chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.5#2016
chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.5#2016dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5.0.0 to 6.0.5. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@fc06bc1...8912a91) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.5 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
|
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
There was a problem hiding this comment.
LGTM — mechanical SHA-pinned action bump across all workflows.
Extended reasoning...
Overview
Dependabot bumps pnpm/action-setup from fc06bc1 (v5.0.0) to 8912a91 (v6.0.5) across all six workflow files (9 call sites). The diff is a pure commit-SHA swap on the uses: line; no inputs, steps, or permissions are changed. The upstream changelog is bootstrap/PATH fixes plus support for pnpm v11 — the action still reads the target pnpm version from packageManager in package.json, which here is pnpm@10.26.1 and remains supported. The run_install: false input is unchanged and still valid in v6.
Security risks
None introduced by this diff. The action remains pinned to a full 40-char commit SHA (not a mutable tag), which is the recommended supply-chain practice. No new permissions are requested and no secrets are touched.
Level of scrutiny
Low. This is a routine, mechanical dependency bump confined to CI tooling — it does not touch SDK source, public API, or published artifacts. Any regression would surface immediately as a failed pnpm install step in the PR's own CI checks (the main.yml and conformance.yml workflows run on pull_request).
Other factors
Grep confirms no stale references to the old SHA remain anywhere in the repo, so the migration is complete (per the "Completeness" recurring catch). No changeset is needed since this is CI-only and ships nothing to consumers. No prior reviewer comments to address.
Bumps pnpm/action-setup from 5.0.0 to 6.0.5.
Release notes
Sourced from pnpm/action-setup's releases.
Commits
8912a91fix: append (not prepend) action node dir to PATH for npm bootstrap (#241)26f6d4ffix: use npm co-located with the action node binary (#239)903f9c1fix: update pnpm to 11.0.0-rc.5bdf0af2test: add strict version-match jobs to reproduce #225 / #22771c9247fix: pnpm self-update binary shadowed by bootstrap on PATH (#230)078e9d4fix: update pnpm to 11.0.0-rc.208c4be7docs(README): update action-setup version5798914chore: update .gitignoreddffd66fix: remove accidentally committed fileb43f991fix: update pnpm to 11.0.0-rc.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)