build(deps-dev): bump @semantic-release/github from 11.0.6 to 12.0.9

[dependabot]

Bumps @semantic-release/github from 11.0.6 to 12.0.9.

Release notes

Sourced from @​semantic-release/github's releases.

v12.0.9

12.0.9 (2026-07-01)

Bug Fixes

• asset-upload: stop setting content-length header manually (241f966), closes #1224
• local-undici: always use the locally installed undici instead of the node built-in version (40973e3), closes #1224
• publish: handle content-length header properly for asset uploads (#1260) (28e3741), closes #1224 #1224

v12.0.8

12.0.8 (2026-05-08)

Bug Fixes

• deps: update dependency http-proxy-agent to v9 (#1203) (edd1652)

v12.0.7

12.0.7 (2026-05-08)

Bug Fixes

• deps: update dependency https-proxy-agent to v9 (#1204) (1f17362)

v12.0.6

12.0.6 (2026-02-12)

Bug Fixes

• latest: add make_latest property to the GH release PATCH request during publish (#1169) (f516337)

v12.0.5

12.0.5 (2026-02-07)

Bug Fixes

• latest: add make_latest property to the GH release POST request during publish (#1157) (38051ba)

v12.0.4

12.0.4 (2026-02-06)

Bug Fixes

• remove failTitle arg in findSRIssues call (#1164) (f7bdd88)

... (truncated)

Commits

• 28e3741 fix(publish): handle content-length header properly for asset uploads (#1260)
• 241f966 fix(asset-upload): stop setting content-length header manually
• 40973e3 fix(local-undici): always use the locally installed undici instead of the nod...
• 8879ae4 chore(deps): update dependency prettier to v3.9.1 (#1259)
• bf720e2 chore(deps): update dependency prettier to v3.9.0 (#1258)
• b34e0ec chore(deps): update dependency prettier to v3.8.5 (#1257)
• b445fa0 chore(deps): update dependency ls-engines to v0.10.1 (#1256)
• 4ca0ef4 chore(deps): lock file maintenance (#1255)
• bb9fdb3 chore(deps): update dependency undici to v7.28.0 [security] (#1254)
• 059c6ce ci(action): update actions/checkout action to v7 (#1252)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/github since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Single Commit Policy — COMPLIANT

Status: 1 commit | Valid format | No merge commits | Ready for merge

Commit details

• Hash: 4d9f75b50117ed72fdae0cd45ac8b05da209f2f5
• Message: build(deps-dev): bump @semantic-release/github from 11.0.6 to 12.0.9
• Author: dependabot[bot]

---

Automated validation — dopamine single-commit enforcement

[murdore]

Reviewed. This is a devDependency-only bump (@semantic-release/github 11.0.6 → 12.0.9) — zero runtime impact on the app itself.

Given this repo's own confirmed-pattern history of routine-looking dependency bumps breaking things CI doesn't catch (PR #21's Express 5 bump crashing server boot, PR #45's yama-action v3.0.0 bump breaking config parsing — both green on CI, both never actually exercised the changed code path), I checked the one thing that matters for a major bump like this:

• Upstream's only functional breaking changes in v12.0.0 (per semantic-release/github's own release notes) are (1) raising the minimum Node engine to ^22.14.0 || >=24.10.0, and (2) dropping internal use of the GitHub Search API — no behavior change for this repo's plugin config (no custom github-plugin options in .releaserc.json).
• ci.yml/release.yml pin Node via actions/setup-node with node-version: "24", which resolves to the latest 24.x — currently v24.18.1, comfortably above the v24.10.0 floor. Engine requirement is satisfied.
• Worth knowing, non-blocking: the semantic-release-validation CI job explicitly overrides --plugins to only @semantic-release/commit-analyzer + @semantic-release/release-notes-generator, so it never actually dry-runs @semantic-release/github itself. The only place this package's code executes is the real npx semantic-release step in release.yml, which only runs post-merge on push to main. So this PR's green CI confirms the engine requirement and build/typecheck, but doesn't prove the plugin runs cleanly — that's only provable at the next real release.

No blockers from me — approvable.