Bump pnpm/action-setup from 4 to 6

[dependabot]

Bumps pnpm/action-setup from 4 to 6.

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.0

Added support for pnpm v11.

v5.0.0

Updated the action to use Node.js 24.

v4.4.0

Updated the action to use Node.js 24.

v4.3.0

What's Changed

• docs: fix the run_install example in the Readme by @​dreyks in pnpm/action-setup#175
• chore: remove unused @types/node-fetch dependency by @​silverwind in pnpm/action-setup#186
• Clarify that package_json_file is relative to GITHUB_WORKSPACE by @​chris-martin in pnpm/action-setup#184
• feat: store caching by @​jrmajor in pnpm/action-setup#188
• refactor: remove star imports by @​KSXGitHub in pnpm/action-setup#196
• fix(ci): exclude macos by @​KSXGitHub in pnpm/action-setup#197

New Contributors

• @​dreyks made their first contribution in pnpm/action-setup#175
• @​silverwind made their first contribution in pnpm/action-setup#186
• @​chris-martin made their first contribution in pnpm/action-setup#184
• @​jrmajor made their first contribution in pnpm/action-setup#188
• @​Boosted-Bonobo made their first contribution in pnpm/action-setup#199

Full Changelog: pnpm/action-setup@v4.2.0...v4.3.0

v4.2.0

When there's a .npmrc file at the root of the repository, pnpm will be fetched from the registry that is specified in that .npmrc file #179

v4.1.0

Add support for package.yaml #156.

Commits

• 26f6d4f fix: use npm co-located with the action node binary (#239)
• 903f9c1 fix: update pnpm to 11.0.0-rc.5
• bdf0af2 test: add strict version-match jobs to reproduce #225 / #227
• 71c9247 fix: pnpm self-update binary shadowed by bootstrap on PATH (#230)
• 078e9d4 fix: update pnpm to 11.0.0-rc.2
• 08c4be7 docs(README): update action-setup version
• 5798914 chore: update .gitignore
• ddffd66 fix: remove accidentally committed file
• b43f991 fix: update pnpm to 11.0.0-rc.0
• 3852509 README.md: bring versions up-to-date (#222)
• Additional commits viewable in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1cf9c3a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[matt-evervault]

Review

Reviewed v4 → v6 against every workflow that uses pnpm/action-setup in this repo.

What changed in v4 → v6

• v4.2.0 — pnpm tarball fetched from .npmrc-configured registry
• v4.3.0 — optional store-caching input added
• v4.4.0 / v5.0.0 — action runtime moved to Node.js 24 (the action's own runtime, not the project's)
• v6.0.0 — adds support for pnpm v11 (becomes the default fallback when no version is pinned)
• v6.0.1–v6.0.5 — bundled pnpm bumps + PATH/npm-binary fixes

How we use the action (12 references across 9 workflows)

• Every call site is bare (no version: input) → version is resolved from package.json → packageManager field per Corepack
• package.json pins pnpm@10.26.1+sha512.…, so v6 will still install pnpm 10.26.1, not v11
• Only other input we use anywhere is run_install: false (in e2e-test.yml), unchanged in v6
• pnpm-store caching is done by actions/setup-node@v6 with cache: "pnpm", independent of this action — we don't enable the action's own cache: input

Compatibility

• Runners (ubuntu-latest, macos-latest/macos-15) all support the v5+ Node 24 runtime
• .nvmrc is v24, fully aligned
• No new permissions, secrets, or supply-chain risks introduced; tag-pin style (@v6) matches existing convention

Verification

• pnpm install --frozen-lockfile and pnpm build both succeed locally on pnpm 10.26.1, confirming the version we'll keep getting is healthy

Verdict

Safe to merge. No code changes needed — the packageManager pin makes v6 a no-op for our actual pnpm runtime, and we don't touch any inputs whose semantics changed.

---

Generated by Claude Code