build(deps): bump actions/stale from 10 to 11

[dependabot]

Bumps actions/stale from 10 to 11.

Release notes

Sourced from actions/stale's releases.

v11.0.0

What's Changed

Enhancement

• Migrate to ESM and update dependencies by @​chiranjib-swain in actions/stale#1350

Dependency Update

• Override brace-expansion to 5.0.8 to address 24 high-severity dependency vulnerabilities by @​dependabot in actions/stale#1351

Full Changelog: actions/stale@v10...v11.0.0

v10.4.0

What's Changed

Bug Fix

• Fixed only-issue-types validation by @​trueberryless in actions/stale#1338

Dependency Updates

• Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by @​dependabot in actions/stale#1342

New Contributors

• @​trueberryless made their first contribution in actions/stale#1338

Full Changelog: actions/stale@v10.3.0...v10.4.0

v10.3.0

What's Changed

Bug Fix

• Enhancement: ignore stale labeling events by @​shamoon in actions/stale#1311

Dependency Updates

• Upgrade dependencies (@​actions/core, @​octokit/plugin-retry, @​typescript-eslint) by @​Copilot in actions/stale#1335

New Contributors

• @​shamoon made their first contribution in actions/stale#1311

Full Changelog: actions/stale@v10...v10.3.0

v10.2.0

What's Changed

Bug Fix

• Fix checking state cache (fix #1136) and switch to Octokit helper methods by @​itchyny in actions/stale#1152

Dependency Updates

• Upgrade js-yaml from 4.1.0 to 4.1.1 by @​dependabot in actions/stale#1304
• Upgrade lodash from 4.17.21 to 4.17.23 by @​dependabot in actions/stale#1313
• Upgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from 5.1.1 to 7.0.0 by @​chiranjib-swain in actions/stale#1312

New Contributors

• @​itchyny made their first contribution in actions/stale#1152

Full Changelog: actions/stale@v10...v10.2.0

... (truncated)

Changelog

Sourced from actions/stale's changelog.

Changelog

[10.1.0]

What's Changed

• Add only-issue-types option to filter issues by type by @​Bibo-Joshi in actions/stale#1255

[10.0.0]

What's Changed

Breaking Changes

• Upgrade to node 24 by @​salmanmkc in actions/stale#1279 Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. Release Notes

Enhancement

• Introducing sort-by option by @​suyashgaonkar in actions/stale#1254

Dependency Upgrades

• Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot[bot] in actions/stale#1186
• Upgrade undici from 5.28.4 to 5.28.5 by @​dependabot[bot] in actions/stale#1201
• Upgrade @​action/cache from 4.0.0 to 4.0.2 by @​aparnajyothi-y in actions/stale#1226
• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​suyashgaonkar in actions/stale#1233
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in actions/stale#1251
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in actions/stale#1277

Documentation changes

• Changelog update for recent releases by @​suyashgaonkar in actions/stale#1224
• Permissions update in Readme by @​ghadimir in actions/stale#1248

[9.1.0]

What's Changed

• Documentation update by @​Marukome0743 in actions/stale#1116
• Add workflow file for publishing releases to immutable action package by @​Jcambass in actions/stale#1179
• Update undici from 5.28.2 to 5.28.4 by @​dependabot in actions/stale#1150
• Update actions/checkout from 3 to 4 by @​dependabot in actions/stale#1091
• Update actions/publish-action from 0.2.2 to 0.3.0 by @​dependabot in actions/stale#1147
• Update ts-jest from 29.1.1 to 29.2.5 by @​dependabot in actions/stale#1175
• Update @​actions/core from 1.10.1 to 1.11.1 by @​dependabot in actions/stale#1191
• Update @​types/jest from 29.5.11 to 29.5.14 by @​dependabot in actions/stale#1193
• Update @​actions/cache from 3.2.2 to 4.0.0 by @​dependabot in actions/stale#1194

[9.0.0]

Breaking Changes

1. Action is now stateful: If the action ends because of operations-per-run then the next run will start from the first unprocessed issue skipping the issues processed during the previous run(s). The state is reset when all the issues are processed. This should be considered for scheduling workflow runs.
2. Version 9 of this action updated the runtime to Node.js 20. All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.

... (truncated)

Commits

• 4391f3d Fix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8 (...
• eaf9131 refactor: update imports to use ES module syntax and improve test structure (...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 12:08 PM ET / 16:08 UTC.

ClawSweeper review

What this changes

Updates all three scheduled stale-policy jobs in .github/workflows/stale.yml from actions/stale@v10 to actions/stale@v11.

Merge readiness

⛔ Blocked until real behavior proof is added - 5 items remain

Keep this PR open for a maintainer-controlled behavior check. Current main still uses actions/stale@v10, and the existing maintainer review correctly identifies that this write-capable major update cannot be proven safe by the unchanged YAML inputs or repository-local checks alone.

Priority: P3
Reviewed head: 750865122356586ac616bc162b0c2fbb449842a4
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is focused and mechanically correct, but merge readiness is capped by missing real behavior proof for write-capable automation.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: No after-fix controlled run, redacted workflow log, or equivalent live evidence shows that actions/stale@v11 preserves the three Gitcrawl stale policies. Before merge, add proof from a disposable repository and redact any private repository details; updating the PR body should trigger fresh review, or a maintainer can comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: No after-fix controlled run, redacted workflow log, or equivalent live evidence shows that actions/stale@v11 preserves the three Gitcrawl stale policies. Before merge, add proof from a disposable repository and redact any private repository details; updating the PR body should trigger fresh review, or a maintainer can comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	4 items	Current main retains v10: The current workflow invokes actions/stale@v10 in all three policy steps, so the requested v11 behavior is not already implemented on main. PR scope is three action invocations: The proposed branch changes only the action major version at the unassigned, assigned-issue, and assigned-PR policy steps; their existing close and exemption inputs remain unchanged. Workflow provenance and shipped baseline: The current stale workflow was introduced by the release-preparation commit and is contained in release v0.8.7; its author is the strongest current-history owner for this automation surface.
Findings	None	None.
Security	Needs attention	Validate the write-capable action upgrade: This changes the external implementation behind three stale and closure policies while retaining write permissions; confirm v11 preserves exemption, labeling, and closing behavior in a controlled repository before enabling it on production items.

How this fits together

Gitcrawl’s scheduled stale workflow runs three policies against repository issues and pull requests. Each policy sends its configured exemption, staleness, and closure rules to the external actions/stale action, which can label or close GitHub items using write permissions.

flowchart LR
  A[Scheduled or manual trigger] --> B[Stale workflow]
  B --> C[Unassigned-item policy]
  B --> D[Assigned-issue policy]
  B --> E[Assigned-PR policy]
  C --> F[External stale action]
  D --> F
  E --> F
  F --> G[GitHub labels and closures]

Loading

Decision needed

Question	Recommendation
Should Gitcrawl accept this write-capable actions/stale@v11 update only after controlled disposable-repository validation, or remain on v10 for now?	Validate in a disposable repository: Run all three policies against representative assigned, exempt, stale, and closure cases and retain redacted evidence before merging.

Why: A version-only diff cannot establish the behavior of the external action that will label and close real repository items; accepting a production run as the first behavior test is an operational choice reserved for the repository owner.

Before merge

• Resolve security concern: Validate the write-capable action upgrade - This changes the external implementation behind three stale and closure policies while retaining write permissions; confirm v11 preserves exemption, labeling, and closing behavior in a controlled repository before enabling it on production items.
• Resolve merge risk (P1) - This external-action major update runs with issues: write and pull-requests: write, so a behavior change can incorrectly label or close repository items even though the workflow inputs are unchanged.
• Resolve merge risk (P1) - No after-fix controlled run currently demonstrates that all three policies preserve exemptions, assigned-item handling, stale marking, and closure behavior under actions/stale@v11.
• Complete next step (P2) - A repository owner must authorize the controlled validation plan or consciously accept production-first behavior testing; there is no narrow source repair for automation to perform.

Findings

• [medium] Validate the write-capable action upgrade — .github/workflows/stale.yml:18

Agent review details

Security

Needs attention: The code diff is narrow, but it changes executable third-party automation that has write access to issues and pull requests, so live behavior validation is required before merge.

Review metrics

Metric	Value	Why it matters
Workflow action calls	3 updated, 1 workflow affected	All three stale and closure policies move to the new external major version under repository write permissions.

