build(deps): bump actions/stale from 10 to 11

[dependabot]

Bumps actions/stale from 10 to 11.

Release notes

Sourced from actions/stale's releases.

v11.0.0

What's Changed

Enhancement

• Migrate to ESM and update dependencies by @​chiranjib-swain in actions/stale#1350

Dependency Update

• Override brace-expansion to 5.0.8 to address 24 high-severity dependency vulnerabilities by @​dependabot in actions/stale#1351

Full Changelog: actions/stale@v10...v11.0.0

v10.4.0

What's Changed

Bug Fix

• Fixed only-issue-types validation by @​trueberryless in actions/stale#1338

Dependency Updates

• Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by @​dependabot in actions/stale#1342

New Contributors

• @​trueberryless made their first contribution in actions/stale#1338

Full Changelog: actions/stale@v10.3.0...v10.4.0

v10.3.0

What's Changed

Bug Fix

• Enhancement: ignore stale labeling events by @​shamoon in actions/stale#1311

Dependency Updates

• Upgrade dependencies (@​actions/core, @​octokit/plugin-retry, @​typescript-eslint) by @​Copilot in actions/stale#1335

New Contributors

• @​shamoon made their first contribution in actions/stale#1311

Full Changelog: actions/stale@v10...v10.3.0

v10.2.0

What's Changed

Bug Fix

• Fix checking state cache (fix #1136) and switch to Octokit helper methods by @​itchyny in actions/stale#1152

Dependency Updates

• Upgrade js-yaml from 4.1.0 to 4.1.1 by @​dependabot in actions/stale#1304
• Upgrade lodash from 4.17.21 to 4.17.23 by @​dependabot in actions/stale#1313
• Upgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from 5.1.1 to 7.0.0 by @​chiranjib-swain in actions/stale#1312

New Contributors

• @​itchyny made their first contribution in actions/stale#1152

Full Changelog: actions/stale@v10...v10.2.0

... (truncated)

Changelog

Sourced from actions/stale's changelog.

Changelog

[10.1.0]

What's Changed

• Add only-issue-types option to filter issues by type by @​Bibo-Joshi in actions/stale#1255

[10.0.0]

What's Changed

Breaking Changes

• Upgrade to node 24 by @​salmanmkc in actions/stale#1279 Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. Release Notes

Enhancement

• Introducing sort-by option by @​suyashgaonkar in actions/stale#1254

Dependency Upgrades

• Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot[bot] in actions/stale#1186
• Upgrade undici from 5.28.4 to 5.28.5 by @​dependabot[bot] in actions/stale#1201
• Upgrade @​action/cache from 4.0.0 to 4.0.2 by @​aparnajyothi-y in actions/stale#1226
• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​suyashgaonkar in actions/stale#1233
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in actions/stale#1251
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in actions/stale#1277

Documentation changes

• Changelog update for recent releases by @​suyashgaonkar in actions/stale#1224
• Permissions update in Readme by @​ghadimir in actions/stale#1248

[9.1.0]

What's Changed

• Documentation update by @​Marukome0743 in actions/stale#1116
• Add workflow file for publishing releases to immutable action package by @​Jcambass in actions/stale#1179
• Update undici from 5.28.2 to 5.28.4 by @​dependabot in actions/stale#1150
• Update actions/checkout from 3 to 4 by @​dependabot in actions/stale#1091
• Update actions/publish-action from 0.2.2 to 0.3.0 by @​dependabot in actions/stale#1147
• Update ts-jest from 29.1.1 to 29.2.5 by @​dependabot in actions/stale#1175
• Update @​actions/core from 1.10.1 to 1.11.1 by @​dependabot in actions/stale#1191
• Update @​types/jest from 29.5.11 to 29.5.14 by @​dependabot in actions/stale#1193
• Update @​actions/cache from 3.2.2 to 4.0.0 by @​dependabot in actions/stale#1194

[9.0.0]

Breaking Changes

1. Action is now stateful: If the action ends because of operations-per-run then the next run will start from the first unprocessed issue skipping the issues processed during the previous run(s). The state is reset when all the issues are processed. This should be considered for scheduling workflow runs.
2. Version 9 of this action updated the runtime to Node.js 20. All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.

