GitHub Actions Deprecation
.github/workflows/release.yaml pins softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe (= v2.6.1), which runs on the Node20 runtime. GitHub defaulted runners to Node24 on June 16, 2026 and will fully remove Node20 support on September 16, 2026 — already past the default-cutover date. Fix: bump to softprops/action-gh-release@v3.0.0+ (confirmed Node24), pinned by SHA per this repo's existing convention.
actions/checkout (SHA-pinned to v6.0.2) already runs on Node24 — no action needed.
The repo's own action.yml declares runs.using: composite (bash-based), so it is not itself subject to the Node runtime deprecation.
npm Dependencies
NONE — no package.json in this repo (composite bash action, no bundled JS/TS runtime).
Go Module CVEs
NONE — no go.mod in this repo. Note: the action downloads a separately-released krakenkey/cli Go binary at runtime (checksum-verified before execution); that binary's Go dependency graph is covered by the separate krakenkey/cli audit, which found no known CVEs as of today.
Terraform Providers
NONE — no *.tf files in this repo.
Note: this is the same softprops/action-gh-release Node20 finding raised in #18 (2026-07-06) — unresolved three weeks later, with the September 16 removal deadline now roughly 7 weeks away.
GitHub Actions Deprecation
.github/workflows/release.yamlpinssoftprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe(= v2.6.1), which runs on the Node20 runtime. GitHub defaulted runners to Node24 on June 16, 2026 and will fully remove Node20 support on September 16, 2026 — already past the default-cutover date. Fix: bump tosoftprops/action-gh-release@v3.0.0+ (confirmed Node24), pinned by SHA per this repo's existing convention.actions/checkout(SHA-pinned to v6.0.2) already runs on Node24 — no action needed.The repo's own
action.ymldeclaresruns.using: composite(bash-based), so it is not itself subject to the Node runtime deprecation.npm Dependencies
NONE — no
package.jsonin this repo (composite bash action, no bundled JS/TS runtime).Go Module CVEs
NONE — no
go.modin this repo. Note: the action downloads a separately-releasedkrakenkey/cliGo binary at runtime (checksum-verified before execution); that binary's Go dependency graph is covered by the separatekrakenkey/cliaudit, which found no known CVEs as of today.Terraform Providers
NONE — no
*.tffiles in this repo.Note: this is the same
softprops/action-gh-releaseNode20 finding raised in #18 (2026-07-06) — unresolved three weeks later, with the September 16 removal deadline now roughly 7 weeks away.