[mortyops]

This PR contains the following updates:

Package	Type	Update	Change
node	uses-with	major	24 → 26

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/node-versions (node)

v26.13.0: 26.13.0

Compare Source

Node.js 26.13.0

v26.12.1: 26.12.1

Compare Source

Node.js 26.12.1

v26.12.0: 26.12.0

Compare Source

Node.js 26.12.0

v26.11.1: 26.11.1

Compare Source

Node.js 26.11.1

v26.11.0: 26.11.0

Compare Source

Node.js 26.11.0

v26.10.0: 26.10.0

Compare Source

Node.js 26.10.0

v26.9.0: 26.9.0

Compare Source

Node.js 26.9.0

v26.8.2: 26.8.2

Compare Source

Node.js 26.8.2

v26.8.1: 26.8.1

Compare Source

Node.js 26.8.1

v26.8.0: 26.8.0

Compare Source

Node.js 26.8.0

v26.7.0: 26.7.0

Compare Source

Node.js 26.7.0

v26.6.0: 26.6.0

Compare Source

Node.js 26.6.0

v26.5.1: 26.5.1

Compare Source

Node.js 26.5.1

v26.5.0: 26.5.0

Compare Source

Node.js 26.5.0

v26.4.0: 26.4.0

Compare Source

Node.js 26.4.0

v26.3.1: 26.3.1

Compare Source

Node.js 26.3.1

v26.3.0: 26.3.0

Compare Source

Node.js 26.3.0

v26.2.0: 26.2.0

Compare Source

Node.js 26.2.0

v26.1.0: 26.1.0

Compare Source

Node.js 26.1.0

v26.0.0: 26.0.0

Compare Source

Node.js 26.0.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local (openai) · pr-reviewer-action v3.7.0

Recommendation

Approve. This is a straightforward Renovate-driven major version bump of the actions/setup-node action's Node.js runtime from 24 to 26 across three CI jobs in .github/workflows/validate.yaml. The change is scoped, correct, and carries no security or operational risk.

Change-by-Change Findings

.github/workflows/validate.yaml — Node version bump (lines 196, 295, 321)

Three actions/setup-node node-version values are changed from "24" to "26":

1. Line 196 — renovate-config job (setup node for Renovate config validation)
2. Line 295 — python-tests job (setup node for Python test harness)
3. Line 321 — renovate job (setup node for pin tests)

The action SHA (actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0) is pinned to a full commit SHA with a version comment — compliant with the repo's GitHub Actions pinning rule.

Scope check: The renovate/node-26.x branch label confirms this is a Renovate-managed dependency update, not a manual change. The ci(github-release)!: Update release node commit type follows the repo's conventional commit format.

No other files changed — this is a pure version bump with no behavioral logic changes.

Standards Compliance

• GitHub Actions pinning: ✅ actions/setup-node is pinned to a full commit SHA with # v7.1.0 comment — satisfies the "pin every action to a full commit SHA" rule.
• No plaintext secrets: ✅ No secrets in the diff.
• No postRenderer bash: ✅ Not applicable (this is a workflow file, not a HelmRelease).
• No allow-github-actions-approve-prs: ✅ Not introduced.
• Fork guard: The changed jobs (renovate-config, python-tests, renovate) are not pull_request_target triggers and do not run in-cluster — no fork guard needed for these.

Unknowns / Needs Verification

• Node.js 26 EOL status: Node.js 26 is an LTS release (current as of the PR date). No evidence in the corpus suggests it is EOL or unsupported. The bump is to 26.12.1 (latest patch), which is appropriate.
• CI compatibility: The validate.yaml workflow runs on the gha-runner-scale-set-aviator-coding-home-ops runner (in-cluster, no Docker daemon). Node.js 26 is a standard runtime — no Docker or kubectl dependency is introduced by this change. No risk to the runner.

Conclusion

This is a low-risk, well-scoped dependency update. The three Node.js version bumps are consistent across all CI jobs that need a Node runtime, and the action SHA remains pinned. No further changes are needed.