chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.1#342
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.1#342dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Claude / Claude Code Review
completed
Apr 20, 2026 in 4m 46s
Code review found 2 potential issues
Found 5 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 1 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | .github/workflows/bundle-analysis.yml:31 |
Stale version comments after SHA update |
| 🟣 Pre-existing | .github/workflows/deploy-docs.yml:27 |
deploy-docs.yml uses mutable tag instead of pinned SHA |
Annotations
Check warning on line 31 in .github/workflows/bundle-analysis.yml
claude / Claude Code Review
Stale version comments after SHA update
8 workflow files updated the pnpm/action-setup SHA to v6.0.1 but kept stale `# v4` comments, while only ci.yml correctly updated to `# v6.0.1`. Version comments exist so security auditors can verify a pinned SHA matches a known release — having comments three major versions behind defeats this purpose; update all `# v4` annotations to `# v6.0.1` in bundle-analysis.yml:31, docs-check.yml:65, docs-seo-aeo.yml:35, prepare-release.yml:34, release-on-tag.yml:26, release.yml:32 and :136, and stable-re
Check notice on line 27 in .github/workflows/deploy-docs.yml
claude / Claude Code Review
deploy-docs.yml uses mutable tag instead of pinned SHA
deploy-docs.yml uses the mutable tag pnpm/action-setup@v6.0.1 instead of a pinned commit SHA, while all 8 other workflow files in this PR use the immutable SHA @078e9d416474b29c0c387560859308974f7e9c53. This is a pre-existing pattern in this file (it previously used @v5), but the PR touched this line without converting to SHA pinning, leaving an inconsistency across the codebase — the fix is to use pnpm/action-setup@078e9d416474b29c0c387560859308974f7e9c53 # v6.0.1.
Loading