ironprogrammer · dependabot · Oct 27, 2025
diff --git a/.github/workflows/coding-standards.yml b/.github/workflows/coding-standards.yml
@@ -98,7 +98,7 @@ jobs:
 
  steps:
  - name: Dispatch workflow run
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  retries: 2
  retry-exempt-status-codes: 418

diff --git a/.github/workflows/commit-built-file-changes.yml b/.github/workflows/commit-built-file-changes.yml
@@ -43,7 +43,7 @@ jobs:
  contents: write
  steps:
  - name: Download artifact
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  script: |
  const artifacts = await github.rest.actions.listWorkflowRunArtifacts( {

diff --git a/.github/workflows/end-to-end-tests.yml b/.github/workflows/end-to-end-tests.yml
@@ -103,7 +103,7 @@ jobs:
  )
  steps:
  - name: Dispatch workflow run
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  retries: 2
  retry-exempt-status-codes: 418

diff --git a/.github/workflows/failed-workflow.yml b/.github/workflows/failed-workflow.yml
@@ -30,7 +30,7 @@ jobs:
 
  steps:
  - name: Rerun a workflow
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  retries: 15
  retry-exempt-status-codes: 418

diff --git a/.github/workflows/install-testing.yml b/.github/workflows/install-testing.yml
@@ -118,7 +118,7 @@ jobs:
 
  steps:
  - name: Set up PHP ${{ matrix.php }}
- uses: shivammathur/setup-php@20529878ed81ef8e78ddf08b480401e6101a850f # v2.35.3
+ uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # v2.35.5
  with:
  php-version: '${{ matrix.php }}'
  coverage: none
@@ -171,7 +171,7 @@ jobs:
 
  steps:
  - name: Dispatch workflow run
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  retries: 2
  retry-exempt-status-codes: 418

diff --git a/.github/workflows/javascript-tests.yml b/.github/workflows/javascript-tests.yml
@@ -91,7 +91,7 @@ jobs:
 
  steps:
  - name: Dispatch workflow run
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  retries: 2
  retry-exempt-status-codes: 418

diff --git a/.github/workflows/local-docker-environment.yml b/.github/workflows/local-docker-environment.yml
@@ -154,7 +154,7 @@ jobs:
 
  steps:
  - name: Dispatch workflow run
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  retries: 2
  retry-exempt-status-codes: 418

diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
@@ -68,7 +68,7 @@ jobs:
  run: echo "TARGET_SHA=$(git rev-parse HEAD^1)" >> "$GITHUB_ENV"
 
  - name: Set subjects
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  id: set-subjects
  with:
  script: |
@@ -165,7 +165,7 @@ jobs:
 
  steps:
  - name: Dispatch workflow run
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  retries: 2
  retry-exempt-status-codes: 418

diff --git a/.github/workflows/php-compatibility.yml b/.github/workflows/php-compatibility.yml
@@ -83,7 +83,7 @@ jobs:
 
  steps:
  - name: Dispatch workflow run
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  retries: 2
  retry-exempt-status-codes: 418

diff --git a/.github/workflows/phpunit-tests.yml b/.github/workflows/phpunit-tests.yml
@@ -625,7 +625,7 @@ jobs:
 
  steps:
  - name: Dispatch workflow run
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  retries: 2
  retry-exempt-status-codes: 418

diff --git a/.github/workflows/props-bot.yml b/.github/workflows/props-bot.yml
@@ -76,7 +76,7 @@ jobs:
  format: 'svn'
 
  - name: Remove the props-bot label
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  if: ${{ github.event.action == 'labeled' && 'props-bot' == github.event.label.name }}
  with:
  retries: 2

diff --git a/.github/workflows/pull-request-comments.yml b/.github/workflows/pull-request-comments.yml
@@ -90,7 +90,7 @@ jobs:
  github.event.workflow_run.conclusion == 'success'
  steps:
  - name: Download artifact
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  script: |
  const artifacts = await github.rest.actions.listWorkflowRunArtifacts( {
@@ -124,7 +124,7 @@ jobs:
  run: unzip pr-number.zip
 
  - name: Leave a comment about testing with Playground
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  if: ${{ github.actor != 'dependabot[bot]' }}
  with:
  script: |
@@ -177,7 +177,7 @@ jobs:
  if: ${{ github.repository == 'WordPress/wordpress-develop' && github.event_name == 'pull_request_target' && ! github.event.pull_request.draft && github.event.pull_request.state == 'open' && github.actor != 'dependabot[bot]' }}
  steps:
  - name: Check for Trac ticket and manage comment
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  script: |
  const { owner, repo } = context.repo;

diff --git a/.github/workflows/reusable-build-package.yml b/.github/workflows/reusable-build-package.yml
@@ -35,7 +35,7 @@ jobs:
  persist-credentials: false
 
  - name: Set up Node.js
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+ uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
  with:
  node-version-file: '.nvmrc'
  cache: npm
@@ -53,7 +53,7 @@ jobs:
  run: zip -q -r develop.zip wordpress/.
 
