From 538331d082783de3bda5c8669850e37b6a7d4895 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Fri, 17 Apr 2026 11:35:58 -0400
Subject: [PATCH 1/4] Reintroduce a Dependabot configuration file.

---
 .github/dependabot.yml | 213 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 213 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000000..24e2573546f53
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,213 @@
+# Configure Dependabot scanning.
+version: 2
+
+updates:
+  # Check for updates to GitHub Actions.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  # Check for updates to Composer packages.
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    ignore:
+      # These dependencies do not currently need to be managed with Dependabot.
+      - dependency-name: "squizlabs/php_codesniffer"
+      - dependency-name: "wp-coding-standards/wpcs"
+      - dependency-name: "phpcompatibility/php-compatibility"
+      - dependency-name: "yoast/phpunit-polyfills"
+    groups:
+      composer-packages:
+        patterns:
+          - "composer/ca-bundle"
+
+  # Monitor some npm dependencies for updates in groups.
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 20
+    ignore:
+      - dependency-name: "@wordpress/*"
+    groups:
+      ##
+      # Groups for updating devDependencies.
+      ##
+
+      # Dependencies related to Playwright testing (E2E, performance).
+      tests-playwright:
+        patterns:
+          - "*playwright*"
+      # Dependencies related to JavaScript testing with QUnit.
+      tests-qunit:
+        patterns:
+          - "*qunit*"
+          - "sinon*"
+      # Dependencies related to CSS and SASS building and manilupating.
+      dev-css-sass:
+        patterns:
+          - "autoprefixer"
+          # postcss and css related dependencies.
+          - "*css*"
+          - "*sass"
+      # Dependencies related to the Webpack build process.
+      dev-webpack:
+        patterns:
+          - "*webpack*"
+          - "react-refresh"
+          - "source-map-loader"
+      # Dependencies related to the local Docker development environment.
+      dev-docker:
+        patterns:
+          - "dotenv*"
+          - "wait-on"
+      # Dependencies that do not fall into a specific grouping.
+      dev-miscellaneous:
+        patterns:
+          - "chalk"
+          - "check-node-version"
+          - "ink-docstrap"
+          - "install-changed"
+          - "matchdep"
+          - "uuid"
+      # Dependencies related to JavaScript minification.
+      dev-uglify:
+        patterns:
+          - "*uglify*"
+      # All GruntJS related dependencies that do not relate to another group.
+      dev-grunt:
+        patterns:
+          - "*grunt*"
+
+      ##
+      # Groups for updating production dependencies.
+      ##
+
+      # Dependencies related to jQuery and its ecosystem.
+      external-jquery:
+        patterns:
+          - "jquery*"
+      # Dependencies related to React and its ecosystem.
+      external-react:
+        patterns:
+          - "react*"
+          - "!react-refresh"
+      # Dependencies used for bundling polyfill libraries into WordPress.
+      external-polyfills:
+        patterns:
+          - "core-js-url-browser"
+          - "element-closest"
+          - "formdata-polyfill"
+          - "imagesloaded"
+          - "objectFitPolyfill"
+          - "polyfill-library"
+          - "regenerator-runtime"
+          - "whatwg-fetch"
+          - "wicg-inert"
+      # Dependencies related to the Masonry library.
+      external-masonry:
+        patterns:
+          - "masonry-layout"
+      # Dependencies that do not fall into a specific grouping.
+      external-miscellaneous:
+        patterns:
+          - "backbone"
+          - "clipboard"
+          - "hoverintent"
+          - "json2php"
+          - "lodash"
+          - "moment"
+          - "underscore"
+
+  # Monitor npm dependencies within default themes.
+  - package-ecosystem: "npm"
+    directory: "/src/wp-content/themes/twentytwentyfive"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    groups:
+      twentytwentyfive-css:
+        patterns:
+          - "**browserslist*"
+          - "*css*"
+
+  - package-ecosystem: "npm"
+    directory: "/src/wp-content/themes/twentytwentytwo"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    groups:
+      twentytwentytwo-css:
+        patterns:
+          - "**browserslist*"
+          - "*css*"
+
+  - package-ecosystem: "npm"
+    directory: "/src/wp-content/themes/twentytwentyone"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    groups:
+      twentytwentyone-sass-css:
+        patterns:
+          - "**browserslist*"
+          - "autoprefixer"
+          - "*css*"
+          - "*sass*"
+          - "!*stylelint*"
+      twentytwentyone-eslint:
+        patterns:
+          - "**eslint*"
+      twentytwentyone-stylelint:
+        patterns:
+          - "**stylelint*"
+      twentytwentyone-miscellaneous:
+        patterns:
+          - "chokidar-cli"
+          - "minimist"
+          - "npm-run-all"
+
+  - package-ecosystem: "npm"
+    directory: "/src/wp-content/themes/twentytwenty"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    groups:
+      twentytwenty-css:
+        patterns:
+          - "**browserslist*"
+          - "autoprefixer"
+          - "*css*"
+      twentytwenty-stylelint:
+        patterns:
+          - "*stylelint*"
+      twentytwenty-miscellaneous:
+        patterns:
+          - "concurrently"
+          - "@wordpress/scripts"
+
+  - package-ecosystem: "npm"
+    directory: "/src/wp-content/themes/twentynineteen"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    groups:
+      twentynineteen-css-sass:
+        patterns:
+          - "**browserslist*"
+          - "autoprefixer"
+          - "*css*"
+          - "*sass*"
+      twentynineteen-miscellaneous:
+        patterns:
+          - "chokidar-cli"
+          - "npm-run-all"

From 2cd9faba369a5a5672e36a21125419568c90f237 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Fri, 17 Apr 2026 11:41:49 -0400
Subject: [PATCH 2/4] Add a workflow to create backport PRs.

---
 .github/workflows/backport.yml | 369 +++++++++++++++++++++++++++++++++
 1 file changed, 369 insertions(+)
 create mode 100644 .github/workflows/backport.yml

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
new file mode 100644
index 0000000000000..a6091199be590
--- /dev/null
+++ b/.github/workflows/backport.yml
@@ -0,0 +1,369 @@
+name: Create backport pull requests
+
+on:
+  workflow_dispatch:
+    inputs:
+      end_branch:
+        description: 'The branch to end at (e.g. 6.9). Defaults to the current supported branch.'
+        required: false
+        type: string
+        default: '7.0'
+      pr-name:
+        description: 'Pull request name (format is "<pr-name> - <branch> branch".'
+        required: false
+        type: string
+        default: ''
+      commit-sha:
+        description: 'Full length commit hash to stage for backport.'
+        required: false
+        type: string
+        default: ''
+      pr_numbers:
+        description: 'Comma-separated PR numbers. Ignored when a SHA is provided.'
+        required: false
+        type: string
+        default: ''
+      repo-source:
+        description: 'Repository to merge changes from.'
+        required: false
+        type: choice
+        default: 'upstream'
+        options:
+          - upstream
+          - current
+      pr-target:
+        description: 'Repository to submit pull requests to.'
+        required: false
+        type: choice
+        default: 'current'
+        options:
+          - upstream
+          - current
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
+jobs:
+  validate-inputs:
+    name: Validate inputs
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Ensure a commit SHA or PR numbers are provided
+        env:
+          INPUTS_COMMIT_SHA: ${{ inputs.commit-sha }}
+          INPUTS_PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          if [ -z "${INPUTS_COMMIT_SHA}" ] && [ -z "${INPUTS_PR_NUMBERS}" ]; then
+            echo "::error::A commit SHA or PR number(s) must be included."
+            exit 1
+          fi
+
+  get-branches:
+    name: Get target branches
+    needs: [ 'validate-inputs' ]
+    runs-on: ubuntu-24.04
+    outputs:
+      branches: ${{ steps.branches.outputs.result }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      # Read keys from .version-support-php.json, filter to those >= end_branch,
+      # convert dashes to dots, and sort numerically descending.
+      # The first key is always the version in active development on trunk, so skip it.
+      - name: Get target branches
+        id: branches
+        env:
+          INPUTS_END_BRANCH: ${{ inputs.end_branch }}
+        run: |
+          END_X=$(echo "${INPUTS_END_BRANCH}" | cut -d. -f1)
+          END_Y=$(echo "${INPUTS_END_BRANCH}" | cut -d. -f2)
+
+          BRANCHES=$(jq -c \
+            --argjson x "$END_X" \
+            --argjson y "$END_Y" \
+            '[ keys[] |
+                . as $k | ($k | split("-")) as $p |
+                select( ($p[0]|tonumber) > $x or
+                        (($p[0]|tonumber) == $x and ($p[1]|tonumber) >= $y) ) |
+                { v: ($k | gsub("-"; ".")), x: ($p[0]|tonumber), y: ($p[1]|tonumber) }
+             ] | sort_by(.x, .y) | reverse | .[1:] | map(.v)' \
+            .version-support-php.json)
+
+          echo "result=$BRANCHES" >> "$GITHUB_OUTPUT"
+
+  backport:
+    name: 'Backport to ${{ matrix.branch }}'
+    needs: [ 'validate-inputs', 'get-branches' ]
+    if: ${{ needs.get-branches.outputs.branches != '[]' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJson( needs.get-branches.outputs.branches ) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: 'true'
+
+      - name: Set up git identity
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Add upstream remote
+        id: upstream
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          UPSTREAM=$(gh repo view "${{ github.repository }}" --json parent --jq 'if .parent then "\(.parent.owner.login)/\(.parent.name)" else empty end')
+          if [ -n "$UPSTREAM" ]; then
+            git remote add upstream "https://github.com/${UPSTREAM}.git"
+            git fetch upstream
+            echo "repo=$UPSTREAM" >> "$GITHUB_OUTPUT"
+          else
+            echo "repo=${{ github.repository }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Determine the name of the branch for the pull request.
+      #
+      # 1. pr-name (normalized to alphanumeric, hyphens, and periods only)
+      # 2. commit-sha
+      # 3. pr_numbers with commas replaced by hyphens
+      - name: Determine backport branch name
+        id: backport-branch
+        env:
+          INPUTS_PR_NAME: ${{ inputs.pr-name }}
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          INPUTS_COMMIT_SHA: ${{ inputs.commit-sha }}
+          INPUTS_PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          if [ -n "${INPUTS_PR_NAME}" ]; then
+            echo "name=backport/${MATRIX_BRANCH}-$(echo "${INPUTS_PR_NAME}" | tr -cs '[:alnum:].-' '-' | sed 's/^-//;s/-$//')" >> "$GITHUB_OUTPUT"
+          elif [ -n "${INPUTS_COMMIT_SHA}" ]; then
+            echo "name=backport/${MATRIX_BRANCH}-${INPUTS_COMMIT_SHA}" >> "$GITHUB_OUTPUT"
+          else
+            echo "name=backport/${MATRIX_BRANCH}-$(echo "${INPUTS_PR_NUMBERS}" | tr -d ' ' | tr ',' '-')" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create backport branch
+        env:
+          STEPS_BACKPORT_BRANCH_OUTPUTS_NAME: ${{ steps.backport-branch.outputs.name }}
+          MATRIX_BRANCH: ${{ matrix.branch }}
+        run: |
+          if git ls-remote --exit-code --heads origin "${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}" > /dev/null 2>&1; then
+            echo "::error::Branch '${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}' already exists on origin."
+            exit 1
+          fi
+
+          git checkout -b "${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}" "origin/${MATRIX_BRANCH}"
+
+      - name: Cherry-pick commit
+        if: ${{ inputs['commit-sha'] != '' }}
+        env:
+          INPUTS_COMMIT_SHA: ${{ inputs.commit-sha }}
+        run: |
+          COMMIT="${INPUTS_COMMIT_SHA}"
+          PARENTS=$(git cat-file -p "$COMMIT" | grep -c '^parent ' || true)
+
+          if [ "$PARENTS" -gt 1 ]; then
+            git cherry-pick -m 1 "$COMMIT"
+          else
+            git cherry-pick "$COMMIT"
+          fi
+
+      - name: Merge PRs
+        id: merge-prs
+        if: ${{ inputs['commit-sha'] == '' && inputs.pr_numbers != '' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_UPSTREAM_OUTPUTS_REPO: ${{ steps.upstream.outputs.repo }}
+          INPUTS_PR_NUMBERS: ${{ inputs.pr_numbers }}
+          INPUTS_REPO_SOURCE: ${{ inputs.repo-source }}
+        run: |
+          if [ "${INPUTS_REPO_SOURCE}" = "upstream" ]; then
+            PR_REPO="${STEPS_UPSTREAM_OUTPUTS_REPO}"
+          else
+            PR_REPO="${GITHUB_REPOSITORY}"
+          fi
+
+          IFS=',' read -ra PR_LIST <<< "${INPUTS_PR_NUMBERS}"
+
+          UPSTREAM_URL="https://github.com/${STEPS_UPSTREAM_OUTPUTS_REPO}.git"
+          RESULTS=""
+          FAILED=false
+
