Skip to content

fix: update @actions/artifact to fix Node.js 24 punycode deprecation - #451

Merged
salmanmkc merged 6 commits into
mainfrom
fix-storage-blob
Dec 12, 2025
Merged

fix: update @actions/artifact to fix Node.js 24 punycode deprecation#451
salmanmkc merged 6 commits into
mainfrom
fix-storage-blob

Conversation

@salmanmkc

@salmanmkc salmanmkc commented Dec 12, 2025

Copy link
Copy Markdown
Contributor

Summary

This PR updates the @actions/artifact package to use @azure/storage-blob@^12.29.1 which fixes the punycode deprecation warning when running on Node.js 24.

Problem

When running on Node.js 24, the current version emits:

(node:1234) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.

Solution

Updating @azure/storage-blob to version ^12.29.1 which has resolved the punycode dependency issue.

Related PRs

Testing

  • Verify deprecation warning is gone on Node.js 24

Note

This PR uses a local file reference for testing purposes. It should be updated to use the published @actions/artifact@5.0.1 once that version is released.

@salmanmkc
chore: use local @actions/artifact package for Node.js 24 testing
458627d 
This branch uses a local file reference to @actions/artifact which includes
the updated @azure/storage-blob ^12.29.1 to fix the punycode deprecation
warning on Node.js 24.

This is a test branch - do not merge until @actions/artifact@5.0.1 is published.
@salmanmkc
fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix
1e3c4b4 
Updates @actions/artifact dependency to use the published npm version
which includes @azure/storage-blob ^12.29.1 that fixes the punycode
deprecation warning on Node.js 24.
@salmanmkc
chore: update package-lock.json with @actions/artifact@5.0.1
8e3ebc4
@salmanmkc
chore: update @actions/artifact license file to 5.0.1
56fe6d9
@salmanmkc
chore: remove obsolete dependency license files
03a8080
@salmanmkc
chore: restore minimatch.dep.yml license file
d484700
@salmanmkc
salmanmkc marked this pull request as ready for review December 12, 2025 17:12
@salmanmkc
salmanmkc requested a review from a team as a code owner December 12, 2025 17:12
Copilot AI review requested due to automatic review settings December 12, 2025 17:12
@salmanmkc salmanmkc changed the title chore: update @actions/artifact to fix Node.js 24 punycode deprecation fix: update @actions/artifact to fix Node.js 24 punycode deprecation Dec 12, 2025
Copilot AI reviewed Dec 12, 2025
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates @actions/artifact from version 5.0.0 to 5.0.1 to resolve the Node.js 24 punycode deprecation warning by upgrading the @azure/storage-blob dependency from ^12.15.0 to ^12.29.1. This update also removes the deprecated @azure/core-http package and cleans up numerous obsolete transitive dependencies, resulting in a more streamlined dependency tree.

Key Changes:

  • Updated @actions/artifact to version 5.0.1 with newer @azure/storage-blob dependency
  • Removed deprecated @azure/core-http and its associated dependencies
  • Deduplicated and consolidated Azure SDK dependencies to use common versions

Reviewed changes

Copilot reviewed 39 out of 43 changed files in this pull request and generated no comments.

File Description
package-lock.json Updated @actions/artifact to 5.0.1, upgraded @azure/storage-blob to ^12.29.1, removed deprecated @azure/core-http and obsolete transitive dependencies (node-fetch, form-data, xml2js, etc.), deduplicated @azure/abort-controller and @azure/core-tracing versions
dist/index.js Rebuilt bundle reflecting dependency updates with updated module references and removal of deprecated code paths
.licenses/npm/*.dep.yml Removed license files for deleted dependencies (node-fetch, form-data, xml2js, uuid, etc.) and updated/added licenses for consolidated dependencies (@azure/abort-controller, @azure/core-tracing)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@salmanmkc
salmanmkc merged commit fd7ae8f into main Dec 12, 2025
17 checks passed
@salmanmkc
salmanmkc deleted the fix-storage-blob branch December 12, 2025 17:15
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request Dec 14, 2025
@mergify
chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 [skip…
11ed963 
… ci]

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 7.0.0.
Release notes

*Sourced from [actions/download-artifact's releases](https://github.com/actions/download-artifact/releases).*

