Update warning

.github/workflows/basic-validation.yml

@@ -16,4 +16,4 @@ jobs:
     name: Basic validation
     uses: actions/reusable-workflows/.github/workflows/basic-validation.yml@main
     with:
-      node-version: '24.x'
+      node-version: '20.x'

.github/workflows/check-dist.yml

@@ -16,4 +16,4 @@ jobs:
     name: Check dist/
     uses: actions/reusable-workflows/.github/workflows/check-dist.yml@main
     with:
-      node-version: '24.x'
+      node-version: '20.x'

.github/workflows/publish-immutable-actions.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checking out
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
       - name: Publish
         id: publish
         uses: actions/[email protected]

.github/workflows/release-new-action-version.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Update the ${{ env.TAG_NAME }} tag
-        uses: actions/publish-action@v0.4.0
+        uses: actions/publish-action@v0.2.2
         with:
           source-tag: ${{ env.TAG_NAME }}
           slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.licensed.yml

@@ -11,7 +11,4 @@ allowed:
   - unlicense
 
 reviewed:
-  npm:
-    - balanced-match
-    - brace-expansion
-    - minimatch
+  npm:

.licenses/npm/@actions/github.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/github"
-version: 6.0.1
+version: 6.0.0
 type: npm
 summary: Actions github lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/github

.licenses/npm/@actions/http-client.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/http-client"
-version: 2.2.3
+version: 2.2.0
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client

.licenses/npm/@octokit/endpoint.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/endpoint"
-version: 9.0.6
+version: 9.0.1
 type: npm
 summary: Turns REST API endpoints into generic request options
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/openapi-types-23.0.1.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@octokit/openapi-types"
-version: 23.0.1
-type: npm
-summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |-
-    Copyright 2020 Gregor Martynus
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
-notices: []

.licenses/npm/@octokit/openapi-types-24.2.0.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@octokit/openapi-types"
-version: 24.2.0
-type: npm
-summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |-
-    Copyright 2020 Gregor Martynus
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
-notices: []

.licenses/npm/@octokit/openapi-types.dep.yml

@@ -3,7 +3,7 @@ name: "@octokit/openapi-types"
 version: 19.0.1
 type: npm
 summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/plugin-paginate-rest.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/plugin-paginate-rest"
-version: 9.2.2
+version: 9.1.0
 type: npm
 summary: Octokit plugin to paginate REST API endpoint responses
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/plugin-rest-endpoint-methods.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/plugin-rest-endpoint-methods"
-version: 10.4.1
+version: 10.1.0
 type: npm
 summary: Octokit plugin adding one method for all of api.github.com REST API endpoints
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/request-error.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/request-error"
-version: 5.1.1
+version: 5.0.1
 type: npm
 summary: Error class for Octokit request errors
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/request.dep.yml

@@ -1,10 +1,10 @@
 ---
 name: "@octokit/request"
-version: 8.4.1
+version: 8.1.4
 type: npm
 summary: Send parameterized requests to GitHub's APIs with sensible defaults in browsers
   and Node
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/types-12.6.0.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@octokit/types"
-version: 12.6.0
-type: npm
-summary: Shared TypeScript definitions for Octokit projects
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |
-    MIT License Copyright (c) 2019 Octokit contributors
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
-notices: []

.licenses/npm/@octokit/types-13.10.0.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@octokit/types"
-version: 13.10.0
-type: npm
-summary: Shared TypeScript definitions for Octokit projects
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |
-    MIT License Copyright (c) 2019 Octokit contributors
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
-notices: []

.licenses/npm/@octokit/types-13.8.0.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@octokit/types"
-version: 13.8.0
-type: npm
-summary: Shared TypeScript definitions for Octokit projects
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |
-    MIT License Copyright (c) 2019 Octokit contributors
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
-notices: []

.licenses/npm/@octokit/types.dep.yml

@@ -3,7 +3,7 @@ name: "@octokit/types"
 version: 12.1.0
 type: npm
 summary: Shared TypeScript definitions for Octokit projects
-homepage:
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/balanced-match.dep.yml

