Bump actions/stale from 10.2.0 to 10.3.0

[dependabot]

Bumps actions/stale from 10.2.0 to 10.3.0.

Release notes

Sourced from actions/stale's releases.

v10.3.0

What's Changed

Bug Fix

• Enhancement: ignore stale labeling events by @​shamoon in actions/stale#1311

Dependency Updates

• Upgrade dependencies (@​actions/core, @​octokit/plugin-retry, @​typescript-eslint) by @​Copilot in actions/stale#1335

New Contributors

• @​shamoon made their first contribution in actions/stale#1311

Full Changelog: actions/stale@v10...v10.3.0

Commits

• eb5cf3a chore: upgrade dependencies and bump version to 10.3.0 (#1335)
• db5d06a Enhancement: ignore stale labeling events (#1311)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[kusari-inspector]

Kusari Analysis Results:

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

The code analysis identified a high-severity supply chain security risk in .github/workflows/stale.yml: the workflow references actions/stale@v10.3.0 using a mutable tag instead of a pinned commit SHA. This means if the upstream tag is moved or the repository is compromised, malicious code could execute silently in CI. The risk is amplified because the action holds write permissions to issues and pull requests, increasing the blast radius of any compromise. For an OpenSSF repository, which should model exemplary supply chain security practices, this is particularly inconsistent. No dependency vulnerabilities were identified. Action required: replace actions/stale@v10.3.0 with the corresponding immutable commit SHA (e.g., actions/stale@<full-commit-sha>) to eliminate the mutable reference risk before merging.

Note

View full detailed analysis result for more information on the output and the checks that were run.

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 4075c1a, performed at: 2026-05-25T12:46:24Z

Found this helpful? Give it a 👍 or 👎 reaction!