Dependency & Actions audit - 2026-05-11

[krakenhavoc]

GitHub Actions — Node.js 20 runner deprecation ⚠️ Deadline: 2 June 2026

GitHub will enforce Node.js 24 as the default Actions runtime on 2 June 2026 and remove Node.js 20 entirely on 16 September 2026 (announcement). ci.yaml has already been migrated to actions/checkout@v6 and actions/setup-go@v6 (both confirmed on Node.js 24). However, release.yaml still references older Docker and GoReleaser actions.

Workflow	Action	Current	Recommended
release.yaml	docker/login-action	@v3 (Node 20)	@v4
release.yaml	docker/setup-buildx-action	@v3 (Node 20)	@v4
release.yaml	docker/setup-qemu-action	@v3 (Node 20)	@v4
release.yaml	goreleaser/goreleaser-action	@v6	verify Node 24 support; check for v7+

After 2 June, the release pipeline will require ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true to keep running until these are updated.

---

Go modules

go.mod and CI both target Go 1.26, the current supported release — no action required.

Direct dependencies (gopkg.in/yaml.v3 v3.0.1, github.com/spf13/pflag v1.0.10) have no known CVEs at their pinned versions.

---

npm dependencies / Terraform providers

Not applicable to this repository.