  - name: Upload ZIP as a GitHub Actions artifact
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
  with:
  name: wordpress-develop
  path: develop.zip

diff --git a/.github/workflows/reusable-check-built-files.yml b/.github/workflows/reusable-check-built-files.yml
@@ -42,7 +42,7 @@ jobs:
  show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
 
  - name: Set up Node.js
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+ uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
  with:
  node-version-file: '.nvmrc'
  cache: npm
@@ -103,7 +103,7 @@ jobs:
 
  # Uploads the diff file as an artifact.
  - name: Upload diff file as artifact
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
  if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
  with:
  name: pr-built-file-changes

diff --git a/.github/workflows/reusable-cleanup-pull-requests.yml b/.github/workflows/reusable-cleanup-pull-requests.yml
@@ -46,7 +46,7 @@ jobs:
  - name: Find pull requests
  id: linked-prs
  if: ${{ steps.trac-tickets.outputs.fixed_list != '' && steps.git-svn-id.outputs.svn_revision_number != '' }}
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  script: |
  const fixedList = "${{ steps.trac-tickets.outputs.fixed_list }}".split(' ').filter(Boolean);
@@ -82,7 +82,7 @@ jobs:
 
  - name: Comment and close pull requests
  if: ${{ steps.trac-tickets.outputs.fixed_list != '' && steps.git-svn-id.outputs.svn_revision_number != '' }}
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  with:
  script: |
  const prNumbers = ${{ steps.linked-prs.outputs.result }};

diff --git a/.github/workflows/reusable-coding-standards-javascript.yml b/.github/workflows/reusable-coding-standards-javascript.yml
@@ -40,7 +40,7 @@ jobs:
  persist-credentials: false
 
  - name: Set up Node.js
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+ uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
  with:
  node-version-file: '.nvmrc'
  cache: npm

diff --git a/.github/workflows/reusable-coding-standards-php.yml b/.github/workflows/reusable-coding-standards-php.yml
@@ -52,7 +52,7 @@ jobs:
  persist-credentials: false
 
  - name: Set up PHP
- uses: shivammathur/setup-php@20529878ed81ef8e78ddf08b480401e6101a850f # v2.35.3
+ uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # v2.35.5
  with:
  php-version: ${{ inputs.php-version }}
  coverage: none
@@ -65,7 +65,7 @@ jobs:
  run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
 
  - name: Cache PHPCS scan cache
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
  with:
  path: |
  .cache/phpcs-src.json

diff --git a/.github/workflows/reusable-end-to-end-tests.yml b/.github/workflows/reusable-end-to-end-tests.yml
@@ -76,13 +76,13 @@ jobs:
  echo "PHP_FPM_GID=$(id -g)" >> "$GITHUB_ENV"
 
  - name: Checkout repository
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
  with:
  show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
  persist-credentials: false
 
  - name: Set up Node.js
- uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
+ uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
  with:
  node-version-file: '.nvmrc'
  cache: npm
@@ -145,7 +145,7 @@ jobs:
  run: npm run test:e2e
 
  - name: Archive debug artifacts (screenshots, HTML snapshots)
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
  if: always()
  with:
  name: failures-artifacts${{ inputs.LOCAL_SCRIPT_DEBUG && '-SCRIPT_DEBUG' || '' }}-${{ github.run_id }}

diff --git a/.github/workflows/reusable-javascript-tests.yml b/.github/workflows/reusable-javascript-tests.yml
@@ -41,7 +41,7 @@ jobs:
  persist-credentials: false
 
  - name: Set up Node.js
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+ uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
  with:
  node-version-file: '.nvmrc'
  cache: npm

diff --git a/.github/workflows/reusable-performance-report-v2.yml b/.github/workflows/reusable-performance-report-v2.yml
@@ -62,13 +62,13 @@ jobs:
  persist-credentials: false
 