> v7.0.0
> ------
>
> v7 - What's new
> ---------------
>
> > [!IMPORTANT]
> > actions/download-artifact@v7 now runs on Node.js 24 (`runs.using: node24`) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.
>
> ### Node.js 24
>
> This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
>
> What's Changed
> --------------
>
> * Update GHES guidance to include reference to Node 20 version by [`@​patrikpolyak`](https://github.com/patrikpolyak) in [actions/download-artifact#440](https://redirect.github.com/actions/download-artifact/pull/440)
> * Download Artifact Node24 support by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#415](https://redirect.github.com/actions/download-artifact/pull/415)
> * fix: update `@​actions/artifact` to fix Node.js 24 punycode deprecation by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#451](https://redirect.github.com/actions/download-artifact/pull/451)
> * prepare release v7.0.0 for Node.js 24 support by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#452](https://redirect.github.com/actions/download-artifact/pull/452)
>
> New Contributors
> ----------------
>
> * [`@​patrikpolyak`](https://github.com/patrikpolyak) made their first contribution in [actions/download-artifact#440](https://redirect.github.com/actions/download-artifact/pull/440)
> * [`@​salmanmkc`](https://github.com/salmanmkc) made their first contribution in [actions/download-artifact#415](https://redirect.github.com/actions/download-artifact/pull/415)
>
> **Full Changelog**: <actions/download-artifact@v6.0.0...v7.0.0>


Commits

* [`37930b1`](actions/download-artifact@37930b1) Merge pull request [#452](https://redirect.github.com/actions/download-artifact/issues/452) from actions/download-artifact-v7-release
* [`72582b9`](actions/download-artifact@72582b9) doc: update readme
* [`0d2ec9d`](actions/download-artifact@0d2ec9d) chore: release v7.0.0 for Node.js 24 support
* [`fd7ae8f`](actions/download-artifact@fd7ae8f) Merge pull request [#451](https://redirect.github.com/actions/download-artifact/issues/451) from actions/fix-storage-blob
* [`d484700`](actions/download-artifact@d484700) chore: restore minimatch.dep.yml license file
* [`03a8080`](actions/download-artifact@03a8080) chore: remove obsolete dependency license files
* [`56fe6d9`](actions/download-artifact@56fe6d9) chore: update `@​actions/artifact` license file to 5.0.1
* [`8e3ebc4`](actions/download-artifact@8e3ebc4) chore: update package-lock.json with `@​actions/artifact`[`@​5`](https://github.com/5).0.1
* [`1e3c4b4`](actions/download-artifact@1e3c4b4) fix: update `@​actions/artifact` to ^5.0.0 for Node.js 24 punycode fix
* [`458627d`](actions/download-artifact@458627d) chore: use local `@​actions/artifact` package for Node.js 24 testing
* Additional commits viewable in [compare view](actions/download-artifact@018cc2c...37930b1)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/download-artifact&package-manager=github\_actions&previous-version=6.0.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
This was referenced Dec 15, 2025
Merged
Merged
Merged
@github-actions github-actions Bot mentioned this pull request Dec 24, 2025
Merged
@github-actions github-actions Bot mentioned this pull request Jan 5, 2026
Merged
lfit-replication pushed a commit to lfit/releng-gerrit_to_platform that referenced this pull request Jan 14, 2026
@dependabot lfit.gh2gerrit
Chore(deps): Bump actions/download-artifact from 6.0.0 to 7.0.0
56036e0 
Bumps actions/download-artifact from 6.0.0 to 7.0.0.
## Release notes

Sourced from actions/download-artifact's releases.

v7.0.0
v7 - What's new

[!IMPORTANT]
actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24
This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
What's Changed

Update GHES guidance to include reference to Node 20 version by @​patrikpolyak in actions/download-artifact#440
Download Artifact Node24 support by @​salmanmkc in actions/download-artifact#415
fix: update @​actions/artifact to fix Node.js 24 punycode deprecation by @​salmanmkc in actions/download-artifact#451
prepare release v7.0.0 for Node.js 24 support by @​salmanmkc in actions/download-artifact#452

New Contributors

@​patrikpolyak made their first contribution in actions/download-artifact#440
@​salmanmkc made their first contribution in actions/download-artifact#415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

## Commits

37930b1 Merge pull request #452 from actions/download-artifact-v7-release
72582b9 doc: update readme
0d2ec9d chore: release v7.0.0 for Node.js 24 support
fd7ae8f Merge pull request #451 from actions/fix-storage-blob
d484700 chore: restore minimatch.dep.yml license file
03a8080 chore: remove obsolete dependency license files
56fe6d9 chore: update @​actions/artifact license file to 5.0.1
8e3ebc4 chore: update package-lock.json with @​actions/artifact@​5.0.1
1e3c4b4 fix: update @​actions/artifact to ^5.0.0 for Node.js 24 punycode fix
458627d chore: use local @​actions/artifact package for Node.js 24 testing
Additional commits viewable in compare view

![Dependabot compatibility score](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: lfit.gh2gerrit <releng+lfit-gh2gerrit@linuxfoundation.org>
Change-Id: If3203b06393869c2c8b70ade669d468a25efcc97
GitHub-PR: #33
GitHub-Hash: 941495290b069787
@github-actions github-actions Bot mentioned this pull request Jan 15, 2026
Merged
@v-priya-kinthali v-priya-kinthali mentioned this pull request Jan 28, 2026
Merged
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request Feb 2, 2026
@mergify
chore(deps): bump actions/download-artifact from 4.1.8 to 7.0.0 [skip…
28de639 
… ci]

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.1.8 to 7.0.0.
Release notes

*Sourced from [actions/download-artifact's releases](https://github.com/actions/download-artifact/releases).*

> v7.0.0
> ------
>
> v7 - What's new
> ---------------
>
> > [!IMPORTANT]
> > actions/download-artifact@v7 now runs on Node.js 24 (`runs.using: node24`) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.
>
> ### Node.js 24
>
> This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
>
> What's Changed
> --------------
>
> * Update GHES guidance to include reference to Node 20 version by [`@​patrikpolyak`](https://github.com/patrikpolyak) in [actions/download-artifact#440](https://redirect.github.com/actions/download-artifact/pull/440)
> * Download Artifact Node24 support by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#415](https://redirect.github.com/actions/download-artifact/pull/415)
> * fix: update `@​actions/artifact` to fix Node.js 24 punycode deprecation by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#451](https://redirect.github.com/actions/download-artifact/pull/451)
> * prepare release v7.0.0 for Node.js 24 support by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#452](https://redirect.github.com/actions/download-artifact/pull/452)
>
> New Contributors
> ----------------
>
> * [`@​patrikpolyak`](https://github.com/patrikpolyak) made their first contribution in [actions/download-artifact#440](https://redirect.github.com/actions/download-artifact/pull/440)
> * [`@​salmanmkc`](https://github.com/salmanmkc) made their first contribution in [actions/download-artifact#415](https://redirect.github.com/actions/download-artifact/pull/415)
>
> **Full Changelog**: <actions/download-artifact@v6.0.0...v7.0.0>
>
> v6.0.0
> ------
>
> What's Changed
> --------------
>
> **BREAKING CHANGE:** this update supports Node `v24.x`. This is not a breaking change per-se but we're treating it as such.
>
> * Update README for download-artifact v5 changes by [`@​yacaovsnc`](https://github.com/yacaovsnc) in [actions/download-artifact#417](https://redirect.github.com/actions/download-artifact/pull/417)
> * Update README with artifact extraction details by [`@​yacaovsnc`](https://github.com/yacaovsnc) in [actions/download-artifact#424](https://redirect.github.com/actions/download-artifact/pull/424)
> * Readme: spell out the first use of GHES by [`@​danwkennedy`](https://github.com/danwkennedy) in [actions/download-artifact#431](https://redirect.github.com/actions/download-artifact/pull/431)
> * Bump `@actions/artifact` to `v4.0.0`
> * Prepare `v6.0.0` by [`@​danwkennedy`](https://github.com/danwkennedy) in [actions/download-artifact#438](https://redirect.github.com/actions/download-artifact/pull/438)
>
> New Contributors
> ----------------
>
> * [`@​danwkennedy`](https://github.com/danwkennedy) made their first contribution in [actions/download-artifact#431](https://redirect.github.com/actions/download-artifact/pull/431)
>
> **Full Changelog**: <actions/download-artifact@v5...v6.0.0>
>
> v5.0.0
> ------
>
> What's Changed
> --------------
>
> * Update README.md by [`@​nebuk89`](https://github.com/nebuk89) in [actions/download-artifact#407](https://redirect.github.com/actions/download-artifact/pull/407)
> * BREAKING fix: inconsistent path behavior for single artifact downloads by ID by [`@​GrantBirki`](https://github.com/GrantBirki) in [actions/download-artifact#416](https://redirect.github.com/actions/download-artifact/pull/416)
>
> v5.0.0
> ------
>
> ### 🚨 Breaking Change
>
> This release fixes an inconsistency in path behavior for single artifact downloads by ID. **If you're downloading single artifacts by ID, the output path may change.**
>
> #### What Changed

