guillaume.hausknecht/arcenal-agent
Watch
1
0
Fork
You've already forked arcenal-agent
 0
Code Issues 1 Pull requests 5 Projects Releases 9 Packages Wiki Activity

chore(actions)(deps): bump actions/setup-node from 4.4.0 to 7.0.0 #5

Open
dependabot[bot] wants to merge 1 commit from dependabot/github_actions/actions/setup-node-7.0.0 into arcenal
pull from: dependabot/github_actions/actions/setup-node-7.0.0
merge into: guillaume.hausknecht:arcenal
Conversation 2 Commits 1 Files changed 5 +5 -5
dependabot[bot] commented 2026-09-03 12:52:42 +00:00 (Migrated from github.com)

Bumps actions/setup-node from 4.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: https://github.com/actions/setup-node/compare/v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: https://github.com/actions/setup-node/compare/v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 7.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-node/releases">actions/setup-node's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <h3>Enhancements:</h3> <ul> <li>Add cache-primary-key and cache-matched-key as outputs by <a href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1577">actions/setup-node#1577</a></li> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1574">actions/setup-node#1574</a></li> </ul> <h3>Bug fixes:</h3> <ul> <li>Remove dummy NODE_AUTH_TOKEN export by <a href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1558">actions/setup-node#1558</a></li> <li>Only use <code>mirrorToken</code> in <code>getManifest</code> if it's provided by <a href="https://github.com/deiga"><code>@​deiga</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li> </ul> <h3>Documentation updates:</h3> <ul> <li>Add documentation for publishing to npm with Trusted Publisher (OIDC) by <a href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li> <li>docs: Update restore-only cache documentation by <a href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1550">actions/setup-node#1550</a></li> <li>docs: Update caching recommendations to mitigate cache poisoning risks by <a href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1567">actions/setup-node#1567</a></li> </ul> <h3>Dependency update:</h3> <ul> <li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li> <li><a href="https://github.com/deiga"><code>@​deiga</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li> <li><a href="https://github.com/jasongin"><code>@​jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6...v7.0.0">https://github.com/actions/setup-node/compare/v6...v7.0.0</a></p> <h2>v6.5.0</h2> <h2>What's Changed</h2> <ul> <li>Update <code>@​actions/cache</code> to 5.1.0 and add security overrides for undici and fast-xml-parser by <a href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1579">actions/setup-node#1579</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0">https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0</a></p> <h2>v6.4.0</h2> <h2>What's Changed</h2> <h3>Dependency updates:</h3> <ul> <li>Upgrade <a href="https://github.com/actions"><code>@​actions</code></a> dependencies by <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li> <li>Update Node.js versions in versions.yml and bump package to v6.4.0 by <a href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1533">actions/setup-node#1533</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6...v6.4.0">https://github.com/actions/setup-node/compare/v6...v6.4.0</a></p> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancements:</h3> <ul> <li>Support parsing <code>devEngines</code> field by <a href="https://github.com/susnux"><code>@​susnux</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1283">actions/setup-node#1283</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-node/commit/820762786026740c76f36085b0efc47a31fe5020"><code>8207627</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-node/issues/1574">#1574</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/04be95cf3511ea51ebf9f224ddfb99cc7ab87cd4"><code>04be95c</code></a> Add cache-primary-key and cache-matched-key as outputs (<a href="https://redirect.github.com/actions/setup-node/issues/1577">#1577</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/7c2c68d20d402ed6a201ada70a81341941093140"><code>7c2c68d</code></a> docs: Update caching recommendations to mitigate cache poisoning risks (<a href="https://redirect.github.com/actions/setup-node/issues/1567">#1567</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/6a61c0375d66246de94630495909f12cf8dac84d"><code>6a61c03</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-node/issues/1569">#1569</a> from jasongin/update-actions-cache-5.1.0</li> <li><a href="https://github.com/actions/setup-node/commit/30eb73b41ded577900c1ebf968ef95cdf8f7434f"><code>30eb73b</code></a> Resolve high-severity audit issues</li> <li><a href="https://github.com/actions/setup-node/commit/4e1a87a501d0302f99e30e2748568adcb388d09f"><code>4e1a87a</code></a> Update dist</li> <li><a href="https://github.com/actions/setup-node/commit/360237f0c01778d0c17291f75c56d6feae4f7574"><code>360237f</code></a> Strict equality</li> <li><a href="https://github.com/actions/setup-node/commit/4f8aac5beb2f0854bc79651567a18c67eb0b9de3"><code>4f8aac5</code></a> Bump <code>@​actions/cache</code> to 5.1.0, log cache write denied</li> <li><a href="https://github.com/actions/setup-node/commit/f4a67bbeca970f103397d3d2b9462cf787cd2980"><code>f4a67bb</code></a> Only use <code>mirrorToken</code> in <code>getManifest</code> if it's provided (<a href="https://redirect.github.com/actions/setup-node/issues/1548">#1548</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/0355742c943ddb13ca8a6b700f824231caa91e75"><code>0355742</code></a> Remove dummy NODE_AUTH_TOKEN export (<a href="https://redirect.github.com/actions/setup-node/issues/1558">#1558</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...820762786026740c76f36085b0efc47a31fe5020">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-node&package-manager=github_actions&previous-version=4.4.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
dependabot[bot] commented 2026-09-03 12:52:44 +00:00 (Migrated from github.com)

