Skip to content

chore(ci)(deps): bump actions/setup-node from 4.4.0 to 6.4.0 - #4857

Merged
jpr5 merged 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-6.4.0
May 15, 2026
Merged

chore(ci)(deps): bump actions/setup-node from 4.4.0 to 6.4.0#4857
jpr5 merged 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-6.4.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 15, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/setup-node from 4.4.0 to 6.4.0.

Release notes

Sourced from actions/setup-node's releases.

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

What's Changed

Documentation

Dependency updates:

New Contributors

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot
chore(ci)(deps): bump actions/setup-node from 4.4.0 to 6.4.0
1b0adb5 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 6.4.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@49933ea...48b55a0)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github May 15, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, github-actions, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.
@vercel

vercel Bot commented May 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
chat-with-your-data Ready Ready Preview, Comment May 15, 2026 4:59pm
docs Ready Ready Preview, Comment May 15, 2026 4:59pm
form-filling Ready Ready Preview, Comment May 15, 2026 4:59pm
research-canvas Ready Ready Preview, Comment May 15, 2026 4:59pm
travel Ready Ready Preview, Comment May 15, 2026 4:59pm

Request Review
@github-actions

github-actions Bot commented May 15, 2026

Copy link
Copy Markdown
Contributor

📣 Social Copy Generator

Generate social media copies (Twitter/X, LinkedIn, Blog Post) for this PR using Claude.

  • Generate social media copies
@github-actions

github-actions Bot commented May 15, 2026

Copy link
Copy Markdown
Contributor

⚠️ Major Version Update — Manual Review Required

Field Value
Action actions/setup-node
Previous v4.4.0
New v6.4.0
Type Major (v4 → v6)

Breaking Changes

  • Breaking Changes
    • Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @dependabot[bot] in #1336

  • Breaking Changes

Release Notes (v5 → v6)

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

What's Changed

Documentation

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

What's Changed

Enhancement:

Dependency updates:

Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

  • Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @dependabot[bot] in #1336
  • Upgrade prettier from 2.8.8 to 3.6.2 by @dependabot[bot] in #1334
  • Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot[bot] in #1362

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

Next Steps

  1. Review breaking changes above
  2. Check if workflow inputs/outputs changed
  3. Verify compatibility with your CI/CD configuration

Full changelog: https://github.com/actions/setup-node/releases

Generated automatically for Dependabot major version PRs.
@jpr5
jpr5 merged commit 004a4cd into main May 15, 2026
50 checks passed
@jpr5
jpr5 deleted the dependabot/github_actions/actions/setup-node-6.4.0 branch May 15, 2026 18:33
@onsclom onsclom mentioned this pull request May 20, 2026
Merged
onsclom added a commit that referenced this pull request May 20, 2026
@onsclom
fix(ci): rebuild better-sqlite3 after pnpm cache restore to fix Node …
1bd5936 
…ABI mismatch (#4938)

## Summary

Fixes a probabilistic CI failure in the `test / unit` matrix where Node
20.x and 22.x jobs would fail with `Module did not self-register` on
`better-sqlite3`.

### Root cause

`setup-node`'s built-in `cache: "pnpm"` uses a cache key of
`node-cache-Linux-pnpm-{lockfileHash}` — **no Node.js version in the
key**. All three matrix jobs (Node 20, 22, 24) share one cache entry.

The failure is **probabilistic, not always-present**:

- **Cold run (first after cache reset):** all three jobs install fresh
and pass. Whichever job finishes first writes its ABI-specific
`better-sqlite3` binary to the shared cache key.
- **Warm run (all subsequent runs):** all three jobs restore from the
same cache entry. Only the job whose Node version matches the cached
binary passes. The other two fail.

This explains the timing: failures started ~May 19 after the
`setup-node` v4→v6 and `pnpm/action-setup` v4→v6 dependabot bumps (May
15, PRs #4857/#4858) reset the cold cache. The first warm run after that
was broken for whichever two Node versions didn't win the write race.

This is a [known upstream bug in
setup-node](actions/setup-node#1171) (issue
#1171, fix pending in PR #1172, not yet in any release).

### Fix

Replace `cache: "pnpm"` in `setup-node` with a manual `actions/cache`
step that scopes the key to the Node.js version:

```
key: ${{ runner.os }}-pnpm-store-${{ matrix.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}
```

Each Node version now has its own isolated pnpm store cache entry. An
ABI-137 binary cached by a Node 24 job can never be served to a Node 20
or 22 job.

The step uses `$GITHUB_OUTPUT` (scoped step output) instead of
`$GITHUB_ENV` per GitHub's security hardening guide.

## Test plan

### Local reproduction (primary evidence)

`better-sqlite3` uses classic ABI (`NODE_MODULE_INIT`, not N-API), so
its binaries are Node-version-specific. With a Node 24 binary in place,
switching to Node 22 without reinstalling reproduces the exact CI
failure:

```
# Binary compiled under Node 24 (ABI 137) — works fine:
$ node --version && node -e "new (require('better-sqlite3'))(':memory:').prepare('SELECT 1').get()"
v24.5.0
{ '1': 1 }

# Same binary, switched to Node 22 (ABI 127) without reinstalling — fails:
$ node-22 -e "new (require('better-sqlite3'))(':memory:')"
Error: The module was compiled against a different Node.js version using
NODE_MODULE_VERSION 137. This version of Node.js requires NODE_MODULE_VERSION 127.
Please try re-compiling or re-installing the module.
```

This is exactly what the shared cache was doing to Node 20/22 jobs:
handing them a binary compiled for a different ABI.

### CI validation

Two runs on this PR confirm the fix end-to-end:

1. **Cold-cache run**
([26185670340](https://github.com/CopilotKit/CopilotKit/actions/runs/26185670340)):
all three jobs install fresh, each writes its own per-version cache
entry, all pass.

2. **Warm-cache run**
([26187495270](https://github.com/CopilotKit/CopilotKit/actions/runs/26187495270)):
each job restores from its own per-version cache entry — the exact
scenario that was previously broken. All pass, with install times
dropping from ~22s (cold, downloading) to 7–10s (warm, linking from
store), confirming real cache hits were served.

| Job | Result | Cache restore | Install |
|-----|--------|--------------|---------|
| unit (20.x) | ✅ pass | 12s (hit) | 8s |
| unit (22.x) | ✅ pass | 12s (hit) | 7s |
| unit (24.x) | ✅ pass | 14s (hit) | 10s |
pull Bot pushed a commit to TheRakeshPurohit/CopilotKit that referenced this pull request May 20, 2026
@onsclom
fix(ci): rebuild better-sqlite3 after pnpm cache restore to fix Node …
193629a 
…ABI mismatch

The pnpm store cache key used by setup-node does not include the Node.js
version, so a cache entry written by a Node 24 job contains an ABI-137
better-sqlite3 binary. When Node 20 (ABI 115) or Node 22 (ABI 127) jobs
restore from the same cache key they get the wrong binary and all
sqlite-runner tests fail with "Module did not self-register".

Adding `pnpm rebuild better-sqlite3` after install re-runs prebuild-install
for the active Node version, downloading the correct prebuilt binary and
overwriting whatever ABI was in the restored cache.

Root cause first appeared after the setup-node v4→v6 and pnpm/action-setup
v4→v6 bumps (May 15, PRs CopilotKit#4857/CopilotKit#4858) reset the cold cache, allowing a
Node 24 binary to poison the shared store entry.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment