build(deps): bump actions/setup-node from 6 to 7

[dependabot]

Bumps actions/setup-node from 6 to 7.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

... (truncated)

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

---

Note

Low Risk
CI workflow version pin only; no runtime or product code changes, though v7 is a major release so pipeline behavior should be validated on the next runs.

Overview
Upgrades every GitHub Actions workflow that installs Node from actions/setup-node@v6 to actions/setup-node@v7, including bot formatting, branch/release builds, coverage, semver labeling, snapshot tests, and the main test/deploy pipeline.

Existing inputs are unchanged (.nvmrc via node-version-file, cache: 'npm' where already used). This is a CI-only dependency bump with no application code changes.

^{Reviewed by Cursor Bugbot for commit eb266be. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Build Branch

Branch	pr-releases/dependabot/github_actions/main/actions/setup-node-7
Commit	3773b2550a
Updated	July 16, 2026 at 3:12:07 PM UTC

Static preview entry points

• Docs: docs/index.html
• Static pages: build/integration/pages/index.html
• Integration pages: injected/integration-test/test-pages/index.html

QR codes (mobile preview)

Entry point	QR code
Docs
Static pages
Integration pages

Integration commands

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#pr-releases/dependabot/github_actions/main/actions/setup-node-7

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/github_actions/main/actions/setup-node-7")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/github_actions/main/actions/setup-node-7
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/github_actions/main/actions/setup-node-7

Pin to exact commit

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#3773b2550a68268ba6e78872c545bf49398ee062

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "3773b2550a68268ba6e78872c545bf49398ee062")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/github_actions/main/actions/setup-node-7
git -C submodules/content-scope-scripts checkout 3773b2550a68268ba6e78872c545bf49398ee062

[cursor]

Injected PR Evaluation: Web Compatibility & Security

PR: build(deps): bump actions/setup-node from 6 to 7 (#2867)
Scope: 8 GitHub workflow files — version pin only (actions/setup-node@v6 → @v7)

---

Web Compatibility Assessment

No findings. This PR does not modify any Content Scope Scripts runtime code.

• No changes under injected/, messaging/, special-pages/, or platform entry points.
• No browser API overrides, wrapper utilities, DOM manipulation, or feature initialization changes.
• actions/setup-node runs exclusively in GitHub Actions CI runners and is outside the C-S-S browser injection trust boundary.

---

Security Assessment

No findings. No C-S-S security-sensitive paths are touched.

• No changes to captured-globals.js, message bridge, messaging transports, or origin validation.
• No new postMessage, dynamic code execution, or config/feature logic.
• CI-only dependency bump; does not ship to end-user browsers.

Info (CI context, not C-S-S runtime): setup-node v7 migrates to ESM and upgrades @actions/cache to 5.1.0. Workflows here retain the same inputs (node-version-file, cache: 'npm'), so no workflow configuration changes are required. The v7 release also documents cache-poisoning mitigation guidance — a CI hygiene improvement, not a C-S-S concern.

---

Risk Level

Low Risk — Dependabot version-pin bump across GitHub Actions workflow YAML only; zero changes to injected JavaScript, messaging, or browser-facing bundles.

---

Recommendations

1. Merge after CI passes — Standard Dependabot workflow bump; no additional C-S-S-specific testing required.
2. No action items for web compatibility or runtime security review.
3. Optional CI note: If any workflow fails post-merge, check runner version compatibility (v7 inherits v6's Node 24 runtime requirement; GitHub-hosted runners satisfy this).

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Stale comment

Dependency update review: actions/setup-node v6 → v7

Verdict: Low risk — safe to merge after CI completes.

This is a mechanical major-version bump across 8 workflow files (20 call sites). No workflow inputs change; only the action ref moves from @v6 to @v7.

---

Changelog impact (confirmed)

Per the v7.0.0 release notes, the only breaking change is an internal ESM migration. Inputs and YAML configuration are unchanged.

Relevant v7 changes for this repo:

Change	Impact here
ESM migration	None for consumers — no workflow edits required
Remove dummy NODE_AUTH_TOKEN export	No impact — no workflows use registry-url / npm auth
@actions/cache 5.1.0 upgrade + cache write logging	Low — workflows already use explicit cache: 'npm' where needed
New cache-primary-key / cache-matched-key outputs	Optional — not used today
Cache-poisoning hardening docs	No impact — no npm publish workflows

Current usage patterns are compatible:

• node-version-file: '.nvmrc' (Node 22) everywhere Node is installed
• Explicit cache: 'npm' on install-heavy jobs
• No always-auth (removed in v6)
• No packageManager field in package.json, so v6/v7 automatic npm caching does not activate implicitly — behavior stays driven by the explicit cache input

---

Test coverage (confirmed)

There is no unit test for the action itself (expected). Coverage comes from CI exercising setup-node on this PR branch:

• Passing at review time: unit, unit-tests (ubuntu + windows), github-scripts-unit, production-deps, build, and most Playwright integration jobs
• Still pending: a few integration/snapshot jobs and branch-protection approval gates

Jobs without cache: 'npm' (github-scripts-unit, deploy-docs, semver-label) also pass — confirms the bump does not break minimal Node-only steps.

---

Is this dependency still needed?

Yes. actions/setup-node is the standard way to pin Node to .nvmrc on GitHub-hosted runners. No better alternative is used elsewhere in this repo.

Note: workflows layer two caches — setup-node npm download cache (cache: 'npm') plus actions/cache for node_modules. That predates this PR and is intentional (npm tarball cache vs. installed modules). Not a regression from v7.

---

Supply chain (advisory)

1. Fresh release: v7.0.0 was published 2026-07-14 (day before this PR). Early adopters may surface edge cases not seen on v6.
2. Floating tag: @v7 will pick up future v7.x patches automatically. This matches the repo’s existing pattern (@v6, @v7 for checkout/cache/etc.), but it is slightly higher supply-chain exposure than pinning to a commit SHA.
3. Publisher trust: actions/setup-node is an official GitHub-maintained action — baseline supply-chain risk is low.

---

Separate fix PR

None opened. I checked for an existing follow-up PR and found only this Dependabot PR (#2867). No code changes are required for compatibility.

Optional hardening (non-blocking, could be a future PR):

• Add a root packageManager field (e.g. [email protected]) for reproducibility / Corepack alignment with setup-node docs
• Consider package-manager-cache: false on jobs that never run npm ci and only invoke node (already mostly the case)

---

Summary

Category	Result
Breaking workflow changes	None expected
Repo-specific regressions	None observed in CI so far
Required follow-up PR	No
Advisory concerns	Fresh major release; floating @v7 tag

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Advisory (non-blocking): This job uses both setup-node’s cache: 'npm' and a separate actions/cache for node_modules. That’s a pre-existing layered caching pattern (npm download cache vs. installed modules) and is unaffected by the v7 bump. v7 only adds optional cache key outputs — no action needed unless you want observability later.

[cursor]

Dependency update review: actions/setup-node v6 → v7

Verdict: Low risk — safe to merge. No follow-up PR required.

---

Change summary

Mechanical version bump only: 19 references across 8 workflow files (bot-format, build-branch, build, coverage, semver-label, snapshots-update, snapshots, tests). No input or configuration changes.

---

Changelog impact (v7.0.0)

Area	Change	Impact on this repo
Breaking	Internal migration to ESM	None for consumers. Workflow inputs/outputs unchanged.
Enhancement	New outputs cache-primary-key, cache-matched-key	Not used today; optional future observability.
Bug fix	Removed dummy NODE_AUTH_TOKEN export	No impact. Workflows do not use registry-url / npm auth inputs.
Bug fix	mirrorToken only used when provided	No impact. No mirror / mirror-token inputs in workflows.
Dependency	Upgraded internal @actions/cache to 5.1.0	Transparent to callers; repo separately pins actions/cache@v5.
Docs	Cache-poisoning mitigation guidance	Awareness only; no workflow change required.

Reference: v7.0.0 release notes

---

Workflow compatibility check

Confirmed compatible with current usage:

• Node version: All jobs use node-version-file: '.nvmrc' (Node 22). Unchanged behavior.
• Caching: Most jobs explicitly set cache: 'npm'. This is intentional layered caching alongside separate actions/cache@v5 for node_modules — setup-node caches npm download artifacts, not node_modules itself.
• No v6-only inputs: Workflows do not use removed always-auth, registry-url, token, or mirror inputs.
• No auto-cache surprise: Root package.json has no packageManager / devEngines.packageManager field, so v6's automatic npm caching would not activate without explicit cache: 'npm' anyway.
• Runners: All jobs use GitHub-hosted runners (ubuntu-latest, windows-latest). No self-hosted / GHES offline scenarios.

---

Test coverage

Confirmed: CI on this PR branch exercises setup-node end-to-end across the full matrix:

• Unit tests (injected, special-pages, github scripts) — pass
• Lint / stylelint / clean-tree — pass
• Integration tests (injected + special-pages, all browser projects) — pass
• Snapshots workflow — pass
• Build release branch — pass
• Production-deps smoke — pass
• CI gate — pass

There is no separate unit test for the GitHub Action itself; workflow execution is the integration test surface, and it is comprehensive here.

---

Dependency necessity

actions/setup-node remains the standard, maintained way to install a pinned Node version on GitHub-hosted runners. No simpler alternative is used elsewhere in this repo. The dependency is still needed.

---

Supply chain risk

Factor	Assessment
Publisher	Official actions/setup-node from GitHub's actions org
Pinning	Major-version tag @v7 (existing repo convention, same as @v6)
Source	Dependabot semver-major bump
Blast radius	CI only; no runtime / shipped artifact impact
Risk level	Low

Uncertain (informational, not blocking): Tag-based pins (@v7) trust the tag publisher. Commit-SHA pinning would harden supply chain further but is a repo-wide policy decision, not a requirement for this bump.

---

Confirmed issues

None.

---

Uncertain / informational concerns

1. Layered caching (pre-existing): Workflows run both setup-node npm cache and a custom node_modules cache. This predates v7 and is a valid pattern (npm cache helps on node_modules cache miss). No action required for this PR.
2. Related open PR: #2796 bumps actions/cache v5→v6 separately. Independent of this change; no conflict observed.

---

Follow-up PR

Not opened. No code or workflow fixes are required beyond this version bump. Checked for existing open PRs targeting setup-node fixes — none found.

---

  

_{Sent by Cursor Automation: Review dependabot}