Bump actions/setup-node from 6.4.0 to 7.0.0

[dependabot]

Bumps actions/setup-node from 6.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[netlify]

✅ Deploy Preview for dh-markpost ready!

Name	Link
🔨 Latest commit	18f29d7
🔍 Latest deploy log	https://app.netlify.com/projects/dh-markpost/deploys/6a663fb66373af00082a99a6
😎 Deploy Preview	https://deploy-preview-112--dh-markpost.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[grimicorn-agent]

Agent triage: no code changes needed — ready for review.

The only red check is Dependency audit (npm). This PR changes GitHub Actions workflow files only (no package.json / package-lock.json changes), so it cannot alter the npm dependency tree or npm audit results.

The audit is currently failing on main itself for the same advisories (verified today: main reports the same 23 vulnerabilities / 5 moderate, 18 high). Clearing those is out of scope for an Actions version bump and would need a separate dependency decision.

Every other check is green. Leaving unassigned and re-requesting review for merge.

[grimicorn-agent]

Agent triage: blocked pending a merge-order decision.

The failing Dependency audit (npm) check is not caused by this bump. This PR only changes files under .github/workflows/, which cannot affect an npm audit.

Diagnosis (verified by running npm ci && npm audit --audit-level=high on a clean clone):

• main currently fails the audit with 18 high / 0 critical / 5 moderate.
• 11 of the 18 high advisories cascade from a single root package, brace-expansion at <= 5.0.7 (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg), reached via both @vue/test-utils -> js-beautify -> editorconfig/glob and nuxt -> nitropack -> archiver -> archiver-utils/readdir-glob.
• A second, unrelated cluster (next, postcss, sharp) comes from geist, which declares next as an unbounded peer dependency, so npm installs a full nested copy of next that never appears in package.json.

This is already fixed elsewhere. PR #113 carries targeted overrides (brace-expansion: ^5.0.8, plus next > postcss/sharp) and its audit passes: 0 high, 0 critical.

What is needed from you: merge #113. Once it lands on main, this PR just needs main merged in and the audit goes green with no changes of its own.

Deliberately not duplicating #113's package.json overrides into this PR — three PRs each carrying the same override would conflict in package.json and package-lock.json as they merge. Applying blocked so the agent stops re-attempting this every run; remove the label once #113 is merged.