chore(actions): bump actions/setup-node from 4 to 7

[dependabot]

Bumps actions/setup-node from 4 to 7.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

... (truncated)

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🛰️ PR Sweeper report

Risk: 🟠 MEDIUM · Security gate: ✅ passing · Files: 3

🔒 Automated guardrails (authoritative)

	Category	Location	Finding
⚠️	scope	—	Touches security-sensitive path(s): .github/workflows/build-catalog.yml, .github/workflows/traffic-stats.yml, .github/workflows/update-message-center.yml. Maintainer + security review required.

🤖 Dual-model AI review (advisory)

Deep-reasoning reviewer — openai/o3 · verdict: comment · risk: low

The PR only bumps actions/setup-node from v4 → v7. No secrets or malicious logic are introduced. Primary concern is the use of unpinned action versions in two workflows, which slightly raises supply-chain risk. Suggest pinning to specific SHAs for full reproducibility.

Security notes:

• medium .github/workflows/build-catalog.yml:41 — The workflow now references actions/setup-node@​v7 without a commit SHA. Floating major-version tags can be retagged, creating a supply-chain risk. Pin to a specific commit (as done in update-message-center.yml) or enable Dependabot.
• medium .github/workflows/traffic-stats.yml:30 — actions/setup-node@​v7 is used without a commit SHA. Pinning is recommended to avoid unexpected code changes.

Quality notes:

• .github/workflows/build-catalog.yml — Two jobs were updated but remain on Node 20 while update-message-center moved to Node 22. Confirm that the runtime split is intentional and documented.
• .github/workflows/update-message-center.yml — Good practice of pinning to a commit for actions/setup-node. Consider applying the same pattern to other workflows for consistency.

✅ Suggested next steps

• Pin actions/setup-node@​v7 to the exact commit SHA in build-catalog.yml and traffic-stats.yml, mirroring update-message-center.yml.
• Optionally add a comment explaining the mix of Node 20 and Node 22 to avoid confusion.

---

The automated guardrails are authoritative and gate the security status. The AI review is advisory and never auto-merges. Thanks for contributing to FastTrack! 🛩️