Skip to content

deps(deps): bump actions/setup-node from 4 to 6 - #69

Merged
DrunkOnJava merged 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-6.4.0
Aug 29, 2026
Merged

deps(deps): bump actions/setup-node from 4 to 6#69
DrunkOnJava merged 1 commit into
mainfrom
dependabot/github_actions/actions/setup-node-6.4.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps actions/setup-node from 4 to 6.

Release notes

Sourced from actions/setup-node's releases.

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot @github

dependabot Bot commented on behalf of github Apr 25, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Apr 25, 2026
@dependabot
dependabot Bot requested a review from DrunkOnJava as a code owner April 25, 2026 08:46
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions/setup-node-6.4.0 branch 2 times, most recently from 7e81c9e to d8bdd97 Compare April 25, 2026 10:52
@dependabot dependabot Bot changed the title deps(deps): bump actions/setup-node from 4.0.2 to 6.4.0 deps(deps): bump actions/setup-node from 4 to 6 Apr 25, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions/setup-node-6.4.0 branch 3 times, most recently from 65129d5 to e36c086 Compare April 25, 2026 12:15
@dependabot
deps(deps): bump actions/setup-node from 4 to 6
870ceae 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions/setup-node-6.4.0 branch from e36c086 to 870ceae Compare April 25, 2026 12:36
@DrunkOnJava
DrunkOnJava merged commit 1d2d70d into main Aug 29, 2026
19 checks passed
@DrunkOnJava
DrunkOnJava deleted the dependabot/github_actions/actions/setup-node-6.4.0 branch August 29, 2026 08:43
@DrunkOnJava DrunkOnJava mentioned this pull request Aug 29, 2026
Merged
3 tasks
DrunkOnJava added a commit that referenced this pull request Aug 29, 2026
@DrunkOnJava @cursoragent
chore: Dependabot triage log + vite ^8.2.2 range (#120)
f6bcb7a 
## Summary

Lane Eleven Dependabot triage:

- Document merge/close/leave-open decisions for all 15 open Dependabot
PRs in `docs/dependabot-triage-2026-08-29.md`.
- Raise viewer `vite` package.json range to `^8.2.2` to match the secure
lockfile already on `main` (8.2.2). Dependabot #111 (8.1.5) conflicted
and is closed as superseded — 8.2.2 is newer than that target.

### Already merged via Dependabot (this session)

- #104 playwright, #69 setup-node, #6 upload-artifact, #4 setup-python,
#3 rust-cache, #2 download-artifact

### Closed as obsolete/superseded

- #102 / #76 pyo3 (main already on 0.29), #72 quick-xml (main on 0.41),
#111 vite (superseded; main lock already 8.2.2)

### Left open for dedicated migrations

- #109 TypeScript 7, #108 three.js 0.185, #74 thiserror 2, #71 criterion
0.7, #70 cfb 0.14

## Test plan

- [x] `cd viewer && npm run typecheck`
- [x] `cd viewer && npm audit --audit-level=high` → 0 vulnerabilities
- [ ] CI on this PR

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: DrunkOnJava <DrunkOnJava@users.noreply.github.com>
DrunkOnJava added a commit that referenced this pull request Aug 31, 2026
@DrunkOnJava
polish: ship-readiness pass — legal, claims, docs, hygiene (Tasks #61-#…
0002717 
…71)

#61 — Legal positioning (README + NOTICE)
  - Dropped inaccurate 17 USC §1201(f) cite (that clause is about
    TPM circumvention, not applicable here)
  - Dropped "clean-room reimplementation" claim (we don't have the
    required team-separation structure)
  - Dropped "Autodesk v. ODA settlement (2006)" reference
    (agreement specific to ODA, not a general precedent)
  - Dropped DWG trademark note (this project doesn't touch DWG)
  - Replaced with Sega v. Accolade + Connectix v. Sony + EU
    2009/24/EC Art. 6 + Australia s.47D as accurate authority;
    Baker v. Selden + Lotus v. Borland for file-format-not-
    copyrightable

