diff --git a/.github/actions/bump/action.yml b/.github/actions/bump/action.yml
index dc8007ce40..af882b1fab 100644
--- a/.github/actions/bump/action.yml
+++ b/.github/actions/bump/action.yml
@@ -25,7 +25,7 @@ runs:
         echo "version=$LATEST" >> $GITHUB_OUTPUT
         echo "message=$MESSAGE" >> $GITHUB_OUTPUT
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v4
+      uses: peter-evans/create-pull-request@v7
       with:
         add-paths: |
           CMakeLists.txt
diff --git a/.github/workflows/update-cares.yml b/.github/workflows/update-cares.yml
index 317af7f623..47b0f77f83 100644
--- a/.github/workflows/update-cares.yml
+++ b/.github/workflows/update-cares.yml
@@ -80,7 +80,7 @@ jobs:
 
       - name: Create Pull Request
         if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: |
diff --git a/.github/workflows/update-hdrhistogram.yml b/.github/workflows/update-hdrhistogram.yml
index 681a82c597..973e69c22b 100644
--- a/.github/workflows/update-hdrhistogram.yml
+++ b/.github/workflows/update-hdrhistogram.yml
@@ -55,7 +55,7 @@ jobs:
             echo "Error: Could not fetch SHA for tag $LATEST_TAG"
             exit 1
           fi
-          
+
           # Try to get commit SHA from tag object (for annotated tags)
           # If it fails, assume it's a lightweight tag pointing directly to commit
           LATEST_SHA=$(curl -sL "https://api.github.com/repos/HdrHistogram/HdrHistogram_c/git/tags/$LATEST_TAG_SHA" 2>/dev/null | jq -r '.object.sha // empty')
@@ -83,7 +83,7 @@ jobs:
 
       - name: Create Pull Request
         if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: |
diff --git a/.github/workflows/update-highway.yml b/.github/workflows/update-highway.yml
index f6b5b40829..79aea6df9d 100644
--- a/.github/workflows/update-highway.yml
+++ b/.github/workflows/update-highway.yml
@@ -58,7 +58,7 @@ jobs:
 
           TAG_OBJECT_SHA=$(echo "$TAG_REF" | jq -r '.object.sha')
           TAG_OBJECT_TYPE=$(echo "$TAG_REF" | jq -r '.object.type')
-          
+
           if [ -z "$TAG_OBJECT_SHA" ] || [ "$TAG_OBJECT_SHA" = "null" ]; then
             echo "Error: Could not fetch SHA for tag $LATEST_TAG"
             exit 1
@@ -99,7 +99,7 @@ jobs:
 
       - name: Create Pull Request
         if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: |
diff --git a/.github/workflows/update-libarchive.yml b/.github/workflows/update-libarchive.yml
index ed7c10b223..226b0ee904 100644
--- a/.github/workflows/update-libarchive.yml
+++ b/.github/workflows/update-libarchive.yml
@@ -80,7 +80,7 @@ jobs:
 
       - name: Create Pull Request
         if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: |
diff --git a/.github/workflows/update-libdeflate.yml b/.github/workflows/update-libdeflate.yml
index 95d86ecf0c..82b82414b3 100644
--- a/.github/workflows/update-libdeflate.yml
+++ b/.github/workflows/update-libdeflate.yml
@@ -80,7 +80,7 @@ jobs:
 
       - name: Create Pull Request
         if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: |
diff --git a/.github/workflows/update-lolhtml.yml b/.github/workflows/update-lolhtml.yml
index f2e3850ec6..bfff32ceff 100644
--- a/.github/workflows/update-lolhtml.yml
+++ b/.github/workflows/update-lolhtml.yml
@@ -55,12 +55,12 @@ jobs:
           TAG_REF_RESPONSE=$(curl -sL "https://api.github.com/repos/cloudflare/lol-html/git/refs/tags/$LATEST_TAG")
           LATEST_TAG_SHA=$(echo "$TAG_REF_RESPONSE" | jq -r '.object.sha')
           TAG_OBJECT_TYPE=$(echo "$TAG_REF_RESPONSE" | jq -r '.object.type')
-          
+
           if [ -z "$LATEST_TAG_SHA" ] || [ "$LATEST_TAG_SHA" = "null" ]; then
             echo "Error: Could not fetch SHA for tag $LATEST_TAG"
             exit 1
           fi
-          
+
           if [ "$TAG_OBJECT_TYPE" = "tag" ]; then
             # This is an annotated tag, we need to get the commit it points to
             LATEST_SHA=$(curl -sL "https://api.github.com/repos/cloudflare/lol-html/git/tags/$LATEST_TAG_SHA" | jq -r '.object.sha')
@@ -92,7 +92,7 @@ jobs:
 
       - name: Create Pull Request
         if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: |
diff --git a/.github/workflows/update-lshpack.yml b/.github/workflows/update-lshpack.yml
index 78e2d0001e..067bc343e0 100644
--- a/.github/workflows/update-lshpack.yml
+++ b/.github/workflows/update-lshpack.yml
@@ -59,7 +59,7 @@ jobs:
 
           LATEST_TAG_SHA=$(echo "$TAG_REF" | jq -r '.object.sha')
           TAG_TYPE=$(echo "$TAG_REF" | jq -r '.object.type')
-          
+
           if [ -z "$LATEST_TAG_SHA" ] || [ "$LATEST_TAG_SHA" = "null" ]; then
             echo "Error: Could not fetch SHA for tag $LATEST_TAG"
             exit 1
@@ -97,7 +97,7 @@ jobs:
 
       - name: Create Pull Request
         if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: |
diff --git a/.github/workflows/update-sqlite3.yml b/.github/workflows/update-sqlite3.yml
index 517eaeb5bb..6ee8115f7c 100644
--- a/.github/workflows/update-sqlite3.yml
+++ b/.github/workflows/update-sqlite3.yml
@@ -91,7 +91,7 @@ jobs:
 
       - name: Create Pull Request
         if: success() && steps.check-version.outputs.current_num < steps.check-version.outputs.latest_num
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: |
diff --git a/.github/workflows/update-vendor.yml b/.github/workflows/update-vendor.yml
new file mode 100644
index 0000000000..7e1ad4ec21
--- /dev/null
+++ b/.github/workflows/update-vendor.yml
@@ -0,0 +1,79 @@
+name: Update vendor
+
+on:
+  schedule:
+    - cron: "0 4 * * 0"
+  workflow_dispatch:
+
+jobs:
+  check-update:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    strategy:
+      matrix:
+        package:
+          - elysia
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Check version
+        id: check-version
+        run: |
+          set -euo pipefail
+
+          # Extract the commit hash from the line after COMMIT
+          current=$(bun -p '(await Bun.file("test/vendor.json").json()).filter(v=>v.package===process.argv[1])[0].tag' ${{ matrix.package }})
+          repository=$(bun -p '(await Bun.file("test/vendor.json").json()).filter(v=>v.package===process.argv[1])[0].repository' ${{ matrix.package }} | cut -d'/' -f4,5)
+
+          if [ -z "$current" ]; then
+            echo "Error: Could not find COMMIT line in test/vendor.json"
+            exit 1
+          fi
+
+          echo "current=$current" >> $GITHUB_OUTPUT
+          echo "repository=$repository" >> $GITHUB_OUTPUT
+
+          LATEST_RELEASE=$(curl -sL https://api.github.com/repos/${repository}/releases/latest)
+          if [ -z "$LATEST_RELEASE" ]; then
+            echo "Error: Failed to fetch latest release from GitHub API"
+            exit 1
+          fi
+
+          LATEST_TAG=$(echo "$LATEST_RELEASE" | jq -r '.tag_name')
+          if [ -z "$LATEST_TAG" ] || [ "$LATEST_TAG" = "null" ]; then
+            echo "Error: Could not extract tag name from GitHub API response"
+            exit 1
+          fi
+
+          echo "latest=$LATEST_TAG" >> $GITHUB_OUTPUT
+
+      - name: Update version if needed
+        if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
+        run: |
+          set -euo pipefail
+          bun -e 'await Bun.write("test/vendor.json", JSON.stringify((await Bun.file("test/vendor.json").json()).map(v=>{if(v.package===process.argv[1])v.tag=process.argv[2];return v;}), null, 2) + "\n")' ${{ matrix.package }} ${{ steps.check-version.outputs.latest }}
+
+      - name: Create Pull Request
+        if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          add-paths: |
+            test/vendor.json
+          commit-message: "deps: update ${{ matrix.package }} to ${{ steps.check-version.outputs.latest }} (${{ steps.check-version.outputs.latest }})"
+          title: "deps: update ${{ matrix.package }} to ${{ steps.check-version.outputs.latest }}"
+          delete-branch: true
+          branch: deps/update-${{ matrix.package }}-${{ github.run_number }}
+          body: |
+            ## What does this PR do?
+
+            Updates ${{ matrix.package }} to version ${{ steps.check-version.outputs.latest }}
+
+            Compare: https://github.com/${{ steps.check-version.outputs.repository }}/compare/${{ steps.check-version.outputs.current }}...${{ steps.check-version.outputs.latest }}
+
+            Auto-updated by [this workflow](https://github.com/oven-sh/bun/actions/workflows/update-vendor.yml)
diff --git a/.github/workflows/update-zstd.yml b/.github/workflows/update-zstd.yml
index 6787eed141..037374f6d9 100644
--- a/.github/workflows/update-zstd.yml
+++ b/.github/workflows/update-zstd.yml
@@ -80,7 +80,7 @@ jobs:
 
       - name: Create Pull Request
         if: success() && steps.check-version.outputs.current != steps.check-version.outputs.latest
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: |