  - name: Set up Node.js
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+ uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
  with:
  node-version-file: '.nvmrc'
  cache: npm
 
  - name: Download artifacts
- uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+ uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
  with:
  pattern: performance-${{ inputs.multisite && 'multisite' || 'single' }}-${{ inputs.memcached && 'memcached' || 'default' }}-*
  path: artifacts
@@ -86,7 +86,7 @@ jobs:
  - name: Set the base sha
  # Only needed when publishing results.
  if: ${{ inputs.publish }}
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  id: base-sha
  with:
  github-token: ${{ secrets.GITHUB_TOKEN }}

diff --git a/.github/workflows/reusable-performance-test-v2.yml b/.github/workflows/reusable-performance-test-v2.yml
@@ -115,14 +115,14 @@ jobs:
  echo "PHP_FPM_GID=$(id -g)" >> "$GITHUB_ENV"
 
  - name: Checkout repository
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
  with:
  show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
  fetch-depth: ${{ github.event_name == 'workflow_dispatch' && '2' || '1' }}
  persist-credentials: false
 
  - name: Set up Node.js
- uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
+ uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
  with:
  node-version-file: '.nvmrc'
  cache: npm
@@ -149,7 +149,7 @@ jobs:
 
  - name: Download previous build artifact (target branch or previous commit)
  if: ${{ inputs.subject == 'before' }}
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  id: get-previous-build
  with:
  script: |
@@ -258,7 +258,7 @@ jobs:
  TEST_RESULTS_PREFIX: ${{ inputs.subject != 'current' && inputs.subject || '' }}
 
  - name: Archive artifacts
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
  if: always()
  with:
  name: performance-${{ inputs.multisite && 'multisite' || 'single' }}-${{ inputs.memcached && 'memcached' || 'default' }}-${{ inputs.subject }}

diff --git a/.github/workflows/reusable-performance.yml b/.github/workflows/reusable-performance.yml
@@ -139,7 +139,7 @@ jobs:
  run: echo "TARGET_SHA=$(git rev-parse HEAD^1)" >> "$GITHUB_ENV"
 
  - name: Set up Node.js
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+ uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
  with:
  node-version-file: '.nvmrc'
  cache: npm
@@ -232,7 +232,7 @@ jobs:
  run: npm run test:performance
 
  - name: Download previous build artifact (target branch or previous commit)
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  id: get-previous-build
  with:
  script: |
@@ -312,7 +312,7 @@ jobs:
  run: npm run test:performance
 
  - name: Archive artifacts
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
  if: always()
  with:
  name: performance-artifacts${{ inputs.multisite && '-multisite' || '' }}${{ inputs.memcached && '-memcached' || '' }}-${{ github.run_id }}
@@ -329,7 +329,7 @@ jobs:
  - name: Set the base sha
  # Only needed when publishing results.
  if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/trunk' && ! inputs.memcached && ! inputs.multisite }}
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
  id: base-sha
  with:
  github-token: ${{ secrets.GITHUB_TOKEN }}

diff --git a/.github/workflows/reusable-php-compatibility.yml b/.github/workflows/reusable-php-compatibility.yml
@@ -46,7 +46,7 @@ jobs:
  persist-credentials: false
 
  - name: Set up PHP
- uses: shivammathur/setup-php@20529878ed81ef8e78ddf08b480401e6101a850f # v2.35.3
+ uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # v2.35.5
  with:
  php-version: ${{ inputs.php-version }}
  coverage: none
@@ -63,7 +63,7 @@ jobs:
  run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
 
  - name: Cache PHP compatibility scan cache
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
  with:
  path: .cache/phpcompat.json
  key: ${{ runner.os }}-date-${{ steps.get-date.outputs.date }}-php-${{ inputs.php-version }}-phpcompat-cache-${{ hashFiles('**/composer.json', 'phpcompat.xml.dist') }}

diff --git a/.github/workflows/reusable-phpunit-tests-v1.yml b/.github/workflows/reusable-phpunit-tests-v1.yml
@@ -103,7 +103,7 @@ jobs:
  persist-credentials: false
 
  - name: Set up Node.js
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+ uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
  with:
  node-version-file: '.nvmrc'
  cache: npm
@@ -121,7 +121,7 @@ jobs:
 
  - name: Cache Composer dependencies
  if: ${{ env.COMPOSER_INSTALL == true }}
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+ uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
  env:
  cache-name: cache-composer-dependencies
  with: