Skip to content

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 15, 2025

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package Type Update Change
actions/setup-node action major v4.2.0 -> v5.0.0
actions/setup-node action major v4.4.0 -> v5.0.0

Release Notes

actions/setup-node (actions/setup-node)

v5.0.0

Compare Source

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

Compare Source

What's Changed

Bug fixes:
Enhancement:
Dependency update:

New Contributors

Full Changelogactions/setup-node@v4...v4.4.0

v4.3.0

Compare Source

What's Changed

Dependency updates

New Contributors

Full Changelog: actions/setup-node@v4...v4.3.0


Configuration

📅 Schedule: Branch creation - "every 2nd week starting on the 2 week of the year before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested review from a team as code owners September 15, 2025 03:01
Copy link

codecov bot commented Sep 15, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.26%. Comparing base (9272018) to head (607cd59).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #452   +/-   ##
=======================================
  Coverage   78.26%   78.26%           
=======================================
  Files         275      275           
  Lines       27441    27441           
=======================================
  Hits        21476    21476           
  Misses       5965     5965           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

mimartin12
mimartin12 previously approved these changes Sep 15, 2025
Copy link
Contributor

Logo
Checkmarx One – Scan Summary & Details71e8b82b-ea32-4928-9bb2-3988e3445d11

New Issues (3)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL CVE-2025-7783 Npm-form-data-4.0.3
detailsRecommended version: 4.0.4
Description: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: 5ymTK0OblflVh6tGXbyLb5IKh%2Fj4i7akd9qJp8UeSw8%3D
Vulnerable Package
CRITICAL CVE-2025-7783 Npm-axios-1.9.0
detailsRecommended version: 1.11.0
Description: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: P1ycUPtI0T2DVi7fQYXHOwGyu%2BgVr9PNcHawvVMXFC8%3D
Vulnerable Package
LOW CVE-2025-54798 Npm-tmp-0.0.33
detailsRecommended version: 0.2.4
Description: tmp is a temporary file and directory creator for node.js. In versions prior to 0.2.4, tmp is vulnerable to an arbitrary temporary file "/" directo...
Attack Vector: LOCAL
Attack Complexity: HIGH

ID: t0KfLVJ707O8r2eI8u12Ob4wIvh%2FPmApymNwLrpM2Ao%3D
Vulnerable Package

Copy link

@renovate renovate bot force-pushed the renovate/actions-setup-node-5.x branch from 791ac81 to 607cd59 Compare September 18, 2025 16:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant