Skip to content

chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.0 #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.0 #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/backup-restore-weekly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6.0.0
with:
version: 9.15.0
Comment on lines +46 to 48

@coderabbitai coderabbitai Bot Apr 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify the commit hash matches the v6.0.0 tag in pnpm/action-setup

# Fetch the commit hash for v6.0.0 tag
curl -s https://api.github.com/repos/pnpm/action-setup/git/ref/tags/v6.0.0 | jq -r '.object.sha'

echo "Expected: 08c4be7e2e672a47d11bd04269e27e5f3e8529cb"

Repository: sebastianspicker/cueq

Length of output: 156

🌐 Web query:

pnpm/action-setup v6.0.0 release notes breaking changes

💡 Result:

pnpm/action-setup v6.0.0 was released recently (around early April 2026 based on nearby tags like 10 Apr). Official release notes are available on the GitHub releases page, but specific details for v6.0.0 are not fully detailed in search snippets. From context: Key changes in recent versions (v5.0.0 and prior, likely carried or similar): - Updated to use Node.js 24 (feat!: run the action on Node.js 24). A major known issue with v6 (including v6.0.0): The action does not respect the specified pnpm version input and always installs pnpm v11 (e.g., 11.0.0-beta.4-1), even if version: 10 is set. This is a confirmed bug reported on 2026-04-11, open as of 2026-04-13. Workaround: Pin to a specific working commit like 2e223e0f0d2b8fd9872cbadb8b7428e5f8b5556d # v6. No other explicit breaking changes listed distinctly for v6.0.0; check https://github.com/pnpm/action-setup/releases/tag/v6.0.0 for full notes. Prior versions had non-breaking docs updates, caching feats, package.yaml support.

Citations:

🌐 Web query:

pnpm/action-setup v6.0.0 compatibility with pnpm 9.15.0

💡 Result:

pnpm/action-setup v6.0.0 is compatible with pnpm 9.15.0 in principle, as the action's tests were updated to use pnpm 9.15.5 and 9.15.0 around February 2025 (commit fff7088), and it supports specifying exact versions like "9.15.0" via the 'version' input. The action fetches and installs the requested pnpm version from the npm registry or as specified. However, there is a critical bug in v6.0.0: it ignores the specified 'version' input and always installs pnpm v11 (e.g., 11.0.0-beta.4-1), as reported in open GitHub issue #225 opened on 2026-04-11 (still active as of 2026-04-13). Workarounds include pinning to a specific commit hash like 2e223e0f0d2b8fd9872cbadb8b7428e5f8b5556d labeled as "# v6". Official releases list latest as v5.0.0 (2026-03-17), but v6.0.0 exists as a Git tag. For reliable use with pnpm 9.15.0, use v5 or pin to a working v6 commit. Official docs and CI examples recommend versions up to pnpm 10.

Citations:

Fix action version and commit hash — v6.0.0 has a critical bug.

The commit hash 08c4be7e2e672a47d11bd04269e27e5f3e8529cb does not match the v6.0.0 tag (actual: f3d73ada1fa6e5c0c19973ff70a3f5cabf225cc5). More critically, pnpm/action-setup@v6.0.0 contains a known bug that ignores the version input and always installs pnpm v11, regardless of the specified version. This means version: 9.15.0 will not be respected.

Solutions:

  • Downgrade to v5.0.0 (latest stable release)
  • Or pin to a working v6 commit hash: 2e223e0f0d2b8fd9872cbadb8b7428e5f8b5556d # v6
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/backup-restore-weekly.yml around lines 46 - 48, Update the
pnpm/action-setup reference to a known-good release so the specified version
input (version: 9.15.0) is honored; either change the tag to the stable v5
release (pnpm/action-setup@v5.0.0) or pin the working v6 commit hash provided
(pnpm/action-setup@2e223e0f0d2b8fd9872cbadb8b7428e5f8b5556d) and remove the
incorrect commit hash (08c4be7e2e672a47d11bd04269e27e5f3e8529cb) currently used
with pnpm/action-setup so the action no longer installs pnpm v11 regardless of
the version input.


Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6.0.0
with:
version: 9.15.0

Expand Down Expand Up @@ -131,7 +131,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup pnpm
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6.0.0
with:
version: 9.15.0

Expand Down