chore(deps): bump NexusPHP/carson in /

[dependabot]

Bumps NexusPHP/carson in / from 1.7.0 to 1.8.0.

Updates NexusPHP/carson from 1.7.0 to 1.8.0

Release notes

Sourced from NexusPHP/carson's releases.

v1.8.0

What's Changed

Added

• The README and the installer page explain the Actions policy that public repositories need from November 2, 2026, when GitHub starts blocking pull_request_target by default. The installer offers the policy as a file to import.

Changed

• template-enforcer resolves its comment when the description is fixed, alongside removing the label. If the item breaks again, it posts a fresh comment listing the current violations instead of only re-adding the label.

Fixed

• Re-running a workflow no longer posts a second comment from welcome, thanks, read-only, or draft-policy. welcome now looks for an earlier greeting on every event, not only on ready_for_review, and thanks does the same. read-only and draft-policy skip a comment when their notice is newer than the event, so a reopened item still gets a fresh one.
• template-enforcer no longer comments on or labels an issue or pull request that is edited after being closed.
• triage-labeler no longer relabels a closed or merged pull request when a review arrives after it closed.
• stale no longer removes the stale label or collapses its notice when someone comments on an item after it was closed.

Contributors

• @​dependabot

Full Changelog: NexusPHP/carson@v1.7.0...v1.8.0

Changelog

Sourced from NexusPHP/carson's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

v1.8.0 - 2026-10-13

Added

• The README and the installer page explain the Actions policy that public repositories need from November 2, 2026, when GitHub starts blocking pull_request_target by default. The installer offers the policy as a file to import.

Changed

• template-enforcer resolves its comment when the description is fixed, alongside removing the label. If the item breaks again, it posts a fresh comment listing the current violations instead of only re-adding the label.

Fixed

• Re-running a workflow no longer posts a second comment from welcome, thanks, read-only, or draft-policy. welcome now looks for an earlier greeting on every event, not only on ready_for_review, and thanks does the same. read-only and draft-policy skip a comment when their notice is newer than the event, so a reopened item still gets a fresh one.
• template-enforcer no longer comments on or labels an issue or pull request that is edited after being closed.
• triage-labeler no longer relabels a closed or merged pull request when a review arrives after it closed.
• stale no longer removes the stale label or collapses its notice when someone comments on an item after it was closed.

v1.7.0 - 2026-09-21

Added

• no-response-closer gains unlabel_on_response: when the item's author comments, pushes to the pull request, or replies in a review thread, the rule's label is removed, so an answered item is no longer closed for lack of a response. Off by default, set per rule or at the top level. Needs auto-labeler enabled.
• triage-labeler gains sweep: when enabled, every open pull request is reconciled on the scheduled run, so a label missed by a cancelled run or by a review on a fork pull request is corrected within a day. It writes only where the label is wrong. Off by default.
• An Actions section in SUBSCRIBERS.md lists each cross-subscriber action, its owner, who requests it, and which subscribers label directly.

Fixed

• Review events on a pull request from a fork no longer produce a failed run. GitHub passes no secrets to pull_request_review and pull_request_review_comment there, so Carson could not authenticate and failed on the missing app_id. It now ends the run successfully with a notice. Empty credentials in any other situation still fail. The README and the no-response-closer, stale, and triage-labeler sections say what this means for fork pull requests.
• stale, template-enforcer, triage-labeler, and auto-labeler's sync no longer fail the run when the label they are removing is already gone, for example removed by a maintainer in the same moment.

v1.6.0 - 2026-09-19

Added

• no-response-closer gains rules: several labels, each with its own days_until_close, close_message, exempt_labels, and an only scope for issues or pull requests. The top-level keys act as defaults, and a configuration without rules behaves as before.
• no-response-closer exposes {{label}} to close_message.
• welcome accepts false for pull_request and issue in either bucket to switch that greeting off, and false for a whole bucket. An empty message, which used to post an empty comment, now does the same.
• welcome gains exempt_roles: authors whose repository role is listed are never greeted.

Changed

... (truncated)

Commits

• 53c45cf Prepare changelog for v1.8.0
• af843c1 [npm] Bump nock (#59)
• 2bafba3 Ignore activity on closed items in stale
• 4077584 Skip closed pull requests in triage-labeler
• 77fa35e [npm] Bump @​types/node from 26.6.3 to 26.6.4 (#60)
• 161fd45 [npm] Bump the eslint group with 2 updates (#58)
• 7123995 [actions] Bump actions/setup-node from 7.0.0 to 7.1.0 (#57)
• cbe9576 Skip closed items in template-enforcer
• 2a874cd [npm] Bump fast-copy from 4.0.4 to 4.1.2 (#55)
• 82e32c1 [npm] Bump source-map-js from 1.2.1 to 1.2.2 (#56)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions