Bump @actions/core from 3.0.0 to 3.0.1

[dependabot]

Bumps @actions/core from 3.0.0 to 3.0.1.

Changelog

Sourced from @​actions/core's changelog.

3.0.1

• Bump undici from 6.23.0 to 6.24.1 #2348

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[ecobitai]

Dependency Verification: APPROVED

@actions/core 3.0.0 → 3.0.1 (patch)

Summary

• CI: ✅ All 4 checks passed
• Risk: Low - internal dependency update only
• Breaking Changes: None

Changelog

The 3.0.1 release contains a single change:

• Bumped undici from 6.23.0 to 6.24.1 (transitive dependency update)

No API changes, no new features, no breaking changes.

Usage in Codebase

The package is used in 5 files:

• src/index.ts - setFailed, error
• src/services/gitHubService.ts - error, info
• src/services/actionService.ts - getInput, warning
• src/services/gitHubClientService.ts - error
• src/services/pullRequestService.ts - info, warning

All usage is straightforward logging and input functions - no impact from this update.

Sibling Package Note

The repo also uses @actions/github at version 9.1.0, which is not included in this update. These are independent packages from the @actions toolkit monorepo and do not require version alignment. No action needed.

LGTM! Safe to merge.

Technical Details

Property	Value
Classifier Tier	standard
Tier Reasoning	Security advisory updates require investigation and verification regardless of patch version, even with passing CI checks.
Verdict	APPROVE
Model	z-ai/glm-5-20260211
Iterations	4
Reasoning	enabled
Duration	56.2s
Auto-Verify	enabled
Auto-Approve Level	major
Auto-Merge Level	minor

Tokens	Count	Cost
Input	44,044	$0.0317
Output	1,519	$0.0035
Total		$0.0352

Classifier overhead: 375 tokens ($0.0005)

Tools: shell x4, search_web, fetch_url

⚡️ Trace Log

🔷 Executed:

#!/bin/bash
# Check for all @actions/* packages in dependencies
cat package.json | jq '[.dependencies, .devDependencies] | add | keys[] | select(startswith("@actions/"))'

Length of output: 34 chars

"@actions/core"
"@actions/github"

---

🔷 Executed:

#!/bin/bash
# Count files using @actions/core
rg "from.*@actions/core" -g "*.{ts,tsx,js,jsx}" -l | wc -l

Length of output: 2 chars

5

---

🔷 Executed:

#!/bin/bash
# Show actual usage of @actions/core
rg "from.*@actions/core" -g "*.{ts,tsx,js,jsx}" -n

Length of output: 381 chars

src/index.ts:1:import { setFailed, error } from '@actions/core'
src/services/gitHubService.ts:1:import { error, info } from '@actions/core'
src/services/actionService.ts:1:import { getInput, warning } from '@actions/core'
src/services/gitHubClientService.ts:1:import { error } from '@actions/core'
src/services/pullRequestService.ts:6:import { info, warning } from '@actions/core'

---

🔷 Executed:

#!/bin/bash
# Get version of @actions/github
cat package.json | jq '.dependencies["@actions/github"]'

Length of output: 8 chars

"9.1.0"

---

🔷 Executed:

search_web(query="@actions/core 3.0.1 changelog release notes")

Length of output: 2826 chars

Found 5 results for "@actions/core 3.0.1 changelog release notes":

1. Bump @actions/core from 1.1.3 to 1.2.6 (#361) · actions/checkout@eccf386
   https://github.com/actions/checkout/commit/eccf386318b560bdd401913a9fe3cca56dc369d6
   Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 1.1.3 to 1.2.6. - [Release notes](https://github.com/actions/toolkit/releases) - [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md) - [Commits](ht...

---

🔷 Executed:

fetch_url(url="https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md")

Length of output: 1433 chars

*Content from https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md:*

# Summary of @actions/core Releases

This page documents the release history of the `@actions/core` package from the GitHub Actions Toolkit repository.

## Key Information:

**Latest Version:** 3.0.1 (April 21, 2026)
- Updated `undici` dependency from 6.23.0 to 6.24.1

**Major Recent Changes:**

- **v3.0.0** - Breaking change: Package is now ESM-only; CommonJS consumers must use dynamic `import()` instead of ...