Informational 19 Bitcoin Committed Jul 13, 2026 · 10:24 UTC

build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1

21337179 View source ↗

Public commit record

What the developer wrote

Authored by dependabot[bot]

93/100 · Strong

build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.8 to 8.1.1.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](https://github.com/peter-evans/create-pull-request/compare/271a8d0340265f705b14b6d32b9829c1cb33d45e...5f6978faf089d4d20b00c7766989d076bb2fc7f1)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-version: 8.1.1
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference

The short version

What changed, and why it matters

This is a routine Dependabot update that bumps a GitHub Actions helper used by automated weekly maintenance workflows to create pull requests. The change only affects internal tooling, not the Rust Bitcoin library code that users rely on. There is no direct evidence of a security vulnerability being fixed or introduced, but any third-party action update carries a small supply-chain risk if the new version were malicious or buggy.

Recommended action

Treat as routine dependency maintenance. Verify the new action release notes for any breaking changes or security fixes, confirm the pinned commit hash matches the official peter-evans/create-pull-request v8.1.1 release, and ensure the APOELSTRA_CREATE_PR_TOKEN secret has only the minimum required permissions (e.g., contents and pull-requests write). No immediate security response is warranted based on the available evidence.

Security signals we found

Third-party GitHub Action version bump in CI/CD workflows

Workflows use a repository secret (APOELSTRA_CREATE_PR_TOKEN) when creating pull requests

No vendor security advisory or CVE referenced in commit or supplied materials

No code changes to the rust-bitcoin library or its dependencies

Technical analysis

Evidence from the diff

The commit updates peter-evans/create-pull-request from v7.0.8 (commit 271a8d03) to v8.1.1 (commit 5f6978fa) across five scheduled GitHub Actions workflows. These workflows run weekly to open automated PRs for rustfmt, cargo-semver-checks, nightly toolchain, RBMT, and stable toolchain updates. The workflows use a repository secret APOELSTRA_CREATE_PR_TOKEN to authenticate PR creation. The diff is a pure version/hash swap with no workflow logic changes.

Changed components

.github/workflows/cron-weekly-rustfmt.yml.github/workflows/cron-weekly-update-cargo-semver-checks.yml.github/workflows/cron-weekly-update-nightly.yml.github/workflows/cron-weekly-update-rbmt.yml.github/workflows/cron-weekly-update-stable.yml

Inspect captured patch +5 / −5

diff --git a/.github/workflows/cron-weekly-rustfmt.yml b/.github/workflows/cron-weekly-rustfmt.yml
index e1fdb708..e1778c8f 100644
--- a/.github/workflows/cron-weekly-rustfmt.yml
+++ b/.github/workflows/cron-weekly-rustfmt.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Get the current date
         run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_ENV
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           author: Fmt Bot <bot@example.com>
           title: Automated nightly rustfmt (${{ env.date }})
diff --git a/.github/workflows/cron-weekly-update-cargo-semver-checks.yml b/.github/workflows/cron-weekly-update-cargo-semver-checks.yml
index 8bf5f7ef..f566f91c 100644
--- a/.github/workflows/cron-weekly-update-cargo-semver-checks.yml
+++ b/.github/workflows/cron-weekly-update-cargo-semver-checks.yml
@@ -34,7 +34,7 @@ jobs:
           fi
       - name: Create Pull Request
         if: env.changes_made == 'true'
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.APOELSTRA_CREATE_PR_TOKEN }}
           author: Update cargo-semver-checks Bot <bot@example.com>
diff --git a/.github/workflows/cron-weekly-update-nightly.yml b/.github/workflows/cron-weekly-update-nightly.yml
index 0dcfbe39..b76b31b6 100644
--- a/.github/workflows/cron-weekly-update-nightly.yml
+++ b/.github/workflows/cron-weekly-update-nightly.yml
@@ -28,7 +28,7 @@ jobs:
           cargo rbmt toolchains --update-nightly
           echo "nightly_version=$(cargo rbmt toolchains --nightly)" >> $GITHUB_ENV
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.APOELSTRA_CREATE_PR_TOKEN }}
           base: ${{ matrix.branch }}
diff --git a/.github/workflows/cron-weekly-update-rbmt.yml b/.github/workflows/cron-weekly-update-rbmt.yml
index 996fcfc4..bd1e5d1a 100644
--- a/.github/workflows/cron-weekly-update-rbmt.yml
+++ b/.github/workflows/cron-weekly-update-rbmt.yml
@@ -34,7 +34,7 @@ jobs:
           fi
       - name: Create Pull Request
         if: env.changes_made == 'true'
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.APOELSTRA_CREATE_PR_TOKEN }}
           author: Update RBMT Bot <bot@example.com>
diff --git a/.github/workflows/cron-weekly-update-stable.yml b/.github/workflows/cron-weekly-update-stable.yml
index c1df37a2..54eda110 100644
--- a/.github/workflows/cron-weekly-update-stable.yml
+++ b/.github/workflows/cron-weekly-update-stable.yml
@@ -27,7 +27,7 @@ jobs:
           cargo rbmt toolchains --update-stable
           echo "stable_version=$(cargo rbmt toolchains --stable)" >> $GITHUB_ENV
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.APOELSTRA_CREATE_PR_TOKEN }}
           base: ${{ matrix.branch }}

Risk score

Why this scored 19/100

Our methodology →

Potential impact 2/30

Exploitability 2/25

Stealth signal 1/15

Affected reach 2/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 19/100

Community notes

Related watches

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`

Merge rust-bitcoin/rust-bitcoin#6440: base58: Introduce `decode_check_to_array` for alloc-less decoding