Upgrade @actions/core to 3.0.0 and @actions/github to 9.0.0 by truggeri · Pull Request #673 · dependabot/fetch-metadata

truggeri · 2026-03-25T18:20:56Z

Summary

There are five open advisories on undici that require us to upgrade actions packages to resolve. This PR upgrades @actions/core and @actions/github to their latest major versions, along with aligning @octokit/request-error to the version required by the new @actions/github.

Resolved advisories

Note that based on CodeQL check, it appears there may end up being new advisories that we become exposed to.

Package upgrades

Package	Old Version	New Version
`@actions/core`	^1.11.1	^3.0.0
`@actions/github`	^6.0.1	^9.0.0
`@octokit/request-error`	^5.1.1	^7.1.0

Breaking changes addressed

ESM-only packages — Both @actions/core 3.0 and @actions/github 9.0 are now ESM-only (no CommonJS require support). @vercel/ncc cannot bundle ESM-only packages, so the build toolchain was switched from ncc → esbuild, which handles ESM natively.
RequestError constructor change — @octokit/request-error v7 removed headers from RequestErrorOptions. Updated the test in src/main.test.ts to match the new API.
Jest ESM resolution — Added a custom jest-resolver.js that adds the import condition for @actions/* packages and falls back to direct file resolution for subpaths not in the exports map (e.g. @actions/github/lib/context). Updated jest.config.js with transformIgnorePatterns to transform ESM dependencies through ts-jest.
TypeScript config — Added skipLibCheck: true to tsconfig.json to handle @octokit/core/types subpath imports in library .d.ts files, which require exports map support unavailable under moduleResolution: "node".

Files changed

package.json — Updated dependency versions, replaced @vercel/ncc with esbuild, updated build script
package-lock.json — Regenerated lockfile
jest.config.js — Added ESM transform and resolver configuration
jest-resolver.js — New custom resolver for ESM-only @actions/* packages
tsconfig.json — Added skipLibCheck: true
src/main.test.ts — Removed headers from RequestError constructor options
dist/index.js — Rebuilt bundle with esbuild

Testing

All 4 test suites pass (49/49 tests)
Build produces dist/index.js successfully via esbuild
TypeScript type checking passes

- Upgrade @actions/core from ^1.11.1 to ^3.0.0 - Upgrade @actions/github from ^6.0.1 to ^9.0.0 - Upgrade @octokit/request-error from ^5.1.1 to ^7.1.0 - Replace @vercel/ncc with esbuild for bundling (ESM support) - Add jest-resolver.js for ESM-only package resolution - Update jest.config.js with transform and resolver settings - Fix RequestError constructor usage in tests (removed headers) - Add skipLibCheck to tsconfig.json for @octokit/core subpath types

truggeri · 2026-03-25T20:55:09Z

From Copilot,

Here's a comprehensive changelog for the three upgraded packages in this PR, sourced from the official actions/toolkit RELEASES.md and octokit/request-error.js releases:

`@actions/core` — ^1.11.1 → ^3.0.0

Version	Type	Changes
3.0.0	💥 Breaking	Package is now ESM-only. CommonJS consumers must use dynamic `import()` instead of `require()`.
2.0.3	Patch	Bump `@actions/http-client` to 3.0.2
2.0.1	Patch	Bump `@actions/exec` from 1.1.1 to 2.0.0
2.0.0	💥 Breaking	Add support for Node 24; bump `@actions/http-client` from 2.0.1 to 3.0.0

Source: packages/core/RELEASES.md

`@actions/github` — ^6.0.1 → ^9.0.0

Version	Type	Changes
9.0.0	💥 Breaking	Package is now ESM-only. CommonJS consumers must use dynamic `import()` instead of `require()`. Fix TypeScript compilation by migrating to ESM, enabling proper imports from `@octokit/core/types`.
8.0.1	Patch	Update `undici` to 6.23.0; update `@actions/http-client` to 3.0.2
8.0.0	💥 Breaking	Minimum Node.js version is now 20 (previously 18). Updated @octokit dependencies: `@octokit/core` ^7.0.6, `@octokit/plugin-paginate-rest` ^14.0.0, `@octokit/plugin-rest-endpoint-methods` ^17.0.0, `@octokit/request` ^10.0.7, `@octokit/request-error` ^7.1.0.
7.0.0	Major	Update to v3.0.1 of `@actions/http-client`

Source: packages/github/RELEASES.md

`@octokit/request-error` — ^5.1.1 → ^7.1.0

Version	Type	Changes
7.1.0	Feature	Inherit options from base `Error` class to add support for the `cause` property (#535/#536)
7.0.2	Patch	Update `@octokit/types` to v16
7.0.1	Patch	Update `@octokit/types` to v15
7.0.0	💥 Breaking	Drop support for Node.js v18. Minimum is now Node 20.
6.0.0	💥 Breaking	Removed `code` and `headers` properties (previously deprecated). Switched package to ESM instead of CommonJS.
6.1.8	Patch	Update `@octokit/types` to v14
6.1.7	Security	Fix ReDoS regex vulnerability
6.1.6	Patch	Bump `@octokit/types` to fix Deno compatibility
6.1.5	Patch	Add explicit `
6.1.4	Patch	Improve performance of request error instantiations
6.1.3	Patch	Correct title in README
6.1.2	Patch	Ensure `statusCode` is always an integer
6.1.1	Patch	Add `default` fallback and `types` export
6.1.0	Feature	Add provenance
6.0.3	Patch	Update `@octokit/types` to v13
6.0.2	Patch	Add `main` entry point
6.0.1	Patch	Remove Node.js/Browser specific builds

Source: octokit/request-error.js releases

Summary of breaking changes relevant to this PR

ESM-only — All three packages moved to ESM-only in their new major versions (@actions/core 3.0, @actions/github 9.0, @octokit/request-error 6.0). This is the main reason the PR switches the bundler from @vercel/ncc → esbuild.
Node.js 20 minimum — @actions/github 8.0 and @octokit/request-error 7.0 dropped Node 18 support.
Removed headers property — @octokit/request-error 6.0 removed the previously-deprecated code and headers properties from RequestError, which is why the test in src/main.test.ts was updated.

jeffwidman

I'm not 100% confident in all this, but I think tha'ts okay because if it breaks it won't block really bad things so we'll have time to fix-forward, plus if it's broken I expect it to be completely broken, not just partially...

The @actions/github v9 exports map does not expose ./lib/context. Added src/dependabot/github-context.ts that derives the Context type and constructor from the github.context singleton, and updated all files to import from it.

Switched dry-run script from ts-node to esbuild bundling to handle ESM-only dependencies.

truggeri · 2026-03-26T02:09:40Z

Splitting into separate PRs for each dependency upgrade.

truggeri requested a review from a team as a code owner March 25, 2026 18:20

truggeri self-assigned this Mar 25, 2026

truggeri added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 25, 2026

jeffwidman previously approved these changes Mar 25, 2026

View reviewed changes

truggeri dismissed jeffwidman’s stale review via 6f895d5 March 25, 2026 21:41

Replace deep @actions/github/lib/context import

49eb34d

The @actions/github v9 exports map does not expose ./lib/context. Added src/dependabot/github-context.ts that derives the Context type and constructor from the github.context singleton, and updated all files to import from it.

truggeri force-pushed the upgrade-actions-core-and-github branch from 6f895d5 to fd27937 Compare March 25, 2026 21:53

fix: Dry run

c25a4c0

Switched dry-run script from ts-node to esbuild bundling to handle ESM-only dependencies.

truggeri force-pushed the upgrade-actions-core-and-github branch from fd27937 to c25a4c0 Compare March 25, 2026 21:58

truggeri closed this Mar 26, 2026

This was referenced Mar 26, 2026

Switch build tooling from ncc to esbuild #676

Merged

Upgrade @actions/core to ^3.0.0 #677

Merged

Upgrade @actions/github to ^9.0.0 and @octokit/request-error to ^7.1.0 #678

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade @actions/core to 3.0.0 and @actions/github to 9.0.0#673

Upgrade @actions/core to 3.0.0 and @actions/github to 9.0.0#673
truggeri wants to merge 3 commits into
mainfrom
upgrade-actions-core-and-github

truggeri commented Mar 25, 2026 •

edited

Loading

Uh oh!

truggeri commented Mar 25, 2026

Uh oh!

jeffwidman left a comment

Uh oh!

truggeri commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

truggeri commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Resolved advisories

Package upgrades

Breaking changes addressed

Files changed

Testing

Uh oh!

truggeri commented Mar 25, 2026

@actions/core — ^1.11.1 → ^3.0.0

@actions/github — ^6.0.1 → ^9.0.0

@octokit/request-error — ^5.1.1 → ^7.1.0

Summary of breaking changes relevant to this PR

Uh oh!

jeffwidman left a comment

Choose a reason for hiding this comment

Uh oh!

truggeri commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

truggeri commented Mar 25, 2026 •

edited

Loading

`@actions/core` — ^1.11.1 → ^3.0.0

`@actions/github` — ^6.0.1 → ^9.0.0

`@octokit/request-error` — ^5.1.1 → ^7.1.0