@@ -1,18 +1,39 @@
 ---
 name: balanced-match
-version: 4.0.4
+version: 1.0.2
 type: npm
 summary: Match balanced character pairs, like "{" and "}"
-homepage:
-license: other
+homepage: https://github.com/juliangruber/balanced-match
+license: mit
 licenses:
 - sources: LICENSE.md
   text: |
     (MIT)
 
-    Original code Copyright Julian Gruber <[email protected]>
+    Copyright (c) 2013 Julian Gruber &lt;[email protected]&gt;
 
-    Port to TypeScript Copyright Isaac Z. Schlueter <[email protected]>
+    Permission is hereby granted, free of charge, to any person obtaining a copy of
+    this software and associated documentation files (the "Software"), to deal in
+    the Software without restriction, including without limitation the rights to
+    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+    of the Software, and to permit persons to whom the Software is furnished to do
+    so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: |-
+    (MIT)
+
+    Copyright (c) 2013 Julian Gruber &lt;[email protected]&gt;
 
     Permission is hereby granted, free of charge, to any person obtaining a copy of
     this software and associated documentation files (the "Software"), to deal in

.licenses/npm/brace-expansion.dep.yml

@@ -1,18 +1,16 @@
 ---
 name: brace-expansion
-version: 5.0.4
+version: 2.0.1
 type: npm
 summary: Brace expansion as known from sh/bash
-homepage:
-license: other
+homepage: https://github.com/juliangruber/brace-expansion
+license: mit
 licenses:
 - sources: LICENSE
   text: |
     MIT License
 
-    Copyright Julian Gruber <[email protected]>
-
-    TypeScript port Copyright Isaac Z. Schlueter <[email protected]>
+    Copyright (c) 2013 Julian Gruber <[email protected]>
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal
@@ -24,6 +22,29 @@ licenses:
     The above copyright notice and this permission notice shall be included in all
     copies or substantial portions of the Software.
 
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: |-
+    (MIT)
+
+    Copyright (c) 2013 Julian Gruber &lt;[email protected]&gt;
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of
+    this software and associated documentation files (the "Software"), to deal in
+    the Software without restriction, including without limitation the rights to
+    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+    of the Software, and to permit persons to whom the Software is furnished to do
+    so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

.licenses/npm/is-plain-object.dep.yml

@@ -0,0 +1,40 @@
+---
+name: is-plain-object
+version: 5.0.0
+type: npm
+summary: Returns true if an object was created by the `Object` constructor, or Object.create(null).
+homepage: https://github.com/jonschlinkert/is-plain-object
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    The MIT License (MIT)
+
+    Copyright (c) 2014-2017, Jon Schlinkert.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+    THE SOFTWARE.
+- sources: README.md
+  text: |-
+    Copyright © 2019, [Jon Schlinkert](https://github.com/jonschlinkert).
+    Released under the [MIT License](LICENSE).
+
+    ***
+
+    _This file was generated by [verb-generate-readme](https://github.com/verbose/verb-generate-readme), v0.8.0, on April 28, 2019._
+notices: []

.licenses/npm/js-yaml.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: js-yaml
-version: 4.1.1
+version: 4.1.0
 type: npm
 summary: YAML 1.2 parser and serializer
-homepage:
+homepage: https://github.com/nodeca/js-yaml
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/minimatch.dep.yml

@@ -1,66 +1,26 @@
 ---
 name: minimatch
-version: 10.2.3
+version: 10.0.1
 type: npm
 summary: a glob matcher in javascript
-homepage:
-license: blueoak-1.0.0
+homepage: 
+license: isc
 licenses:
-- sources: LICENSE.md
+- sources: LICENSE
   text: |
-    # Blue Oak Model License
+    The ISC License
 
-    Version 1.0.0
+    Copyright (c) 2011-2022 Isaac Z. Schlueter and Contributors
 