... (truncated)


Commits

* [`37930b1`](actions/download-artifact@37930b1) Merge pull request [#452](https://redirect.github.com/actions/download-artifact/issues/452) from actions/download-artifact-v7-release
* [`72582b9`](actions/download-artifact@72582b9) doc: update readme
* [`0d2ec9d`](actions/download-artifact@0d2ec9d) chore: release v7.0.0 for Node.js 24 support
* [`fd7ae8f`](actions/download-artifact@fd7ae8f) Merge pull request [#451](https://redirect.github.com/actions/download-artifact/issues/451) from actions/fix-storage-blob
* [`d484700`](actions/download-artifact@d484700) chore: restore minimatch.dep.yml license file
* [`03a8080`](actions/download-artifact@03a8080) chore: remove obsolete dependency license files
* [`56fe6d9`](actions/download-artifact@56fe6d9) chore: update `@​actions/artifact` license file to 5.0.1
* [`8e3ebc4`](actions/download-artifact@8e3ebc4) chore: update package-lock.json with `@​actions/artifact`[`@​5`](https://github.com/5).0.1
* [`1e3c4b4`](actions/download-artifact@1e3c4b4) fix: update `@​actions/artifact` to ^5.0.0 for Node.js 24 punycode fix
* [`458627d`](actions/download-artifact@458627d) chore: use local `@​actions/artifact` package for Node.js 24 testing
* Additional commits viewable in [compare view](actions/download-artifact@v4.1.8...37930b1)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/download-artifact&package-manager=github\_actions&previous-version=4.1.8&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@github-actions github-actions Bot mentioned this pull request Feb 19, 2026
Merged
@YumNumm YumNumm mentioned this pull request May 12, 2026
Closed
This was referenced May 15, 2026
Merged
Merged
Merged
tae898 pushed a commit to humemai/arcadedb-embedded-python that referenced this pull request Jun 28, 2026
@mergify
chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 [skip…
d7d0937 
… ci]

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 7.0.0.
Release notes

*Sourced from [actions/download-artifact's releases](https://github.com/actions/download-artifact/releases).*

> v7.0.0
> ------
>
> v7 - What's new
> ---------------
>
> > [!IMPORTANT]
> > actions/download-artifact@v7 now runs on Node.js 24 (`runs.using: node24`) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.
>
> ### Node.js 24
>
> This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
>
> What's Changed
> --------------
>
> * Update GHES guidance to include reference to Node 20 version by [`@​patrikpolyak`](https://github.com/patrikpolyak) in [actions/download-artifact#440](https://redirect.github.com/actions/download-artifact/pull/440)
> * Download Artifact Node24 support by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#415](https://redirect.github.com/actions/download-artifact/pull/415)
> * fix: update `@​actions/artifact` to fix Node.js 24 punycode deprecation by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#451](https://redirect.github.com/actions/download-artifact/pull/451)
> * prepare release v7.0.0 for Node.js 24 support by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#452](https://redirect.github.com/actions/download-artifact/pull/452)
>
> New Contributors
> ----------------
>
> * [`@​patrikpolyak`](https://github.com/patrikpolyak) made their first contribution in [actions/download-artifact#440](https://redirect.github.com/actions/download-artifact/pull/440)
> * [`@​salmanmkc`](https://github.com/salmanmkc) made their first contribution in [actions/download-artifact#415](https://redirect.github.com/actions/download-artifact/pull/415)
>
> **Full Changelog**: <actions/download-artifact@v6.0.0...v7.0.0>


