3c42e5aac5ba805825da76410c181273ba90b1", - "setupNode": "820762786026740c76f36085b0efc47a31fe5020", + "setupNode": "949feb2413d6458794dcd2491c4babbbce0c15c1", "uploadArtifact": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a", "downloadArtifact": "9000827ccba6bdab643e8b6fd33ac0654aef8333", "attest": "1e69f48acb82d1966a394da916b4c1698aa569d6",