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

### Labels The following labels could not be found: `dependencies`, `github-actions`. Please create them before Dependabot can add them to a pull request. Please fix the above issues or remove invalid values from `dependabot.yml`.
github-actions[bot] commented 2026-09-04 12:54:05 +00:00 (Migrated from github.com)

૮ >ﻌ< ა ci review

ran on 881e0d1 — chore(actions)(deps): bump actions/setup-node from 4.4.0 to

❌ Job failures

Check contributors / check-attribution · View job

Job Check contributors / check-attribution failed.

Check uv.lock / uv lock --check · View job

Job Check uv.lock / uv lock --check failed.

OS-specific tests / macOS-only tests · View job

Job OS-specific tests / macOS-only tests failed.

Python tests / e2e · View job

Job Python tests / e2e failed.

⚠️ Action required

CI-sensitive file review · View job

This PR changes CI-sensitive files (eslint config, workflow YAMLs, or composite actions). These influence what the js-autofix job executes and pushes to main.

Sensitive files changed:

How to fix:

Add the ci-reviewed label after verifying:

  • no new eslint rules with custom fix functions that write outside linted paths,
  • no workflow changes that widen permissions or remove guards,
  • no composite action changes that alter what gets executed.

Unrelated histories · View job

This PR has no common ancestor with main.

How to fix:

Rebase your changes onto current main:

git fetch origin main
git checkout -b fix-branch origin/main
# re-apply your changes (cherry-pick, copy files, etc.)
git push -f origin fix-branch

uv.lock out of sync · View job

uv.lock is out of sync with pyproject.toml.

How to fix:

Run uv lock locally and commit the result. If on a PR, sync with main first:

git fetch origin main
git rebase origin/main
uv lock
git add uv.lock
git commit -m "chore: refresh uv.lock"

⚠️ Warnings

OSV vulnerability scan · View job

28 known vulnerabilities found in pinned dependencies.