Commits

* [`37930b1`](actions/download-artifact@37930b1) Merge pull request [#452](https://redirect.github.com/actions/download-artifact/issues/452) from actions/download-artifact-v7-release
* [`72582b9`](actions/download-artifact@72582b9) doc: update readme
* [`0d2ec9d`](actions/download-artifact@0d2ec9d) chore: release v7.0.0 for Node.js 24 support
* [`fd7ae8f`](actions/download-artifact@fd7ae8f) Merge pull request [#451](https://redirect.github.com/actions/download-artifact/issues/451) from actions/fix-storage-blob
* [`d484700`](actions/download-artifact@d484700) chore: restore minimatch.dep.yml license file
* [`03a8080`](actions/download-artifact@03a8080) chore: remove obsolete dependency license files
* [`56fe6d9`](actions/download-artifact@56fe6d9) chore: update `@​actions/artifact` license file to 5.0.1
* [`8e3ebc4`](actions/download-artifact@8e3ebc4) chore: update package-lock.json with `@​actions/artifact`[`@​5`](https://github.com/5).0.1
* [`1e3c4b4`](actions/download-artifact@1e3c4b4) fix: update `@​actions/artifact` to ^5.0.0 for Node.js 24 punycode fix
* [`458627d`](actions/download-artifact@458627d) chore: use local `@​actions/artifact` package for Node.js 24 testing
* Additional commits viewable in [compare view](actions/download-artifact@018cc2c...37930b1)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/download-artifact&package-manager=github\_actions&previous-version=6.0.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
tae898 pushed a commit to humemai/arcadedb-embedded-python that referenced this pull request Jun 28, 2026
@mergify
chore(deps): bump actions/download-artifact from 4.1.8 to 7.0.0 [skip…
665d0b8 
… ci]

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.1.8 to 7.0.0.
Release notes

*Sourced from [actions/download-artifact's releases](https://github.com/actions/download-artifact/releases).*

> v7.0.0
> ------
>
> v7 - What's new
> ---------------
>
> > [!IMPORTANT]
> > actions/download-artifact@v7 now runs on Node.js 24 (`runs.using: node24`) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.
>
> ### Node.js 24
>
> This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
>
> What's Changed
> --------------
>
> * Update GHES guidance to include reference to Node 20 version by [`@​patrikpolyak`](https://github.com/patrikpolyak) in [actions/download-artifact#440](https://redirect.github.com/actions/download-artifact/pull/440)
> * Download Artifact Node24 support by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#415](https://redirect.github.com/actions/download-artifact/pull/415)
> * fix: update `@​actions/artifact` to fix Node.js 24 punycode deprecation by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#451](https://redirect.github.com/actions/download-artifact/pull/451)
> * prepare release v7.0.0 for Node.js 24 support by [`@​salmanmkc`](https://github.com/salmanmkc) in [actions/download-artifact#452](https://redirect.github.com/actions/download-artifact/pull/452)
>
> New Contributors
> ----------------
>
> * [`@​patrikpolyak`](https://github.com/patrikpolyak) made their first contribution in [actions/download-artifact#440](https://redirect.github.com/actions/download-artifact/pull/440)
> * [`@​salmanmkc`](https://github.com/salmanmkc) made their first contribution in [actions/download-artifact#415](https://redirect.github.com/actions/download-artifact/pull/415)
>
> **Full Changelog**: <actions/download-artifact@v6.0.0...v7.0.0>
>
> v6.0.0
> ------
>
> What's Changed
> --------------
>
> **BREAKING CHANGE:** this update supports Node `v24.x`. This is not a breaking change per-se but we're treating it as such.
>
> * Update README for download-artifact v5 changes by [`@​yacaovsnc`](https://github.com/yacaovsnc) in [actions/download-artifact#417](https://redirect.github.com/actions/download-artifact/pull/417)
> * Update README with artifact extraction details by [`@​yacaovsnc`](https://github.com/yacaovsnc) in [actions/download-artifact#424](https://redirect.github.com/actions/download-artifact/pull/424)
> * Readme: spell out the first use of GHES by [`@​danwkennedy`](https://github.com/danwkennedy) in [actions/download-artifact#431](https://redirect.github.com/actions/download-artifact/pull/431)
> * Bump `@actions/artifact` to `v4.0.0`
> * Prepare `v6.0.0` by [`@​danwkennedy`](https://github.com/danwkennedy) in [actions/download-artifact#438](https://redirect.github.com/actions/download-artifact/pull/438)
>
> New Contributors
> ----------------
>
> * [`@​danwkennedy`](https://github.com/danwkennedy) made their first contribution in [actions/download-artifact#431](https://redirect.github.com/actions/download-artifact/pull/431)
>
> **Full Changelog**: <actions/download-artifact@v5...v6.0.0>
>
> v5.0.0
> ------
>
> What's Changed
> --------------
>
> * Update README.md by [`@​nebuk89`](https://github.com/nebuk89) in [actions/download-artifact#407](https://redirect.github.com/actions/download-artifact/pull/407)
> * BREAKING fix: inconsistent path behavior for single artifact downloads by ID by [`@​GrantBirki`](https://github.com/GrantBirki) in [actions/download-artifact#416](https://redirect.github.com/actions/download-artifact/pull/416)
>
> v5.0.0
> ------
>
> ### 🚨 Breaking Change
>
> This release fixes an inconsistency in path behavior for single artifact downloads by ID. **If you're downloading single artifacts by ID, the output path may change.**
>
> #### What Changed

