Repository navigation
meta: Dependabot fails attempting update of gr2m/create-or-update-pull-request-action action #62990
Description
Situation
Dependabot logs https://github.com/nodejs/node/actions/runs/24660702701/job/72105638122 show a failure attempting to update the GitHub Action gr2m/create-or-update-pull-request-action
+---------------------------------------------------------------------------+
| Dependencies failed to update |
+-------------------------------------------+---------------+---------------+
| Dependency | Error Type | Error Details |
+-------------------------------------------+---------------+---------------+
| gr2m/create-or-update-pull-request-action | unknown_error | null |
+-------------------------------------------+---------------+---------------+
Assessment
A similar issue was described and resolved in nodejs/corepack#815
Multiple GitHub Actions workflows, for example:
use commit gr2m/create-or-update-pull-request-action@77596e3 from Nov 24, 2022
The parent of the above commit is gr2m/create-or-update-pull-request-action@df20b2c which is tagged with v1.9.2
Dependabot would appear to be unable to find out which major.minor.patch the commit gr2m/create-or-update-pull-request-action@77596e3 belongs to, since the commit is not equivalent to any tag and presumably is unable to use update logic that depends on this.
Suggestion
Manually update all instances of:
uses: gr2m/create-or-update-pull-request-action@77596e3166f328b24613f7082ab30bf2d93079d5to a valid SHA gr2m/create-or-update-pull-request-action@b65137c (b65137ca591da0b9f43bad7b24df13050ea45d1b) corresponding to the action's latest version tag gr2m/create-or-update-pull-request-action@v1.10.1, released Nov 14, 2024
This should enable Dependabot to take over future updates.
Other
Note that the latest version gr2m/create-or-update-pull-request-action@v1.10.1 is based on node20 which causes deprecation warnings in GitHub Actions.
I already submitted gr2m/create-or-update-pull-request-action#728 to request an update to node24. It appears that the action repo is however not being actively maintained at this time.
cc: @nodejs/actions
Activity
MikeMcC399 commentedon Apr 28, 2026
I can offer to submit a PR to update the action version gr2m/create-or-update-pull-request-action in each of the workflows that use it.
I'm not sure though that this would be helpful, since the actions are set up to run in the parent repo, not in a fork, so I can't easily test them.
Renegade334 commentedon May 1, 2026
I can see nothing between the current SHA and v1.10.1 that should be breaking, so I'd say go for it.
MikeMcC399 commentedon May 1, 2026
@Renegade334
I have gone for it with PR #63065 knowing that I can't test these workflows in a fork. If that's an issue, then a user with write access could clone the branch and test it in the parent repo.
tools: update gr2m/create-or-update-pull-request-action to v1.10.1
tools: update gr2m/create-or-update-pull-request-action to v1.10.1
tools: update gr2m/create-or-update-pull-request-action to v1.10.1
tools: update gr2m/create-or-update-pull-request-action to v1.10.1
tools: update gr2m/create-or-update-pull-request-action to v1.10.1