Dependency & Actions audit - 2026-08-17

[krakenhavoc]

GitHub Actions Deprecation

.github/workflows/release.yaml line 57 pins softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe (= v2.6.1), which runs on the Node20 runtime (verified via the action's action.yml at that pinned SHA: runs.using: node20). GitHub defaulted hosted runners to Node24 on June 16, 2026, and will fully remove Node20 support on September 16, 2026 — about 4 weeks from today. Once that happens, this step will fail outright.

• Fix: bump to softprops/action-gh-release@v3.0.0 or later (v3.0.2 is current latest; confirmed runs.using: node24), pinned by SHA per this repo's existing convention.

.github/workflows/test.yaml and .github/workflows/release.yaml also pin actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd (= v6.0.2), which already runs on Node24 (verified) — no runtime action needed, though v7.0.1 is the current latest release if staying current is desired.

The repo's own root action.yml declares runs.using: composite (bash-based via entrypoint.sh), so it is not itself subject to the Node runtime deprecation.

Note: This is the same softprops/action-gh-release Node20 finding raised previously in #18 (2026-07-06) and #20 (2026-07-27) and remains unresolved. With the September 16, 2026 hard-removal date now roughly 4 weeks away, this should be prioritized before the next audit cycle.

npm Dependencies

NONE — no package.json anywhere in the repo (composite bash action, no bundled JS/TS runtime).

Go Module CVEs

NONE — no go.mod in this repo. The action downloads a separately-released krakenkey/cli Go binary at runtime (SHA-256 checksum-verified against a published checksums file before execution); that binary's own dependency graph is out of scope for this repo's audit.

Terraform Providers

NONE — no *.tf files in this repo.