chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0

[dependabot]

Bumps actions/setup-node from 6.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[robertvangor]

Vulnerability validation

• Scope: Exact-head setup-node 7 workflow compatibility and repository validation
• PR head: 1f861febef60bd0d1c52ec17ae61d648a0781bbf
• Tested head: 1f861febef60bd0d1c52ec17ae61d648a0781bbf
• Tested at: 2026-07-21T19:58:53.854Z

Remediation proof

• No linked advisory identified (not-applicable): CI used actions/setup-node 6.4.0 with unused GitHub Packages registry/auth configuration -> CI uses actions/setup-node 7.0.0 and installs the public dependency graph without package credentials. The PR changes only .github/workflows/ci.yaml. Auth-free frozen install and the exact-head workflow pass; @staffbase/widget-sdk resolves publicly.

Changelog and compatibility review

• actions/setup-node 6.4.0 -> 7.0.0: Official interval releases found: v7.0.0, v6.5.0. Release-history highlight: What's Changed Enhancements: Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in Add cache-primary-key and cache-matched-key as outputs actions/setup-node#1577 Migrate to ESM and upgrade dependencies by @gowridurgad in https://gi. This crosses a major-version boundary. Repository implication: setup-node 7 now selects Node 20 and initializes the dependency install without a dummy token; the exact workflow and full sample gate pass.

Test evidence

• PASS [REQUIRED] - local / auth-free immutable install and complete weather example gate: Node 20.20.2 / Yarn 1.22.22: frozen install, build, lint, typecheck, 10 Jest suites and 19 tests passed without GitHub Packages credentials.

• PASS [REQUIRED] - remote CI / exact-head setup-node 7 workflow: At 1f861fe, executing-tests, Autodev, CLA, policy and Socket checks all pass; the PR is mergeable and only review is outstanding.

• FAIL [BASELINE] - baseline attribution / latest-main application regression: Latest main and a local main+chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 #291 composition both fail build/Jest with Babel _lruCache is not a constructor, while this exact branch passes. The PR touches only CI workflow configuration, directly excluding chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 #291 as the cause.

• Deployment: NOT-APPLICABLE (branch-stack): This PR changes only the CI workflow; product bundle deployment and tenant installation would not execute the updated action.

• Observability: NOT-APPLICABLE: No runtime artifact or service changes in this workflow-only PR.; soak: not required

Remaining gaps

• Latest main has an unrelated Babel/Jest regression after merged changes; it must be repaired before cumulative-main product validation, but direct composition proof excludes chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 #291.

Scores and recommendation

• Importance: 4/10 - This is non-runtime platform maintenance that restores supported setup-node behavior and removes unnecessary credential coupling from CI.
• Tested residual risk: 2/10 - The exact workflow-only diff is narrow, auth-free local validation and every exact-head GitHub check pass, and the unrelated latest-main regression is directly excluded.
• Recommendation: Ready for review and merge as a workflow-only change; track the unrelated latest-main Babel regression separately.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}