feat!: Upgrade Node.js dependencies (Actions and Supported versions) (#3498)

Author: brandonlenz

.github/workflows/build-and-test.yml

@@ -14,16 +14,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [ '20', '22', '24' ]
+        node: [ '22', '24', '26' ]
 
     name: Node ${{ matrix.node }} tests
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: 'yarn'
@@ -42,10 +42,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: '.node-version'
           cache: 'yarn'

.github/workflows/deploy-storybook.yml

@@ -22,16 +22,16 @@ jobs:
       url: ${{ steps.build-publish.outputs.page_url }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Set up node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: '.node-version'
           cache: 'yarn'
 
       - name: Deploy 🚀
-        uses: bitovi/github-actions-storybook-to-github-pages@v1.0.3
+        uses: bitovi/github-actions-storybook-to-github-pages@b75ece8f984a32b2adb322065d7a8a2cc8db2d52 # v1.0.3
         with:
           install_command: yarn install
           build_command: yarn build-storybook

.github/workflows/happo.yml

@@ -15,7 +15,7 @@ jobs:
   happo:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.ref }}
           fetch-depth: 100
@@ -24,7 +24,7 @@ jobs:
         run: git fetch origin main:main
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: '.node-version'
           cache: 'yarn'

.github/workflows/package-release.yml

@@ -19,10 +19,10 @@ jobs:
 
     steps: 
       - name: Checkout out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: '.node-version'
           cache: 'yarn'
@@ -39,7 +39,7 @@ jobs:
         run: yarn pack --out trussworks-react-uswds-v%v.tgz
 
       - name: Upload package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           path: trussworks-react-uswds-v*.*.*.tgz
           if-no-files-found: error

.github/workflows/publish-next.yml

@@ -13,18 +13,18 @@ jobs:
     name: Publish next to Github Packages
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Set up node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: '.node-version'
 
       - name: Get yarn cache directory path
         id: yarn-cache-dir-path
         run: echo "dir='.yarn/cache'" >> $GITHUB_OUTPUT
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: yarn-cache
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
@@ -38,7 +38,7 @@ jobs:
 
       # Setup .npmrc file to publish to GitHub Packages
       - name: Set up node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           registry-url: 'https://npm.pkg.github.com'
           node-version-file: '.node-version'

.github/workflows/release-please.yml

@@ -17,7 +17,7 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
         with:
           config-file: "release-please-config.json"
           manifest-file: ".release-please-manifest.json"

.github/workflows/semantic_pr.yml

@@ -17,13 +17,13 @@ jobs:
       pull-requests: write
     steps:
       - id: lint_pr_title
-        uses: amannn/action-semantic-pull-request@v6
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           wip: false
 
-      - uses: marocchino/sticky-pull-request-comment@v2
+      - uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         # Continue execution if action-semantic-pull-request fails with an error
         if: always() && (steps.lint_pr_title.outputs.error_message != null)
         with:
@@ -41,7 +41,7 @@ jobs:
 
       # If the PR linting issue has been resolved, delete the corresponding comment if one exists
       - if: ${{ steps.lint_pr_title.outputs.error_message == null }}
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         with:
           header: Invalid Pull Request Title
           delete: true

.node-version

@@ -1 +1 @@
-24.11.0
+26.3.0

dangerfile.ts

@@ -69,12 +69,27 @@ const checkYarnAudit: () => void = () => {
     '--json',
   ])
   const output = result.stdout.toString()
-  const summary = JSON.parse(output) as YawnAuditOutput
+
+  let summary: YawnAuditOutput
+  try {
+    summary = JSON.parse(output) as YawnAuditOutput
+  } catch {
+    // npm retired the audit endpoint Yarn 3 relies on (410 Gone), so the
+    // command emits an error message instead of JSON. Skip the audit check
+    // rather than failing every PR. Will be resolved in https://github.com/trussworks/react-uswds/pull/3500
+    // by migrating to NPM.
+    warn(
+      'Unable to run `yarn npm audit` — the command did not return JSON ' +
+        '(npm has retired the audit endpoint used by Yarn 3). ' +
+        'Skipping the dependency audit check.'
+    )
+    return
+  }
 
   if (!summary.metadata?.vulnerabilities || !summary.advisories) {
     warn(
-      `Unable to parse the yarn npm audit response.\n" + 
-      "dangerfile.ts likely needs updating`
+      'Unable to parse the yarn npm audit response.\n' +
+        'dangerfile.ts likely needs updating'
     )
     return
   }

package.json

@@ -33,7 +33,7 @@
     "lib"
   ],
   "engines": {
-    "node": ">= 20"
+    "node": ">= 22"
   },
   "scripts": {
     "test": "vitest --run",