chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.3#1970
chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.3#1970dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5.0.0 to 6.0.3. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@fc06bc1...903f9c1) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine Dependabot bump of pnpm/action-setup, SHA-pinned across all workflows.
Extended reasoning...
Overview
Dependabot bumps pnpm/action-setup from v5.0.0 (SHA fc06bc1…) to v6.0.3 (SHA 903f9c1…) in all six workflow files (conformance.yml, deploy-docs.yml, main.yml, publish.yml, release.yml, update-spec-types.yml). The diff is purely the uses: SHA pin and trailing version comment on each occurrence — no inputs, steps, permissions, or job structure change.
Security risks
None introduced by this diff. The action remains pinned to a full commit SHA (not a mutable tag), and pnpm/action-setup is a well-known first-party action from the pnpm org. No new permissions or secrets are referenced.
Level of scrutiny
Low. This is a mechanical CI dependency bump with no source, type, or public-API impact. The v6 major of the action upgrades its bootstrap pnpm to v11 and adds pnpm 11 support, but the actual pnpm version used in CI is resolved from the repo's "packageManager": "pnpm@10.26.1" in package.json (no version: input is passed), so runtime behavior is unchanged. The run_install: false input is preserved everywhere.
Other factors
main.yml,conformance.yml, andpublish.ymlall run onpull_request, so this PR's own CI directly exercises the new action version.- No changeset is needed — CI-only change with no published-package impact, consistent with the changeset-bot note.
- Per the repo's "CI & GitHub Actions" recurring-catches guidance, I verified the action's release notes rather than speculating: v6.0.0–v6.0.3 only touch the bundled bootstrap pnpm and a PATH-shadowing fix, neither of which affects this repo's pinned-pnpm setup.
Bumps pnpm/action-setup from 5.0.0 to 6.0.3.
Release notes
Sourced from pnpm/action-setup's releases.
Commits
903f9c1fix: update pnpm to 11.0.0-rc.5bdf0af2test: add strict version-match jobs to reproduce #225 / #22771c9247fix: pnpm self-update binary shadowed by bootstrap on PATH (#230)078e9d4fix: update pnpm to 11.0.0-rc.208c4be7docs(README): update action-setup version5798914chore: update .gitignoreddffd66fix: remove accidentally committed fileb43f991fix: update pnpm to 11.0.0-rc.03852509README.md: bring versions up-to-date (#222)6e7bdbdchore: bump bootstrap pnpm to 11.0.0-beta.4-1 and add update scriptDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)