chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.10 - #2635
chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.10#2635dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5.0.0 to 6.0.10. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@fc06bc1...0977fd9) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.10 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
@modelcontextprotocol/client
@modelcontextprotocol/codemod
@modelcontextprotocol/core
@modelcontextprotocol/server
@modelcontextprotocol/server-legacy
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — mechanical Dependabot bump of pnpm/action-setup from v5.0.0 to v6.0.10, SHA-pinned.
What was reviewed:
- Verified the pinned SHA
0977fd9...is the actual v6.0.10 head commit per the Dependabot commit list, and all 12 usages across the 7 workflows were updated consistently with no leftover v5 pins. - Checked the v5→v6 major-version impact: no workflow passes a
versioninput, and the rootpackage.jsonpinspackageManager: pnpm@10.26.1, so v6 resolves the pnpm version frompackageManagerexactly as v5 did. - The
run_install: false+ setup-node pnpm-cache pattern used everywhere is unchanged and supported in v6.
Extended reasoning...
Overview
This PR is a Dependabot-generated bump of the pnpm/action-setup GitHub Action from v5.0.0 to v6.0.10 across all seven workflow files (conformance.yml, deploy-docs.yml, examples.yml, main.yml, publish.yml, release.yml, update-spec-types.yml). Every change is the identical one-line substitution of the pinned commit SHA plus its version comment; no inputs, permissions, or step ordering were touched.
Security risks
Low. The action remains pinned to a full commit SHA (supply-chain best practice), and I verified the new SHA 0977fd99725f1db4007ccb2928dbb4e90d06cc86 matches the v6.0.10 head commit listed in Dependabot's commit log, so the # v6.0.10 comment is accurate. The bump touches workflows with elevated permissions (release/publish with id-token: write), but the action's role there — installing pnpm before pnpm install — is unchanged, and per this repo's review conventions I did not assert toolchain failures without verification: the OIDC publish path still delegates to the system npm CLI, which this action does not affect.
Level of scrutiny
This is a CI configuration change with zero runtime/SDK code impact. The one thing warranting real scrutiny in a major-version action bump is behavioral drift: v6's notable change is stricter resolution of the pnpm version from packageManager/devEngines. No workflow here passes a version input, and the repo root package.json pins packageManager: pnpm@10.26.1, so v6 resolves the same pinned pnpm version v5 did. The run_install: false usage pattern is unchanged between majors.
Other factors
All 12 call sites across the 7 workflows now use the same SHA — no partial migration. The bug hunting system found no issues. CI on this PR itself exercises the bumped action in the main/test/examples/conformance workflows, so any resolution failure would surface immediately as a red check rather than latently. No changeset is needed for a workflows-only change.
Bumps pnpm/action-setup from 5.0.0 to 6.0.10.
Release notes
Sourced from pnpm/action-setup's releases.
... (truncated)
Commits
0977fd9docs: Update README to include devEngines.packageManager (#273)48261acfix: update pnpm to v11.19.0 (#283)75677f7ci: use pnpm 11 forpr-check(#284)769ae71refactor: introduce restore keys for cache (#280)6fed91fdocs(README): point users to the successor pnpm/setup action (#282)0ebf471fix: update pnpm to v11.7.0 (#267)0e279bbfix: update pnpm to 11.1.1 (#248)3e83581fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)551b42edocs(README): fixcache_dependency_pathtype (#257)739bfe4fix: self-update bootstrap to packageManager-pinned version (#233) (#256)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)