DeterminateSystems/update-flake-lock (github-action) v28 -> v29

Risk: 🟢 Safe

The Deep Dive

Update Scope

Bumps the SHA-pinned DeterminateSystems/update-flake-lock action in .github/workflows/update-flake-lock.yaml from v28 (834c491) to v29 (da03c0f), 116 upstream commits. It is a composite action, so the bump also moves its pinned sub-actions: peter-evans/create-pull-request v7.0.9 → v8.1.1, crazy-max/ghaction-import-gpg v6.3.0 → v7.0.0, and juliangruber/read-file-action v1.1.7 → v1.1.8. Its bundled JS moves from git-sourced detsys-ts to @determinate-systems/detsys-ts 2.1.3 from npm, @actions/core 1.11.1 → 3.0.1, and undici 5.29.0 → 6.28.1. Nothing else in the workflow changes: actions/checkout v7, cachix/install-nix-action v31, the inputs passed (token, pr-title, pr-body) and the ubuntu-latest runner all stay the same. The "major" label is just upstream's tag numbering; no inputs or outputs were removed or renamed.

Performance & Stability

• Retries on GitHub API errors when the PR is opened: create-pull-request v8.1.0 added @octokit/plugin-retry for retriable server errors, and v8.1.1 retries 422 eventual-consistency errors on the calls made after the PR is created. This workflow uses the pull-request-number output right away to label and auto-merge the PR, so a flaky API response is now less likely to fail the weekly run.
• Remote-prune limited to self-hosted runners: v7.0.11 and v8.1.0 stop running remote prune on GitHub-hosted runners. This workflow runs on ubuntu-latest, so that step is now skipped there.

Features & UX

• New push-to-fork input: PR #268 lets the action push the PR branch to a fork and open the PR against the parent repo. It is opt-in and nothing turns it on automatically. The workflow passes only token, pr-title and pr-body, so it is unused here, and nothing calls for it in a single-owner dotfiles repo.
• Telemetry moves to OpenTelemetry: PR #307 and PR #319 wrap the update in a withSpan trace and record the exit code as a span attribute instead of a PostHog execution_failure event. This is on by default, and the trade-offs are covered under Hazards.

Security

v29 fixes many bundled-dependency advisories and introduces none. I ran the npm bulk-advisory API against the full runtime dependency tree of each version: 95 packages from v28's pnpm-lock.yaml and 97 non-dev packages from v29's package-lock.json, including @actions/core, @actions/http-client, @determinate-systems/detsys-ts and every @opentelemetry/* package.

• Fixed by v29 (affect v28's bundle):
  • undici 5.29.0 → 6.28.1 clears 13 advisories, including GHSA-vxpw-j846-p89q (high), GHSA-vrm6-8vpv-qv8q (high), GHSA-v9p9-hfj2-hcw8 (high), GHSA-2mjp-6q6p-2qxm (smuggling) and GHSA-r53p-7pc4-xj5r.
  • fast-xml-parser 5.2.5 → 5.11.1 clears GHSA-m7jm-9gc2-mpf2 (critical) and six others.
  • minimatch 3.1.2 → 3.1.5 clears GHSA-3ppc-4f35-3m26 and two other ReDoS advisories.
  • @fastify/busboy, form-data and uuid drop out of the tree, which removes GHSA-x8mw-p69m-v3mx, GHSA-hmw2-7cc7-3qxx and GHSA-w5hq-g745-h8pq.
  • Upstream did this in PR #262 ("Fix vulnerability and switch to npm") and PR #308 (brace-expansion 2.1.4 override). Both change package.json, package-lock.json and dist/index.js, so the fixes reach the shipped runtime bundle, not just dev tooling.
• Present in both versions (not introduced):
  • http-cache-semantics 4.2.0 (GHSA-ch52-4w7c-c8xp).
  • brace-expansion (GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr). These affect v28's 1.1.12 (ranges < 1.1.19/1.1.20/1.1.21) and v29's 2.1.4 (ranges < 2.1.5/2.1.6/2.1.7). v29 drops four other brace-expansion advisories that only hit 1.1.12 (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895, GHSA-f886-m6hf-6m8v, GHSA-3jxr-9vmj-r5cp).
• Reachability: v29's dist/index.js has no new WebSocket, WebSocketStream, RetryAgent, .compose( or interceptors.retry/cache/dump calls. undici's setCookie/getSetCookies appear only in undici's own fetch-Headers module and its exports. The action makes outbound HTTPS calls to GitHub and Determinate endpoints from a short-lived, GitHub-hosted job. The fixes reduce risk, and nothing new is opened.
• The repo has no published security advisories of its own.

