build(deps): bump actions/github-script from 8.0.0 to 9.0.0
What the developer wrote
Authored by dependabot[bot]
build(deps): bump actions/github-script from 8.0.0 to 9.0.0
Bumps [actions/github-script](https://github.com/actions/github-script) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3)
---
updated-dependencies:
- dependency-name: actions/github-script
dependency-version: 9.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine update by Dependabot that bumps the version of a GitHub Actions helper called actions/github-script from version 8.0.0 to 9.0.0 in two workflow files. The workflows only manage issue/label automation after CI runs and do not handle source code, secrets, or release artifacts. There is no indication in the commit that this fixes a security vulnerability.
Treat as routine maintenance. Review the upstream actions/github-script v9.0.0 release notes for any breaking changes before merging, and verify the pinned SHA matches the official release. No security-specific action is required based on the supplied materials.
Security signals we found
Dependency version bump of a third-party GitHub Action
Workflows use GITHUB_TOKEN with repository write scopes for issue/label management
No vendor disclosure of security relevance
No CVE or advisory referenced in commit or supplied materials
Evidence from the diff
The commit updates pinned SHA references for actions/github-script from v8.0.0 (ed597411d8f924073f98dfc5c65a23a2325f34cd) to v9.0.0 (3a2844b7e9c422d3c10d287c895573f7108da1b3) in .github/workflows/ci-failure-issues.yml and .github/workflows/semver-checks-pr-label.yml. Both workflows run with GITHUB_TOKEN and perform repository-management tasks (creating issues, downloading artifacts, adding labels/comments). The change is a standard major-version dependency bump with no disclosed security relevance and no code changes to the rust-bitcoin library itself.
Changed components
.github/workflows/ci-failure-issues.yml.github/workflows/semver-checks-pr-label.ymlactions/github-script GitHub ActionInspect captured patch +3 / −3
diff --git a/.github/workflows/ci-failure-issues.yml b/.github/workflows/ci-failure-issues.yml
index 21b169e2..21a3d24c 100644
--- a/.github/workflows/ci-failure-issues.yml
+++ b/.github/workflows/ci-failure-issues.yml
@@ -24,7 +24,7 @@ jobs:
runs-on: ubuntu-24.04
steps:
- - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+ - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const run = context.payload.workflow_run;
diff --git a/.github/workflows/semver-checks-pr-label.yml b/.github/workflows/semver-checks-pr-label.yml
index 947b1ee3..2b1138ce 100644
--- a/.github/workflows/semver-checks-pr-label.yml
+++ b/.github/workflows/semver-checks-pr-label.yml
@@ -19,7 +19,7 @@ jobs:
if: ${{ github.event.workflow_run.conclusion == 'success' }}
steps:
- name: "Download artifact"
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
// get all artifacts from the workflow run
@@ -55,7 +55,7 @@ jobs:
if: ${{ hashFiles('semver-break.zip') != '' }}
run: unzip -n semver-break.zip
- name: "Comment and add label on PR - Semver break"
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
if: ${{ hashFiles('semver-break') != '' }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.