Upgrade to Node 24 and GitHub Actions v5/v6

[pflynn-virtru]

Overview

Several dependency updates are currently blocked waiting for Node 24 support in GitHub Actions runners. This issue tracks the deferred updates and the infrastructure upgrades needed to support them.

Blocked Updates

GitHub Actions (require runner v2.327.1+ with Node 24)

• actions/checkout v4 → v5

  • Current: v4.2.2
  • Target: v5.x
  • Blocker: Requires GitHub runner with Node 24 support
  • Dependabot PR: chore(ci): bump actions/checkout from 4.2.2 to 5.0.0 #742 (closed, deferred to this issue)

• actions/setup-go v5 → v6

  • Current: v5.x
  • Target: v6.x
  • Blocker: Requires GitHub runner with Node 24 support
  • Dependabot PR: chore(ci): bump actions/setup-go from 5.4.0 to 6.0.0 #743 (closed, deferred to this issue)

• actions/download-artifact v4 → v5

  • Current: v4.x
  • Target: v5.x
  • Blocker: Breaking changes + requires Node 24 runners
  • Dependabot PR: chore(ci): bump actions/download-artifact from 4.2.1 to 5.0.0 #721 (closed, deferred to this issue)

Type Definitions

• @types/node 22 → 24
  • Current: v22.x
  • Target: v24.x
  • Rationale: Type definitions should match the runtime Node.js version
  • Blocker: Should be updated when project upgrades to Node 24 runtime
  • Dependabot PR: chore(cli): bump @types/node from 22.13.8 to 24.9.1 in /cli #777 (closed, deferred to this issue)

Needs Separate Review

• stefanzweifel/git-auto-commit-action v5 → v6
  • Current: v5.x
  • Target: v6.x
  • Blocker: Major version update requires changelog review for breaking changes
  • Action: Review v6 changelog before upgrading
  • Dependabot PR: chore(ci): bump stefanzweifel/git-auto-commit-action from 5.1.0 to 6.0.1 #667 (closed, deferred to this issue)

Timeline & Dependencies

GitHub Actions Node 24 Support

• Status: Not yet available (as of January 2026)
• Expected: Q1-Q2 2026 based on GitHub's release cadence
• Tracking:
  • Monitor GitHub Actions runner releases
  • Monitor ubuntu-24.04 runner availability

Node 24 Runtime

• Current project version: Node 22
• Target: Node 24 LTS (when stable and supported by GitHub Actions)
• Impact: Will enable deferred GitHub Actions updates

Action Items

Completed ✅

• Close deferred dependabot PRs with message linking to this issue
• Document which specific PR numbers are being deferred

Monitor (Ongoing)

• Watch for GitHub Actions runner v2.327.1+ release announcements
• Watch for ubuntu-24.04 becoming available in GitHub hosted runners
• Monitor Node.js 24 LTS schedule

Before Upgrading (When Ready)

• Review stefanzweifel/git-auto-commit-action v6 changelog
• Plan Node 24 runtime upgrade for the project
• Test GitHub Actions workflows locally or in test environment
• Update .nvmrc or other Node version specifications

Execute Upgrade (When Infrastructure Ready)

• Upgrade to Node 24 runtime
• Update @types/node to v24
• Update GitHub Actions to v5/v6 versions
• Test all workflows in CI
• Verify all functionality

Related

• Deferred from PR fix: all vulnerabilities and update tooling #812 (Security & Dependencies: Fix all vulnerabilities and update tooling)
• Part of ongoing dependency management strategy
• Closed PRs: chore(cli): bump @types/node from 22.13.8 to 24.9.1 in /cli #777, chore(ci): bump actions/setup-go from 5.4.0 to 6.0.0 #743, chore(ci): bump actions/checkout from 4.2.2 to 5.0.0 #742, chore(ci): bump actions/download-artifact from 4.2.1 to 5.0.0 #721, chore(ci): bump stefanzweifel/git-auto-commit-action from 5.1.0 to 6.0.1 #667

Future Recommendations

1. Automate monitoring: Set up notifications for GitHub Actions runner updates
2. Staged rollout: Test Node 24 in dev environment before production
3. Regular reviews: Quarterly review of deferred dependencies
4. Renovate adoption: Consider migrating from Dependabot to Renovate for better grouped updates

---

Note: This issue will remain open until GitHub Actions runners support Node 24, at which point these updates can be safely applied.

[pflynn-virtru]

see #857