Update Renovatebot GHA Updates (major)

[protocols-renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	major	v5 → v6
actions/checkout	action	major	v6 → v7
actions/setup-node	action	major	v6 → v7
actions/setup-python	action	major	v6 → v7

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

actions/cache (actions/cache)

v6.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in #​1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

• Update packages, migrate to ESM by @​Samirat in #​1760

Full Changelog: actions/cache@v5...v6.0.0

v6

Compare Source

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Various dependency updates

v7

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

v7

Compare Source

actions/setup-python (actions/setup-python)

v7.0.0

Compare Source

What's Changed

Enhancements

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​1330
• Pin SHA commits and update docs with latest versions by @​HarithaVattikuti in #​1338
• Remove the pip-install input by @​gowridurgad in #​1336

Bug Fix

• Fix to Classify stderr warning messages as warnings instead of errors in annotations by @​lmvysakh in #​1335
• Validate and retry manifest fetch to prevent silent failures by @​priyagupta108 in #​1332

Dependency Upgrade

• Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @​dependabot in #​1328
• Remove EOL Python versions and Bumps numpy text fixture by @​priya-kinthali in #​1333
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in #​1337

New Contributors

• @​lmvysakh made their first contribution in #​1335
• @​philip-gai made their first contribution in #​1337

Full Changelog: actions/setup-python@v6...v7.0.0

v7

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

---

Note

Medium Risk
Major-version bumps to checkout and cache affect every CI path that uses these composites; checkout v7’s fork-PR restrictions could change behavior for pull_request_target-style flows if any consumers rely on fork checkouts.

Overview
Renovate bumps pinned third-party GitHub Actions across repo workflows and composite actions, with no changes to step inputs or job logic beyond the new commit SHAs.

actions/checkout moves from v6 → v7 everywhere it checks out this repo or Consensys/github-actions (Renovate workflow, docker sanitize tests, and shared composites for docs, Trivy, ECR/DockerHub, security scanning, Slack, etc.). Checkout v7 adds stricter behavior around fork PRs on pull_request_target / workflow_run.

actions/setup-node is updated v6 → v7 in docs build/lint/deploy/release/firecrawl/link-check composites. actions/setup-python goes v6 → v7 in docs-spelling-check. actions/cache/save goes v5 → v6 in trivy-update-cache (ESM migration in that action family).

^{Reviewed by Cursor Bugbot for commit 00586ce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[joshuafernandes]

LGTM