chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.8#2123
chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.8#2123dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5.0.0 to 6.0.8. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@fc06bc1...0e279bb) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.8 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
the
github_actions
|
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — mechanical SHA-pinned Dependabot bump of pnpm/action-setup v5.0.0 → v6.0.8 across all workflows; the repo's packageManager pin (pnpm@10.26.1) means the action's default-version change in v6 has no effect here.
Extended reasoning...
Overview
Dependabot PR replacing the pinned commit for pnpm/action-setup (v5.0.0 → v6.0.8) in all six .github/workflows/*.yml files. The change is a straight find-and-replace of the action SHA + version comment; no other workflow logic, inputs, or steps are altered. All sites keep run_install: false and rely on actions/setup-node for caching.
Security risks
The bump touches publish.yml and release.yml, which run with id-token: write for npm OIDC trusted publishing — so a malicious or compromised action update would be supply-chain relevant. Mitigations: the action remains SHA-pinned (0e279bb…), pnpm/action-setup is the official pnpm-org action, and the diff makes no permission or token changes. No new secrets or scopes are introduced.
Level of scrutiny
This is a CI dependency bump, not SDK code. The main behavioral concern with v5 → v6 is that v6 changed the default pnpm version (now pnpm 11) and introduced a self-update bootstrap. Neither matters here: package.json pins "packageManager": "pnpm@10.26.1", which the action honors (and v6.0.7+ specifically fixed self-update to the packageManager-pinned version). The release.yml comment about pnpm@10 delegating pnpm publish to the npm CLI remains accurate since the pinned pnpm version is unchanged.
Other factors
No bugs found by the bug-hunting system. CI itself (main.yml, conformance.yml) will exercise the new action version on this very PR, so any installation regression surfaces before merge. No changeset is needed for workflow-only changes (changeset-bot warning is expected). This fits squarely in the approvable mechanical-version-bump category.
Bumps pnpm/action-setup from 5.0.0 to 6.0.8.
Release notes
Sourced from pnpm/action-setup's releases.
... (truncated)
Commits
0e279bbfix: update pnpm to 11.1.1 (#248)3e83581fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)551b42edocs(README): fixcache_dependency_pathtype (#257)739bfe4fix: self-update bootstrap to packageManager-pinned version (#233) (#256)f61705dchore: add CODEOWNERS7a5507bfix: restore inputs from state in post (#255)1155470fix: honor devEngines.packageManager.onFail=error (#252) (#254)91ab88efix: bin_dest output points to self-updated pnpm, not bootstrap (#249)e578e19fix: update pnpm to 11.0.48912a91fix: append (not prepend) action node dir to PATH for npm bootstrap (#241)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)