  • CVE-2026-67213 in website/package-lock.json
  • CVE-2026-82417 in scripts/whatsapp-bridge/package-lock.json
  • CVE-2026-82417 in website/package-lock.json
  • CVE-2026-75931 in package-lock.json
  • CVE-2026-75931 in website/package-lock.json
  • CVE-2026-83610 in package-lock.json
  • CVE-2026-83610 in package-lock.json
  • CVE-2026-71554 in uv.lock
  • CVE-2026-73088 in package-lock.json
  • CVE-2026-73088 in website/package-lock.json
  • GHSA-8423-8fgw-73vq in uv.lock
  • CVE-2026-70608 in package-lock.json
  • CVE-2026-73089 in package-lock.json
  • CVE-2026-73089 in website/package-lock.json
  • CVE-2026-75975 in package-lock.json
  • CVE-2026-75975 in website/package-lock.json
  • CVE-2026-75899 in package-lock.json
  • CVE-2026-75899 in website/package-lock.json
  • CVE-2026-84371 in package-lock.json
  • CVE-2026-56876 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

debug info

CI timings

CI timings · View report · View job

Wall time 1440m19s (no baseline yet).

<!-- hermes-ci-review-bot --> # ૮ >ﻌ< ა ci review <sub>ran on [881e0d1](https://github.com/arcenal-coder/arcenal-agent/pull/5/commits/881e0d14b2255fa04bdb6bfe768572dfa28d069b) — chore(actions)(deps): bump actions/setup-node from 4.4.0 to </sub> ## ❌ Job failures ### Check contributors / check-attribution · [View job](https://github.com/arcenal-coder/arcenal-agent/actions/runs/33757778518/job/100656500104) Job **Check contributors / check-attribution** failed. --- ### Check uv.lock / uv lock --check · [View job](https://github.com/arcenal-coder/arcenal-agent/actions/runs/33757778518/job/100656501124) Job **Check uv.lock / uv lock --check** failed. --- ### OS-specific tests / macOS-only tests · [View job](https://github.com/arcenal-coder/arcenal-agent/actions/runs/33757778518/job/100656500957) Job **OS-specific tests / macOS-only tests** failed. --- ### Python tests / e2e · [View job](https://github.com/arcenal-coder/arcenal-agent/actions/runs/33757778518/job/100656500796) Job **Python tests / e2e** failed. --- ## ⚠️ Action required ### CI-sensitive file review · [View job](https://github.com/arcenal-coder/arcenal-agent/actions/runs/33757778518/job/100657231646) This PR changes CI-sensitive files (eslint config, workflow YAMLs, or composite actions). These influence what the js-autofix job executes and pushes to main. **Sensitive files changed:** - [`.github/workflows/deploy-site.yml`](https://github.com/arcenal-coder/arcenal-agent/compare/9d6d684997e714b9db8390f09144202798198204...881e0d14b2255fa04bdb6bfe768572dfa28d069b#diff-0b263af13139bf9e35cf8d76ee84f4a007e7dc1d35f1f45c282eeec1449e6ce1) - [`.github/workflows/docs-site-checks.yml`](https://github.com/arcenal-coder/arcenal-agent/compare/9d6d684997e714b9db8390f09144202798198204...881e0d14b2255fa04bdb6bfe768572dfa28d069b#diff-8d9bd959f47ab69784d394c96d7e5ea2e7e4db421272420472a8dd32951cb94b) - [`.github/workflows/e2e-desktop.yml`](https://github.com/arcenal-coder/arcenal-agent/compare/9d6d684997e714b9db8390f09144202798198204...881e0d14b2255fa04bdb6bfe768572dfa28d069b#diff-5e49cca52e526fa0d8230640d7650bbe647331a93a8b8a03f3123165c9fb59e7) - [`.github/workflows/js-autofix.yml`](https://github.com/arcenal-coder/arcenal-agent/compare/9d6d684997e714b9db8390f09144202798198204...881e0d14b2255fa04bdb6bfe768572dfa28d069b#diff-9525ccecf3eb918cd000fd6147df3f2e92c96507f8f81e372ebb4ce5fad1ecd3) - [`.github/workflows/js-tests.yml`](https://github.com/arcenal-coder/arcenal-agent/compare/9d6d684997e714b9db8390f09144202798198204...881e0d14b2255fa04bdb6bfe768572dfa28d069b#diff-92f03a7c67e39d07571037d4e9b81235979c3f876ce8bed5d0f745bcefa442d7) **How to fix:** Add the `ci-reviewed` label after verifying: - no new eslint rules