+          for PR_NUMBER in "${PR_LIST[@]}"; do
+            PR_NUMBER=$(echo "$PR_NUMBER" | tr -d ' ')
+
+            PR_DATA=$(gh pr view "$PR_NUMBER" --repo "$PR_REPO" --json title,mergeCommit,baseRefName)
+            PR_TITLE=$(echo "$PR_DATA" | jq -r '.title')
+            MERGE_COMMIT=$(echo "$PR_DATA" | jq -r '.mergeCommit.oid')
+
+            set +e
+            if [ -n "$MERGE_COMMIT" ] && [ "$MERGE_COMMIT" != "null" ]; then
+              # PR is merged: cherry-pick its merge commit.
+              # Determine if it is a merge commit or squash commit.
+              PARENTS=$(git cat-file -p "$MERGE_COMMIT" | grep -c '^parent ' || true)
+
+              if [ "$PARENTS" -gt 1 ]; then
+                git cherry-pick -m 1 --no-commit "$MERGE_COMMIT"
+              else
+                git cherry-pick --no-commit "$MERGE_COMMIT"
+              fi
+            else
+              # PR is open or closed without merging: apply its changes as a diff
+              # against the point where it diverged from its base branch.
+              BASE_REF=$(echo "$PR_DATA" | jq -r '.baseRefName')
+
+              git fetch "$UPSTREAM_URL" "$BASE_REF"
+              BASE_SHA=$(git rev-parse FETCH_HEAD)
+
+              git fetch "$UPSTREAM_URL" "refs/pull/${PR_NUMBER}/head"
+              PR_HEAD_SHA=$(git rev-parse FETCH_HEAD)
+
+              MERGE_BASE=$(git merge-base "$PR_HEAD_SHA" "$BASE_SHA")
+              git diff "$MERGE_BASE" "$PR_HEAD_SHA" | git apply --index
+            fi
+            APPLY_EXIT=$?
+            set -e
+
+            if [ $APPLY_EXIT -eq 0 ]; then
+              git commit -m "$PR_TITLE"
+              RESULTS="${RESULTS}${PR_NUMBER}=✅ "
+            else
+              git cherry-pick --abort 2>/dev/null || git reset --hard HEAD
+              RESULTS="${RESULTS}${PR_NUMBER}=❌ "
+              FAILED=true
+              break
+            fi
+          done
+
+          echo "results=${RESULTS}" >> "$GITHUB_OUTPUT"
+
+          if [ "$FAILED" = "true" ]; then
+            exit 1
+          fi
+
+      - name: Push backport branch
+        env:
+          STEPS_BACKPORT_BRANCH_OUTPUTS_NAME: ${{ steps.backport-branch.outputs.name }}
+        run: git push -u origin "${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}"
+
+      - name: Create pull request
+        id: create-pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_UPSTREAM_OUTPUTS_REPO: ${{ steps.upstream.outputs.repo }}
+          INPUTS_PR_NAME: ${{ inputs.pr-name }}
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          INPUTS_COMMIT_SHA: ${{ inputs.commit-sha }}
+          INPUTS_PR_NUMBERS: ${{ inputs.pr_numbers }}
+          INPUTS_REPO_SOURCE: ${{ inputs.repo-source }}
+          INPUTS_PR_TARGET: ${{ inputs.pr-target }}
+          STEPS_BACKPORT_BRANCH_OUTPUTS_NAME: ${{ steps.backport-branch.outputs.name }}
+        run: |
+          if [ "${INPUTS_REPO_SOURCE}" = "upstream" ]; then
+            PR_REPO="${STEPS_UPSTREAM_OUTPUTS_REPO}"
+          else
+            PR_REPO="${GITHUB_REPOSITORY}"
+          fi
+
+          if [ -n "${INPUTS_PR_NAME}" ]; then
+            PR_TITLE="${INPUTS_PR_NAME} - ${MATRIX_BRANCH} branch"
+          else
+            PR_TITLE="Backport to ${MATRIX_BRANCH}"
+          fi
+
+          if [ -n "${INPUTS_COMMIT_SHA}" ]; then
+            BODY="This pull request backports \`${INPUTS_COMMIT_SHA}\` (https://github.com/${STEPS_UPSTREAM_OUTPUTS_REPO}/commit/${INPUTS_COMMIT_SHA}) to the \`${MATRIX_BRANCH}\` branch."
+          else
+            BODY="Backports to the \`${MATRIX_BRANCH}\` branch."
+          fi
+
+          BODY="${BODY}\n\n## Changes Included\n"
+
+          if [ -n "${INPUTS_COMMIT_SHA}" ]; then
+            COMMIT_MESSAGE=$(git log --format=%B -n 1 "${INPUTS_COMMIT_SHA}")
+            BLOCKQUOTE=$(echo "${COMMIT_MESSAGE}" | sed 's/^/> /')
+            BODY="${BODY}\n${BLOCKQUOTE}"
+          fi
+
+          if [ -n "${INPUTS_PR_NUMBERS}" ] && [ -z "${INPUTS_COMMIT_SHA}" ]; then
+            IFS=',' read -ra PR_LIST <<< "${INPUTS_PR_NUMBERS}"
+            for PR_NUMBER in "${PR_LIST[@]}"; do
+              PR_NUMBER=$(echo "$PR_NUMBER" | tr -d ' ')
+              BODY="${BODY}\n- ${PR_REPO}#${PR_NUMBER}"
+            done
+          fi
+
+          if [ "${INPUTS_PR_TARGET}" = "upstream" ]; then
+            PR_REPO="${STEPS_UPSTREAM_OUTPUTS_REPO}"
+            PR_HEAD="${GITHUB_REPOSITORY_OWNER}:${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}"
+          else
+            PR_REPO="${GITHUB_REPOSITORY}"
+            PR_HEAD="${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}"
+          fi
+
+          PR_URL=$(gh pr create \
+            --repo "${PR_REPO}" \
+            --base "${MATRIX_BRANCH}" \
+            --head "${PR_HEAD}" \
+            --title "$PR_TITLE" \
+            --assignee "${GITHUB_ACTOR}" \
+            --draft \
+            --body "$(echo -e "$BODY")")
+
+          if gh label list --repo "${PR_REPO}" --json name --jq '[.[].name] | contains(["Auto-backport"])' | grep -q 'true'; then
+            gh pr edit "$PR_URL" --repo "${PR_REPO}" --add-label 'Auto-backport'
+          else
+            echo "::notice::The 'Auto-backport' label does not exist on ${PR_REPO}. Consider adding it so that backport pull requests can be identified easily."
+          fi
+
+          echo "url=${PR_URL}" >> "$GITHUB_OUTPUT"
+
+      - name: Write job summary
+        if: always()
+        env:
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          INPUTS_COMMIT_SHA: ${{ inputs.commit-sha }}
+          INPUTS_PR_NUMBERS: ${{ inputs.pr_numbers }}
+          STEPS_MERGE_PRS_OUTPUTS_RESULTS: ${{ steps.merge-prs.outputs.results }}
+          STEPS_CREATE_PR_OUTPUTS_URL: ${{ steps.create-pr.outputs.url }}
+        run: |
+          PR_DISPLAY="${STEPS_CREATE_PR_OUTPUTS_URL:-N/A}"
+
+          if [ -n "${INPUTS_PR_NUMBERS}" ] && [ -z "${INPUTS_COMMIT_SHA}" ]; then
+            IFS=',' read -ra PR_LIST <<< "${INPUTS_PR_NUMBERS}"
+
+            HEADER="| Branch |"
+            SEPARATOR="| :--- |"
+            for PR_NUM in "${PR_LIST[@]}"; do
+              PR_NUM=$(echo "$PR_NUM" | tr -d ' ')
+              HEADER="${HEADER} #${PR_NUM} |"
+              SEPARATOR="${SEPARATOR} :---: |"
+            done
+            HEADER="${HEADER} Pull Request |"
+            SEPARATOR="${SEPARATOR} :--- |"
+
+            ROW="| \`${MATRIX_BRANCH}\` |"
+            for PR_NUM in "${PR_LIST[@]}"; do
+              PR_NUM=$(echo "$PR_NUM" | tr -d ' ')
+              STATUS=$(echo "${STEPS_MERGE_PRS_OUTPUTS_RESULTS}" | tr ' ' '\n' | grep "^${PR_NUM}=" | cut -d= -f2)
+              ROW="${ROW} ${STATUS:-❌} |"
+            done
+            ROW="${ROW} ${PR_DISPLAY} |"
+
+            printf '%s\n%s\n%s\n' "$HEADER" "$SEPARATOR" "$ROW" >> "$GITHUB_STEP_SUMMARY"
+          else
+            printf '| Branch | Pull Request |\n| :--- | :--- |\n| `%s` | %s |\n' \
+              "${MATRIX_BRANCH}" "${PR_DISPLAY}" >> "$GITHUB_STEP_SUMMARY"
+          fi

