Updated to use Node 24#48
Conversation
GitHub still warned 'Node.js 20 actions are deprecated' for two
actions whose v-major refs lag behind their actual Node 24 work:
* rustsec/audit-check@v2 — upstream merged the Node 24 bump
(rustsec/audit-check#48, master commit 858dc40f, 2026-03-20)
but has not cut a v2.x.x release yet, so the v2 floating ref
still points at v2.0.0 (2024-09-23) which ships Node 20.
Pin to the master commit SHA. The pin is documented inline so
the next maintainer (or dependabot) knows to drop it once a
real release lands. Same pin in both build.yml and
security-scan.yml.
* github/codeql-action — v3.x.x is the legacy Node 20 series;
the maintainer publishes v4.x.x in parallel and the v4 line
runs on Node 24 (verified against init/action.yml on tag
v4.35.4). Bump init/autobuild/analyze from @V3 to @v4 in
security-scan.yml.
Verified with actionlint v1.7.7 — both files lint clean. After
this push the only remaining 'Node 20' warnings would be from
actions whose latest tag itself ships Node 20 (none in our tree
as of 2026-05-07).
|
Is there any chance to release this with a bump say 2.0.1 or 2.1.0? Thank you in advance |
|
Not sure what you're wanting bumped? |
|
The release here: https://github.com/rustsec/audit-check/releases That version is what is used in the actions to fetch your repo. The alternative is to use |
|
Oh I get you. Yes agreed. @tarcieri are you able to cut a release? Also you mentioned that this repo is overly complex - can you elaborate more? |
This. No docker container. No node. Just a small yaml shared GitHub actions config that installs I cut one release before but it requires getting a whole Node environment setup which is not something I regularly do. It took me a lot of time and was very annoying. I guess I can look into it again. If anyone else involved in RUSTSEC who actually has any familiarity with node wants to look into it instead, that'd be great. This whole thing is way outside my wheelhouse and I'm really, really tired of being its only maintainer. |
|
Here is a preliminary starting point: https://github.com/rustsec/actions/blob/main/cargo-audit-install/action.yml |
|
I have removed rustsec/audit-check from all my pipelines and replaced it with the composite action you listed. Thank you. Personally I'd be good with updating the readme + archiving this repo. Thank you for your help here. (Un-watching this thread) |
## Problem Security / Dependency audit logs show: > Node 20 is being deprecated. This workflow is running with Node 24 by default. If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable. Example: [run 28693006383 / job 85097617848](https://github.com/assura-lang/assura/actions/runs/28693006383/job/85097617848) ## Fix (not the insecure escape hatch) `rustsec/audit-check@v2.0.0` (`69366f33…`) still has `runs.using: node20`. Main has [rustsec/audit-check#48](rustsec/audit-check#48) at `858dc40f52ca2b8570b7a997c1c4e35c6fc9a432` with `runs.using: node24`. Pin that SHA until a new tag includes it. **Do not** set `ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true`. That only re-enables the deprecated runtime. ## Scope Independent of the v0.1.0 release cut. Security workflow only. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
|
Hi everyone, sorry for writing in a closed issue, surely not the best place. @haydonryan bored of node.js 20 deprecation warnings in my Rust projects, I have developed this nimble solution, since this issue has been merged but it's not released yet. I hope it helps. |
4 participants
Resolves #47
Tested against my own repo - worked fine. (warning doesn't appear).
I used AI to apply this change.