Newer Versions

v29 (published 2026-09-09) is the newest tag in the release list. main is 3 commits ahead: a flake.lock refresh and detsys-ts 2.1.4, which only bumps CI and dev dependencies. Nothing newer fixes a regression or advisory introduced in v29, and no issues have been filed upstream since the release.

Hazards & Risks

Nothing here requires a change before merging. The major tag doesn't remove or rename any of the action's inputs or outputs. Each bumped component's documented breaking changes are covered below.

Inventory of documented breaks:

• create-pull-request v7 → v8 (updating guide): the only documented behaviour change is the Node 24 runtime, which needs runner v2.327.1 or later. This job runs on GitHub-hosted ubuntu-latest, so it's unaffected.
• ghaction-import-gpg v6.3.0 → v7.0.0 (release): Node 24 by default, needs runner v2.327.1 or later, switches to ESM, and bumps @actions/core and @actions/exec to 3.x and openpgp to 6.3.0. The step only runs when sign-commits == 'true', and this workflow doesn't set it, so the step is skipped.
• @actions/core 1.11.1 → 3.0.1 (RELEASES.md): 2.0.0 adds Node 24 support and http-client 3, and 3.0.0 is ESM-only. This doesn't matter here: ncc bundles it into dist/index.js, and that bundle was already ESM in v28. Both v28 and v29 start with import { createRequire } from "module", and both package.json files declare "type": "module".
• undici 5.29.0 → 6.28.1 (v6.0.0 release): the documented break is dropping Node 16. The action runs node dist/index.js with the runner's system Node, which the ubuntu-24.04 image readme lists as Node.js 22.23.3. That meets the requirement.
• Build tooling pnpm → npm (PR #262, PR #312): this only changes how upstream builds and locks dependencies. The workflow consumes the prebuilt dist/, so nothing changes for it.

New telemetry destination and payload: detsys-ts 2.x (via #307) exports OTLP traces and logs to https://otel.determinate.systems. v28 sent IDS/PostHog diagnostic events to install.determinate.systems.

• Sent by default in both versions: the vendor is the same. The workflow doesn't opt out before or after this PR: it sets no OTEL_SDK_DISABLED, diagnostic-endpoint or OTEL_EXPORTER_OTLP_ENDPOINT.
• What v29 exports: the action's code makes three log.* calls.
  • log.debug(JSON.stringify({options, inputs, message, args})). detsys-ts documents debug messages as "always exported to OpenTelemetry". The workflow doesn't set nix-options, inputs or commit-msg, so this is options: [], inputs: [], message: "flake.lock: Update" (the action.yml default), and the matching nix flake update args.
  • log.info("flake.lock file was successfully updated").
  • log.setFailed("non-zero exit code ...") on failure.
  • On top of that, the update_flake_lock span with detsys.exit_code, plus detsys-ts's standard run attributes: event name, action repository, nix version, arch, and hashed correlation IDs.
  • pr-title, pr-body and token are never passed to any log.* call. None of the exported values is secret.
• Scope: the OTLP variables live in the action's own process env, and its nix child process inherits them. They aren't written to GITHUB_ENV, so later steps don't see them. To opt out, set OTEL_SDK_DISABLED: true on the step.

Sources

• update-flake-lock v29 release
• update-flake-lock v28...v29 compare (pinned SHAs)
• update-flake-lock PR #268 (push-to-fork)
• update-flake-lock PR #307 (OpenTelemetry)
• update-flake-lock v29...main compare
• create-pull-request v7→v8 updating guide
• create-pull-request v8.1.1 release
• create-pull-request v8.1.0 release
• GitHub advisory database: undici
• ghaction-import-gpg v7.0.0 release
• @actions/core RELEASES.md
• undici v6.0.0 release
• update-flake-lock PR #262
• update-flake-lock PR #308
• ubuntu-24.04 runner image readme

🟢 Verdict: Safe

I'm rating this safe: no input or output changes, GitHub-hosted runners cover the Node 24 and runtime-break requirements, and the npm advisory lookups show v29 fixes many bundled-dependency advisories (one critical) while introducing none. The only behaviour change is that default telemetry now goes to an OpenTelemetry collector, and it carries nothing secret for this workflow.