chore(deps): update pin digests (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	major	v6.5.0 → v7.0.0
slackapi/slack-github-action	action	major	v3.0.5 → v4.0.0

---

Release Notes

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

v7

Compare Source

slackapi/slack-github-action (slackapi/slack-github-action)

v4.0.0: Slack GitHub Action v4.0.0

Compare Source

Major Changes

• b1974f0: build: parse yaml with more strict multiline indentation rules

  Internal dependencies of js-yaml@v5 make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value.

  See the YAML line prefixes spec for the expected indentation rule:

    channel: "C0123"
    text: "first line
  
  - second line"
  +   second line"

Patch Changes

• 654bb72: chore: provide global fetch proxied configurations with updates to web api and webhook packages

v4.0

Compare Source

v4

Compare Source

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dawsontoth]

Approving — all 22 checks green (5 skipped). Two genuine majors in here, both verified.

Digests both match their real upstream tags:

• actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 = v7.0.0 ✅
• slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d = v4.0.0 ✅

slack-github-action v3.0.5 → v4.0.0 — the sole major change is stricter YAML parsing via js-yaml@v5:

Indentation is now required for values that span multiple lines against the base value.

This only bites plain multiline scalars. I checked all 11 call sites across publish-docker.yaml, create-release.yaml, publish-npm.yaml, and notify-release-published.yaml — every one passes its payload as a payload: | literal block containing indented JSON, e.g.:

payload: |
  {
    "channel": "#development-ci",
    "text": "Harper Pro ${{ github.event.release.tag_name }} GitHub release published",

Literal block scalars take their content verbatim, so the new indentation rule doesn't apply. No payload uses a plain multiline value. ✅

actions/setup-node v7 — the notable change is removing the dummy NODE_AUTH_TOKEN export, which is a fix for OIDC publishing rather than a risk.

Flagging that this touches 13 workflows including publish-npm.yaml, publish-docker.yaml, and create-release.yaml — none of which PR CI exercises. The Slack notifications and publish steps get their first real run at the next release.

[dawsontoth]

Heads up: this has gone to a conflicted merge state, and #619 is the reason — the two PRs overlap on all 11 workflow files and rewrite the same actions/setup-node lines (#619 → v6.5.0, this one → v7.0.0). They're mutually exclusive.

My approval above stands on the content. Since v7.0.0 supersedes v6.5.0, simplest path is to merge this one and let Renovate retire #619 — otherwise merge #619 first and this needs a rebase to reapply cleanly.