#62 — README claim audit
  - 1,156 fields → 1,114 (current parser output)
  - "34 field names + ~400 classes" → accurate current numbers
  - "19 probes" → 23 probes (actual examples/ count)
  - "11 addenda" → 12 addenda (actual section count)
  - "375 class records" → 395 (current schema parser output)

#65 — Examples cleanup
  - field_type_probe.rs: #[allow(dead_code)] on the
    inspection struct (clean warning)
  - roundtrip.rs: added module-level //! doc header
  - All 23 examples now build clean + have doc headers

#67 — Doctests
  - RevitFile::open + open_bytes: runnable usage snippets
  - compression::inflate_at: truncated-gzip round-trip demo
  - redact::redact_path_str: before/after example
  - 5 doctests pass

#68 — Announcement draft refresh
  - Replaced Phase-C-era stale numbers with current
    (15 tests → 51; 30-byte invariant → 165-byte; etc.)
  - Removed $500-5k ODA pricing speculation
  - Removed "Whoever owns that wins" polemic
  - Softened "nobody has publicly explained" to
    "I haven't found a published explanation"
  - Added Phase D findings (tag drift, 2021 transition,
    format GUID, 84% field decoding)

#69 — Recon-report review
  - Title: "Moat-Break Reconnaissance" → "on-disk format —
    reconnaissance report" (neutral technical framing)
  - TL;DR: removed "bigger whale than DWG" comparison +
    pricing table
  - Strategic framing: softened "Autodesk has structurally
    prevented it" phrasing while keeping accurate openBIM
    context with its published sources
  - Section 7-8 removed: internal decision memo with whale
    comparison (Tyler Tech, Enverus, CiteCodes), revenue
    speculation, and "STRONG GO" business framework — not
    appropriate for public technical report. Replaced with a
    concise "Status & next steps" section keyed to the
    moat-layer model

#71 — Final verification
  cargo clean → cargo build --release → cargo test --release
  → cargo doc (with -D warnings) all green. 43 unit + 8
  integration + 5 doctests = 56 tests passing. 0 warnings.

Also bundled in this tranche (from prior commits not yet
pushed): the rewrite to reader.rs (doctest additions),
NOTICE legal cleanup, examples/roundtrip.rs doc header.
DrunkOnJava added a commit that referenced this pull request Aug 31, 2026
@DrunkOnJava @cursoragent
chore: Dependabot triage log + vite ^8.2.2 range (#120)
d3468f4 
## Summary

Lane Eleven Dependabot triage:

- Document merge/close/leave-open decisions for all 15 open Dependabot
PRs in `docs/dependabot-triage-2026-08-29.md`.
- Raise viewer `vite` package.json range to `^8.2.2` to match the secure
lockfile already on `main` (8.2.2). Dependabot #111 (8.1.5) conflicted
and is closed as superseded — 8.2.2 is newer than that target.

### Already merged via Dependabot (this session)

- #104 playwright, #69 setup-node, #6 upload-artifact, #4 setup-python,
#3 rust-cache, #2 download-artifact

### Closed as obsolete/superseded

- #102 / #76 pyo3 (main already on 0.29), #72 quick-xml (main on 0.41),
#111 vite (superseded; main lock already 8.2.2)

### Left open for dedicated migrations

- #109 TypeScript 7, #108 three.js 0.185, #74 thiserror 2, #71 criterion
0.7, #70 cfb 0.14

## Test plan

- [x] `cd viewer && npm run typecheck`
- [x] `cd viewer && npm audit --audit-level=high` → 0 vulnerabilities
- [ ] CI on this PR

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: DrunkOnJava <DrunkOnJava@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@DrunkOnJava DrunkOnJava Awaiting requested review from DrunkOnJava DrunkOnJava is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DrunkOnJava