chore(deps): resolve open Dependabot alerts

[MarshallOfSound]

Note

The remaining lodash (×2) and vite (×3) alerts are not addressed here because their patched releases are currently rejected by npmMinimalAgeGate: 10080 in .yarnrc.yml. Re-run yarn up -R lodash on/after 2026-04-08 and yarn up -R vite on/after 2026-04-13 to clear them — no code or top-level dep changes required.

Resolves 8 of 13 open Dependabot alerts.

Top-level bumps

• @actions/github ^5.1.1 → ^9.0.0 — removes the @octokit/core@3.x chain (fixes @octokit/request, @octokit/plugin-paginate-rest, @octokit/request-error) and brings undici@6.24.1.
• @actions/core ^1.10.0 → ^2.0.0 — drops @actions/http-client@2.x, removing the last undici@5.x.

Source change

@actions/github@9 updates the bundled Octokit types so apps.getAuthenticated() can return null. Added a null guard in src/index.ts to keep tsc --noEmit clean.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​actions/​github@​5.1.1 ⏵ 9.0.0			+1
	@​actions/​core@​1.11.1 ⏵ 2.0.3	+1			+3

View full report