Skip to content

build(deps): bump actions/github-script from 7.0.1 to 8.0.0 #8173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Oct 1, 2025
Merged

build(deps): bump actions/github-script from 7.0.1 to 8.0.0 #8173

merged 1 commit into from
Oct 1, 2025

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 1, 2025

Bumps actions/github-script from 7.0.1 to 8.0.0.

Release notes

Sourced from actions/github-script's releases.

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

New Contributors

Full Changelog: actions/github-script@v7...v7.1.0

Commits
  • ed59741 Merge pull request #653 from actions/sneha-krip/readme-for-v8
  • 2dc352e Bold minimum Actions Runner version in README
  • 01e118c Update README for Node 24 runtime requirements
  • 8b222ac Apply suggestion from @​salmanmkc
  • adc0eea README for updating actions/github-script from v7 to v8
  • 20fe497 Merge pull request #637 from actions/node24
  • e7b7f22 update licenses
  • 2c81ba0 Update Node.js version support to 24.x
  • f28e40c Merge pull request #610 from actions/nebuk89-patch-1
  • 1ae9958 Update README.md
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump actions/github-script from 7.0.1 to 8.0.0
063b1d3 
Bumps [actions/github-script](https://github.com/actions/github-script) from 7.0.1 to 8.0.0.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@60a0d83...ed59741)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added Dependencies Issue or pull request related to project dependencies. github_actions Pull requests that update GitHub Actions code. labels Oct 1, 2025
@stdlib-bot stdlib-bot added Needs Review A pull request which needs code review. Good First PR A pull request resolving a Good First Issue. labels Oct 1, 2025
@socket-security Socket Security
Copy link

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedremark-html@​10.0.099259880100
Addedremark-lint-no-trailing-spaces@​3.0.2831007079100
Addedremark-vdom@​8.0.0711009977100
Addedproxyquire-universal@​2.1.0751007276100
Addedmathjax-node-sre@​3.0.3821008976100
Addedprocess@​0.11.101001007681100
Addedtap-xunit@​2.4.1991009176100
Addedtap-summary@​4.0.07710010079100
Addedparse-link-header@​1.0.1100868477100
Addedvdom-to-html@​2.3.1801008978100
Addedmathjax-node@​2.1.19210010078100
Addedlunr@​2.3.91001009678100
Addedto-vfile@​6.1.010010010078100
Addedtap-spec@​5.0.01001008578100
Addedvirtual-dom@​2.1.110010010078100
Addedmkdirp@​0.5.61001009978100
Addedread-installed@​4.0.31001007883100
Addedremark-lint-no-auto-link-without-protocol@​1.0.410010010078100
Addedremark-lint-no-inline-padding@​1.0.510010010078100
Addedremark-slug@​5.1.21001009779100
Addedresolve@​1.22.109910010079100
Addedproxyquireify@​3.2.18210010080100
Addedproxyquire@​2.1.310010010080100
Addedunist-util-visit@​2.0.310010010080100
Addedunist-util-visit-parents@​3.1.110010010080100
Addedplato@​1.7.09910010080100
Addedremark-unlink@​2.1.2821009780100
Addedremark-lint-linebreak-style@​1.0.49710010081100
Addedremark-lint-no-html@​1.0.4881009981100
Addedrehype@​9.0.11001009681100
Addedremark-lint-no-paragraph-content-indent@​1.0.79810010081100
Addedremark-frontmatter@​1.3.310010010081100
Addeduglifyify@​5.0.29910010081100
Addedremark-cli@​7.0.11001009881100
See 73 more rows in the dashboard

View full report

@socket-security Socket Security
Copy link

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
remark-html@10.0.0 has a Critical CVE.

CVE: GHSA-9q5w-79cv-947m Unsafe defaults in remark-html (CRITICAL)

Affected versions: = 14.0.0; < 13.0.2; >= 14.0.0 < 14.0.1

Patched version: 13.0.2

From: package.json → npm/remark-html@10.0.0

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/remark-html@10.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@Planeshifter Planeshifter added the Ready To Merge A pull request which is ready to be merged. label Oct 1, 2025
@stdlib-bot stdlib-bot removed the Needs Review A pull request which needs code review. label Oct 1, 2025
@stdlib-bot
Copy link
Contributor

PR Commit Message

build(deps): bump actions/github-script from 7.0.1 to 8.0.0

PR-URL: https://github.com/stdlib-js/stdlib/pull/8173

Reviewed-by: Philipp Burckhardt <pburckhardt@outlook.com>
Signed-off-by: dependabot[bot] <support@github.com>

Please review the above commit message and make any necessary adjustments.

@Planeshifter Planeshifter merged commit 150f351 into develop Oct 1, 2025
133 checks passed
@dependabot dependabot bot deleted the dependabot/github_actions/actions/github-script-8.0.0 branch October 1, 2025 06:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Planeshifter Planeshifter Planeshifter approved these changes

Assignees

No one assigned

Labels

Dependencies Issue or pull request related to project dependencies. github_actions Pull requests that update GitHub Actions code. Good First PR A pull request resolving a Good First Issue. Ready To Merge A pull request which is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@stdlib-bot @Planeshifter