chore(deps): update actions/setup-node digest to 48b55a0 by renovate[bot] · Pull Request #396 · deepnote/deepnote

renovate · 2026-06-08T01:33:38Z

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node (changelog)	action	digest	`53b8394` → `48b55a0`

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- "before 9am on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

Chores
- Updated the pinned Node.js setup action used across CI and release workflows to a newer version.
- No workflow behavior, build steps, or application features were changed.

coderabbitai · 2026-06-08T01:33:51Z

Warning

Review limit reached

@renovate[bot], we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 50 minutes and 27 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b8c000c5-8d6d-4349-9aff-b52175a9fede

📥 Commits

Reviewing files that changed from the base of the PR and between 1adabfd and eb6f459.

📒 Files selected for processing (3)

.github/workflows/cd-pypi-cli.yml
.github/workflows/cd.yml
.github/workflows/ci.yml

📝 Walkthrough

Walkthrough

This PR updates the pinned actions/setup-node@v6 commit hash across three workflow files. The CD PyPI CLI and CD publish workflows each get one pin update. The CI workflow receives nine pin updates across spell-check, lint-and-format, typecheck, build, test, cli-e2e, license-check, audit-prod, and audit-all. No other step configuration or logic changed.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Suggested reviewers

tkislan
jamesbhobbs

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the only change: repinning actions/setup-node to digest 48b55a0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Updates Docs	✅ Passed	Only GitHub Actions digests changed in workflows; no feature docs were applicable or modified.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-06-08T11:36:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.51%. Comparing base (af431e0) to head (eb6f459).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #396   +/-   ##
=======================================
  Coverage   84.51%   84.51%           
=======================================
  Files         153      153           
  Lines        8093     8093           
  Branches     2189     2189           
=======================================
  Hits         6840     6840           
  Misses       1252     1252           
  Partials        1        1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/cd-pypi-cli.yml:
- Around line 35-38: The actions/setup-node step in the release workflow is
susceptible to cache poisoning attacks from untrusted PR runs because it uses
the standard pnpm cache that is shared across all workflows. To fix this
security vulnerability, either disable caching by changing `cache: 'pnpm'` to
`cache: false` to prevent any cache restoration during releases, or implement
cache isolation by replacing the cache property with a unique
cache-dependency-path (such as 'release-pnpm-lock.yaml') to ensure release
builds use a separate, dedicated cache that cannot be poisoned by PR workflows.
The first option (disabling cache) is simpler and more secure for release
workflows.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 783afa81-51ff-4425-afea-75a28cf18bc6

📥 Commits

Reviewing files that changed from the base of the PR and between 9d79b47 and e5526ec.

📒 Files selected for processing (3)

.github/workflows/cd-pypi-cli.yml
.github/workflows/cd.yml
.github/workflows/ci.yml

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/cd.yml:
- Around line 50-53: The release publish job in the workflow is reusing the
shared pnpm cache, which can be restored from untrusted PR runs. Update the
setup-node step in the release workflow to disable automatic pnpm caching or
switch to a release-only cache key so the publish job does not consume caches
written by CI runs. Use the existing setup-node configuration in the workflow to
locate the change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f8d24f30-2b5f-412f-81ec-ad8ab9f77320

📥 Commits

Reviewing files that changed from the base of the PR and between e5526ec and 6b7a20a.

📒 Files selected for processing (3)

.github/workflows/cd-pypi-cli.yml
.github/workflows/cd.yml
.github/workflows/ci.yml

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/ci.yml

renovate Bot added dependencies renovate labels Jun 8, 2026

coderabbitai Bot approved these changes Jun 8, 2026

View reviewed changes

renovate Bot force-pushed the renovate/actions-setup-node-digest branch 2 times, most recently from 1af8a9d to a44a128 Compare June 8, 2026 11:33

renovate Bot force-pushed the renovate/actions-setup-node-digest branch 5 times, most recently from 9d79b47 to e5526ec Compare June 18, 2026 09:34

coderabbitai Bot requested changes Jun 18, 2026

View reviewed changes

Comment thread .github/workflows/cd-pypi-cli.yml

renovate Bot force-pushed the renovate/actions-setup-node-digest branch from e5526ec to 6b7a20a Compare June 25, 2026 15:37

coderabbitai Bot requested changes Jun 25, 2026

View reviewed changes

Comment thread .github/workflows/cd.yml

renovate Bot force-pushed the renovate/actions-setup-node-digest branch from 6b7a20a to 1adabfd Compare June 25, 2026 15:43

jamesbhobbs marked this pull request as ready for review June 25, 2026 15:43

jamesbhobbs requested a review from a team as a code owner June 25, 2026 15:43

jamesbhobbs approved these changes Jun 25, 2026

View reviewed changes

jamesbhobbs enabled auto-merge (squash) June 25, 2026 15:44

coderabbitai Bot approved these changes Jun 25, 2026

View reviewed changes

chore(deps): update actions/setup-node digest to 48b55a0

eb6f459

renovate Bot force-pushed the renovate/actions-setup-node-digest branch from 1adabfd to eb6f459 Compare June 25, 2026 15:46

jamesbhobbs merged commit e25912b into main Jun 25, 2026
21 of 22 checks passed

jamesbhobbs deleted the renovate/actions-setup-node-digest branch June 25, 2026 15:48

coderabbitai Bot mentioned this pull request Jul 2, 2026

chore(deps): update non-major dependencies #328

Draft

1 task

coderabbitai Bot mentioned this pull request Jul 13, 2026

chore(deps): update actions/setup-python digest to ece7cb0 #410

Merged

1 task

coderabbitai Bot mentioned this pull request Jul 24, 2026

chore(deps): update pypa/gh-action-pypi-publish digest to dc37677 #363

Draft

1 task

Navigation Menu

chore(deps): update actions/setup-node digest to 48b55a0 - #396

chore(deps): update actions/setup-node digest to 48b55a0#396
jamesbhobbs merged 1 commit into
mainfrom
renovate/actions-setup-node-digest

renovate Bot commented Jun 8, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 8, 2026 •

edited

Loading

Review limit reached

Walkthrough

Estimated code review effort

Suggested reviewers

Uh oh!

codecov Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Jun 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Configuration

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Estimated code review effort

Suggested reviewers

Uh oh!

codecov Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jun 8, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 8, 2026 •

edited

Loading

codecov Bot commented Jun 8, 2026 •

edited

Loading