Skip to content

build(deps): bump actions/stale from 10 to 11 - #250

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/stale-11
Open

build(deps): bump actions/stale from 10 to 11#250
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/stale-11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/stale from 10 to 11.

Release notes

Sourced from actions/stale's releases.

v11.0.0

What's Changed

Enhancement

Dependency Update

Full Changelog: actions/stale@v10...v11.0.0

v10.4.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Full Changelog: actions/stale@v10.3.0...v10.4.0

v10.3.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Full Changelog: actions/stale@v10...v10.3.0

v10.2.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Full Changelog: actions/stale@v10...v10.2.0

... (truncated)

Changelog

Sourced from actions/stale's changelog.

Changelog

[10.1.0]

What's Changed

[10.0.0]

What's Changed

Breaking Changes

Enhancement

Dependency Upgrades

Documentation changes

[9.1.0]

What's Changed

[9.0.0]

Breaking Changes

  1. Action is now stateful: If the action ends because of operations-per-run then the next run will start from the first unprocessed issue skipping the issues processed during the previous run(s). The state is reset when all the issues are processed. This should be considered for scheduling workflow runs.
  2. Version 9 of this action updated the runtime to Node.js 20. All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.

... (truncated)

Commits
  • 4391f3d Fix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8 (...
  • eaf9131 refactor: update imports to use ES module syntax and improve test structure (...
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump actions/stale from 10 to 11
d9253bf 
Bumps [actions/stale](https://github.com/actions/stale) from 10 to 11.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@v10...v11)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: '11'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026
@vercel

vercel Bot commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
api-enhanced Ready Ready Preview Sep 1, 2026 12:48pm UTC

@yukka-agent

yukka-agent Bot commented Sep 1, 2026

Copy link
Copy Markdown

PR #250 的 stale 升级审查开始 — 先核验主要变更的风险。

PR #250 Review: actions/stale v10 -> v11

结论: 可合并，但该文件存在阻塞 stale 功能的逻辑缺陷，建议随此 PR 一并修复。版本升级本身低风险。

1. 版本升级本身 - 通过

.github/workflows/issue-manage.yml:34 uses: actions/stale@v10 -> @v11

Medium

v11.0.0 主要变更：

  • Migrate to ESM and update dependencies #1350 - 内部重构，无 inputs 破坏性变更
  • Override brace-expansion to 5.0.8 #1351 - 修复 24 个 high 漏洞，正向收益

v10 已要求 Node 24 / runner >=v2.327.1，v11 未新增 Breaking Change，兼容 ubuntu-latest。升级正确，建议合并。

2. 阻塞性逻辑缺陷 - Stale 任务永远不会定时执行

.github/workflows/issue-manage.yml:6-8 + .github/workflows/issue-manage.yml:30

on:
  issues:
    types: [opened, labeled] # 仅在新建/打标签时触发
jobs:
  stale-issues:
    if: github.event.action == 'opened' # 且仅 opened 时运行

Critical

问题： actions/stale 设计为遍历全仓 issue/pr，需由 schedule: cron 定时驱动。当前配置仅在“有人新建 issue”的瞬间扫描一次，days-before-stale: 30 / days-before-close: 7 的 30天/7天逻辑完全失效。labeled 触发后因 if==opened 直接跳过，造成空跑浪费。

建议 Review Comment 加在 L6-L8 和 L30:

Critical 定时任务缺失，stale 功能形同虚设

# 建议修复：
on:
  schedule:
    - cron: '30 1 * * *' # 每天 01:30 UTC 扫描
  workflow_dispatch: {}
  issues:
    types: [opened, labeled] # 若仅为 welcome 保留，可拆分两个 workflow

# stale-issues 移除 if: opened，允许 cron 触发
stale-issues:
  # if: github.event.action == 'opened' # 删除
  runs-on: ubuntu-latest

3. 权限缺失 - 无法关闭 PR

.github/workflows/issue-manage.yml:2-4

permissions:
  issues: write
  contents: read

High Security

stale-pr-message + stale-pr-label 已启用，但关闭 PR 需要 pull-requests: write。官方 README 要求 issues: write + pull-requests: write。当前仅授权 issues，PR 的 stale/close 会 403。

建议：

permissions:
  issues: write
  pull-requests: write
  contents: read

4. 供应链安全 - 未 Pin Commit SHA

.github/workflows/issue-manage.yml:34 uses: actions/stale@v11

Medium Security

浮动标签可被移动。最佳实践 uses: actions/stale@4391f3d... # v11.0.0。本仓库其他 workflow (ci-check.yml:20) 已使用 @v6 同样未 pin，可后续统一治理，当前至少建议注释 SHA。

建议：

uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0

5. 次要：配置可优化

.github/workflows/issue-manage.yml:49-54

Medium

  • days-before-stale 对 issue/pr 共用，若需差异化可显式设置 days-before-pr-stale
  • exempt-issue-labels 已包含 enhancement 但 exempt-pr-labels 没有，是否一致需确认
  • 建议添加 operations-per-run: 100 避免单次 API 限流（v9 后有 stateful 特性）

总结

等级 数量 说明
Critical 1 schedule 缺失导致 stale 永不执行，需随版本 bump 一并修复
High 1 缺 pull-requests: write 导致 PR 无法关闭
Medium 2 未 Pin SHA + 空跑浪费

处理建议：

  1. 当前 +1/-1 改动安全，可 Approve 版本升级部分
  2. 强烈建议 在合并前追加 commit 修复 Critical/High 两项，否则此 PR 合并后 v11 依然不生效，失去升级意义（修复 24 个漏洞的收益也无法体现）
  3. 验证：pnpm lint + actionlint 检查 YAML 语法，合并后观察 Actions -> Issue Management 下次 schedule 是否正常标记 stale

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
❌ Deployment failed
View logs		 api-enhanced d9253bf Sep 01 2026, 12:49 PM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants