Upgrade to Node 24

[benjyw]

Node 20 actions are deprecated and GHA will
refuse to run them in a few months.

This change:

• upgrades the action to Node 24
• upgrades actions it uses to versions on Node 24
• modifies how upload-artifact is used, as required
  by a breaking change to that action.

[CLAassistant]

All committers have signed the CLA.

[benjyw]

Note that the markdown link check fails on a URL that exists, likely because npmjs.com have switched to stricter Cloudflare bot detection. I leave it to the maintainers to decide how to handle this.

[jonasdedden]

Hey @benjyw, any update on this? :) setup-protoc will fail in less than a month, how can we proceed?

[benjyw]

Hey @benjyw, any update on this? :) setup-protoc will fail in less than a month, how can we proceed?

I think this is up to @per1234 or someone else with write access in this repo. I have signed the CLA and the status badge finally shows this. The markdown link check is failing erroneously.

For now you can fork the repo and reference your own branch on your fork? I don't want to guarantee that use benjyw/setup-protoc@fa4f90f will be around forever...

[rdamazio]

It's looking like this repo is dead? 😦

[StackOverflowExcept1on]

Hey @benjyw, it's still warns about old deps:

Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-node@v4, arduino/setup-task@v1, xt0rted/markdownlint-problem-matcher@v1. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[StackOverflowExcept1on]

Actual fix: https://github.com/StackOverflowExcept1on/setup-protoc/tree/node24

      # TODO: swicth back to `arduino/setup-protoc@v3` after it supports Node 24
      - name: Install Protoc
        uses: StackOverflowExcept1on/setup-protoc@node24
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

[rdamazio]

    uses: StackOverflowExcept1on/setup-protoc@node24

I don't know about others, but I'm immediately hesitant to adopt an action from a user that owns repo StackOverflowExcept1on/how-to-hack-github-actions and takes in my repo token :)

[rdamazio]

I checked the delta from the original arduino repo and it seems fine so far, but I'd recommend at least something like this instead to make sure that continues to be the case:

      # TODO: swicth back to `arduino/setup-protoc@v3` after it supports Node 24
      - name: Install Protoc
        uses: StackOverflowExcept1on/setup-protoc@f5f2b9afbd3d14a13caf3e0b4f6c109ed8f3e89c
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

(@StackOverflowExcept1on for similar reasons you may want to consider hardcoding the hash for anthonyafgx/setup-task@chore/bump-node24 used in your repo)

[StackOverflowExcept1on]

@rdamazio ok, make sense!

[StackOverflowExcept1on]

Now with improved security (pin commit hash for here and for dependencies): https://github.com/StackOverflowExcept1on/setup-protoc/tree/node24. We use it at https://github.com/gear-tech/builds.

      # TODO: swicth back to `arduino/setup-protoc@v3` after it supports Node 24
      - name: Install Protoc
        uses: StackOverflowExcept1on/setup-protoc@3c8638272249639ffb4bc8571caff93ee0383579
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

[StackOverflowExcept1on]

It would also be nice to fix this in my fork, but I don't know how yet.

(node:2269) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
(Use `node --trace-deprecation ...` to show where the warning was created)

[houseme]

rustfs/setup-protoc@v3.0.1