Skip to content

chore(deps): bump @actions/github to v9 to remove undici 5.29.0 #40265

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ggazzo merged 1 commit into from
Apr 22, 2026
Merged

chore(deps): bump @actions/github to v9 to remove undici 5.29.0 #40265

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions packages/release-action/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,11 @@
"lint:fix": "eslint --fix src"
},
"dependencies": {
"@actions/core": "^1.11.1",
"@actions/exec": "^1.1.1",
"@actions/github": "^6.0.1",
"@octokit/core": "^5.0.2",
"@octokit/plugin-throttling": "^6.1.0",
"@actions/core": "^3.0.1",
"@actions/exec": "^3.0.0",
"@actions/github": "^9.1.1",
"@octokit/core": "^7.0.6",
"@octokit/plugin-throttling": "^11.0.3",
Comment on lines +12 to +16

@coderabbitai coderabbitai Bot Apr 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

@octokit/plugin-throttling v11 onRateLimit callback signature breaking changes

💡 Result:

There are no breaking changes to the onRateLimit callback signature in @octokit/plugin-throttling v11. The current signature in v11.0.3 (latest as of Oct 2025) is onRateLimit: (retryAfter, options, octokit, retryCount) => boolean, and onSecondaryRateLimit: (retryAfter, options, octokit) => boolean. This matches the documentation across official sources including GitHub repo README and npm page. v11.0.0's only breaking change was dropping Node.js v18 support (requires >= v20 now), with no mentions of API changes to callbacks in release notes, tags, or compare views between v10 and v11. Older docs mentioning onAbuseLimit appear outdated; current uses onSecondaryRateLimit.

Citations:

🌐 Web query:

@actions/github v9 lib/utils getOctokitOptions GitHub plugin export

💡 Result:

In @actions/github v9.0.0, getOctokitOptions is exported from the subpath ./lib/utils. It is a utility function that formats Octokit options for use with custom Octokit constructors, particularly when extending with plugins. Key details: - Import: import { getOctokitOptions } from '@actions/github/lib/utils'; - Usage: Takes a token (string) and optional options?: OctokitOptions. Adds authentication (auth: \token ${token}\ or from options), shallow clones options, and returns OctokitOptions. - Related exports from ./lib/utils: GitHub (pre-configured Octokit constructor with REST and pagination plugins), defaults (base OctokitOptions with proxy-aware request config and API baseUrl). - Purpose: Used for advanced customization, e.g., adding enterprise plugins: import { GitHub, getOctokitOptions } from '@actions/github/lib/utils'; import { enterpriseServer220Admin } from '@octokit/plugin-enterprise-server'; const CustomOctokit = GitHub.plugin(enterpriseServer220Admin); const token = core.getInput('myToken'); const octokit = new CustomOctokit(getOctokitOptions(token)); - The main getOctokit(token, options) from @actions/github internally uses this function combined with GitHub. - Confirmed ESM-only in v9; subpath exports supported per package.json. - "GitHub plugin export" refers to the GitHub class/constructor from ./lib/utils, which is an Octokit instance with built-in plugins that can be further extended via .plugin. This is part of the GitHub Actions Toolkit for creating authenticated Octokit clients in actions.

Citations:

🏁 Script executed:

#!/bin/bash
# Sanity: confirm the call sites we need to re-validate against the new majors.
rg -nP -C2 '@actions/(github|exec|core)|@octokit/(core|plugin-throttling)' packages/release-action/src
rg -nP -C2 'onRateLimit|onSecondaryRateLimit|GitHub\.plugin|getOctokitOptions|octokit\.rest\.' packages/release-action/src
# Confirm how dist is produced (tsc vs bundler) — relevant for ESM-only transitive deps.
cat packages/release-action/package.json
fd -t f 'action.ya?ml|ncc|esbuild|rollup' packages/release-action

Repository: RocketChat/Rocket.Chat

Length of output: 8808

Confirm the release action works correctly with these major version bumps before merging.

These dependency updates are significant (e.g., @actions/github v6→v9, @octokit/plugin-throttling v6→v11, @octokit/core v5→v7). While the import paths and callback signatures are compatible with the versions specified:

  • @actions/github v9 confirms that @actions/github/lib/utils exports GitHub and getOctokitOptions as expected.
  • The throttling plugin callback signature in setupOctokit.ts matches @octokit/plugin-throttling v11.0.3.

A manual test run of the release action (via GitHub Actions) is required before merge to verify end-to-end functionality with the new versions, particularly the REST API calls in publishRelease.ts and bumpNextVersion.ts. The PR description already flags this as pending; please confirm it completes successfully.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@packages/release-action/package.json` around lines 12 - 16, The dependency
bumps require an end-to-end verification: run the release action in GitHub
Actions and confirm the workflow completes successfully; specifically exercise
the codepaths in setupOctokit.ts (ensure the `@octokit/plugin-throttling` callback
still accepts the same parameters), the module imports from `@actions/github`
(verify GitHub / getOctokitOptions imports work), and the REST calls in
publishRelease.ts and bumpNextVersion.ts (validate API responses and error
handling with the new `@octokit/core/`@actions/github versions). If anything
fails, update import calls or callback signatures in setupOctokit.ts and adjust
REST call usage in publishRelease.ts/bumpNextVersion.ts to match the new client
APIs, then re-run the workflow until it passes.

"mdast-util-to-string": "2.0.0",
"remark-parse": "9.0.0",
"remark-stringify": "9.0.1",
Expand Down
Loading
Loading