Summary
actions/upload-pages-artifact@v4 (released 2025-08-14) is the latest published tag and still nests actions/upload-artifact@v4.6.2 (commit ea165f8d65b6e75b540449e92b4886f43607fa02). That predates the @actions/artifact v6.0.0 punycode fix shipped in December 2025, so every workflow using @v4 produces a DEP0040 punycode DeprecationWarning annotation in Deploy logs.
The main branch has long since fixed this — it's been pinning actions/upload-artifact@v7 since 56f665a6 (2026-03-11), with subsequent SHA pinning in 4a90348b (2026-03-23) and the latest commit fc324d35 from 2026-04-08. There's just no release tag pointing at any of those.
Reproduction
Any workflow using actions/deploy-pages@v5 + actions/upload-pages-artifact@v4 produces this annotation:
! Node.js 20 actions are deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
(With FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true set; without it the message is "running on Node.js 20".)
Trace
Diagnose run with NODE_OPTIONS=--trace-deprecation traces the warning to:
(node:6420) [DEP0040] DeprecationWarning: The `punycode` module is deprecated.
at node:punycode:7:10
at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:398:7)
...
The transitively-loaded punycode comes from the bundled actions/upload-artifact@v4.6.2 distribution, which is what @v4 of this composite action still pins.
Ask
Please cut a new release tag (v5? v4.1?) pointing at current main. That would let downstream users (including actions/deploy-pages consumers) drop the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 workaround and get rid of the annotation noise.
Related
Workaround in the meantime
Pinning the action to a post-v4.0.0 SHA from main works:
- uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9
But that's an unreleased commit, so it's a fragile workaround until a proper tag exists.
Summary
actions/upload-pages-artifact@v4(released 2025-08-14) is the latest published tag and still nestsactions/upload-artifact@v4.6.2(commitea165f8d65b6e75b540449e92b4886f43607fa02). That predates the@actions/artifactv6.0.0 punycode fix shipped in December 2025, so every workflow using@v4produces aDEP0040 punycodeDeprecationWarningannotation in Deploy logs.The
mainbranch has long since fixed this — it's been pinningactions/upload-artifact@v7since56f665a6(2026-03-11), with subsequent SHA pinning in4a90348b(2026-03-23) and the latest commitfc324d35from 2026-04-08. There's just no release tag pointing at any of those.Reproduction
Any workflow using
actions/deploy-pages@v5+actions/upload-pages-artifact@v4produces this annotation:(With
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=trueset; without it the message is "running on Node.js 20".)Trace
Diagnose run with
NODE_OPTIONS=--trace-deprecationtraces the warning to:The transitively-loaded
punycodecomes from the bundledactions/upload-artifact@v4.6.2distribution, which is what@v4of this composite action still pins.Ask
Please cut a new release tag (v5? v4.1?) pointing at current
main. That would let downstream users (includingactions/deploy-pagesconsumers) drop theFORCE_JAVASCRIPT_ACTIONS_TO_NODE24workaround and get rid of the annotation noise.Related
@actions/artifact: actions/upload-artifact PR #744 (merged 2025-12-12)Workaround in the meantime
Pinning the action to a post-v4.0.0 SHA from main works:
But that's an unreleased commit, so it's a fragile workaround until a proper tag exists.