From 1c48cc9a983f63be72c05dac514c879a75540fc5 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Mon, 10 Aug 2026 05:59:20 +0000
Subject: [PATCH 1/2] ci: move actions off the deprecated Node 20 runtime
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

checkout, setup-node and pnpm/action-setup all still targeted Node 20, so
every run was being forced onto Node 24 with a deprecation warning.

pnpm/action-setup v6 refuses to start when a `version:` input and a
`packageManager` field both name a pnpm version, so drop the redundant
`version: 9.12.0` from test.yml and release.yml — package.json already
pins pnpm@9.12.0 and stays the single source of truth.
---
 .github/workflows/auto-rebase.yml      | 6 +++---
 .github/workflows/release.yml          | 8 +++-----
 .github/workflows/test.yml             | 8 +++-----
 .github/workflows/threatcrush-scan.yml | 4 ++--
 .github/workflows/vu1nz-scan.yml       | 2 +-
 5 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/auto-rebase.yml b/.github/workflows/auto-rebase.yml
index 2475e80c..88b9de24 100644
--- a/.github/workflows/auto-rebase.yml
+++ b/.github/workflows/auto-rebase.yml
@@ -19,18 +19,18 @@ jobs:
 
     steps:
       - name: Checkout master
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           run_install: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 22
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0c9157de..27a9cd32 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,13 +12,11 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.0
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           cache: pnpm
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3bb6d4fd..92a03043 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,13 +9,11 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.0
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           cache: pnpm
diff --git a/.github/workflows/threatcrush-scan.yml b/.github/workflows/threatcrush-scan.yml
index 1ce8b3bc..888d4da1 100644
--- a/.github/workflows/threatcrush-scan.yml
+++ b/.github/workflows/threatcrush-scan.yml
@@ -19,9 +19,9 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "20"
 
diff --git a/.github/workflows/vu1nz-scan.yml b/.github/workflows/vu1nz-scan.yml
index 3fcf98e8..ed5b334f 100644
--- a/.github/workflows/vu1nz-scan.yml
+++ b/.github/workflows/vu1nz-scan.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - uses: actions/setup-python@v5
         with:

From 31e9a5e3882b7a81258d4291c35202d30c813ff7 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Mon, 10 Aug 2026 06:00:47 +0000
Subject: [PATCH 2/2] ci: opt threatcrush out of setup-node's package-manager
 cache

setup-node v5 caches for the package.json `packageManager` by default.
The scan job never installs pnpm, so that default made it fail with
'Unable to locate executable file: pnpm'.
---
 .github/workflows/threatcrush-scan.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/threatcrush-scan.yml b/.github/workflows/threatcrush-scan.yml
index 888d4da1..f87666e1 100644
--- a/.github/workflows/threatcrush-scan.yml
+++ b/.github/workflows/threatcrush-scan.yml
@@ -24,6 +24,9 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: "20"
+          # setup-node v5 caches for the package.json `packageManager` by
+          # default, which would shell out to a pnpm this job never installs.
+          package-manager-cache: false
 
       # An unretried `npm i -g` is a network call to a registry that decides
       # whether a security gate runs at all. Retry before giving up; a