From 36bb1d9c866ea003d18c0bdce21df4aca72418cb Mon Sep 17 00:00:00 2001 From: Bez625 Date: Thu, 22 Oct 2026 14:08:36 +0100 Subject: [PATCH] chore(ci): bump actions off EOL Node runtimes Node 12/16/20 are EOL and will not receive the fixes from the October 2026 Node.js security releases (22.23.4 / 24.22.1 / 26.12.1), including CVE-2026-111497 (out-of-bounds write in the Brotli decoder, RCE). Bumps pinned actions to releases that declare `using: node24`. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/golangci-lint.yml | 6 +++--- .github/workflows/release.yml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 4f68864..55e3b0c 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -11,11 +11,11 @@ jobs: name: lint runs-on: ubuntu-latest steps: - - uses: actions/setup-go@v3 + - uses: actions/setup-go@v7 with: go-version: 1.17 - - uses: actions/checkout@v3 + - uses: actions/checkout@v6 - name: golangci-lint - uses: golangci/golangci-lint-action@v3 + uses: golangci/golangci-lint-action@v9 with: version: latest diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0675f81..3dc80b6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,13 +12,13 @@ jobs: steps: - name: Set up Go 1.x - uses: actions/setup-go@v2 + uses: actions/setup-go@v7 with: go-version: ^1.17 id: go - name: Check out code into the Go module directory - uses: actions/checkout@v2 + uses: actions/checkout@v6 - name: Get dependencies run: |