Repository navigation
Conversation
Node 12/16/20 are EOL and will not receive the fixes from the October 2026 Node.js security releases (22.23.4 / 24.22.1 / 26.12.1), including CVE-2026-111497 (out-of-bounds write in the Brotli decoder, RCE). Bumps pinned actions to releases that declare `using: node24`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps pinned GitHub Actions off end-of-life Node runtimes.
Why
The Node.js October 2026 security releases (21 Oct 2026) patched 10 CVEs across the 22.x, 24.x and 26.x lines — fixed in 22.23.4 / 24.22.1 / 26.12.1. The notable one for CI is CVE-2026-111497, an out-of-bounds write in the Brotli decoder leading to RCE; Brotli sits in the path of most registry and HTTP traffic an action performs.
Node 12, 16 and 20 are all EOL and will never receive these fixes. A JS action declares its runtime via
using:in its ownaction.yml, and the runner supplies that binary — so the only fix is to pin an action release that declaresusing: node24, which then inherits the patched Node 24 from the runner image.What changed
Mechanical
uses:version bumps only — 3 file(s). No workflow logic, inputs or job structure were changed.Known gaps, not addressed here
Deliberately not bumped here:
golangci/golangci-lint-actionis left on its current version. This repo's.golangci.ymlis still in golangci-lint v1 config format, and action v7+ requires the v2 format — bumping it would fail the lint job. That needs a separate config-migration PR.These actions were left alone because no release declaring node24 exists yet — bumping them would still land on EOL Node 20:
actions/download-artifact,docker/build-push-action,dorny/test-reporter,thollander/actions-comment-pull-request,aws-actions/configure-aws-credentials,a7ul/tar-action,GoTestTools/gotestfmt-action.actions/upload-release-asset@v1andactions/create-release@v1(both node12) are archived with no successor and need migrating toncipollo/release-action— a job restructure, so deliberately out of scope for this PR.Please let CI verify before merging.
🤖 Generated with Claude Code