Dependency & Actions audit - 2026-07-27

[krakenhavoc]

GitHub Actions Deprecation

This repo's CI is still pinned to Node20-runtime actions across ci.yaml, docker-publish.yaml, and release.yaml. GitHub defaulted runners to Node24 on June 16, 2026 and will fully remove Node20 support on September 16, 2026 — already past the default-cutover date, with roughly 7 weeks left until full removal.

File(s)	Action	Current pin	Bump to
ci.yaml, docker-publish.yaml, release.yaml	actions/checkout	@v4	@v6
ci.yaml	actions/setup-go	@v5	@v6
ci.yaml, docker-publish.yaml	golangci/golangci-lint-action	@v6	@v9
ci.yaml	actions/upload-artifact	@v4	@v6
docker-publish.yaml, release.yaml	docker/setup-qemu-action	@v3	@v4
docker-publish.yaml, release.yaml	docker/setup-buildx-action	@v3	@v4
docker-publish.yaml, release.yaml	docker/login-action	@v3	@v4
docker-publish.yaml	docker/build-push-action	@v6	@v7
release.yaml	goreleaser/goreleaser-action	@v6	@v7

This remains the most out-of-date workflow set in the org — every sibling repo (app, cli, infra-int, cert-action) has already moved to the versions above.

npm Dependencies

NONE — no package.json in this repo (pure Go module).

Go Module CVEs

No known CVEs. The sole dependency, gopkg.in/yaml.v3 v3.0.1, is already the patched release for its historical advisory (CVE-2022-28948).

Toolchain drift (not a CVE, but related): go.mod pins go 1.23.6 while CI pins go-version: "1.24"; sibling repo cli is already on Go 1.26. Recommend aligning.

Terraform Providers

NONE — no *.tf files in this repo.

---

Note: this is the same Node20-actions finding raised in #18 (2026-06-01) and #24 (2026-07-06) — still unresolved after two prior audits.