[cao-githubnext-gh-aw-cao-write]

Dependency Release Train Summary

What changed

• Package/ecosystem: npm — @actions/github
• Manifest(s): package.json / package-lock.json (root)
• Old version: 7.0.0
• New version: 9.1.1
• Update type: major (security-driven)

Why now

• npm audit reports 5 vulnerabilities (1 high, 4 moderate) rooted in the
  undici range pinned by @actions/github@7.0.0 (^5.28.5): a
  high-severity Request/Response smuggling advisory plus a moderate unbounded
  decompression-chain advisory (GHSA-g9mf-h72j-4rw9 and related). @actions/github@9.1.1
  requires undici@^6.23.0, which resolves outside all affected ranges.
  0 open Dependabot security alerts were found via list_dependabot_alerts,
  so this was sourced directly from npm audit on the checked-out manifest.

Risk assessment

• Runtime/dev/build/CI scope: devDependency only, used by
  activity/local-runner.mjs to construct an authenticated Octokit client
  (getOctokit, context) for locally-invoked activity scripts. Not part of
  the browser/dashboard bundle and not shipped to any deployed artifact.
• Direct/transitive: direct dependency in root package.json.
• Reachability: confirmed via grep — only consumer is
  activity/local-runner.mjs (import * as githubToolkit from "@actions/github",
  using githubToolkit.getOctokit(token) and githubToolkit.context). Both
  APIs are present and functionally unchanged in v9.1.1 (verified by importing
  the installed package and calling getOctokit() directly).
• Breaking changes: major version bump (7→9) per @actions/github's own
  semver, but the consumed surface (getOctokit, context) has been stable
  across these majors; no other exports of the package are used in this repo.
• Toolchain: Node v22.23.2 (matches repository's available toolchain; no
  engines/packageManager override for this package).
• Registry preflight: npm view @actions/github versions, npm install --package-lock-only, and full npm install --ignore-scripts all succeeded
  against the public npm registry.
• Residual audit findings: @actions/artifact (used only transitively by
  @github/local-action) and @github/local-action itself still pin an
  older @actions/github@^6.0.1/undici@^5.x chain that npm audit fix --force would only resolve by downgrading @github/local-action to
  5.2.0 (a separate breaking change with unrelated risk/scope). That is
  intentionally left out of this bundle — it is a distinct dependency and
  update path, and downgrading a devtool to "fix" an audit finding is not a
  safe blind action. Flagging for a possible follow-up, human-reviewed bundle
  if the team wants that closed too.
• Risk: low-medium (major devDependency bump, but security-driven, narrow
  reachable surface, unchanged consumed API).
• Confidence: high

Validation

• Commands run: npm install --package-lock-only, npm install --ignore-scripts (full install), npm run typecheck:cao, npm run test:unit, npm run test:integration, plus a direct smoke import of
  @actions/github (getOctokit/context typeof checks) and of
  activity/local-runner.mjs (module loads, exports run).
• Result: typecheck:cao clean; test:integration 167/167 passing;
  test:unit 341/349 passing with 4 failures/4 cancelled — reproduced
  identically via git stash/git stash pop A-B comparison on unmodified
  main (sandbox target/ checkout path artifacts and pre-existing
  environment-specific timing issues), none related to this dependency.
• Remaining gaps: full npm run check (lint/test:load/check:svg/compile/
  docs:build) not run in this pass; npm audit still reports the separate
  @github/local-action/@actions/artifact chain noted above, which is out
  of scope for this bundle.

Control Plane

• Correlation ID: 34713654868-238
• Central repo: githubnext/gh-aw-cao
• Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34713654868

• Sensitive surface area: none directly (no auth/crypto/payment/database
  code touched); the package itself wraps GitHub API auth/HTTP but only for
  local dev-tooling invocation of activity scripts, not production request
  paths.
• Breaking-change notes: major version bump; only getOctokit/context are
  consumed and both remain API-compatible.

Reviewer checklist

• CI passes
• CODEOWNERS or service owners reviewed
• Security-sensitive areas approved, if applicable
• Deployment/canary owner confirms runtime health, if needed

Rollback guidance

• Revert this PR, or pin @actions/github back to ^7.0.0 in package.json
  and regenerate package-lock.json with npm install --package-lock-only.

Smart-Dependabot-Merge-Candidate: no

Generated by Dependabot / Release Trains · copilot · auto · 261.6 AIC · ⌖ 18.7 AIC · ⊞ 18.5K · ◷