Dependency & Actions audit - 2026-05-11

[krakenhavoc]

GitHub Actions — Node.js 20 runner deprecation ⚠️ Deadline: 2 June 2026

GitHub will enforce Node.js 24 as the default Actions runtime on 2 June 2026 and remove Node.js 20 entirely on 16 September 2026 (announcement). Most workflows have already been migrated to actions/checkout@v6 / actions/setup-node@v6, but several Node.js 20 actions remain.

Workflow(s)	Action	Current	Recommended
sync-openapi-spec.yml	actions/setup-node	@v4 (Node 20)	@v6 (already used in the other workflows in this repo)
test.yaml	actions/upload-artifact	@v4 (Node 20)	@v5 / @v6
backend-docker-publish.yml, frontend-docker-publish.yml	docker/login-action	@v3 (Node 20)	@v4
backend-docker-publish.yml, frontend-docker-publish.yml	docker/setup-buildx-action	@v3 (Node 20)	@v4
backend-docker-publish.yml, frontend-docker-publish.yml	docker/metadata-action	@v5	verify Node 24 support; update if needed
backend-docker-publish.yml, frontend-docker-publish.yml	docker/build-push-action	@v6	verify Node 24 support; update if needed
backend-docker-publish.yml, frontend-docker-publish.yml	peter-evans/repository-dispatch	@v4	verify Node 24 support

After 2 June, any workflow still using a Node.js 20 action will require ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true to keep running.

---

npm dependencies

No packages were found to be more than two major versions behind their latest release across backend/package.json, frontend/package.json, and shared/package.json. typeorm remains on 0.3.x (pre-1.0), consistent with the upstream project's long-standing versioning policy — no action required.

---

Go modules

Not applicable — this is a TypeScript/Node.js project.

---

Terraform providers

Not applicable to this repository.