-    ## Purpose
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose with or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
 
-    This license gives everyone as much permission to work with
-    this software as possible, while protecting contributors
-    from liability.
-
-    ## Acceptance
-
-    In order to receive this license, you must agree to its
-    rules. The rules of this license are both obligations
-    under that agreement and conditions to your license.
-    You must not do anything with this software that triggers
-    a rule that you cannot or will not follow.
-
-    ## Copyright
-
-    Each contributor licenses you to do everything with this
-    software that would otherwise infringe that contributor's
-    copyright in it.
-
-    ## Notices
-
-    You must ensure that everyone who gets a copy of
-    any part of this software from you, with or without
-    changes, also gets the text of this license or a link to
-    <https://blueoakcouncil.org/license/1.0.0>.
-
-    ## Excuse
-
-    If anyone notifies you in writing that you have not
-    complied with [Notices](#notices), you can keep your
-    license by taking all practical steps to comply within 30
-    days after the notice. If you do not do so, your license
-    ends immediately.
-
-    ## Patent
-
-    Each contributor licenses you to do everything with this
-    software that would otherwise infringe any patent claims
-    they can license or become able to license.
-
-    ## Reliability
-
-    No contributor can revoke this license.
-
-    ## No Liability
-
-    **_As far as the law allows, this software comes as is,
-    without any warranty or condition, and no contributor
-    will be liable to anyone for any damages related to this
-    software or this license, under any kind of legal claim._**
+    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 notices: []

.licenses/npm/undici.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 5.29.0
+version: 5.28.4
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org

.licenses/npm/uuid.dep.yml

@@ -1,20 +1,20 @@
 ---
-name: "@octokit/openapi-types"
-version: 20.0.0
+name: uuid
+version: 8.3.2
 type: npm
-summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
-homepage:
+summary: RFC4122 (v1, v4, and v5) UUIDs
+homepage: 
 license: mit
 licenses:
-- sources: LICENSE
-  text: |-
-    Copyright 2020 Gregor Martynus
+- sources: LICENSE.md
+  text: |
+    The MIT License (MIT)
+
+    Copyright (c) 2010-2020 Robert Kieffer and other contributors
 
     Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
     The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
 notices: []

README.md

@@ -4,13 +4,6 @@
 
 Automatically label new pull requests based on the paths of files being changed or the branch name.
 
-## Breaking changes in V6
-
-- Upgraded action from node20 to node24.
-  > Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. [Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1)
-
-For more details, see the full release notes on the [release page](https://github.com/actions/labeler/releases/tag/v6.0.0)
-
 ## Breaking changes in V5
 1) The ability to apply labels based on the names of base and/or head branches was added ([#186](https://github.com/actions/labeler/issues/186) and [#54](https://github.com/actions/labeler/issues/54)). The match object for changed files was expanded with new combinations in order to make it more intuitive and flexible ([#423](https://github.com/actions/labeler/issues/423) and [#101](https://github.com/actions/labeler/issues/101)). As a result, the configuration file structure was significantly redesigned and is not compatible with the structure of the previous version. Please read the documentation below to find out how to adapt your configuration files for use with the new action version.
 
@@ -169,7 +162,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v6
+    - uses: actions/labeler@v5
 ```
 
 #### Inputs
@@ -189,10 +182,10 @@ You might want to use action called [@actions/checkout](https://github.com/actio
 
 ```yml
     steps:
-    - uses: actions/checkout@v5 # Uploads repository content to the runner
+    - uses: actions/checkout@v4 # Uploads repository content to the runner
       with:
         repository: "owner/repositoryName" # The one of the available inputs, visit https://github.com/actions/checkout#readme to find more
-    - uses: actions/labeler@v6
+    - uses: actions/labeler@v5
       with:
         configuration-path: 'path/to/the/uploaded/configuration/file'
 
@@ -215,7 +208,7 @@ jobs:
     steps:
     