with custom `fix` functions that write outside linted paths, - no workflow changes that widen permissions or remove guards, - no composite action changes that alter what gets executed. --- ### Unrelated histories · [View job](https://github.com/arcenal-coder/arcenal-agent/actions/runs/33757778518/job/100656500366) This PR has no common ancestor with main. **How to fix:** Rebase your changes onto current main: ``` git fetch origin main git checkout -b fix-branch origin/main # re-apply your changes (cherry-pick, copy files, etc.) git push -f origin fix-branch ``` --- ### uv.lock out of sync · [View job](https://github.com/arcenal-coder/arcenal-agent/actions/runs/33757778518) uv.lock is out of sync with pyproject.toml. **How to fix:** Run `uv lock` locally and commit the result. If on a PR, sync with main first: ``` git fetch origin main git rebase origin/main uv lock git add uv.lock git commit -m "chore: refresh uv.lock" ``` --- ## ⚠️ Warnings ### OSV vulnerability scan · [View job](https://github.com/arcenal-coder/arcenal-agent/actions/runs/33757778518/job/100656259183) 28 known vulnerabilities found in pinned dependencies. - CVE-2026-67213 in website/package-lock.json - CVE-2026-82417 in scripts/whatsapp-bridge/package-lock.json - CVE-2026-82417 in website/package-lock.json - CVE-2026-75931 in package-lock.json - CVE-2026-75931 in website/package-lock.json - CVE-2026-83610 in package-lock.json - CVE-2026-83610 in package-lock.json - CVE-2026-71554 in uv.lock - CVE-2026-73088 in package-lock.json - CVE-2026-73088 in website/package-lock.json - GHSA-8423-8fgw-73vq in uv.lock - CVE-2026-70608 in package-lock.json - CVE-2026-73089 in package-lock.json - CVE-2026-73089 in website/package-lock.json - CVE-2026-75975 in package-lock.json - CVE-2026-75975 in website/package-lock.json - CVE-2026-75899 in package-lock.json - CVE-2026-75899 in website/package-lock.json - CVE-2026-84371 in package-lock.json - CVE-2026-56876 in package-lock.json **How to fix:** Review the findings in the [Security tab](../../security/code-scanning). Update the affected dependencies if a patched version is available. --- ### debug info <details> <summary>CI timings</summary> ### CI timings · [View report](https://github.com/arcenal-coder/arcenal-agent/actions/runs/33757778518/artifacts/9937516436) · [View job](https://github.com/arcenal-coder/arcenal-agent/actions/runs/33757778518/job/101030100965) Wall time 1440m19s (no baseline yet). </details>
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin "dependabot/github_actions/actions/setup-node-7.0.0:dependabot/github_actions/actions/setup-node-7.0.0"
git switch "dependabot/github_actions/actions/setup-node-7.0.0"

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch "arcenal"
git merge --no-ff "dependabot/github_actions/actions/setup-node-7.0.0"
git switch "dependabot/github_actions/actions/setup-node-7.0.0"
git rebase "arcenal"
git switch "arcenal"
git merge --ff-only "dependabot/github_actions/actions/setup-node-7.0.0"
git switch "dependabot/github_actions/actions/setup-node-7.0.0"
git rebase "arcenal"
git switch "arcenal"
git merge --no-ff "dependabot/github_actions/actions/setup-node-7.0.0"
git switch "arcenal"
git merge --squash "dependabot/github_actions/actions/setup-node-7.0.0"
git switch "arcenal"
git merge --ff-only "dependabot/github_actions/actions/setup-node-7.0.0"
git switch "arcenal"
git merge "dependabot/github_actions/actions/setup-node-7.0.0"
git push origin "arcenal"
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
accessibility
Barrier affecting people with disabilities

  
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
guillaume.hausknecht/arcenal-agent!5
No description provided.