build(deps): bump ncipollo/release-action from 1.20.0 to 1.21.0
What the developer wrote
Authored by dependabot[bot]
build(deps): bump ncipollo/release-action from 1.20.0 to 1.21.0
Bumps [ncipollo/release-action](https://github.com/ncipollo/release-action) from 1.20.0 to 1.21.0.
- [Release notes](https://github.com/ncipollo/release-action/releases)
- [Commits](https://github.com/ncipollo/release-action/compare/b7eabc95ff50cbeeedec83973935c8f306dfcd0b...339a81892b84b4eeb0f6e744e4574d79d0d9b8dd)
---
updated-dependencies:
- dependency-name: ncipollo/release-action
dependency-version: 1.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine update by Dependabot to the GitHub Action used for creating releases. It changes the pinned version of ncipollo/release-action from 1.20.0 to 1.21.0 in the project's release workflow. There is no direct evidence in the commit or supplied references that this update fixes a security vulnerability or introduces one. It is a normal dependency maintenance change.
Review the upstream ncipollo/release-action v1.21.0 release notes for any security fixes or breaking changes before merging. If none are present, this can be treated as routine maintenance. Ensure the new commit hash matches the official release tag.
Security signals we found
Dependency bump of a third-party GitHub Action used in release automation
No security-relevant description in commit message or title
No CVE, advisory, or security release notes referenced
Workflow is limited to release events and does not handle secrets beyond default GitHub token
Evidence from the diff
The commit updates a single GitHub Actions workflow file (.github/workflows/gh-release.yml), pinning ncipollo/release-action to a new commit hash corresponding to version 1.21.0. The workflow only runs on published releases and uses generateReleaseNotes: true. No code changes to the rust-bitcoin library are made. No security advisory, CVE, or vendor security note is provided in the commit or references.
Changed components
.github/workflows/gh-release.ymlncipollo/release-action GitHub Action (1.20.0 -> 1.21.0)Inspect captured patch +1 / −1
diff --git a/.github/workflows/gh-release.yml b/.github/workflows/gh-release.yml
index c8e33010..795819b2 100644
--- a/.github/workflows/gh-release.yml
+++ b/.github/workflows/gh-release.yml
@@ -16,6 +16,6 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- - uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
+ - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
with:
generateReleaseNotes: true
Why this scored 13/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.