[renovate]

This PR contains the following updates:

Package	Type	Update	Change
pnpm/setup	action	patch	v3.1.1 → v3.1.2

---

Release Notes

pnpm/setup

v3.1.2

Compare Source

What's Changed

• fix: update get-pnpm to v0.0.6 by @​zkochan in #​86
• perf: stop lockfile reads after the environment document by @​MindTooth in #​75
• fix: skip saving the cache when the pruned store matches the restored one by @​poulet42 in #​77
• fix: save the lockfile verification cache at most once per job by @​zkochan in #​87
• fix: let get-pnpm resolve the pnpm version by @​zkochan in #​88
• fix: read only the path from pnpm's cache directory output by @​zkochan in #​89
• fix: read the runtime versions when pnpm prints more than the listing by @​zkochan in #​90
• chore: lint with the ESLint rules pnpm/pnpm and get-pnpm use by @​zkochan in #​91
• fix: read the lockfile from lockfileDir when the workspace sets it by @​zkochan in #​92

Full Changelog: pnpm/setup@v3.1.1...v3.1.2

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1d97825

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🤖 Claude Dependency Review

✅ Recommended Actions

None — safe to merge as-is. This patch update contains only bug fixes and performance improvements with no breaking changes.

📦 Update Summary

• Library: pnpm/setup (GitHub Action)
• Version: v3.1.1 → v3.1.2
• Change Type: Patch

📝 Release Notes

Release URL: https://github.com/pnpm/setup/releases/tag/v3.1.2

Released: October 25, 2026

This patch release contains bug fixes, one performance improvement, and maintenance updates. No breaking changes or new features.

🐛 Bug Fixes

• Update get-pnpm to v0.0.6 (#86)
• Skip saving the cache when the pruned store matches the restored one (#77)
• Save the lockfile verification cache at most once per job (#87)
• Let get-pnpm resolve the pnpm version (#88)
• Read only the path from pnpm's cache directory output (#89)
• Read runtime versions when pnpm prints more than the listing (#90)
• Read the lockfile from lockfileDir when the workspace sets it (#92)

⚡ Performance

• Stop lockfile reads after the environment document (#75)

🔧 Maintenance

• Lint with the ESLint rules that pnpm/pnpm and get-pnpm use (#91)

Full Changelog: pnpm/setup@v3.1.1...v3.1.2

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: None found for the pnpm/setup GitHub Action itself. The search identified several CVEs for the pnpm CLI tool (CVE-2026-55697, CVE-2026-55698, CVE-2026-50014), but these affect the pnpm package manager, not the GitHub Action that installs it.
• Supply-chain notes:
  • No maintainer or ownership changes detected
  • No suspicious lifecycle scripts added
  • No abnormal version jumps (patch update from v3.1.1 to v3.1.2)
  • The action updates its internal dependency get-pnpm from an older version to v0.0.6, which is expected maintenance
  • Release was published on October 25, 2026, and this PR was created promptly by the automated dependency update system
  • The action repository is maintained by the official pnpm organization (owner_id: 21320719)

🚨 Breaking Changes

None. This is a patch release with only bug fixes and performance improvements.

✨ Main Changes

Bug Fixes (Cache & Lockfile Handling)

The primary improvements in this release focus on more reliable caching and lockfile reading:

• Cache optimization: The action now skips saving the cache when the pruned store matches the restored one, reducing unnecessary cache writes
• Lockfile verification: Ensures the lockfile verification cache is saved at most once per job, preventing redundant cache operations
• Lockfile directory support: The action now correctly reads the lockfile from lockfileDir when the workspace configuration specifies it, which is important for monorepos with custom lockfile locations
• Version resolution: Improved reliability in resolving the pnpm version by delegating to the get-pnpm utility
• Output parsing: More robust parsing of pnpm's cache directory output and runtime version information

Performance Improvements

• Faster lockfile processing: Stops reading the lockfile after the environment document, reducing I/O operations during setup

Impact

These changes primarily improve the action's reliability and performance in CI environments. Users may notice:

• Faster setup times due to optimized lockfile reading
• Reduced cache storage usage due to smarter cache saving logic
• Better compatibility with monorepo configurations using custom lockfileDir settings

🔍 Impact Analysis

📁 Usage Locations

pnpm/setup is used in 2 direct locations and affects 17 workflows indirectly:

1. .github/actions/install-deps/action.yml

   - name: Install pnpm + Node.js
     uses: pnpm/setup@​fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2
     with:
       runtime: node@​${{ inputs.node-version }}
       cache: true
       install: false

   • Feature used: Installs pnpm and Node.js, enables caching
   • Impact: This is the primary reusable composite action used across the repository. All 17 workflows listed below inherit this change.
   • Configuration: Uses the runtime parameter to install both pnpm and Node.js together, with caching enabled but installation deferred to a separate step

2. .github/workflows/lockfile-audit.yml

   - name: Install pnpm + Node.js
     uses: pnpm/setup@​fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2
     with:
       runtime: node@​24.22.1
       install: false

   • Feature used: Installs pnpm and Node.js for lockfile auditing
   • Impact: Direct usage in the lockfile audit workflow, which validates dependency security on lockfile changes
   • Configuration: Pins to Node.js 24.22.1, no automatic dependency installation

🔄 Workflows Indirectly Affected (via install-deps composite action)

The following 17 workflows use the install-deps composite action and will benefit from this update:

3. .github/workflows/changeset-check.yml - Validates changeset requirements for PRs
4. .github/workflows/check-license.yml - Verifies license compliance
5. .github/workflows/check-workspace-regions.yml - Checks workspace region configuration
6. .github/workflows/ci.yml - Main continuous integration workflow
7. .github/workflows/cleanup-e2e-workspaces.yml - Cleans up end-to-end test workspaces
8. .github/workflows/deploy-drift-check.yml - Checks for deployment configuration drift
9. .github/workflows/deploy.yml - Deploys to the Tailor Platform
10. .github/workflows/erd-schema.yml - Generates entity-relationship diagrams
11. .github/workflows/generate.yml - Runs code generation
12. .github/workflows/github-actions-lint.yml - Lints GitHub Actions workflows
13. .github/workflows/migration.yml - Handles database migrations
14. .github/workflows/pkg-pr-new.yml - Creates preview packages for PRs
15. .github/workflows/release.yml - Publishes releases
16. .github/workflows/sdk-e2e.yml - Runs SDK end-to-end tests
17. .github/workflows/sdk-metrics.yml - Collects SDK metrics
18. .github/workflows/template-tests.yml - Tests project templates
19. .github/workflows/test.yml - Runs unit and integration tests

📄 Lockfile Tracking

20. .github/workflows/actions.lock - Tracks all GitHub Action versions used in workflows (updated with the new v3.1.2 SHA)

Expected Impact

Positive impacts:

• ✅ Faster CI job setup times due to optimized lockfile parsing
• ✅ Reduced cache storage usage from smarter cache management
• ✅ More reliable builds, especially for workflows with custom lockfileDir configurations
• ✅ Improved cache efficiency (avoiding redundant cache writes)

No negative impact expected:

• ⚠️ No breaking changes in this release
• ⚠️ All existing configurations remain compatible
• ⚠️ The runtime parameter usage in both direct usages is standard and fully supported

---