⬆️ Bump actions/setup-node from 4 to 5

[dependabot]

Bumps actions/setup-node from 4 to 5.

Release notes

Sourced from actions/setup-node's releases.

v5.0.0

What's Changed

Breaking Changes

• Enhance caching in setup-node with automatic package manager detection by @​priya-kinthali in actions/setup-node#1348

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

• Upgrade action to use node24 by @​salmanmkc in actions/setup-node#1325

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

• Upgrade @​octokit/request-error and @​actions/github by @​dependabot[bot] in actions/setup-node#1227
• Upgrade uuid from 9.0.1 to 11.1.0 by @​dependabot[bot] in actions/setup-node#1273
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in actions/setup-node#1295
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in actions/setup-node#1332
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in actions/setup-node#1345

New Contributors

• @​priya-kinthali made their first contribution in actions/setup-node#1348
• @​salmanmkc made their first contribution in actions/setup-node#1325

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

What's Changed

Bug fixes:

• Make eslint-compact matcher compatible with Stylelint by @​FloEdelmann in actions/setup-node#98
• Add support for indented eslint output by @​fregante in actions/setup-node#1245

Enhancement:

• Support private mirrors by @​marco-ippolito in actions/setup-node#1240

Dependency update:

• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​aparnajyothi-y in actions/setup-node#1262

New Contributors

• @​FloEdelmann made their first contribution in actions/setup-node#98
• @​fregante made their first contribution in actions/setup-node#1245
• @​marco-ippolito made their first contribution in actions/setup-node#1240

Full Changelog: actions/setup-node@v4...v4.4.0

... (truncated)

Commits

• a0853c2 Bump actions/checkout from 4 to 5 (#1345)
• b7234cc Upgrade action to use node24 (#1325)
• d7a1131 Enhance caching in setup-node with automatic package manager detection (#1348)
• 5e2628c Bumps form-data (#1332)
• 65becef Bump undici from 5.28.5 to 5.29.0 (#1295)
• 7e24a65 Bump uuid from 9.0.1 to 11.1.0 (#1273)
• 08f58d1 Bump @​octokit/request-error and @​actions/github (#1227)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

• Chores
  • Upgraded the Node.js setup action in the continuous integration pipeline to the latest major version, applied to both lint and auto-fix jobs. This modernizes the CI environment, improves reliability, and positions us for future Node.js/tooling improvements. No changes to app features or behaviour; end-user experience remains unchanged. Ensures continued support and security updates from the action maintainers.

[coderabbitai]

Walkthrough

The GitHub Actions workflow for Node.js updated the action reference from actions/setup-node@v4 to actions/setup-node@v5 in two steps within the same workflow file. No other steps or control flow were modified.

Changes

Cohort / File(s)	Summary
CI workflow update .github/workflows/node.js.yaml	Bumped actions/setup-node from v4 to v5 in lint and fix jobs; no other workflow changes.

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Gitmoji Commits	⚠️ Warning	I fetched the PR’s commits via GitHub CLI and validated each commit message against the allowed Gitmoji set, ensuring the message begins with exactly one of the specified emojis followed by a space or colon. The PR title includes a valid emoji (⬆️), but at least one underlying commit message does not start with an allowed emoji, so the PR fails the Gitmoji Commits policy. This conclusion is based solely on the commit message headlines returned for PR #91 in NatoBoram/docker-compose.	Please rewrite the PR’s commit messages to start with a single allowed Gitmoji, for example “⬆️ Bump actions/setup-node from 4 to 5”. You can amend locally with “git rebase -i origin/main” and “git commit --amend” for each commit, then force-push the branch, or use GitHub’s “Update commit message” if available. After updating, re-run this check.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title correctly begins with the ⬆️ emoji indicating a dependency upgrade and precisely describes the core change of updating actions/setup-node from version 4 to 5, matching the pull request’s modifications.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch dependabot/github_actions/actions/setup-node-5

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 80b70d2 and 3e924bb.

📒 Files selected for processing (1)

• .github/workflows/node.js.yaml (2 hunks)

🧰 Additional context used

🔍 Remote MCP context7, deepwiki, github, grep, tavily

Review notes — PR #91 (⬆️ actions/setup-node v4 → v5)

• Change: .github/workflows/node.js.yaml — actions/setup-node@v4 → actions/setup-node@v5 in two steps (cache: pnpm, node-version: latest). No other files changed.

• Upstream v5 highlights (breaking/compatibility): automatic package-manager caching when a valid packageManager field exists in package.json (disable with package-manager-cache: false); action runtime updated to node24; requires Actions runner v2.327.1 or later; multiple dependency bumps (includes actions/checkout -> v5). Verify these before merging.

• Repo impact: this workflow already sets cache: pnpm and uses pnpm/action-setup, and uses actions/checkout@v5. Automatic caching only triggers if a packageManager field exists in package.json — I found no occurrences of packageManager in the repo. So current explicit cache: pnpm behavior remains relevant; main risk is runner compatibility on self-hosted runners.

• Reviewer checklist (recommended):

  1. Run CI / trigger the workflow to confirm no runtime errors.
  2. If you use self-hosted runners, confirm runner version >= v2.327.1.
  3. If you do NOT want automatic package-manager caching, add package-manager-cache: false to the setup-node steps.
  4. Consider pinning node-version (vs. latest) to avoid unexpected changes.

Tools/sources used:,,,,,,

🔇 Additional comments (1)

.github/workflows/node.js.yaml (1)

26-29: Confirm runner compatibility for node24 runtime.

actions/setup-node@v5 now executes on node24 and expects the runner to be at least v2.327.1. ubuntu-latest on GitHub-hosted runners already tracks current images, but if you have any self-hosted runners or pinned VM snapshots in rotation, please double-check they meet that floor before merging. Applies to both the lint and fix jobs; otherwise these updates look good. (github.com)

Also applies to: 52-55

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}