Build(deps): Bump actions/setup-node from 6.4.0 to 7.0.0

[dependabot]

Bumps actions/setup-node from 6.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

⏸️ Hold — Bot PR Safety Review

actions/setup-node 6.4.0 → 7.0.0 (github-actions ecosystem, major version bump)

Axis	Result	Detail
Cooldown	❌ Violated	PR opened 2026-07-20 (today, 0 days old). The 7-day cooldown requires waiting until 2026-07-27. No security advisory claimed in the PR body.
Security	✅ No advisory	No CVE/GHSA referenced in the PR body. No known security advisories against actions/setup-node.
Risk / blast radius	🟡 Medium	CI-only change — only modifies review-bot-prs.lock.yml (one SHA pin updated). No impact on the shipped dagfactory package. However, this is a major version bump (v6 → v7); the v7.0.0 release notes indicate ESM migration and dependency upgrades. CI is green, suggesting the bump is compatible with the current workflow.
CI gate	✅ Green	All 54 check runs completed: unit tests (full matrix), integration tests, CodeQL, zizmor, Code-Coverage all pass; Build/Deploy-Pages and PyPI publish skipped as expected. No checks are pending or awaiting maintainer authorization.
Tag integrity	⚠️ Unverified	New SHA 820762786026740c76f36085b0efc47a31fe5020 is annotated as # v7.0.0 in the diff. Tag dereference API was unavailable in this run (filtered by integrity policy). A maintainer should verify manually: gh api repos/actions/setup-node/git/ref/tags/v7.0.0 (deref annotated tag if needed) and confirm the SHA matches before merging.

Recommendation: Wait until 2026-07-27 for the 7-day cooldown to elapse, then verify tag integrity manually before merging.

---

This review comment was generated by an agent. It is advisory only and does not approve or merge the PR. Reviewed on 2026-07-20 16:42 UTC.