[campaign] Security Alert Burndown: Dependabot bundle — Node.js — /actions/setup/js/package.json (2026-01-30)

[github-actions]

Context

This issue tracks one Dependabot PR bundle discovered by the Security Alert Burndown campaign.

Bundle

• Runtime: Node.js
• Manifest: /actions/setup/js/package.json

Bundling Rules

• Group work by runtime. Never mix runtimes.
• Group changes by target dependency file (one manifest + its lockfile).
• Patch/minor updates may be bundled; major updates should be isolated unless tightly coupled.
• Bundled releases must include a research report (packages, versions, breaking changes, migration, risk, tests).

PRs in Bundle

• Bump @vitest/ui from 4.0.17 to 4.0.18 in /actions/setup/js #12011 - Bump @vitest/ui from 4.0.17 to 4.0.18 in /actions/setup/js
• Bump @actions/github from 7.0.0 to 8.0.0 in /actions/setup/js #12012 - Bump @actions/github from 7.0.0 to 8.0.0 in /actions/setup/js (⚠️ major update - review carefully)
• Bump prettier from 3.8.0 to 3.8.1 in /actions/setup/js #12014 - Bump prettier from 3.8.0 to 3.8.1 in /actions/setup/js
• Bump @types/node from 25.0.9 to 25.0.10 in /actions/setup/js #12016 - Bump @types/node from 25.0.9 to 25.0.10 in /actions/setup/js
• Bump @vitest/coverage-v8 from 4.0.17 to 4.0.18 in /actions/setup/js #12017 - Bump @vitest/coverage-v8 from 4.0.17 to 4.0.18 in /actions/setup/js

Agent Task

1. Research each update for breaking changes and summarize risks (especially @actions/github 7→8 major bump).
2. Create a single bundled PR (one runtime + one manifest).
3. Ensure CI passes; run relevant runtime tests.
4. Add the research report to the bundled PR.
5. Update this issue checklist as PRs are merged.

AI generated by Dependabot Burner