[dependabot:update-planner] Dependency update plan for github/gh-aw

[cao-githubnext-gh-aw-cao-write]

Dependabot evidence for github/gh-aw shows 12 open dependency update pull requests across GitHub Actions, npm, and Go ecosystems, and no open Dependabot security alerts visible to this workflow. No Dependabot repository-access read tool was reachable from this run, so repository-access status is unavailable rather than confirmed clear. All items are routine patch/minor updates; the highest-risk item is a major bump of mermaid (11→12) in /docs. Next merge batch: the GitHub Actions Docker toolchain group (login/qemu/buildx/build-push), since all four are used together in one workflow and should be validated as a set.

Action: Do not assign this parent issue to a coding agent. Assign one ready child task at a time; each child produces exactly one pull request and reports its own validation.

Apply in this order

1. #aw_dockrbld — Docker Actions toolchain bump (login/qemu/buildx/build-push), grouped: all four steps run together in publish-safe-outputs-node.yml
2. #aw_ghacov — Bump actions/upload-code-coverage (1.3.0 → 1.4.2), used across ci.yml/cgo.yml
3. #aw_vitestgrp — Bump vitest toolchain (@vitest/ui, @vitest/coverage-v8) to 5.0.1 in /actions/setup/js, grouped: shared lockfile + single vitest peer resolution
4. #aw_typesnode — Bump @types/node (26.5.1 → 26.6.2) in /actions/setup/js
5. #aw_copilotsdk — Bump @github/copilot-sdk (1.0.13 → 1.0.14) in /actions/setup/js
6. #aw_prettier — Bump prettier (3.9.6 → 3.9.8) in /actions/setup/js
7. #aw_gogh — Bump github.com/cli/go-gh/v2 (2.16.0 → 2.16.1)
8. #aw_gotools — Bump golang.org/x/tools (0.49.0 → 0.50.0)
9. #aw_mermaid — Bump mermaid (11.17.2 → 12.0.0) in /docs — major version, requires human review

Security and access boundaries

No auth, crypto, payment, database, serialization/deserialization, or telemetry-SDK dependency is touched by any current update. docker/login-action, docker/setup-qemu-action, docker/setup-buildx-action, and docker/build-push-action are CI/CD build-tooling actions used to build and push the gh-aw-node container image; treat this group as a build/CI-toolchain boundary requiring careful review of the publish workflow's registry-push behavior, even though the version bumps themselves are minor/patch. mermaid is a docs-rendering major bump; review for docs/ build breakage only, no runtime/production surface. Dependabot repository-access evidence could not be retrieved in this run (no accessible read tool), so an access-related blocker cannot be ruled out; this is recorded as an evidence gap, not a confirmed boundary.

Update checklist

• Docker Actions toolchain bump: docker/login-action 4.2.0→4.6.0, docker/setup-qemu-action 4.2.0→4.4.0, docker/setup-buildx-action 4.3.0→4.4.0, docker/build-push-action 7.2.0→7.4.0 — github-actions ecosystem, .github/workflows/publish-safe-outputs-node.yml (source) — minor/patch — build/CI boundary — PRs Bump docker/login-action from 4.2.0 to 4.6.0 #62617, Bump docker/setup-qemu-action from 4.2.0 to 4.4.0 #62616, Bump docker/setup-buildx-action from 4.3.0 to 4.4.1 #62614, Bump docker/build-push-action from 7.2.0 to 7.4.0 #62613 — #aw_dockrbld
• Bump actions/upload-code-coverage 1.3.0→1.4.2 — github-actions ecosystem, .github/workflows/ci.yml, .github/workflows/cgo.yml — minor — CI boundary — PR Bump actions/upload-code-coverage from 1.3.0 to 1.4.2 #62611 — #aw_ghacov
• Bump @vitest/ui and @vitest/coverage-v8 5.0.0→5.0.1 — npm ecosystem, /actions/setup/js/package.json — patch, dev/test dependency — PRs Bump @vitest/ui from 5.0.0 to 5.0.1 in /actions/setup/js #62608, Bump @vitest/coverage-v8 from 5.0.0 to 5.0.1 in /actions/setup/js #62607 — #aw_vitestgrp
• Bump @types/node 26.5.1→26.6.2 — npm ecosystem, /actions/setup/js/package.json — minor, dev dependency — PR Bump @types/node from 26.5.1 to 26.6.2 in /actions/setup/js #62606 — #aw_typesnode
• Bump @github/copilot-sdk 1.0.13→1.0.14 — npm ecosystem, /actions/setup/js/package.json — patch, runtime dependency (Copilot engine action) — PR Bump @github/copilot-sdk from 1.0.13 to 1.0.14 in /actions/setup/js #62605 — #aw_copilotsdk
• Bump prettier 3.9.6→3.9.8 — npm ecosystem, /actions/setup/js/package.json — patch, dev/lint dependency — PR Bump prettier from 3.9.6 to 3.9.8 in /actions/setup/js #62604 — #aw_prettier
• Bump github.com/cli/go-gh/v2 2.16.0→2.16.1 — gomod ecosystem, root go.mod — patch, direct runtime dependency (gh CLI wrapper) — PR Bump github.com/cli/go-gh/v2 from 2.16.0 to 2.16.1 #62603 — #aw_gogh
• Bump golang.org/x/tools 0.49.0→0.50.0 — gomod ecosystem, root go.mod — minor, indirect/build-tool dependency — PR Bump golang.org/x/tools from 0.49.0 to 0.50.0 #61090 — #aw_gotools
• Bump mermaid 11.17.2→12.0.0 in /docs — npm ecosystem, docs/package.json — major, docs-build dependency — PR Bump mermaid from 11.17.2 to 12.0.0 in /docs #61091 — #aw_mermaid