     # Label PRs 1, 2, and 3
-    - uses: actions/labeler@v6
+    - uses: actions/labeler@v5
       with:        
         pr-number: |
           1
@@ -248,7 +241,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - id: label-the-PR
-      uses: actions/labeler@v6
+      uses: actions/labeler@v5
       
     - id: run-frontend-tests
       if: contains(steps.label-the-PR.outputs.all-labels, 'frontend')
@@ -265,36 +258,15 @@ jobs:
 
 ## Recommended Permissions
 
-To successfully add labels to pull requests using the GitHub Labeler Action, specific permissions must be granted based on your use case:
-
-1. **Adding Existing Labels**:
-   - Requires: `pull-requests: write`
-   - Use this if all labels already exist in the repository (i.e., pre-defined in `.github/labeler.yml`).
-
-2. **Creating New Labels**:
-   - Requires: `issues: write`
-   - This is necessary if the action needs to create labels that do not already exist in the repository.
-
-However, when the action runs on a pull request from a forked repository, GitHub only grants read access tokens for `pull_request` events, at most. If you encounter an `Error: HttpError: Resource not accessible by integration`, it's likely due to these permission constraints. To resolve this issue, you can modify the `on:` section of your workflow to use
-[`pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) instead of `pull_request` (see example [above](#create-workflow)). This change allows the action to have write access, because `pull_request_target` alters the [context of the action](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) and safely grants additional permissions.
-
-There exists a potentially dangerous misuse of the `pull_request_target` workflow trigger that may lead to malicious PR authors (i.e. attackers) being able to obtain repository write permissions or stealing repository secrets. Hence, it is advisable that `pull_request_target` should only be used in workflows that are carefully designed to avoid executing untrusted code and to also ensure that workflows using `pull_request_target` limit access to sensitive resources. Refer to the [GitHub token permissions documentation](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) for more details about access levels and event contexts.
-
-### Example Workflow Permissions
-
-To ensure the action works correctly, include the following permissions in your workflow file:
+In order to add labels to pull requests, the GitHub labeler action requires write permissions on the pull-request. However, when the action runs on a pull request from a forked repository, GitHub only grants read access tokens for `pull_request` events, at most. If you encounter an `Error: HttpError: Resource not accessible by integration`, it's likely due to these permission constraints. To resolve this issue, you can modify the `on:` section of your workflow to use
+[`pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) instead of `pull_request` (see example [above](#create-workflow)). This change allows the action to have write access, because `pull_request_target` alters the [context of the action](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) and safely grants additional permissions. Refer to the [GitHub token permissions documentation](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) for more details about access levels and event contexts.
 
 ```yml
     permissions:
       contents: read
       pull-requests: write
-      issues: write
 ```
 
-### Manual Label Creation as an Alternative to Granting issues write Permission 
-
-If you prefer not to grant the `issues: write` permission in your workflow, you can manually create all required labels in the repository before the action runs.
-
 ## Notes regarding `pull_request_target` event
 
 Using the `pull_request_target` event trigger involves several peculiarities related to initial set up of the labeler or updating version of the labeler.
@@ -319,4 +291,4 @@ Once you confirm that the updated configuration files function as intended, you
 
 ## Contributions
 
-Contributions are welcome! See the [Contributor's Guide](CONTRIBUTING.md).
+Contributions are welcome! See the [Contributor's Guide](CONTRIBUTING.md).

__tests__/labeler.test.ts

@@ -1,8 +1,5 @@
 import * as yaml from 'js-yaml';
 import * as core from '@actions/core';
-import * as api from '../src/api';
-import {labeler} from '../src/labeler';
-import * as github from '@actions/github';
 import * as fs from 'fs';
 import {checkMatchConfigs} from '../src/labeler';
 import {
@@ -13,7 +10,6 @@ import {
 } from '../src/api/get-label-configs';
 
 jest.mock('@actions/core');
-jest.mock('../src/api');
 
