chore(main): release 7.0.0

[nodejs-github-bot]

🤖 I have created a release beep boop

7.0.0 (2026-08-07)

⚠ BREAKING CHANGES

• remove npm shrinkwrap, bundle package dependencies (#1135)
• ncu-ci: remove --copy flag (#1140)
• remove deprecated get-metadata entrypoint
• v8: synchronize Rust crates with major updates (#1117)
• drop support for Node.js 20 and 25 (#1072)

Features

• add confirmation steps to any write operation (#1092) (07d5ba0)
• add metadata JSON readiness output (#1113) (a22e127)
• git-node: add git node benchmark (#1114) (eb405a1)
• git-node: add git node security --apply-patches (#1050) (bf990ac)
• git-node: select security release PRs from affectedVersions (#1124) (72bf756)
• improve DX of request-cves (#1120) (f2f4ac5)
• security: add include-all report selection mode (#1111) (e4a7c7d)
• security: offer Tuesday release date choices (#1110) (1f46846)
• support affectedVersions as object (#1118) (c3b9dc6)
• v8: synchronize Rust crates with major updates (#1117) (78e1dbb)

Bug Fixes

• add announcement ref to top-level vuln json (#1119) (3017208)
• adjust changelog on security releases (9ccbe8e)
• borrow generateAmendedMessage in CherryPick (#1125) (5b3296a)
• cherry-pick the landedCommitSha for security releases (eabfbde)
• git-node: add missing exit loop condition (#1101) (2d1085f)
• git-node: fix security release preparation (e828716)
• git-node: fix SSH passphrase input when promoting a release (#1097) (10c6f35)
• git-node: prefill both patch and minor versions when requesting CVEs (#1095) (0ead0a1)
• git-node: security release preparation should not use staging (#1096) (4ad397f)
• handle affectedVersions as object for post-release (#1122) (c263c2a)
• remove the separator for dep update (#1112) (67fbf88)
• v8: set RUSTC_BOOTSTRAP=1 when using Cargo nightly features (#1127) (828f427)
• wpt: avoid test/fixtures/wpt/README.md conflicts (d9fff73)

Miscellaneous Chores

• drop support for Node.js 20 and 25 (#1072) (c564d81)
• ncu-ci: remove --copy flag (#1140) (490362f)
• remove deprecated get-metadata entrypoint (438f78d)
• remove npm shrinkwrap, bundle package dependencies (#1135) (b7939d2)

---

This PR was generated with Release Please. See documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.19%. Comparing base (b7939d2) to head (28756fc).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1082   +/-   ##
=======================================
  Coverage   57.19%   57.19%           
=======================================
  Files          53       53           
  Lines       10367    10367           
=======================================
  Hits         5929     5929           
  Misses       4438     4438           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[aduh95]

Let's release before we have to drop support for Node.js 22 too!

[nodejs-github-bot]

🤖 Created releases:

• v7.0.0

🌻