Risk and migration notes

• Docker Actions group: all four actions are consumed together in publish-safe-outputs-node.yml's image build/push job; bump as one unit and confirm registry push (ghcr.io) still succeeds in dry-run/no-push conditions available to CI.
• actions/upload-code-coverage: coverage-upload-only action, minimal blast radius; confirm the action's input schema hasn't changed (file: input).
• @vitest/ui + @vitest/coverage-v8 share the vitest@^5.0.0 peer resolution in /actions/setup/js/package-lock.json; bump together to avoid a peer-version mismatch.
• @types/node: type-only dependency, low risk; confirm no new TS diagnostics after bump.
• @github/copilot-sdk: powers the Copilot engine action; review release notes for any breaking API surface used in actions/setup/js/*.cjs.
• mermaid 12.0.0 is a major version bump for the docs-rendering dependency; review the mermaid v12 release notes for breaking diagram syntax changes and confirm docs/ builds and renders sample diagrams correctly.
• golang.org/x/tools: used by Go tooling (staticcheck/tooling in this repo's linters); confirm go build ./... and make lint still pass.
• github.com/cli/go-gh/v2: direct dependency used for gh CLI interactions; patch bump, low risk, but exercise any gh API call paths in unit tests.

Validation commands

• Docker Actions group: no local build available; rely on CI dry-run of publish-safe-outputs-node.yml (should_push gate) and manual review of the diff; there is no local emulation command.
• actions/upload-code-coverage: no local validation; verify workflow still parses via gh aw compile equivalent / YAML lint, and diff the pinned SHA/tag comment.
• JS deps in /actions/setup/js: cd actions/setup/js && npm ci && npm run typecheck && npm test
• mermaid in /docs: cd docs && npm ci && npm run build (and manually inspect a rendered page containing Mermaid diagrams)
• Go deps (go-gh/v2, x/tools): go build ./... && go vet ./... && make test-unit (impacted-first) or targeted package tests for pkg/cli and any tooling that shells out via go-gh
• Full repository gate before merge: make lint and make test-unit

Blocked updates

None identified. No update is currently blocked by conflicts, failed Dependabot runs, or access gaps beyond the access-evidence gap noted below.

Evidence

• list_dependabot_alerts (state=open) returned an empty result for github/gh-aw.
• 12 open Dependabot-authored pull requests found via list_pull_requests (numbers 62617, 62616, 62614, 62613, 62611, 62608, 62607, 62606, 62605, 62604, 62603, 61091, 61090), used here as supplementary queue/status evidence, not as the sole update inventory.
• No Dependabot-native repository-access read tool was reachable in this run (GitHub MCP server is read-only and no repository-access endpoint was exposed); repository-access status is recorded as unavailable rather than clear.
• .github/dependabot.yml confirms configured ecosystems: github-actions (root), gomod (root, .github/workflows), npm (docs, actions/setup/js, .github/workflows), pip (.github/workflows), docker (root, actions/setup/js, .devcontainer).
• Repository guidance: .github/dependabot.md was checked and is present but empty (no maintainer-authored dependency priorities, grouping preferences, or validation commands were found to incorporate).
• Toolchain: go.mod declares go 1.26.8; docs/package.json declares "engines": {"node": ">=22.13.0"}; no packageManager field or .tool-versions/mise file was found for /actions/setup/js.

Agent prompt

This parent issue intentionally has no agent prompt. See each child issue's own collapsed Agent prompt block for the self-contained instructions to assign.

Task boundaries

• The Docker Actions group (#aw_dockrbld) is grouped because all four actions are invoked in one build/push job in publish-safe-outputs-node.yml; they are a hard edge (one resolver invocation / one deployable artifact — the gh-aw-node container image) and must be validated together.
• The vitest toolchain group (#aw_vitestgrp) is grouped because @vitest/ui and @vitest/coverage-v8 share a single vitest@^5.0.0 peer resolution in the same package-lock.json; bumping one without the other risks a peer-version mismatch (hard edge).
• All other updates (upload-code-coverage, @types/node, @github/copilot-sdk, prettier, github.com/cli/go-gh/v2, golang.org/x/tools, mermaid) are independent manifests/packages with no shared lockfile or resolver dependency on each other or on the two grouped items above, so each remains its own single-PR child.

Generated by Dependabot / Update Planner · copilot · auto · 104.1 AIC · ⌖ 16.8 AIC · ⊞ 22.6K · ◷