 beforeAll(() => {
   jest.spyOn(core, 'getInput').mockImplementation((name, options) => {
@@ -163,73 +159,3 @@ describe('checkMatchConfigs', () => {
     });
   });
 });
-
-describe('labeler error handling', () => {
-  const mockClient = {} as any;
-  const mockPullRequest = {
-    number: 123,
-    data: {labels: []},
-    changedFiles: []
-  };
-
-  beforeEach(() => {
-    jest.resetAllMocks();
-
-    (github.getOctokit as jest.Mock).mockReturnValue(mockClient);
-    (api.getPullRequests as jest.Mock).mockReturnValue([
-      {
-        ...mockPullRequest,
-        data: {labels: [{name: 'old-label'}]}
-      }
-    ]);
-
-    (api.getLabelConfigs as jest.Mock).mockResolvedValue(
-      new Map([['new-label', ['dummy-config']]])
-    );
-
-    // Force match so "new-label" is always added
-    jest.spyOn({checkMatchConfigs}, 'checkMatchConfigs').mockReturnValue(true);
-  });
-
-  it('throws a custom error for HttpError 403 with "unauthorized" message', async () => {
-    (api.setLabels as jest.Mock).mockRejectedValue({
-      name: 'HttpError',
-      status: 403,
-      message: 'Request failed with status code 403: Unauthorized'
-    });
-
-    await expect(labeler()).rejects.toThrow(
-      /does not have permission to create labels/
-    );
-  });
-
-  it('rethrows unexpected HttpError', async () => {
-    const unexpectedError = {
-      name: 'HttpError',
-      status: 404,
-      message: 'Not Found'
-    };
-    (api.setLabels as jest.Mock).mockRejectedValue(unexpectedError);
-
-    // NOTE: In the current implementation, labeler rethrows the raw error object (not an Error instance).
-    // `rejects.toThrow` only works with real Error objects, so here we must use `rejects.toEqual`.
-    // If labeler is updated to always wrap errors in `Error`, this test can be changed to use `rejects.toThrow`.
-    await expect(labeler()).rejects.toEqual(unexpectedError);
-  });
-
-  it('handles "Resource not accessible by integration" gracefully', async () => {
-    const error = {
-      name: 'HttpError',
-      message: 'Resource not accessible by integration'
-    };
-    (api.setLabels as jest.Mock).mockRejectedValue(error);
-
-    await labeler();
-
-    expect(core.warning).toHaveBeenCalledWith(
-      expect.stringContaining("requires 'issues: write'"),
-      expect.any(Object)
-    );
-    expect(core.setFailed).toHaveBeenCalledWith(error.message);
-  });
-});

action.yml

@@ -28,5 +28,5 @@ outputs:
   all-labels:
     description: 'A comma-separated list of all labels that the PR contains'
 runs:
-  using: 'node24'
+  using: 'node20'
   main: 'dist/index.js'

package.json

@@ -1,11 +1,8 @@
 {
   "name": "labeler",
-  "version": "6.0.0",
+  "version": "5.0.0",
   "description": "Labels pull requests by files altered",
   "main": "lib/main.js",
-    "engines": {
-    "node": ">=24"
-  },
   "scripts": {
     "build": "tsc && ncc build lib/main.js",
     "format": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write \"**/*.{ts,yml,yaml}\"",
@@ -32,25 +29,25 @@
     "@octokit/plugin-retry": "^6.0.0",
     "js-yaml": "^4.1.0",
     "lodash.isequal": "^4.5.0",
-    "minimatch": "^10.2.3"
+    "minimatch": "^10.0.1"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",
     "@types/js-yaml": "^4.0.9",
     "@types/lodash.isequal": "^4.5.8",
     "@types/minimatch": "^5.1.2",
-    "@types/node": "^24.1.0",
+    "@types/node": "^20.11.30",
     "@typescript-eslint/eslint-plugin": "^7.3.1",
     "@typescript-eslint/parser": "^7.18.0",
-    "@vercel/ncc": "^0.38.3",
+    "@vercel/ncc": "^0.38.1",
     "eslint": "^8.57.0",
     "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-jest": "^28.11.0",
+    "eslint-plugin-jest": "^28.9.0",
     "eslint-plugin-node": "^11.1.0",
     "jest": "^29.7.0",
     "prettier": "^3.4.2",
     "ts-jest": "^29.2.5",
-    "typescript": "^5.7.3"
+    "typescript": "^5.7.2"
 
   }
 }

src/labeler.ts

@@ -22,7 +22,7 @@ export const run = () =>
     core.setFailed(error.message);
   });
 
-export async function labeler() {
+async function labeler() {
   const {token, configPath, syncLabels, dot, prNumbers} = getInputs();
 
   if (!prNumbers.length) {
@@ -51,50 +51,20 @@ export async function labeler() {
       }
     }
 
-    const labelsToApply = [...allLabels].slice(0, GITHUB_MAX_LABELS);
+    const labelsToAdd = [...allLabels].slice(0, GITHUB_MAX_LABELS);
     const excessLabels = [...allLabels].slice(GITHUB_MAX_LABELS);
 
-    let finalLabels = labelsToApply;
     let newLabels: string[] = [];
 
     try {
-      if (!isEqual(labelsToApply, preexistingLabels)) {
-        // Fetch the latest labels for the PR
-        const latestLabels: string[] = [];
-        // Skip fetching real labels when running tests (uses mock data instead)
-        if (process.env.NODE_ENV !== 'test') {
-          const pr = await client.rest.pulls.get({
-            ...github.context.repo,
-            pull_number: pullRequest.number
-          });
-          latestLabels.push(...pr.data.labels.map(l => l.name).filter(Boolean));
-        }
-
-        // Labels added manually during the run (not in first snapshot)
-        const manualAddedDuringRun = latestLabels.filter(
-          l => !preexistingLabels.includes(l)
+      if (!isEqual(labelsToAdd, preexistingLabels)) {
+        await api.setLabels(client, pullRequest.number, labelsToAdd);
+        newLabels = labelsToAdd.filter(
+          label => !preexistingLabels.includes(label)
         );
-
-        // Preserve manual labels first, then apply config-based labels, respecting GitHub's 100-label limit
-        finalLabels = [
-          ...new Set([...manualAddedDuringRun, ...labelsToApply])
-        ].slice(0, GITHUB_MAX_LABELS);
-
-        await api.setLabels(client, pullRequest.number, finalLabels);
-
-        newLabels = finalLabels.filter(l => !preexistingLabels.includes(l));
       }
     } catch (error: any) {
       if (
-        error.name === 'HttpError' &&
-        error.status === 403 &&
-        error.message.toLowerCase().includes('unauthorized')
-      ) {
-        throw new Error(
-          `Failed to set labels for PR #${pullRequest.number}. The workflow does not have permission to create labels. ` +
-            `Ensure the 'issues: write' permission is granted in the workflow file or manually create the missing labels in the repository before running the action.`
-        );
-      } else if (
         error.name !== 'HttpError' ||
         error.message !== 'Resource not accessible by integration'
       ) {
@@ -102,8 +72,7 @@ export async function labeler() {
       }
 
       core.warning(
-        `The action requires 'issues: write' permission to create new labels or 'pull-requests: write' permission to add existing labels to pull requests. ` +
-          `For more information, refer to the action documentation: https://github.com/actions/labeler#recommended-permissions`,
+        `The action requires write permission to add labels to pull requests. For more information please refer to the action documentation: https://github.com/actions/labeler#recommended-permissions`,
         {
           title: `${process.env['GITHUB_ACTION_REPOSITORY']} running under '${github.context.eventName}' is misconfigured`
         }
@@ -115,7 +84,7 @@ export async function labeler() {
     }
 
     core.setOutput('new-labels', newLabels.join(','));
-    core.setOutput('all-labels', finalLabels.join(','));
+    core.setOutput('all-labels', labelsToAdd.join(','));
 
     if (excessLabels.length) {
       core.warning(