From d391568a3f1822d2975f095a9a39ed3d16bff4a5 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Fri, 17 Apr 2026 13:32:23 -0400
Subject: [PATCH 3/4] Add workflow for testing backport PRs.

---
 .github/workflows/create-backport-prs.yml | 515 ++++++++++++++++++++++
 1 file changed, 515 insertions(+)
 create mode 100644 .github/workflows/create-backport-prs.yml

diff --git a/.github/workflows/create-backport-prs.yml b/.github/workflows/create-backport-prs.yml
new file mode 100644
index 0000000000000..6329761f79ba9
--- /dev/null
+++ b/.github/workflows/create-backport-prs.yml
@@ -0,0 +1,515 @@
+name: Create backport pull requests
+
+on:
+  workflow_dispatch:
+    inputs:
+      end_branch:
+        description: 'The branch to end at (e.g. 6.9). Defaults to the current supported branch.'
+        required: false
+        type: string
+        default: '7.0'
+      pr-name:
+        description: 'Pull request name (format is "<pr-name> - <branch> branch".'
+        required: false
+        type: string
+        default: ''
+      commit-sha:
+        description: 'Full length commit hash to stage for backport.'
+        required: false
+        type: string
+        default: ''
+      pr_numbers:
+        description: 'Comma-separated PR numbers. Ignored when a SHA is provided.'
+        required: false
+        type: string
+        default: ''
+      repo-source:
+        description: 'Repository to merge changes from.'
+        required: false
+        type: choice
+        default: 'upstream'
+        options:
+          - upstream
+          - current
+      pr-target:
+        description: 'Repository to submit pull requests to.'
+        required: false
+        type: choice
+        default: 'current'
+        options:
+          - upstream
+          - current
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
+jobs:
+  # Confirms that enough information is included to attempt a backport.
+  validate-inputs:
+    name: Validate inputs
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Ensure a commit SHA or PR numbers are provided
+        env:
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          if [ -z "${COMMIT_SHA}" ] && [ -z "${PR_NUMBERS}" ]; then
+            echo "::error::A commit SHA or PR number(s) must be included."
+            exit 1
+          fi
+
+  # Generates a list of branches to create backport PRs for.
+  #
+  # The keys are read from .version-support-php.json, filtered to only include
+  # any after the specified end branch, and sort numerically descending.
+  #
+  # The first key in the file is always skipped because it represents the next
+  # version of WordPress in active development in trunk.
+  #
+  # Performs the following steps:
+  # - Checks out the repository.
+  # - Reads branch versions from .version-support-php.json and outputs a filtered, sorted list.
+  get-branches:
+    name: Get target branches
+    needs: [ 'validate-inputs' ]
+    runs-on: ubuntu-24.04
+    outputs:
+      branches: ${{ steps.branches.outputs.result }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Get target branches
+        id: branches
+        env:
+          END_BRANCH: ${{ inputs.end_branch }}
+        run: |
+          END_X=$(echo "${END_BRANCH}" | cut -d. -f1)
+          END_Y=$(echo "${END_BRANCH}" | cut -d. -f2)
+
+          BRANCHES=$(jq -c \
+            --argjson x "$END_X" \
+            --argjson y "$END_Y" \
+            '[ keys[] |
+                . as $k | ($k | split("-")) as $p |
+                select( ($p[0]|tonumber) > $x or
+                        (($p[0]|tonumber) == $x and ($p[1]|tonumber) >= $y) ) |
+                { v: ($k | gsub("-"; ".")), x: ($p[0]|tonumber), y: ($p[1]|tonumber) }
+             ] | sort_by(.x, .y) | reverse | .[1:] | map(.v)' \
+            .version-support-php.json)
+
+          echo "result=$BRANCHES" >> "$GITHUB_OUTPUT"
+
+  # Resolves shared context and variables used by all matrix jobs.
+  #
+  # The branch name suffix is determined in the following order:
+  # 1. pr-name (normalized to alphanumeric, hyphens, and periods only)
+  # 2. commit-sha
+  # 3. pr_numbers with commas replaced by hyphens
+  #
+  # Performs the following steps:
+  # - Determines whether the repository is a fork.
+  # - Constructs the branch name suffix.
+  resolve-context:
+    name: Resolve context
+    needs: [ 'validate-inputs', 'get-branches' ]
+    if: ${{ needs.get-branches.outputs.branches != '[]' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    outputs:
+      upstream-repo: ${{ steps.upstream.outputs.repo }}
+      branch-suffix: ${{ steps.branch-suffix.outputs.value }}
+    steps:
+      - name: Detect upstream repository
+        id: upstream
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          UPSTREAM=$(gh repo view "${{ github.repository }}" --json parent --jq 'if .parent then "\(.parent.owner.login)/\(.parent.name)" else empty end')
+          if [ -n "$UPSTREAM" ]; then
+            echo "This repository is a fork of ${UPSTREAM}. Original repository configured as \`upstream\` remote."
+            echo "repo=$UPSTREAM" >> "$GITHUB_OUTPUT"
+          else
+            echo "This repository is not a fork. No \`upstream\` remote configured."
+            echo "repo=${{ github.repository }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Determine branch name suffix
+        id: branch-suffix
+        env:
+          PR_NAME: ${{ inputs.pr-name }}
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          if [ -n "${PR_NAME}" ]; then
+            echo "value=$(echo "${PR_NAME}" | tr -cs '[:alnum:].-' '-' | sed 's/^-//;s/-$//')" >> "$GITHUB_OUTPUT"
+          elif [ -n "${COMMIT_SHA}" ]; then
+            echo "value=${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=$(echo "${PR_NUMBERS}" | tr -d ' ' | tr ',' '-')" >> "$GITHUB_OUTPUT"
+          fi
+
+  # Attempts to backport the specified changes in the desired branches.
+  #
+  # Performs the following steps:
+  # - Checks out the repository.
+  # - Configures the Git author.
+  # - Configures the upstream remote (forks only).
+  # - Creates a new branch.
+  # - Performs a `git cherry-pick` when a SHA value is specified.
+  # - Attempts to merge changes from the pull requests specified.
+  # - Pushes the new branch to the origin remote.
+  backport:
+    name: 'Backport to ${{ matrix.branch }}'
+    needs: [ 'validate-inputs', 'get-branches', 'resolve-context' ]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJson( needs.get-branches.outputs.branches ) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: 'true'
+
+      - name: Configure git user name and email
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Add upstream remote
+        env:
+          UPSTREAM_REPO: ${{ needs.resolve-context.outputs.upstream-repo }}
+        run: |
+          if [ "${UPSTREAM_REPO}" != "${{ github.repository }}" ]; then
+            git remote add upstream "https://github.com/${UPSTREAM_REPO}.git"
+            git fetch upstream
+          fi
+
+      - name: Create backport branch
+        env:
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          HEAD_BRANCH_SUFFIX: ${{ needs.resolve-context.outputs.branch-suffix }}
+        run: |
+          BRANCH_NAME="backport/${MATRIX_BRANCH}-${HEAD_BRANCH_SUFFIX}"
+
+          if git ls-remote --exit-code --heads origin "${BRANCH_NAME}" > /dev/null 2>&1; then
+            echo "::error::Branch '${BRANCH_NAME}' already exists on origin."
+            exit 1
+          fi
+
+          git checkout -b "${BRANCH_NAME}" "origin/${MATRIX_BRANCH}"
+
+      - name: Cherry-pick commit
+        if: ${{ inputs['commit-sha'] != '' }}
+        env:
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+        run: |
+          COMMIT="${COMMIT_SHA}"
+          PARENTS=$(git cat-file -p "$COMMIT" | grep -c '^parent ' || true)
+
+          if [ "$PARENTS" -gt 1 ]; then
+            git cherry-pick -m 1 "$COMMIT"
+          else
+            git cherry-pick "$COMMIT"
+          fi
+
+      - name: Merge PRs
+        id: merge-prs
+        if: ${{ inputs['commit-sha'] == '' && inputs.pr_numbers != '' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          UPSTREAM_REPO: ${{ needs.resolve-context.outputs.upstream-repo }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+          REPO_SOURCE: ${{ inputs.repo-source }}
+        run: |
+          if [ "${REPO_SOURCE}" = "upstream" ]; then
+            PR_REPO="${UPSTREAM_REPO}"
+          else
+            PR_REPO="${GITHUB_REPOSITORY}"
+          fi
+
+          IFS=',' read -ra PR_LIST <<< "${PR_NUMBERS}"
+
+          UPSTREAM_URL="https://github.com/${UPSTREAM_REPO}.git"
+          RESULTS=""
+          FAILED=false
+
+          for PR_NUMBER in "${PR_LIST[@]}"; do
+            PR_NUMBER=$(echo "$PR_NUMBER" | tr -d ' ')
+
+            PR_DATA=$(gh pr view "$PR_NUMBER" --repo "$PR_REPO" --json title,mergeCommit,baseRefName)
+            PR_TITLE=$(echo "$PR_DATA" | jq -r '.title')
+            MERGE_COMMIT=$(echo "$PR_DATA" | jq -r '.mergeCommit.oid')
+
+            set +e
+            if [ -n "$MERGE_COMMIT" ] && [ "$MERGE_COMMIT" != "null" ]; then
+              # PR is merged: cherry-pick its merge commit.
+              # Determine if it is a merge commit or squash commit.
+              PARENTS=$(git cat-file -p "$MERGE_COMMIT" | grep -c '^parent ' || true)
+
