actions/dependency-review-action upstream-blocked at Node 20

[TMHSDigital]

actions/dependency-review-action@v4.9.0 (latest as of 2026-04-25) still declares using: 'node20' in its action.yml. Upstream tracker: actions/dependency-review-action#1084 (OPEN).

6 ecosystem workflow files use this action: Docker, Home-Lab, Monday, Plaid, Steam, Developer-Tools-Directory. Cannot be fixed downstream.

Deadline: 2026-06-02 (Node 24 default). If upstream does not ship v5 by then, these workflows will break.

Mitigation options:

• Wait for upstream (preferred)
• Drop the action and replace with dependabot-only review flow
• Accept temporary PR-time breakage (the action is not release-blocking)

Action: monitor upstream. Decision required by 2026-05-25 (one week before deadline).

[TMHSDigital]

Upstream check on 2026-04-25: latest release is still v4.9.0 (published 2026-03-03) with action.yml declaring using: 'node20'. Tracker actions/dependency-review-action#1084 still OPEN (last updated 2026-04-08, no comments).

Monitoring continues. Next check date: 2026-05-15 (10 days before the May 25 decision deadline). If upstream has not shipped v5 by then, evaluate the mitigation options listed in this issue body.