GitHub Actions Deprecation
.github/workflows/release.yaml pins softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe (= v2.6.1), whose action.yml runs on the Node20 runtime. GitHub defaulted runners to Node24 on June 2, 2026 and will fully remove Node20 support on September 16, 2026 — already past the default-cutover date. Fix: bump to softprops/action-gh-release@v3.0.1 (confirmed Node24), pinned by SHA per this repo's existing convention.
actions/checkout (pinned by SHA to v6.0.2) already runs on Node24 — no action needed; v7.0.0 is the current major if a routine bump is wanted later, but it's not urgent.
This repo's own action.yml declares runs.using: composite (a bash-based action), so it is not itself subject to the Node runtime deprecation.
npm Dependencies
NONE — no package.json in this repo (composite bash action, no bundled JS/TS runtime).
Go Module CVEs
NONE — no go.mod in this repo. Note: the action downloads a separately-released krakenkey/cli Go binary at runtime and checksum-verifies it before executing; that binary's dependency graph is covered by the separate krakenkey/cli audit rather than this repo.
Terraform Providers
NONE — no *.tf files in this repo.
GitHub Actions Deprecation
.github/workflows/release.yamlpinssoftprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe(= v2.6.1), whoseaction.ymlruns on the Node20 runtime. GitHub defaulted runners to Node24 on June 2, 2026 and will fully remove Node20 support on September 16, 2026 — already past the default-cutover date. Fix: bump tosoftprops/action-gh-release@v3.0.1(confirmed Node24), pinned by SHA per this repo's existing convention.actions/checkout(pinned by SHA to v6.0.2) already runs on Node24 — no action needed; v7.0.0 is the current major if a routine bump is wanted later, but it's not urgent.This repo's own
action.ymldeclaresruns.using: composite(a bash-based action), so it is not itself subject to the Node runtime deprecation.npm Dependencies
NONE — no
package.jsonin this repo (composite bash action, no bundled JS/TS runtime).Go Module CVEs
NONE — no
go.modin this repo. Note: the action downloads a separately-releasedkrakenkey/cliGo binary at runtime and checksum-verifies it before executing; that binary's dependency graph is covered by the separatekrakenkey/cliaudit rather than this repo.Terraform Providers
NONE — no
*.tffiles in this repo.