+              if [ "$PARENTS" -gt 1 ]; then
+                git cherry-pick -m 1 --no-commit "$MERGE_COMMIT"
+              else
+                git cherry-pick --no-commit "$MERGE_COMMIT"
+              fi
+            else
+              # PR is open or closed without merging: apply its changes as a diff
+              # against the point where it diverged from its base branch.
+              BASE_REF=$(echo "$PR_DATA" | jq -r '.baseRefName')
+
+              git fetch "$UPSTREAM_URL" "$BASE_REF"
+              BASE_SHA=$(git rev-parse FETCH_HEAD)
+
+              git fetch "$UPSTREAM_URL" "refs/pull/${PR_NUMBER}/head"
+              PR_HEAD_SHA=$(git rev-parse FETCH_HEAD)
+
+              MERGE_BASE=$(git merge-base "$PR_HEAD_SHA" "$BASE_SHA")
+              git diff "$MERGE_BASE" "$PR_HEAD_SHA" | git apply --index
+            fi
+            APPLY_EXIT=$?
+            set -e
+
+            if [ $APPLY_EXIT -eq 0 ]; then
+              git commit -m "$PR_TITLE"
+              RESULTS="${RESULTS}${PR_NUMBER}=✅ "
+            else
+              git cherry-pick --abort 2>/dev/null || git reset --hard HEAD
+              RESULTS="${RESULTS}${PR_NUMBER}=❌ "
+              FAILED=true
+              break
+            fi
+          done
+
+          echo "results=${RESULTS}" >> "$GITHUB_OUTPUT"
+
+          if [ "$FAILED" = "true" ]; then
+            exit 1
+          fi
+
+      - name: Push backport branch
+        env:
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          HEAD_BRANCH_SUFFIX: ${{ needs.resolve-context.outputs.branch-suffix }}
+        run: git push -u origin "backport/${MATRIX_BRANCH}-${HEAD_BRANCH_SUFFIX}"
+
+      - name: Save results
+        if: always()
+        env:
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          MERGE_RESULTS: ${{ steps.merge-prs.outputs.results }}
+        run: |
+          mkdir -p apply-results
+          SAFE_BRANCH=$(echo "${MATRIX_BRANCH}" | tr '.' '-')
+          {
+            echo "branch=${MATRIX_BRANCH}"
+            echo "merge_results=${MERGE_RESULTS}"
+          } > "apply-results/${SAFE_BRANCH}.txt"
+
+      - name: Upload results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: apply-results-${{ matrix.branch }}
+          path: apply-results/
+          retention-days: 1
+
+  # Creates a draft pull request for each successfully applied backport branch.
+  # Requires only write access to pull requests, keeping git operations separate.
+  #
+  # Performs the following steps:
+  # - Downloads the apply result artifact to confirm changes were applied successfully.
+  # - Creates a draft pull request targeting the specified repository.
+  # - Adds the `Auto-backport` label to the pull request if it exists.
+  # - Formats and uploads a pre-rendered summary row artifact for the report job.
+  create-pr:
+    name: 'Create PR for ${{ matrix.branch }}'
+    needs: [ 'validate-inputs', 'get-branches', 'resolve-context', 'backport' ]
+    if: ${{ always() && !cancelled() && needs.resolve-context.result == 'success' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: write
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJson( needs.get-branches.outputs.branches ) }}
+    steps:
+      - name: Download apply result
+        id: apply-result
+        uses: actions/download-artifact@v4
+        with:
+          name: apply-results-${{ matrix.branch }}
+          path: apply-result/
+        continue-on-error: true
+
+      - name: Create pull request
+        id: create-pr
+        if: ${{ steps.apply-result.outcome == 'success' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          UPSTREAM_REPO: ${{ needs.resolve-context.outputs.upstream-repo }}
+          HEAD_BRANCH_SUFFIX: ${{ needs.resolve-context.outputs.branch-suffix }}
+          PR_NAME: ${{ inputs.pr-name }}
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+          REPO_SOURCE: ${{ inputs.repo-source }}
+          PR_TARGET: ${{ inputs.pr-target }}
+        run: |
+          BACKPORT_BRANCH="backport/${MATRIX_BRANCH}-${HEAD_BRANCH_SUFFIX}"
+
+          if [ "${REPO_SOURCE}" = "upstream" ]; then
+            SOURCE_REPO="${UPSTREAM_REPO}"
+          else
+            SOURCE_REPO="${GITHUB_REPOSITORY}"
+          fi
+
+          if [ -n "${PR_NAME}" ]; then
+            PR_TITLE="${PR_NAME} - ${MATRIX_BRANCH} branch"
+          else
+            PR_TITLE="Backport to ${MATRIX_BRANCH}"
+          fi
+
+          if [ -n "${COMMIT_SHA}" ]; then
+            BODY="This pull request backports \`${COMMIT_SHA}\` (https://github.com/${UPSTREAM_REPO}/commit/${COMMIT_SHA}) to the \`${MATRIX_BRANCH}\` branch."
+          else
+            BODY="Backports to the \`${MATRIX_BRANCH}\` branch."
+          fi
+
+          BODY="${BODY}\n\n## Changes Included\n"
+
+          if [ -n "${COMMIT_SHA}" ]; then
+            COMMIT_MESSAGE=$(gh api "repos/${UPSTREAM_REPO}/commits/${COMMIT_SHA}" --jq '.commit.message')
+            BLOCKQUOTE=$(echo "${COMMIT_MESSAGE}" | sed 's/^/> /')
+            BODY="${BODY}\n${BLOCKQUOTE}"
+          fi
+
+          if [ -n "${PR_NUMBERS}" ] && [ -z "${COMMIT_SHA}" ]; then
+            IFS=',' read -ra PR_LIST <<< "${PR_NUMBERS}"
+            for PR_NUMBER in "${PR_LIST[@]}"; do
+              PR_NUMBER=$(echo "$PR_NUMBER" | tr -d ' ')
+              BODY="${BODY}\n- ${SOURCE_REPO}#${PR_NUMBER}"
+            done
+          fi
+
+          if [ "${PR_TARGET}" = "upstream" ]; then
+            PR_REPO="${UPSTREAM_REPO}"
+            PR_HEAD="${GITHUB_REPOSITORY_OWNER}:${BACKPORT_BRANCH}"
+          else
+            PR_REPO="${GITHUB_REPOSITORY}"
+            PR_HEAD="${BACKPORT_BRANCH}"
+          fi
+
+          PR_URL=$(gh pr create \
+            --repo "${PR_REPO}" \
+            --base "${MATRIX_BRANCH}" \
+            --head "${PR_HEAD}" \
+            --title "$PR_TITLE" \
+            --assignee "${GITHUB_ACTOR}" \
+            --draft \
+            --body "$(echo -e "$BODY")")
+
+          if gh label list --repo "${PR_REPO}" --json name --jq '[.[].name] | contains(["Auto-backport"])' | grep -q 'true'; then
+            gh pr edit "$PR_URL" --repo "${PR_REPO}" --add-label 'Auto-backport'
+          else
+            echo "::notice::The 'Auto-backport' label does not exist on ${PR_REPO}. Consider adding it so that backport pull requests can be identified easily."
+          fi
+
+          echo "url=${PR_URL}" >> "$GITHUB_OUTPUT"
+
+      - name: Save summary row
+        if: always()
+        env:
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          PR_URL: ${{ steps.create-pr.outputs.url }}
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          mkdir -p summary-row
+          SAFE_BRANCH=$(echo "${MATRIX_BRANCH}" | tr '.' '-')
+          MERGE_RESULTS=""
+
+          if [ -f "apply-result/${SAFE_BRANCH}.txt" ]; then
+            MERGE_RESULTS=$(grep '^merge_results=' "apply-result/${SAFE_BRANCH}.txt" | cut -d= -f2-)
+          fi
+
+          PR_DISPLAY="${PR_URL:-N/A}"
+
+          if [ -n "${PR_NUMBERS}" ] && [ -z "${COMMIT_SHA}" ]; then
+            IFS=',' read -ra PR_LIST <<< "${PR_NUMBERS}"
+            ROW="| \`${MATRIX_BRANCH}\` |"
+            for PR_NUM in "${PR_LIST[@]}"; do
+              PR_NUM=$(echo "$PR_NUM" | tr -d ' ')
+              STATUS=$(echo "${MERGE_RESULTS}" | tr ' ' '\n' | grep "^${PR_NUM}=" | cut -d= -f2)
+              ROW="${ROW} ${STATUS:-❌} |"
+            done
+            ROW="${ROW} ${PR_DISPLAY} |"
+          else
+            ROW="| \`${MATRIX_BRANCH}\` | ${PR_DISPLAY} |"
+          fi
+
+          printf '%s\n' "$ROW" > "summary-row/${SAFE_BRANCH}.txt"
+
+      - name: Upload summary row
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: summary-row-${{ matrix.branch }}
+          path: summary-row/
+          retention-days: 1
+
+  # Aggregates results from all matrix jobs into a single workflow summary.
+  #
+  # Performs the following steps:
+  # - Downloads pre-rendered summary row artifacts from all create-pr jobs.
+  # - Writes the table header and appends all rows to the workflow summary.
+  report:
+    name: Backport report
+    needs: [ 'backport', 'create-pr' ]
+    runs-on: ubuntu-24.04
+    if: always()
+    steps:
+      - name: Download summary rows
+        uses: actions/download-artifact@v4
+        with:
+          pattern: summary-row-*
+          path: summary-rows/
+          merge-multiple: true
+        continue-on-error: true
+
+      - name: Write summary
+        env:
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          if [ -n "${PR_NUMBERS}" ] && [ -z "${COMMIT_SHA}" ]; then
+            IFS=',' read -ra PR_LIST <<< "${PR_NUMBERS}"
+
+            HEADER="| Branch |"
+            SEPARATOR="| :--- |"
+            for PR_NUM in "${PR_LIST[@]}"; do
+              PR_NUM=$(echo "$PR_NUM" | tr -d ' ')
+              HEADER="${HEADER} #${PR_NUM} |"
+              SEPARATOR="${SEPARATOR} :---: |"
+            done
+            HEADER="${HEADER} Pull Request |"
+            SEPARATOR="${SEPARATOR} :--- |"
+
+            printf '%s\n%s\n' "$HEADER" "$SEPARATOR" >> "$GITHUB_STEP_SUMMARY"
+          else
+            printf '| Branch | Pull Request |\n| :--- | :--- |\n' >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          for ROW_FILE in $(ls summary-rows/*.txt 2>/dev/null | sort); do
+            cat "${ROW_FILE}" >> "$GITHUB_STEP_SUMMARY"
+          done

