Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0
What the developer wrote
Authored by Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6909: build(deps): bump actions/labeler from 6.2.0 to 7.0.0
f6c31cbd78e1142d2454ec3fe7979b755c56e12e build(deps): bump actions/labeler from 6.2.0 to 7.0.0 (dependabot[bot])
Pull request description:
Bumps [actions/labeler](https://github.com/actions/labeler) from 6.2.0 to 7.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/labeler/releases">actions/labeler's releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements:</h3>
<ul>
<li>Migrate to ESM and update dependencies by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/949">actions/labeler#949</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/labeler/compare/v6...v7.0.0">https://github.com/actions/labeler/compare/v6...v7.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/labeler/commit/bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13"><code>bf12e9b</code></a> feat: migrate to ESM and update dependencies (<a href="https://redirect.github.com/actions/labeler/issues/949">#949</a>)</li>
<li>See full diff in <a href="https://github.com/actions/labeler/compare/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d...bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit:
apoelstra:
ACK f6c31cbd78e1142d2454ec3fe7979b755c56e12e; successfully ran local tests
satsfy:
ACK f6c31cbd78e1142d2454ec3fe7979b755c56e12e
Tree-SHA512: c01e93f62f62f0053adf8d6356c4b4766e12f338d8886004cdf4817e74362717807bee30b26b63bf39f1ad59b7586b628631e739606534e11e6215d4dccbf7c1
What changed, and why it matters
This commit updates a GitHub Actions automation tool (actions/labeler) used to automatically tag pull requests with labels. It is a routine dependency version bump from 6.2.0 to 7.0.0, with no indication of a security fix or vulnerability. The change only affects internal project workflow automation and does not touch the rust-bitcoin library code that users install.
No security action required. Treat as routine CI/CD maintenance. Review the upstream release notes for any breaking changes to the labeler configuration format before merging, but this is a normal dependency update.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit bumps the pinned GitHub action actions/labeler from commit b8dd2d9 (v6.2.0) to bf12e9b (v7.0.0) in .github/workflows/manage-pr.yml. The upstream v7.0.0 release notes describe the change as a migration to ESM and dependency updates. There is no mention of a security advisory, CVE, or vulnerability fix in the commit message, PR description, or supplied references. The action only labels pull requests and has no access to repository secrets or release artifacts beyond the GITHUB_TOKEN permissions granted to the workflow.
Changed components
.github/workflows/manage-pr.ymlInspect captured patch +1 / −1
### .github/workflows/manage-pr.yml
@@ -17,7 +17,7 @@ jobs:
- name: Generate label config
run: ./.github/gen_label_config.sh
- name: Update labels
- uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+ uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
with:
configuration-path: .github/labeler.yml
sync-labels: trueWhy this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.