Please publish a new release tag with current main (includes upload-artifact@v7 + punycode fix)

[michailidouservices]

Summary

actions/upload-pages-artifact@v4 (released 2025-08-14) is the latest published tag and still nests actions/upload-artifact@v4.6.2 (commit ea165f8d65b6e75b540449e92b4886f43607fa02). That predates the @actions/artifact v6.0.0 punycode fix shipped in December 2025, so every workflow using @v4 produces a DEP0040 punycode DeprecationWarning annotation in Deploy logs.

The main branch has long since fixed this — it's been pinning actions/upload-artifact@v7 since 56f665a6 (2026-03-11), with subsequent SHA pinning in 4a90348b (2026-03-23) and the latest commit fc324d35 from 2026-04-08. There's just no release tag pointing at any of those.

Reproduction

Any workflow using actions/deploy-pages@v5 + actions/upload-pages-artifact@v4 produces this annotation:

! Node.js 20 actions are deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02

(With FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true set; without it the message is "running on Node.js 20".)

Trace

Diagnose run with NODE_OPTIONS=--trace-deprecation traces the warning to:

(node:6420) [DEP0040] DeprecationWarning: The `punycode` module is deprecated.
    at node:punycode:7:10
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:398:7)
    ...

The transitively-loaded punycode comes from the bundled actions/upload-artifact@v4.6.2 distribution, which is what @v4 of this composite action still pins.

Ask

Please cut a new release tag (v5? v4.1?) pointing at current main. That would let downstream users (including actions/deploy-pages consumers) drop the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 workaround and get rid of the annotation noise.

Related

• Downstream symptom in actions/deploy-pages: Support Node.js 24 deploy-pages#410
• Punycode fix in @actions/artifact: actions/upload-artifact PR #744 (merged 2025-12-12)

Workaround in the meantime

Pinning the action to a post-v4.0.0 SHA from main works:

- uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9

But that's an unreleased commit, so it's a fragile workaround until a proper tag exists.

[andrewmogan]

Came here to raise the same issue.

[dylanhand]

Also came here to raise this.

[jsoref]

• There's now a v5.0.0 (but no floating v5), see Please create a v5 tag #143

[fountaindive]

Will this fix errors like this too The action actions/upload-artifact@v4 is not allowed ? We have to reference actions via SHA instead of tags. Thanks!

[andrewmogan]

I believe this has been resolved. I noticed a v5 tag now exists and I'm using actions/upload-pages-artifact@v5 in my workflow without issues.