From 700630f129e7ccfb3b3fc00e1396e8a0a4d04acb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 24 Apr 2026 04:33:19 +0000
Subject: [PATCH 4/4] Bump the github-actions group across 1 directory with 7
 updates

Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `6.4.0` |
| [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.3` | `6.0.0` |
| [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) | `3.0.1` | `3.0.2` |



Updates `actions/github-script` from 8.0.0 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)

Updates `actions/download-artifact` from 4 to 8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4...v8)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e)

Updates `actions/cache` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...27d5ce7f107fe9357f9df03efb73ab90386fccae)

Updates `codecov/codecov-action` from 5.5.3 to 6.0.0
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/1af58845a975a7985b0beb0cbe6fbbb71a41dbad...57e3a136b779b570ffcdbf80b3bdc90e7fab3de2)

Updates `slackapi/slack-github-action` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/slackapi/slack-github-action/releases)
- [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/slackapi/slack-github-action/compare/af78098f536edbc4de71162a307590698245be95...03ea5433c137af7c0495bc0cad1af10403fc800c)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: slackapi/slack-github-action
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/coding-standards.yml               |  2 +-
 .github/workflows/commit-built-file-changes.yml      |  2 +-
 .github/workflows/create-backport-prs.yml            |  8 ++++----
 .github/workflows/end-to-end-tests.yml               |  2 +-
 .github/workflows/failed-workflow.yml                |  2 +-
 .github/workflows/install-testing.yml                |  2 +-
 .github/workflows/javascript-tests.yml               |  2 +-
 .github/workflows/javascript-type-checking.yml       |  2 +-
 .github/workflows/local-docker-environment.yml       |  2 +-
 .github/workflows/performance.yml                    |  4 ++--
 .github/workflows/php-compatibility.yml              |  2 +-
 .github/workflows/phpstan-static-analysis.yml        |  2 +-
 .github/workflows/phpunit-tests.yml                  |  2 +-
 .github/workflows/props-bot.yml                      |  2 +-
 .github/workflows/pull-request-comments.yml          |  6 +++---
 .github/workflows/reusable-build-package.yml         |  4 ++--
 .github/workflows/reusable-check-built-files.yml     |  4 ++--
 .github/workflows/reusable-cleanup-pull-requests.yml |  4 ++--
 .../reusable-coding-standards-javascript.yml         |  2 +-
 .github/workflows/reusable-coding-standards-php.yml  |  2 +-
 .github/workflows/reusable-end-to-end-tests.yml      |  4 ++--
 .github/workflows/reusable-javascript-tests.yml      |  2 +-
 .../reusable-javascript-type-checking-v1.yml         |  6 +++---
 .github/workflows/reusable-performance-report-v2.yml |  4 ++--
 .github/workflows/reusable-performance-test-v2.yml   |  6 +++---
 .github/workflows/reusable-performance.yml           |  8 ++++----
 .github/workflows/reusable-php-compatibility.yml     |  2 +-
 .../reusable-phpstan-static-analysis-v1.yml          |  6 +++---
 .github/workflows/reusable-phpunit-tests-v1.yml      |  4 ++--
 .github/workflows/reusable-phpunit-tests-v2.yml      |  4 ++--
 .github/workflows/reusable-phpunit-tests-v3.yml      |  6 +++---
 .../workflows/reusable-test-core-build-process.yml   |  6 +++---
 .../reusable-test-gutenberg-build-process.yml        |  2 +-
 .../reusable-test-local-docker-environment-v1.yml    |  2 +-
 .github/workflows/slack-notifications.yml            | 12 ++++++------
 .github/workflows/test-and-zip-default-themes.yml    | 10 +++++-----
 .github/workflows/test-build-processes.yml           |  2 +-
 .github/workflows/test-coverage.yml                  |  2 +-
 .github/workflows/test-old-branches.yml              |  2 +-
 .github/workflows/upgrade-develop-testing.yml        |  2 +-
 .github/workflows/upgrade-testing.yml                |  2 +-
 .github/workflows/workflow-lint.yml                  |  2 +-
 42 files changed, 77 insertions(+), 77 deletions(-)

diff --git a/.github/workflows/coding-standards.yml b/.github/workflows/coding-standards.yml
index 6f9fc831df92f..195d4ce0883fc 100644
--- a/.github/workflows/coding-standards.yml
+++ b/.github/workflows/coding-standards.yml
@@ -99,7 +99,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/commit-built-file-changes.yml b/.github/workflows/commit-built-file-changes.yml
index f93cd4bd662ec..154048c2b0740 100644
--- a/.github/workflows/commit-built-file-changes.yml
+++ b/.github/workflows/commit-built-file-changes.yml
@@ -43,7 +43,7 @@ jobs:
       contents: write
     steps:
       - name: Download artifact
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const artifacts = await github.rest.actions.listWorkflowRunArtifacts( {
diff --git a/.github/workflows/create-backport-prs.yml b/.github/workflows/create-backport-prs.yml
index 6329761f79ba9..c8ad858b173ac 100644
--- a/.github/workflows/create-backport-prs.yml
+++ b/.github/workflows/create-backport-prs.yml
@@ -317,7 +317,7 @@ jobs:
 
       - name: Upload results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: apply-results-${{ matrix.branch }}
           path: apply-results/
@@ -346,7 +346,7 @@ jobs:
     steps:
       - name: Download apply result
         id: apply-result
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: apply-results-${{ matrix.branch }}
           path: apply-result/
@@ -462,7 +462,7 @@ jobs:
 
       - name: Upload summary row
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: summary-row-${{ matrix.branch }}
           path: summary-row/
@@ -480,7 +480,7 @@ jobs:
     if: always()
     steps:
       - name: Download summary rows
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: summary-row-*
           path: summary-rows/
diff --git a/.github/workflows/end-to-end-tests.yml b/.github/workflows/end-to-end-tests.yml
index b397a2241947e..66c5f44274cb5 100644
--- a/.github/workflows/end-to-end-tests.yml
+++ b/.github/workflows/end-to-end-tests.yml
@@ -105,7 +105,7 @@ jobs:
       )
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/failed-workflow.yml b/.github/workflows/failed-workflow.yml
index 6df8999464a68..288a2a9e0e930 100644
--- a/.github/workflows/failed-workflow.yml
+++ b/.github/workflows/failed-workflow.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Rerun a workflow
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 15
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/install-testing.yml b/.github/workflows/install-testing.yml
index f15d6e4830268..041c4f2fb46f5 100644
--- a/.github/workflows/install-testing.yml
+++ b/.github/workflows/install-testing.yml
@@ -171,7 +171,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/javascript-tests.yml b/.github/workflows/javascript-tests.yml
index 4ebb1fd17b499..df5aab9288c49 100644
--- a/.github/workflows/javascript-tests.yml
+++ b/.github/workflows/javascript-tests.yml
@@ -94,7 +94,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/javascript-type-checking.yml b/.github/workflows/javascript-type-checking.yml
index b8a10da5465bd..4327a815d620c 100644
--- a/.github/workflows/javascript-type-checking.yml
+++ b/.github/workflows/javascript-type-checking.yml
@@ -85,7 +85,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/local-docker-environment.yml b/.github/workflows/local-docker-environment.yml
index c9dbae312595a..b640a8853bf8a 100644
--- a/.github/workflows/local-docker-environment.yml
+++ b/.github/workflows/local-docker-environment.yml
@@ -154,7 +154,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index d9be2c8842ec4..2bdc6efeffb31 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -71,7 +71,7 @@ jobs:
         run: echo "TARGET_SHA=$(git rev-parse HEAD^1)" >> "$GITHUB_ENV"
 
       - name: Set subjects
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: set-subjects
         with:
           script: |
@@ -168,7 +168,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/php-compatibility.yml b/.github/workflows/php-compatibility.yml
index bd81c8958daa6..48c881a3df485 100644
--- a/.github/workflows/php-compatibility.yml
+++ b/.github/workflows/php-compatibility.yml
@@ -83,7 +83,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/phpstan-static-analysis.yml b/.github/workflows/phpstan-static-analysis.yml
index a479e8e371214..e09fbc44ce9c2 100644
--- a/.github/workflows/phpstan-static-analysis.yml
+++ b/.github/workflows/phpstan-static-analysis.yml
@@ -81,7 +81,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/phpunit-tests.yml b/.github/workflows/phpunit-tests.yml
index de36d5a505187..45dfa7ce4d312 100644
--- a/.github/workflows/phpunit-tests.yml
+++ b/.github/workflows/phpunit-tests.yml
@@ -347,7 +347,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/props-bot.yml b/.github/workflows/props-bot.yml
index a8656eb5ce1a9..38acc07113c2c 100644
--- a/.github/workflows/props-bot.yml
+++ b/.github/workflows/props-bot.yml
@@ -76,7 +76,7 @@ jobs:
           format: 'svn'
 
       - name: Remove the props-bot label
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: ${{ github.event.action == 'labeled' && 'props-bot' == github.event.label.name }}
         with:
           retries: 2
diff --git a/.github/workflows/pull-request-comments.yml b/.github/workflows/pull-request-comments.yml
index da30e2feb7f11..ffb1e2f24cc90 100644
--- a/.github/workflows/pull-request-comments.yml
+++ b/.github/workflows/pull-request-comments.yml
@@ -90,7 +90,7 @@ jobs:
       github.event.workflow_run.conclusion == 'success'
     steps:
       - name: Download artifact
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const artifacts = await github.rest.actions.listWorkflowRunArtifacts( {
@@ -124,7 +124,7 @@ jobs:
         run: unzip pr-number.zip
 
       - name: Leave a comment about testing with Playground
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require( 'fs' );
@@ -190,7 +190,7 @@ jobs:
     if: ${{ github.repository == 'WordPress/wordpress-develop' && github.event_name == 'pull_request_target' && ! github.event.pull_request.draft && github.event.pull_request.state == 'open' }}
     steps:
       - name: Check for Trac ticket and manage comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { owner, repo } = context.repo;
diff --git a/.github/workflows/reusable-build-package.yml b/.github/workflows/reusable-build-package.yml
index 320ec1c621335..dda138505e6f0 100644
--- a/.github/workflows/reusable-build-package.yml
+++ b/.github/workflows/reusable-build-package.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -53,7 +53,7 @@ jobs:
         run: zip -q -r develop.zip wordpress/.
 
