Skip to content

Upgraded versions of two GitHub Actions - #1059

Closed
jasnow wants to merge 1 commit into
rubysec:masterfrom
jasnow:ghsa-syncbot-2026-05-20-08_37_26
Closed

Upgraded versions of two GitHub Actions #1059
jasnow wants to merge 1 commit into
rubysec:masterfrom
jasnow:ghsa-syncbot-2026-05-20-08_37_26

Conversation

@jasnow

@jasnow jasnow commented May 20, 2026

Copy link
Copy Markdown
Member

Upgraded versions of two GitHub Actions

Yesterday, I fouund this warning in one of our GHA logs:

Warning: Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not
work as expected: 
 * actions/checkout@v3,
 * actions/setup-python@v4.
Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be 
removed from the runner on September 16th, 2026. Please check if updated versions of these actions
are available that support Node.js 24. To opt into Node.js 24 now, set the 
 *FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true
environment variable on the runner or in your workflow file. Once Node.js 24 becomes the
default, you can temporarily opt out by setting
 *  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true.
For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners]

so I found out this
" actions/checkout@v3" had a "v4" version and
" actions/setup-python@v4" had a "v5" version.

Will monitor GHA for green run.

@jasnow

jasnow commented May 20, 2026

Copy link
Copy Markdown
Member Author

Green GHA/Ready for review

@jasnow jasnow changed the title Upgraded two GitHub Actions versions Upgraded versions of two GitHub Actions May 20, 2026

@simi simi left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can setup dependabot for us to cover this also in the future.

@connorshea

Copy link
Copy Markdown
Contributor

I think it'd be worth considering pinned SHA hashes as part of this: #1064

@flavorjones

Copy link
Copy Markdown
Member

Should be resolved by dependabot now that #1064 is merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants