Dependabot opened #68 (actions/checkout v5.1.0 → v7.0.1) and #69 (actions/setup-node v5.0.0 → v7.0.0). Both are safe here, and both are incomplete: they were generated before .github/workflows/pages.yml existed, so they update 6 of the 7 checkout pins and 5 of the 6 setup-node pins.
Merging them as they are leaves the Pages workflow on the old pins, which then drifts until Dependabot notices and opens a third pull request. One change, applied everywhere, is easier to reason about than a split.
Why the majors are safe here, checked rather than assumed
- checkout v7 blocks checking out a fork PR for
pull_request_target and workflow_run. Neither trigger appears in any workflow in this repository.
- checkout v6 moved credential persistence to a separate file. Nothing here reads
.git/config for a token.
- setup-node v6 disabled automatic caching for pnpm and yarn to avoid compatibility problems. It did not remove the feature:
cache: pnpm passed explicitly still works, and every job here passes it explicitly.
- setup-node v7 removed a dummy
NODE_AUTH_TOKEN export. Publishing here authenticates with an OIDC token from a trusted publisher, not a token.
All three proposed SHAs were verified against their tags through the API, rather than trusted from the pull request body.
Not included: changesets/action
#67 (changesets/action v1.9.0 → v2.1.2) is a different matter and should not be merged. See the note on that pull request: v2 requires Changesets CLI v3, and this repository is on @changesets/cli@2.29.8. The action validates that and directs v2 users back to @v1.
Dependabot opened #68 (
actions/checkoutv5.1.0 → v7.0.1) and #69 (actions/setup-nodev5.0.0 → v7.0.0). Both are safe here, and both are incomplete: they were generated before.github/workflows/pages.ymlexisted, so they update 6 of the 7checkoutpins and 5 of the 6setup-nodepins.Merging them as they are leaves the Pages workflow on the old pins, which then drifts until Dependabot notices and opens a third pull request. One change, applied everywhere, is easier to reason about than a split.
Why the majors are safe here, checked rather than assumed
pull_request_targetandworkflow_run. Neither trigger appears in any workflow in this repository..git/configfor a token.cache: pnpmpassed explicitly still works, and every job here passes it explicitly.NODE_AUTH_TOKENexport. Publishing here authenticates with an OIDC token from a trusted publisher, not a token.All three proposed SHAs were verified against their tags through the API, rather than trusted from the pull request body.
Not included: changesets/action
#67 (
changesets/actionv1.9.0 → v2.1.2) is a different matter and should not be merged. See the note on that pull request: v2 requires Changesets CLI v3, and this repository is on@changesets/cli@2.29.8. The action validates that and directs v2 users back to@v1.