... (truncated)

Commits

• 4391f3d Fix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8 (...
• eaf9131 refactor: update imports to use ES module syntax and improve test structure (...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 1, 2026, 6:56 PM ET / 22:56 UTC.

ClawSweeper review

What this changes

Updates all three scheduled stale-policy steps in .github/workflows/stale.yml from actions/stale@v10 to actions/stale@v11.

Merge readiness

⛔ Blocked until real behavior proof is added - 5 items remain

This PR remains necessary: current main and the latest release still use actions/stale@v10, while the branch makes the requested v11 update. The patch is mechanically narrow and clean, but v11 changes code executed by a scheduled workflow that can label and close issues and pull requests; no controlled after-fix run demonstrates that the repository’s existing policy inputs retain their bounded behavior.

Priority: P3
Reviewed head: 750865122356586ac616bc162b0c2fbb449842a4
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The reference-only patch is clean, but the required real behavior proof for this write-capable automation upgrade is absent.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The PR body supplies release notes and CI results but no after-fix live workflow output showing v11 handling the repository’s stale-policy inputs; add redacted controlled-run evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR body supplies release notes and CI results but no after-fix live workflow output showing v11 handling the repository’s stale-policy inputs; add redacted controlled-run evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	4 items	Current workflow behavior: Current main still invokes actions/stale@v10 in all three policy steps; the job grants write access to issues and pull requests, so this dependency executes with authority to mutate repository state. PR scope: The PR head changes exactly three action references and no policy inputs, messages, or permissions in the stale workflow. Feature provenance: The current stale workflow, including its v10 references and write-capable job, was introduced in the v0.8.7 release-preparation commit.
Findings	None	None.
Security	Needs attention	Validate the write-capable action upgrade before merging: actions/stale@v11 replaces code that receives issue and pull-request write permissions; the PR provides no controlled run showing that the current policy inputs still produce only the intended labels and closures.

How this fits together

Gitcrawl’s scheduled stale workflow passes repository inactivity policy into the third-party actions/stale action. That action applies labels and can close issues or pull requests, so this dependency reference controls automated repository-state changes.

flowchart LR
  A[Daily schedule or manual dispatch] --> B[Gitcrawl stale workflow]
  B --> C[Stale-policy inputs]
  C --> D[actions/stale v11]
  D --> E[Issue and pull-request labels]
  D --> F[Issue and pull-request closure]

Loading

Decision needed

Question	Recommendation
Should this repository accept the major actions/stale upgrade after controlled evidence confirms that its existing write-capable stale policy still labels and closes only the intended items?	Validate then merge: Run the v11 workflow against controlled stale and non-stale fixtures with the current inputs, retain redacted evidence of the resulting labels and closures, then merge if behavior matches v10 policy.

Why: The branch changes third-party code that receives issue and pull-request write permissions; the correct validation environment and acceptable mutation scope are repository-owner choices.

Before merge

• Resolve security concern: Validate the write-capable action upgrade before merging - actions/stale@v11 replaces code that receives issue and pull-request write permissions; the PR provides no controlled run showing that the current policy inputs still produce only the intended labels and closures.
• Resolve merge risk (P1) - Version 11 replaces code run by a daily write-capable workflow; without a controlled run using these policy inputs, maintainers cannot confirm that its labeling and closure mutations remain bounded as intended.
• Resolve merge risk (P1) - The upstream major update includes an ESM/runtime and dependency-graph change, so successful repository CI does not establish scheduled stale-workflow behavior.
• Complete next step (P2) - A repository owner must choose and review the controlled validation environment for this write-capable major action upgrade; there is no narrow code repair to automate.

Findings

• [medium] Validate the write-capable action upgrade before merging — .github/workflows/stale.yml:18

Agent review details

Security

Needs attention: This narrow dependency reference update changes code executed with repository write permissions, and no controlled execution evidence establishes its mutation behavior under the existing policy.

Review metrics

Metric	Value	Why it matters
Workflow surface	1 workflow changed; 3 action references updated	All automated stale-policy paths would execute the new major action version after merge.

Merge-risk options

Maintainer options:

1. Capture controlled workflow proof (recommended)
   Before merge, run the v11 action with the repository’s current inputs against controlled stale and non-stale fixtures and attach redacted live output showing the resulting mutations.
2. Defer the major action upgrade
   Keep the released v10 reference until the repository can validate the new action runtime and mutation behavior in a controlled target.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Require redacted controlled-run evidence showing v11 preserves the configured stale labels, exemptions, and close behavior before merging.

Technical review

Best possible solution:

Validate v11 in an isolated repository or other controlled target using the current policy inputs and known stale/non-stale issue and pull-request fixtures, then merge this narrow reference-only update if the observed mutations match the existing policy.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction: this PR upgrades workflow automation rather than repairing a reported runtime failure. A high-confidence merge proof instead requires a controlled execution of the scheduled stale policy with v11.

Is this the best way to solve the issue?

Unclear: changing only the three references is the narrowest implementation, but it is not yet proven safe for this repository’s write-capable stale workflow. Controlled after-fix behavior evidence is the safer path before acceptance.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against dcdf94703540.

Labels

Label justifications:

• P3: This is a narrow dependency-maintenance update with no demonstrated current user regression.
• merge-risk: 🚨 security-boundary: The update changes third-party code executed by a workflow granted issue and pull-request write permissions.
• merge-risk: 🚨 automation: The changed dependency controls scheduled automation that labels and closes repository items.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body supplies release notes and CI results but no after-fix live workflow output showing v11 handling the repository’s stale-policy inputs; add redacted controlled-run evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Validate the write-capable action upgrade before merging — .github/workflows/stale.yml:18
actions/stale@v11 replaces code that receives issue and pull-request write permissions; the PR provides no controlled run showing that the current policy inputs still produce only the intended labels and closures.
  Confidence: 0.94

What I checked:

• Current workflow behavior: Current main still invokes actions/stale@v10 in all three policy steps; the job grants write access to issues and pull requests, so this dependency executes with authority to mutate repository state. (.github/workflows/stale.yml:12, dcdf94703540)
• PR scope: The PR head changes exactly three action references and no policy inputs, messages, or permissions in the stale workflow. (.github/workflows/stale.yml:18, 750865122356)
• Feature provenance: The current stale workflow, including its v10 references and write-capable job, was introduced in the v0.8.7 release-preparation commit. (.github/workflows/stale.yml:18, 4f737bb846e0)
• Release provenance: The commit that introduced the current v10 stale workflow is contained in release v0.8.7; no inspected current-main commit upgrades the action to v11. (.github/workflows/stale.yml:18, 4f737bb846e0)

Likely related people:

• Peter Steinberger: Git history and line blame attribute the current workflow, its policy inputs, and the v10 action references to the release-preparation commit. (role: introduced the current stale-policy workflow; confidence: high; commits: 4f737bb846e0; files: .github/workflows/stale.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Run the v11 workflow against controlled stale and non-stale issue and pull-request fixtures, then attach redacted output showing labels and closures.
• If a new review does not trigger after proof is added, ask a maintainer to comment @clawsweeper re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (13 earlier review cycles; latest 8 shown)

• reviewed 2026-07-31T21:16:03.708Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T22:40:00.766Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T05:08:20.474Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T13:11:44.892Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T16:14:37.542Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T17:34:09.144Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T20:14:33.542Z sha 7508651 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T21:22:35.855Z sha 7508651 :: needs maintainer review before merge. :: none