chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by dependabot[bot] · Pull Request #13936 · cli/cli

dependabot · 2026-07-21T14:03:25Z

Bumps actions/setup-node from 6.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in actions/setup-node#1577

Migrate to ESM and upgrade dependencies by @gowridurgad in actions/setup-node#1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in actions/setup-node#1558

Only use mirrorToken in getManifest if it's provided by @deiga in actions/setup-node#1548

Documentation updates:

Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in actions/setup-node#1536

docs: Update restore-only cache documentation by @priya-kinthali in actions/setup-node#1550

docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in actions/setup-node#1567

Dependency update:

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-node#1569

New Contributors

@chiranjib-swain made their first contribution in actions/setup-node#1536

@deiga made their first contribution in actions/setup-node#1548

@jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

8207627 Migrate to ESM and upgrade dependencies (#1574)
04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
30eb73b Resolve high-severity audit issues
4e1a87a Update dist
360237f Strict equality
4f8aac5 Bump @actions/cache to 5.1.0, log cache write denied
f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

@me

This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `2.96.0` → `2.97.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/cli/cli/badge)](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@zwick](https://github.com/zwick) in [#13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@zwick](https://github.com/zwick) in [#13823](cli/cli#13823) - Add Grok skill host support by [@tommaso-moro](https://github.com/tommaso-moro) in [#13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@tommaso-moro](https://github.com/tommaso-moro) in [#13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@malancas](https://github.com/malancas) in [#13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@kofuk](https://github.com/kofuk) in [#13787](cli/cli#13787) - Fix skill picker label wrapping by [@tommaso-moro](https://github.com/tommaso-moro) in [#13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@github-actions](https://github.com/github-actions)\[bot] in [#13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@BagToad](https://github.com/BagToad) in [#13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@Solaris-star](https://github.com/Solaris-star) in [#13927](cli/cli#13927) - Add a macOS keyring security doc by [@williammartin](https://github.com/williammartin) in [#13960](cli/cli#13960) - Add a code review agent skill by [@BagToad](https://github.com/BagToad) in [#14003](cli/cli#14003) - Establish a pull request template for scale by [@BagToad](https://github.com/BagToad) in [#14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@lukewar](https://github.com/lukewar) in [#13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@tidy-dev](https://github.com/tidy-dev) in [#13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@alondahari](https://github.com/alondahari) in [#13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@williammartin](https://github.com/williammartin) in [#13985](cli/cli#13985) - Harden the deployment workflow by [@niik](https://github.com/niik) in [#13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@williammartin](https://github.com/williammartin) in [#13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@williammartin](https://github.com/williammartin) in [#13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@kobihikri](https://github.com/kobihikri) in [#13886](cli/cli#13886) - Fix typos in code and documentation by [@pstoeckle](https://github.com/pstoeckle) in [#13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#13900](cli/cli#13900) #####

Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@dependabot](https://github.com/dependabot) in [#13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@dependabot](https://github.com/dependabot) in [#13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@dependabot](https://github.com/dependabot) in [#13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@dependabot](https://github.com/dependabot) in [#13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot) in [#13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot) in [#13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot) in [#13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@dependabot](https://github.com/dependabot) in [#13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot) in [#13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@dependabot](https://github.com/dependabot) in [#13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@dependabot](https://github.com/dependabot) in [#13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@dependabot](https://github.com/dependabot) in [#13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@dependabot](https://github.com/dependabot) in [#13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@dependabot](https://github.com/dependabot) in [#13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@dependabot](https://github.com/dependabot) in [#13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@dependabot](https://github.com/dependabot) in [#13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@dependabot](https://github.com/dependabot) in [#13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@dependabot](https://github.com/dependabot) in [#13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@dependabot](https://github.com/dependabot) in [#13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@dependabot](https://github.com/dependabot) in [#13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@dependabot](https://github.com/dependabot) in [#13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@dependabot](https://github.com/dependabot) in [#13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@dependabot](https://github.com/dependabot) in [#13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@dependabot](https://github.com/dependabot) in [#13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@dependabot](https://github.com/dependabot) in [#13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot) in [#13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@dependabot](https://github.com/dependabot) in [#14018](cli/cli#14018) #### New Contributors - [@lukewar](https://github.com/lukewar) made their first contribution in [#13777](cli/cli#13777) - [@niik](https://github.com/niik) made their first contribution in [#13780](cli/cli#13780) - [@kofuk](https://github.com/kofuk) made their first contribution in [#13787](cli/cli#13787) - [@zwick](https://github.com/zwick) made their first contribution in [#13807](cli/cli#13807) - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#13886](cli/cli#13886) - [@pstoeckle](https://github.com/pstoeckle) made their first contribution in [#13940](cli/cli#13940) - [@Solaris-star](https://github.com/Solaris-star) made their first contribution in [#13927](cli/cli#13927) - [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#13900](cli/cli#13900) - [@alondahari](https://github.com/alondahari) made their first contribution in [#13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://codeberg.org/pabrahamsson/containers/pulls/28

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.96.0` → `v2.97.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@zwick](https://github.com/zwick) in [#13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@zwick](https://github.com/zwick) in [#13823](cli/cli#13823) - Add Grok skill host support by [@tommaso-moro](https://github.com/tommaso-moro) in [#13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@tommaso-moro](https://github.com/tommaso-moro) in [#13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@malancas](https://github.com/malancas) in [#13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@kofuk](https://github.com/kofuk) in [#13787](cli/cli#13787) - Fix skill picker label wrapping by [@tommaso-moro](https://github.com/tommaso-moro) in [#13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@github-actions](https://github.com/github-actions)\[bot] in [#13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@BagToad](https://github.com/BagToad) in [#13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@Solaris-star](https://github.com/Solaris-star) in [#13927](cli/cli#13927) - Add a macOS keyring security doc by [@williammartin](https://github.com/williammartin) in [#13960](cli/cli#13960) - Add a code review agent skill by [@BagToad](https://github.com/BagToad) in [#14003](cli/cli#14003) - Establish a pull request template for scale by [@BagToad](https://github.com/BagToad) in [#14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@lukewar](https://github.com/lukewar) in [#13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@tidy-dev](https://github.com/tidy-dev) in [#13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@alondahari](https://github.com/alondahari) in [#13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@williammartin](https://github.com/williammartin) in [#13985](cli/cli#13985) - Harden the deployment workflow by [@niik](https://github.com/niik) in [#13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@williammartin](https://github.com/williammartin) in [#13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@williammartin](https://github.com/williammartin) in [#13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@kobihikri](https://github.com/kobihikri) in [#13886](cli/cli#13886) - Fix typos in code and documentation by [@pstoeckle](https://github.com/pstoeckle) in [#13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#13900](cli/cli#13900) #####

Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@dependabot](https://github.com/dependabot) in [#13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@dependabot](https://github.com/dependabot) in [#13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@dependabot](https://github.com/dependabot) in [#13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@dependabot](https://github.com/dependabot) in [#13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot) in [#13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot) in [#13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@dependabot](https://github.com/dependabot) in [#13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@dependabot](https://github.com/dependabot) in [#13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot) in [#13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@dependabot](https://github.com/dependabot) in [#13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@dependabot](https://github.com/dependabot) in [#13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@dependabot](https://github.com/dependabot) in [#13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@dependabot](https://github.com/dependabot) in [#13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@dependabot](https://github.com/dependabot) in [#13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@dependabot](https://github.com/dependabot) in [#13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@dependabot](https://github.com/dependabot) in [#13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@dependabot](https://github.com/dependabot) in [#13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@dependabot](https://github.com/dependabot) in [#13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot) in [#13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@dependabot](https://github.com/dependabot) in [#13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@dependabot](https://github.com/dependabot) in [#13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@dependabot](https://github.com/dependabot) in [#13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@dependabot](https://github.com/dependabot) in [#13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@dependabot](https://github.com/dependabot) in [#13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@dependabot](https://github.com/dependabot) in [#13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@dependabot](https://github.com/dependabot) in [#13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@dependabot](https://github.com/dependabot) in [#13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@dependabot](https://github.com/dependabot) in [#13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@dependabot](https://github.com/dependabot) in [#13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@dependabot](https://github.com/dependabot) in [#13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@dependabot](https://github.com/dependabot) in [#13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@dependabot](https://github.com/dependabot) in [#13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot) in [#13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@dependabot](https://github.com/dependabot) in [#13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@dependabot](https://github.com/dependabot) in [#14018](cli/cli#14018) #### New Contributors - [@lukewar](https://github.com/lukewar) made their first contribution in [#13777](cli/cli#13777) - [@niik](https://github.com/niik) made their first contribution in [#13780](cli/cli#13780) - [@kofuk](https://github.com/kofuk) made their first contribution in [#13787](cli/cli#13787) - [@zwick](https://github.com/zwick) made their first contribution in [#13807](cli/cli#13807) - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#13886](cli/cli#13886) - [@pstoeckle](https://github.com/pstoeckle) made their first contribution in [#13940](cli/cli#13940) - [@Solaris-star](https://github.com/Solaris-star) made their first contribution in [#13927](cli/cli#13927) - [@SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#13900](cli/cli#13900) - [@alondahari](https://github.com/alondahari) made their first contribution in [#13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 21, 2026

dependabot Bot requested a review from a team as a code owner July 21, 2026 14:03

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 21, 2026

dependabot Bot requested a review from williammartin July 21, 2026 14:03

dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Jul 21, 2026

babakks approved these changes Jul 22, 2026

View reviewed changes

babakks merged commit a5a326f into trunk Jul 22, 2026
40 checks passed

babakks deleted the dependabot/github_actions/actions/setup-node-7.0.0 branch July 22, 2026 09:05

BrewTestBot mentioned this pull request Jul 31, 2026

gh 2.97.0 Homebrew/homebrew-core#296261

Merged

scottames-github-bot Bot mentioned this pull request Aug 4, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1003

Merged

1 task

Navigation Menu

Uh oh!

chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 - #13936

chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0#13936
babakks merged 1 commit into
trunkfrom
dependabot/github_actions/actions/setup-node-7.0.0

dependabot Bot commented on behalf of github Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 21, 2026

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

v6.5.0

What's Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant