Dependency & Actions audit - 2026-08-17

[krakenhavoc]

GitHub Actions Deprecation

Every third-party action referenced in this repo's workflows is still pinned to a major version whose current release runs on the Node20 runtime. GitHub switched hosted runners to execute actions with Node24 by default on June 16, 2026, and will fully remove Node20 support on September 16, 2026 — about 4 weeks from this audit. Steps using actions that haven't shipped a Node24-compatible release under a newer major tag by then will fail.

Verified by fetching each action's action.yml at the pinned ref (runs.using) and comparing against each project's current latest release.

File	Line	Action	Current pin	Runtime at pin	Latest release	Runtime at latest
.github/workflows/ci.yaml	17, 29, 48	actions/checkout	@v4	node20	v7.0.1	node24
.github/workflows/docker-publish.yaml	31, 50	actions/checkout	@v4	node20	v7.0.1	node24
.github/workflows/release.yaml	17	actions/checkout	@v4	node20	v7.0.1	node24
.github/workflows/ci.yaml	18, 30, 49	actions/setup-go	@v5	node20	v7.0.0	node24
.github/workflows/docker-publish.yaml	32	actions/setup-go	@v5	node20	v7.0.0	node24
.github/workflows/release.yaml	20	actions/setup-go	@v5	node20	v7.0.0	node24
.github/workflows/ci.yaml	21	golangci/golangci-lint-action	@v6	node20	v9.3.0	node24
.github/workflows/docker-publish.yaml	35	golangci/golangci-lint-action	@v6	node20	v9.3.0	node24
.github/workflows/ci.yaml	35	actions/upload-artifact	@v4	node20	v7.0.1	node24
.github/workflows/docker-publish.yaml	53	docker/setup-qemu-action	@v3	node20	v4.2.0	node24
.github/workflows/release.yaml	32	docker/setup-qemu-action	@v3	node20	v4.2.0	node24
.github/workflows/docker-publish.yaml	56	docker/setup-buildx-action	@v3	node20	v4.2.0	node24
.github/workflows/release.yaml	30	docker/setup-buildx-action	@v3	node20	v4.2.0	node24
.github/workflows/docker-publish.yaml	59	docker/login-action	@v3	node20	v4.6.0	node24
.github/workflows/release.yaml	24	docker/login-action	@v3	node20	v4.6.0	node24
.github/workflows/docker-publish.yaml	67	docker/metadata-action	@v5	node20	v6.2.0	node24
.github/workflows/docker-publish.yaml	76	docker/build-push-action	@v6	node20	v7.3.0	node24
.github/workflows/release.yaml	33	goreleaser/goreleaser-action	@v6	node20	v7.2.3	node24

Not flagged: .github/workflows/docker-publish.yaml:104 (peter-evans/repository-dispatch@v4) already runs on node24 — no action needed.

This is the same finding raised in #18 (2026-06-01) and #24/#26 (2026-07-06, 2026-07-27) and remains unresolved after three prior audits, now with the September 16 removal date noticeably closer.