Merge-risk options

Maintainer options:

1. Prove the policy behavior before merge (recommended)
   Use a controlled disposable repository to verify all three v11 stale policies, including exemptions and closure cases, before enabling this write-capable major update.
2. Accept production as the first behavior test
   Merge only if the repository owner explicitly accepts that the scheduled production workflow may be the first test of v11 labeling and closure behavior.
3. Defer the upgrade
   Keep the known v10 behavior until controlled validation can be performed.

Technical review

Best possible solution:

Validate the three v11 policies in a disposable repository with representative exempt, assigned, stale, and closure cases, retain redacted run evidence, then merge only if the observed labels and closures match the current policy contract.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-update PR rather than a reported product bug. The relevant evidence gap is an after-fix controlled run of the external stale-action policies.

Is this the best way to solve the issue?

No: a version-only update is not sufficient proof for a write-capable major automation change. Controlled policy validation is the narrowest safe path because it tests the real labeling and closure outcomes without changing Gitcrawl code.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against bbaf5ca9cdab.

Labels

Label changes:

• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• remove rating: 🧂 unranked krab: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.

Label justifications:

• P3: This is a narrow maintenance update, but it needs deliberate validation before routine merging.
• merge-risk: 🚨 security-boundary: The updated third-party action executes with permissions to modify issue and pull-request state.
• merge-risk: 🚨 automation: A major action-version change can alter scheduled stale labeling and closing outcomes without changing workflow inputs.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: No after-fix controlled run, redacted workflow log, or equivalent live evidence shows that actions/stale@v11 preserves the three Gitcrawl stale policies. Before merge, add proof from a disposable repository and redact any private repository details; updating the PR body should trigger fresh review, or a maintainer can comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Validate the write-capable action upgrade — .github/workflows/stale.yml:18
  This changes the external implementation behind three stale and closure policies while retaining write permissions; confirm v11 preserves exemption, labeling, and closing behavior in a controlled repository before enabling it on production items.
  Confidence: 0.97

What I checked:

• Current main retains v10: The current workflow invokes actions/stale@v10 in all three policy steps, so the requested v11 behavior is not already implemented on main. (.github/workflows/stale.yml:18, bbaf5ca9cdab)
• PR scope is three action invocations: The proposed branch changes only the action major version at the unassigned, assigned-issue, and assigned-PR policy steps; their existing close and exemption inputs remain unchanged. (.github/workflows/stale.yml:18, 750865122356)
• Workflow provenance and shipped baseline: The current stale workflow was introduced by the release-preparation commit and is contained in release v0.8.7; its author is the strongest current-history owner for this automation surface. (.github/workflows/stale.yml:1, 4f737bb846e0)
• Maintainer review requires live policy validation: The existing review comment says this is intentionally separate from the merged dependency refresh and recommends exercising all three policies in a controlled disposable repository, including representative assigned, exempt, stale, and closure cases. (750865122356)

Likely related people:

• steipete: Peter Steinberger authored the current stale workflow in the v0.8.7 release commit and supplied the item-specific guidance requiring controlled validation before this major action update lands. (role: current workflow author and recent automation contributor; confidence: high; commits: 4f737bb846e0, 80bd318d3416; files: .github/workflows/stale.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Run the three v11 policies in a controlled disposable repository with exempt, assigned, stale, and closure cases.
• Attach redacted workflow output that shows the observed labels and closures match the existing policy contract.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (20 earlier review cycles; latest 8 shown)

• reviewed 2026-08-01T21:22:35.855Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T22:56:55.872Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-02T00:15:55.355Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-02T04:02:16.759Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-02T08:45:27.672Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-02T10:57:39.849Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-02T12:08:47.129Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-02T14:30:23.385Z sha 7508651 :: needs maintainer review before merge. :: none

[steipete]

Triaged separately from #136 and intentionally left open. This is a write-capable major automation update: repository-local build and syntax checks cannot prove the actual labeling and closing decisions produced by actions/stale@v11.

Recommendation: do not land yet. Peter should either run the three existing policies in a controlled disposable repository with representative assigned, exempt, stale, and closure cases, or explicitly accept the next scheduled production run as the first behavior test. I prefer controlled validation; if that is not worth the operational setup, defer on v10 rather than claiming unearned proof.