... (truncated)


Commits

* [`37930b1`](actions/download-artifact@37930b1) Merge pull request [#452](https://redirect.github.com/actions/download-artifact/issues/452) from actions/download-artifact-v7-release
* [`72582b9`](actions/download-artifact@72582b9) doc: update readme
* [`0d2ec9d`](actions/download-artifact@0d2ec9d) chore: release v7.0.0 for Node.js 24 support
* [`fd7ae8f`](actions/download-artifact@fd7ae8f) Merge pull request [#451](https://redirect.github.com/actions/download-artifact/issues/451) from actions/fix-storage-blob
* [`d484700`](actions/download-artifact@d484700) chore: restore minimatch.dep.yml license file
* [`03a8080`](actions/download-artifact@03a8080) chore: remove obsolete dependency license files
* [`56fe6d9`](actions/download-artifact@56fe6d9) chore: update `@​actions/artifact` license file to 5.0.1
* [`8e3ebc4`](actions/download-artifact@8e3ebc4) chore: update package-lock.json with `@​actions/artifact`[`@​5`](https://github.com/5).0.1
* [`1e3c4b4`](actions/download-artifact@1e3c4b4) fix: update `@​actions/artifact` to ^5.0.0 for Node.js 24 punycode fix
* [`458627d`](actions/download-artifact@458627d) chore: use local `@​actions/artifact` package for Node.js 24 testing
* Additional commits viewable in [compare view](actions/download-artifact@v4.1.8...37930b1)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/download-artifact&package-manager=github\_actions&previous-version=4.1.8&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
vbraun pushed a commit to sagemath/sage that referenced this pull request Jul 26, 2026
Release Manager
576a0f5 
gh-42561: build(deps): bump actions/download-artifact from 6 to 8
    
