chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.7#2051
chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.7#2051dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5.0.0 to 6.0.7. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@fc06bc1...739bfe4) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.7 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — mechanical Dependabot SHA bump for pnpm/action-setup, no input changes.
Extended reasoning...
Overview
Dependabot bumps pnpm/action-setup from the v5.0.0 commit SHA to the v6.0.7 commit SHA across all six workflow files (conformance.yml, deploy-docs.yml, main.yml, publish.yml, release.yml, update-spec-types.yml). Each occurrence is a one-line change to the uses: pin; the only input passed (run_install: false) is unchanged and still supported in v6. No version: input is set, so the action continues to resolve the pnpm version from packageManager: "pnpm@10.26.1" in the root package.json — v6's main behavioral change is that the bootstrap now self-updates to that pinned version, which is the desired outcome.
Security risks
None introduced by this diff. The action remains pinned to a full 40-char commit SHA from the official pnpm/action-setup repo, so there's no tag-mutation supply-chain exposure. No new permissions, secrets, or tokens are added to any workflow.
Level of scrutiny
Low. This is CI tooling only — no SDK source, public API, or published package contents are touched, and no changeset is required. Three of the six affected workflows (main.yml, conformance.yml, publish.yml) run on pull_request, so the bumped action is exercised by this PR's own CI; a regression would surface as a failing check before merge. The release.yml OIDC publish path already pins npm@11.5.1 independently, so the action's internal bootstrap changes don't affect trusted publishing.
Other factors
CODEOWNERS only assigns the default repo team to these paths (no specialized owner). There are no prior reviewer comments to address, the bug-hunting system found nothing, and the change is purely mechanical and consistent across all callsites.
Bumps pnpm/action-setup from 5.0.0 to 6.0.7.
Release notes
Sourced from pnpm/action-setup's releases.
... (truncated)
Commits
739bfe4fix: self-update bootstrap to packageManager-pinned version (#233) (#256)f61705dchore: add CODEOWNERS7a5507bfix: restore inputs from state in post (#255)1155470fix: honor devEngines.packageManager.onFail=error (#252) (#254)91ab88efix: bin_dest output points to self-updated pnpm, not bootstrap (#249)e578e19fix: update pnpm to 11.0.48912a91fix: append (not prepend) action node dir to PATH for npm bootstrap (#241)26f6d4ffix: use npm co-located with the action node binary (#239)903f9c1fix: update pnpm to 11.0.0-rc.5bdf0af2test: add strict version-match jobs to reproduce #225 / #227Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)