chore(deps): bump actions/stale from 10.4.0 to 11.0.0 - #20935
chore(deps): bump actions/stale from 10.4.0 to 11.0.0#20935dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/stale](https://github.com/actions/stale) from 10.4.0 to 11.0.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@1e223db...4391f3d) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Reviewing this major version bump. Workflow run |
![mozilla-blender[bot]](https://avatars.githubusercontent.com/in/3479298?s=60&v=4){kind=small}
There was a problem hiding this comment.
APPROVED: auto-merge: major bump evaluated as safe (high confidence).
Reason: actions/stale is used in exactly one place: the scheduled workflow .github/workflows/close-stale-prs.yml. The v11.0.0 breaking change is an internal migration to ESM plus a transitive dependency override (brace-expansion -> 5.0.8 for vulnerability fixes). Neither changes the action's public input interface. The inputs consumed here (repo-token, days-before-issue-stale, stale-pr-message, stale-pr-label) are long-stable and unaffected. The change is a pinned-SHA/tag bump in a single cron workflow that has no effect on the FxA build/test pipeline. All completed CI checks pass; the in-progress and on-hold gated jobs are unrelated to this scheduled workflow change.
Breaking changes: Migrate to ESM and update dependencies (actions/stale#1350) — internal implementation change to the action's bundled runtime; does not change action inputs/outputs.; Override brace-expansion to 5.0.8 to address 24 high-severity dependency vulnerabilities (actions/stale#1351) — internal transitive dependency bump, no interface impact.
Test coverage: No repository unit/integration tests exercise this GitHub Action; it is a third-party action invoked only by a scheduled (cron) workflow. Workflow YAML is validated by actionlint, zizmor, and yamllint. The used inputs are unchanged in v11, and no consumer code depends on the action's internals, so the ESM migration cannot break this usage. The action's own behavior is not run in this PR's CI (it fires only on schedule).
Bumps actions/stale from 10.4.0 to 11.0.0.
Release notes
Sourced from actions/stale's releases.
Commits
4391f3dFix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8 (...eaf9131refactor: update imports to use ES module syntax and improve test structure (...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)