Bumps [actions/download-artifact](https://github.com/actions/download-
artifact) from 6 to 8.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/download-
artifact/releases">actions/download-artifact's releases</a>.</em></p>
<blockquote>
<h2>v8.0.0</h2>
<h2>v8 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/download-artifact@v8 has been migrated to an ESM module. This
should be transparent to the caller but forks might need to make
significant changes.</p>
</blockquote>
<blockquote>
<p>[!IMPORTANT]
Hash mismatches will now error by default. Users can override this
behavior with a setting change (see below).</p>
</blockquote>
<h3>Direct downloads</h3>
<p>To support direct uploads in <code>actions/upload-artifact</code>,
the action will no longer attempt to unzip all downloaded files.
Instead, the action checks the <code>Content-Type</code> header ahead of
unzipping and skips non-zipped files. Callers wishing to download a
zipped file as-is can also set the new <code>skip-decompress</code>
parameter to <code>true</code>.</p>
<h3>Enforced checks (breaking)</h3>
<p>A previous release introduced digest checks on the download. If a
download hash didn't match the expected hash from the server, the action
would log a warning. Callers can now configure the behavior on mismatch
with the <code>digest-mismatch</code> parameter. To be secure by
default, we are now defaulting the behavior to <code>error</code> which
will fail the workflow run.</p>
<h3>ESM</h3>
<p>To support new versions of the @actions/* packages, we've upgraded
the package to ESM.</p>
<h2>What's Changed</h2>
<ul>
<li>Don't attempt to un-zip non-zipped downloads by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a href="https://redirect.github.com/actions/download-
artifact/pull/460">actions/download-artifact#460</a></li>
<li>Add a setting to specify what to do on hash mismatch and default it
to <code>error</code> by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a href="https://redirect.github.com/actions/download-
artifact/pull/461">actions/download-artifact#461</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-
artifact/compare/v7...v8.0.0">https://github.com/actions/download-
artifact/compare/v7...v8.0.0</a></p>
<h2>v7.0.0</h2>
<h2>v7 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/download-artifact@v7 now runs on Node.js 24 (<code>runs.using:
node24</code>) and requires a minimum Actions Runner version of 2.327.1.
If you are using self-hosted runners, ensure they are updated before
upgrading.</p>
</blockquote>
<h3>Node.js 24</h3>
<p>This release updates the runtime to Node.js 24. v6 had preliminary
support for Node 24, however this action was by default still running on
Node.js 20. Now this action by default will run on Node.js 24.</p>
<h2>What's Changed</h2>
<ul>
<li>Update GHES guidance to include reference to Node 20 version by <a
href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
in <a href="https://redirect.github.com/actions/download-
artifact/pull/440">actions/download-artifact#440</a></li>
<li>Download Artifact Node24 support by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/download-
artifact/pull/415">actions/download-artifact#415</a></li>
<li>fix: update <code>@​actions/artifact</code> to fix Node.js 24
punycode deprecation by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/download-
artifact/pull/451">actions/download-artifact#451</a></li>
<li>prepare release v7.0.0 for Node.js 24 support by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/download-
artifact/pull/452">actions/download-artifact#452</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-
artifact/pull/440">actions/download-artifact#440</a></li>
<li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-
artifact/pull/415">actions/download-artifact#415</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-
artifact/compare/v6.0.0...v7.0.0">https://github.com/actions/download-
artifact/compare/v6.0.0...v7.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="actions/download-artifact@3e5f45b
2cfb9172054b4087a40e8e0b5a5461e7c"><code>3e5f45b</code></a> Add
regression tests for CJK characters (<a
href="https://redirect.github.com/actions/download-
artifact/issues/471">#471</a>)</li>
<li><a href="actions/download-artifact@e6d03f6
7377d4412c7aa56a8e2e4988e6ec479dd"><code>e6d03f6</code></a> Add a
regression test for artifact name + content-type mismatches (<a
href="https://redirect.github.com/actions/download-
artifact/issues/472">#472</a>)</li>
<li><a href="actions/download-artifact@70fc10c
6e5e1ce46ad2ea6f2b72d43f7d47b13c3"><code>70fc10c</code></a> Merge pull
request <a href="https://redirect.github.com/actions/download-
artifact/issues/461">#461</a> from actions/danwkennedy/digest-mismatch-
behavior</li>
<li><a href="actions/download-artifact@f258da9
a506b755b84a09a531814700b86ccfc62"><code>f258da9</code></a> Add change
docs</li>
<li><a href="actions/download-artifact@ccc058e
5fbb0bb2352213eaec3491e117cbc4a5c"><code>ccc058e</code></a> Fix linting
issues</li>
<li><a href="actions/download-artifact@bd7976b
a57ecea96e6f3df575eb922d11a12a9fd"><code>bd7976b</code></a> Add a
setting to specify what to do on hash mismatch and default it to
<code>error</code></li>
<li><a href="actions/download-artifact@ac21fcf
45e0aaee541c0f7030558bdad38d77d6c"><code>ac21fcf</code></a> Merge pull
request <a href="https://redirect.github.com/actions/download-
artifact/issues/460">#460</a> from actions/danwkennedy/download-no-
unzip</li>
<li><a href="actions/download-artifact@15999bf
f51058bc7c19b50ebbba518eaef7c26c0"><code>15999bf</code></a> Add note
about package bumps</li>
<li><a href="actions/download-artifact@974686e
d5098c7f9c9289ec946b9058e496a2561"><code>974686e</code></a> Bump the
version to <code>v8</code> and add release notes</li>
<li><a href="actions/download-artifact@fbe48b1
d2756394be4cd4358ed3bc1343b330e75"><code>fbe48b1</code></a> Update test
names to make it clearer what they do</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/download-
artifact/compare/v6...v8">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-
badges.githubapp.com/badges/compatibility_score?dependency-
name=actions/download-artifact&package-manager=github_actions&previous-
version=6&new-version=8)](https://docs.github.com/en/github/managing-
security-vulnerabilities/about-dependabot-security-updates#about-
compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
    
URL: #42561
Reported by: dependabot[bot]
Reviewer(s):
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
+1 more reviewer
@yacaovsnc yacaovsnc yacaovsnc approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@salmanmkc @yacaovsnc