       - name: Upload ZIP as a GitHub Actions artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wordpress-develop
           path: develop.zip
diff --git a/.github/workflows/reusable-check-built-files.yml b/.github/workflows/reusable-check-built-files.yml
index 11d97639a30fc..92cca9556f2f9 100644
--- a/.github/workflows/reusable-check-built-files.yml
+++ b/.github/workflows/reusable-check-built-files.yml
@@ -42,7 +42,7 @@ jobs:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -103,7 +103,7 @@ jobs:
 
       # Uploads the diff file as an artifact.
       - name: Upload diff file as artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
         with:
           name: pr-built-file-changes
diff --git a/.github/workflows/reusable-cleanup-pull-requests.yml b/.github/workflows/reusable-cleanup-pull-requests.yml
index 9dae63cb213d3..a76b4c6611aa8 100644
--- a/.github/workflows/reusable-cleanup-pull-requests.yml
+++ b/.github/workflows/reusable-cleanup-pull-requests.yml
@@ -46,7 +46,7 @@ jobs:
       - name: Find pull requests
         id: linked-prs
         if: ${{ steps.trac-tickets.outputs.fixed_list != '' && steps.git-svn-id.outputs.svn_revision_number != '' }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fixedList = "${{ steps.trac-tickets.outputs.fixed_list }}".split(' ').filter(Boolean);
@@ -90,7 +90,7 @@ jobs:
 
       - name: Comment and close pull requests
         if: ${{ steps.trac-tickets.outputs.fixed_list != '' && steps.git-svn-id.outputs.svn_revision_number != '' }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const prNumbers = ${{ steps.linked-prs.outputs.result }};
diff --git a/.github/workflows/reusable-coding-standards-javascript.yml b/.github/workflows/reusable-coding-standards-javascript.yml
index 5c9a0c1ec0d03..0bbf7d17aa9ea 100644
--- a/.github/workflows/reusable-coding-standards-javascript.yml
+++ b/.github/workflows/reusable-coding-standards-javascript.yml
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
diff --git a/.github/workflows/reusable-coding-standards-php.yml b/.github/workflows/reusable-coding-standards-php.yml
index 1213ccb6baa6f..0b978706e300f 100644
--- a/.github/workflows/reusable-coding-standards-php.yml
+++ b/.github/workflows/reusable-coding-standards-php.yml
@@ -65,7 +65,7 @@ jobs:
         run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
 
       - name: Cache PHPCS scan cache
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: |
             .cache/phpcs-src.json
diff --git a/.github/workflows/reusable-end-to-end-tests.yml b/.github/workflows/reusable-end-to-end-tests.yml
index 0b2ceec077602..87f90f1b53039 100644
--- a/.github/workflows/reusable-end-to-end-tests.yml
+++ b/.github/workflows/reusable-end-to-end-tests.yml
@@ -82,7 +82,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -145,7 +145,7 @@ jobs:
         run: npm run test:e2e
 
       - name: Archive debug artifacts (screenshots, HTML snapshots)
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: failures-artifacts${{ inputs.LOCAL_SCRIPT_DEBUG && '-SCRIPT_DEBUG' || '' }}-${{ github.run_id }}
diff --git a/.github/workflows/reusable-javascript-tests.yml b/.github/workflows/reusable-javascript-tests.yml
index 6bab6a5287665..00b35490878e1 100644
--- a/.github/workflows/reusable-javascript-tests.yml
+++ b/.github/workflows/reusable-javascript-tests.yml
@@ -41,7 +41,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
diff --git a/.github/workflows/reusable-javascript-type-checking-v1.yml b/.github/workflows/reusable-javascript-type-checking-v1.yml
index 7eab9346f2147..9dabd01e27fa0 100644
--- a/.github/workflows/reusable-javascript-type-checking-v1.yml
+++ b/.github/workflows/reusable-javascript-type-checking-v1.yml
@@ -39,7 +39,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -53,7 +53,7 @@ jobs:
         run: npm ci --ignore-scripts
 
       - name: Cache TypeScript build info
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: |
             *.tsbuildinfo
@@ -65,7 +65,7 @@ jobs:
         run: npm run typecheck:js
 
       - name: "Save result cache"
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         if: ${{ !cancelled() }}
         with:
           path: |
diff --git a/.github/workflows/reusable-performance-report-v2.yml b/.github/workflows/reusable-performance-report-v2.yml
index 1b158bb6813ae..d696937cf0025 100644
--- a/.github/workflows/reusable-performance-report-v2.yml
+++ b/.github/workflows/reusable-performance-report-v2.yml
@@ -62,7 +62,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -86,7 +86,7 @@ jobs:
       - name: Set the base sha
         # Only needed when publishing results.
         if: ${{ inputs.publish }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: base-sha
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/reusable-performance-test-v2.yml b/.github/workflows/reusable-performance-test-v2.yml
index f572060e26d63..f6748c956a9ff 100644
--- a/.github/workflows/reusable-performance-test-v2.yml
+++ b/.github/workflows/reusable-performance-test-v2.yml
@@ -122,7 +122,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -149,7 +149,7 @@ jobs:
 
       - name: Download previous build artifact (target branch or previous commit)
         if: ${{ inputs.subject == 'before' }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: get-previous-build
         with:
           script: |
@@ -255,7 +255,7 @@ jobs:
           TEST_RESULTS_PREFIX: ${{ inputs.subject != 'current' && inputs.subject || '' }}
 
       - name: Archive artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: performance-${{ inputs.multisite && 'multisite' || 'single' }}-${{ inputs.memcached && 'memcached' || 'default' }}-${{ inputs.subject }}
diff --git a/.github/workflows/reusable-performance.yml b/.github/workflows/reusable-performance.yml
index 923b472f609c6..6ad44c3701dae 100644
--- a/.github/workflows/reusable-performance.yml
+++ b/.github/workflows/reusable-performance.yml
@@ -139,7 +139,7 @@ jobs:
         run: echo "TARGET_SHA=$(git rev-parse HEAD^1)" >> "$GITHUB_ENV"
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -229,7 +229,7 @@ jobs:
         run: npm run test:performance
 
       - name: Download previous build artifact (target branch or previous commit)
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: get-previous-build
         with:
           script: |
@@ -309,7 +309,7 @@ jobs:
         run: npm run test:performance
 
       - name: Archive artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: performance-artifacts${{ inputs.multisite && '-multisite' || '' }}${{ inputs.memcached && '-memcached' || '' }}-${{ github.run_id }}
@@ -326,7 +326,7 @@ jobs:
       - name: Set the base sha
         # Only needed when publishing results.
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/trunk' && ! inputs.memcached && ! inputs.multisite }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: base-sha
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/reusable-php-compatibility.yml b/.github/workflows/reusable-php-compatibility.yml
index fee371fbdf7a0..d0e8df9143e65 100644
--- a/.github/workflows/reusable-php-compatibility.yml
+++ b/.github/workflows/reusable-php-compatibility.yml
@@ -63,7 +63,7 @@ jobs:
         run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
 
       - name: Cache PHP compatibility scan cache
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: .cache/phpcompat.json
           key: ${{ runner.os }}-date-${{ steps.get-date.outputs.date }}-php-${{ inputs.php-version }}-phpcompat-cache-${{ hashFiles('**/composer.json', 'phpcompat.xml.dist') }}
diff --git a/.github/workflows/reusable-phpstan-static-analysis-v1.yml b/.github/workflows/reusable-phpstan-static-analysis-v1.yml
index bbf1b78589a8c..c7e8af6b287c7 100644
--- a/.github/workflows/reusable-phpstan-static-analysis-v1.yml
+++ b/.github/workflows/reusable-phpstan-static-analysis-v1.yml
@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -87,7 +87,7 @@ jobs:
         run: npm run build:dev
 
       - name: Cache PHP Static Analysis scan cache
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: .cache # This is defined in the base.neon file.
           key: "phpstan-result-cache-${{ github.run_id }}"
@@ -99,7 +99,7 @@ jobs:
         run: composer run phpstan -- -vvv --error-format=checkstyle | cs2pr --errors-as-warnings --graceful-warnings
 
