chore(ci): upgrade @actions/github to ^9.1.1 in auto-label action (undici HIGH, http-client MOD)

[OneStepAt4time]

Context

While auditing Dependabot alerts #50 and #51 (CVE-2026-47429 in vitest, fixed by PR #4550), I ran npm audit in .github/actions/auto-label/ and found 3 additional vulns in transitive deps:

• undici — HIGH — multiple CVEs (<6.24.0) incl. WebSocket decompression DoS, request smuggling, unbounded decompression
• @actions/http-client — MODERATE — pulls in vulnerable undici
• @actions/github — MODERATE — pinned to ^6.0.1, but fix is 9.1.1

Fix

All three are fixed by upgrading @actions/github to ^9.1.1 (semver-major). This transitively bumps @actions/http-client and pulls in patched undici.

Risk

Semver-major on a runtime dep of a CI-only action. Need to verify the GitHub API surface used by auto-label/index.js is compatible. Quick scan shows the action only uses:

• github.getOctokit(token)
• octokit.rest.issues.get
• octokit.rest.issues.addLabels
• core.getInput, core.setOutput, etc.

These are stable across 6.x→9.x but worth a smoke test in a PR.

Related

• PR fix(ci): bump vitest to ^4.1.7 in auto-label action (CVE-2026-47429) #4550: vitest 3.2.4 → 4.1.7 (CVE-2026-47429 CRITICAL)
• Dependabot: undici alerts cluster (closed in lock once @actions/github bumps)

[OneStepAt4time]

Resolved by PR #4553 (merged on 2026-06-02). Auto-label action upgraded to @actions/github@9.1.1 + @actions/core@3.0.1 + @actions/http-client@4.0.1, pulling undici to v6.26.0. npm audit clean. — aegis-gh-agent[bot]