chore(deps): bump actions/upload-artifact from 5 to 6

[dependabot]

Bumps actions/upload-artifact from 5 to 6.

Release notes

Sourced from actions/upload-artifact's releases.

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Upload Artifact Node 24 support by @​salmanmkc in actions/upload-artifact#719
• fix: update @​actions/artifact for Node.js 24 punycode deprecation by @​salmanmkc in actions/upload-artifact#744
• prepare release v6.0.0 for Node.js 24 support by @​salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

Commits

• b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
• e516bc8 docs: correct description of Node.js 24 support in README
• ddc45ed docs: update README to correct action name for Node.js 24 support
• 615b319 chore: release v6.0.0 for Node.js 24 support
• 017748b Merge pull request #744 from actions/fix-storage-blob
• 38d4c79 chore: rebuild dist
• 7d27270 chore: add missing license cache files for @​actions/core, @​actions/io, and mi...
• 5f643d3 chore: update license files for @​actions/artifact@​5.0.1 dependencies
• 1df1684 chore: update package-lock.json with @​actions/artifact@​5.0.1
• b5b1a91 fix: update @​actions/artifact to ^5.0.0 for Node.js 24 punycode fix
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🚨 Workflow Security Review Required

This PR modifies CI/CD workflow files or CODEOWNERS configuration. These changes require careful security review to prevent:

• Script injection vulnerabilities
• Unauthorized secret access
• Malicious code execution
• Bypass of security controls

Workflow files:

.github/workflows/pr-fast-feedback.yml

Security Checklist for Reviewers

Before approving this PR, verify:

• No script injection: User input (PR titles, branch names, etc.) is not directly used in run: commands
• Environment variables: All user input is passed via env: and referenced as $VAR not ${'$'}{{ }}
• Minimal permissions: Workflow has only necessary permissions (default: contents: read)
• Explicit checkout: For pull_request_target, checkout uses explicit ref: and persist-credentials: false
• Secret protection: Secrets are only used in trusted contexts (not in pull_request from forks)
• Action versions: Actions are pinned (preferably to SHA, or at least to major version)
• Proper triggers: pull_request_target is only used when necessary for secrets
• CODEOWNERS: Changes to CODEOWNERS maintain security (workflow files assigned to maintainers)

Maintainer Actions Required

1. Review each changed file for security implications
2. Test in a safe environment if possible (fork or test branch)
3. Verify CODEOWNERS ensures workflow files require maintainer review
4. Approve only if confident the changes don't introduce vulnerabilities

⚠️ Remember: Malicious workflow changes can:

• Steal repository secrets (API keys, credentials)
• Modify code without review
• Execute arbitrary code on runners
• Compromise the entire CI/CD pipeline

---

See GitHub Actions Security Best Practices for more information.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/upload-artifact	6.*.*	🟢 5.5	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 6 8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 8 SAST tool detected but not run on all commits Vulnerabilities 🟢 4 6 existing vulnerabilities detected

Scanned Files

• .github/workflows/pr-fast-feedback.yml

[github-actions]

✅ Fast Feedback Passed

All code quality checks have passed:

• ✅ Linting
• ✅ Unit Tests (Linux)
• ✅ Security Scanning
• ✅ Build Verification (Linux, Windows, macOS)

Next Steps:
⏳ E2E tests require maintainer approval. A maintainer can trigger them by:

• Approving this PR, or
• Commenting /run-e2e