       - name: "Save result cache"
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         if: ${{ !cancelled() }}
         with:
           path: .cache
diff --git a/.github/workflows/reusable-phpunit-tests-v1.yml b/.github/workflows/reusable-phpunit-tests-v1.yml
index bcb0451d7134b..cd0b026d37bed 100644
--- a/.github/workflows/reusable-phpunit-tests-v1.yml
+++ b/.github/workflows/reusable-phpunit-tests-v1.yml
@@ -103,7 +103,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -121,7 +121,7 @@ jobs:
 
       - name: Cache Composer dependencies
         if: ${{ env.COMPOSER_INSTALL == true }}
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         env:
           cache-name: cache-composer-dependencies
         with:
diff --git a/.github/workflows/reusable-phpunit-tests-v2.yml b/.github/workflows/reusable-phpunit-tests-v2.yml
index 4e7b6716ebef1..fb1f814df8214 100644
--- a/.github/workflows/reusable-phpunit-tests-v2.yml
+++ b/.github/workflows/reusable-phpunit-tests-v2.yml
@@ -105,7 +105,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -118,7 +118,7 @@ jobs:
         run: echo "composer_dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Cache Composer dependencies
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         env:
           cache-name: cache-composer-dependencies
         with:
diff --git a/.github/workflows/reusable-phpunit-tests-v3.yml b/.github/workflows/reusable-phpunit-tests-v3.yml
index da0372f8538be..6796bfdb3252b 100644
--- a/.github/workflows/reusable-phpunit-tests-v3.yml
+++ b/.github/workflows/reusable-phpunit-tests-v3.yml
@@ -137,7 +137,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -237,7 +237,7 @@ jobs:
 
       - name: Upload test coverage report to Codecov
         if: ${{ inputs.coverage-report }}
-        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: wp-code-coverage${{ inputs.multisite && '-multisite' || '-single' }}-${{ github.sha }}.xml
@@ -246,7 +246,7 @@ jobs:
 
       - name: Upload HTML coverage report as artifact
         if: ${{ inputs.coverage-report }}
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wp-code-coverage${{ inputs.multisite && '-multisite' || '-single' }}-${{ github.sha }}
           path: wp-code-coverage${{ inputs.multisite && '-multisite' || '-single' }}-${{ github.sha }}
diff --git a/.github/workflows/reusable-test-core-build-process.yml b/.github/workflows/reusable-test-core-build-process.yml
index fbb6a08b15820..c9ee6457183d0 100644
--- a/.github/workflows/reusable-test-core-build-process.yml
+++ b/.github/workflows/reusable-test-core-build-process.yml
@@ -91,7 +91,7 @@ jobs:
           custom-cache-suffix: ${{ steps.get-date.outputs.date }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -133,7 +133,7 @@ jobs:
         run: git diff --exit-code
 
       - name: Upload ZIP as a GitHub Actions artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ inputs.save-build || inputs.prepare-playground }}
         with:
           name: wordpress-build-${{ github.event_name == 'pull_request' && github.event.number || github.sha }}
@@ -151,7 +151,7 @@ jobs:
       # Uploads the PR number as an artifact for the Pull Request Commenting workflow to download and then
       # leave a comment detailing how to test the PR within WordPress Playground.
       - name: Upload PR number as artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ inputs.prepare-playground && github.repository == 'WordPress/wordpress-develop' && github.event_name == 'pull_request' }}
         with:
           name: pr-number
diff --git a/.github/workflows/reusable-test-gutenberg-build-process.yml b/.github/workflows/reusable-test-gutenberg-build-process.yml
index 6fff07a842bf2..75b64427e78e0 100644
--- a/.github/workflows/reusable-test-gutenberg-build-process.yml
+++ b/.github/workflows/reusable-test-gutenberg-build-process.yml
@@ -63,7 +63,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
diff --git a/.github/workflows/reusable-test-local-docker-environment-v1.yml b/.github/workflows/reusable-test-local-docker-environment-v1.yml
index 9aa0fb124a22e..8c503780adffb 100644
--- a/.github/workflows/reusable-test-local-docker-environment-v1.yml
+++ b/.github/workflows/reusable-test-local-docker-environment-v1.yml
@@ -92,7 +92,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
diff --git a/.github/workflows/slack-notifications.yml b/.github/workflows/slack-notifications.yml
index 3d0dd7c680558..4b5407b4b9baa 100644
--- a/.github/workflows/slack-notifications.yml
+++ b/.github/workflows/slack-notifications.yml
@@ -60,7 +60,7 @@ jobs:
     steps:
       - name: Determine the status of the previous attempt
         id: previous-attempt-result
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
@@ -130,7 +130,7 @@ jobs:
 
       - name: Get the commit message
         id: current-commit-message
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
         with:
           retries: 2
@@ -171,7 +171,7 @@ jobs:
 
     steps:
       - name: Post failure notifications to Slack
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # v3.0.2
         with:
           webhook-type: webhook-trigger
           webhook: ${{ secrets.SLACK_GHA_FAILURE_WEBHOOK }}
@@ -188,7 +188,7 @@ jobs:
 
     steps:
       - name: Post failure notifications to Slack
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # v3.0.2
         with:
           webhook-type: webhook-trigger
           webhook: ${{ secrets.SLACK_GHA_FIXED_WEBHOOK }}
@@ -205,7 +205,7 @@ jobs:
 
     steps:
       - name: Post success notifications to Slack
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # v3.0.2
         with:
           webhook-type: webhook-trigger
           webhook: ${{ secrets.SLACK_GHA_SUCCESS_WEBHOOK }}
@@ -222,7 +222,7 @@ jobs:
 
     steps:
       - name: Post cancelled notifications to Slack
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # v3.0.2
         with:
           webhook-type: webhook-trigger
           webhook: ${{ secrets.SLACK_GHA_CANCELLED_WEBHOOK }}
diff --git a/.github/workflows/test-and-zip-default-themes.yml b/.github/workflows/test-and-zip-default-themes.yml
index 6ea0f7f206809..7f234d304db39 100644
--- a/.github/workflows/test-and-zip-default-themes.yml
+++ b/.github/workflows/test-and-zip-default-themes.yml
@@ -144,7 +144,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -176,7 +176,7 @@ jobs:
 
       # Uploads the diff file as an artifact.
       - name: Upload diff file as artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
         with:
           name: pr-built-file-changes
@@ -229,7 +229,7 @@ jobs:
 
       - name: Set up Node.js for themes needing minification
         if: matrix.theme == 'twentytwentytwo' || matrix.theme == 'twentytwentyfive'
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -246,7 +246,7 @@ jobs:
         working-directory: src/wp-content/themes/${{ matrix.theme }}
 
       - name: Upload theme ZIP as an artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.theme }}
           path: |
@@ -289,7 +289,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/test-build-processes.yml b/.github/workflows/test-build-processes.yml
index 184f85a323993..f52e31177b27c 100644
--- a/.github/workflows/test-build-processes.yml
+++ b/.github/workflows/test-build-processes.yml
@@ -133,7 +133,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/test-coverage.yml b/.github/workflows/test-coverage.yml
index deb190eba9e9b..5fd31558b8255 100644
--- a/.github/workflows/test-coverage.yml
+++ b/.github/workflows/test-coverage.yml
@@ -99,7 +99,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/test-old-branches.yml b/.github/workflows/test-old-branches.yml
index 74f9c2d43d54c..a5a90018a5440 100644
--- a/.github/workflows/test-old-branches.yml
+++ b/.github/workflows/test-old-branches.yml
@@ -126,7 +126,7 @@ jobs:
     # Run all branches monthly, but only the currently supported one twice per month.
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: ${{ github.event_name == 'push' || ( github.event_name == 'workflow_dispatch' && matrix.branch == inputs.strategy || inputs.strategy == 'all' ) || github.event.schedule == '0 0 15 * *' || matrix.branch == env.CURRENTLY_SUPPORTED_BRANCH }}
         with:
           retries: 2
diff --git a/.github/workflows/upgrade-develop-testing.yml b/.github/workflows/upgrade-develop-testing.yml
index 7dfe96271f459..a88b2e7f1941e 100644
--- a/.github/workflows/upgrade-develop-testing.yml
+++ b/.github/workflows/upgrade-develop-testing.yml
@@ -146,7 +146,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/upgrade-testing.yml b/.github/workflows/upgrade-testing.yml
index b8953bad20def..5a9cc8b438118 100644
--- a/.github/workflows/upgrade-testing.yml
+++ b/.github/workflows/upgrade-testing.yml
@@ -225,7 +225,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418
diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
index 0aae098543e21..acb74cf5971c7 100644
--- a/.github/workflows/workflow-lint.yml
+++ b/.github/workflows/workflow-lint.yml
@@ -73,7 +73,7 @@ jobs:
 
     steps:
       - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           retries: 2
           retry-exempt-status-codes: 418