AI NewsInfrastructureAnnouncement
GitHub Actions retires Node 20 and the opt-out flag that let teams keep using it
GitHub retired Node 20 from GitHub Actions runners on 2026-09-23, and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is also gone, so any JavaScript action still targeting Node 20 stops running until it is republished against Node 24.
Why it mattersA workflow that pins an older third-party action, or a private action a team maintains itself, now fails on the runner until somebody updates the metadata and cuts a new release.
A workflow that pinned an older JavaScript action and was never updated is the workflow that stops working today. GitHub retired Node 20 from GitHub Actions runners on 2026-09-23, and posted the change as the final notification on its changelog.
Runners now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out that let teams stay on the older runtime for a while longer is also gone, which is the change most likely to catch a team by surprise. It was the fallback that made the deadline optional. Without it, an action that still targets Node 20 fails on the runner.
What has to change, and where
The changelog is specific about the fix. If a team maintains a JavaScript action, it has to update the runs.using value in action.yml to node24 and cut a new release. GitHub links to the JavaScript actions metadata reference for the exact syntax.
If a team consumes JavaScript actions in its workflows, the fix is to move to the latest versions of those actions that support Node 24. The newest versions of all first-party actions were updated to Node 24 already, per the linked announcement changelog, so bumping a uses: line in a workflow file to the latest tag is enough for those.
The private and third-party actions are where the exposure sits. A team that pinned a specific SHA on a lesser-used action, or that maintains its own composite of custom actions internally, has to update each one by hand.
Two more limits worth reading
Node 24 does not support macOS 13.4 or earlier, and it does not officially support ARM32. Self-hosted runners on those operating systems or architectures are no longer supported by first-party actions.
Teams that still run their CI against a fleet of older Mac hardware or on ARM32 devices have to plan the migration alongside the Node bump. The two often move together in an infra roadmap, but this changelog is the moment it stops being optional.
The scope of the change covers both github.com and GitHub with Data Residency, per the post.
The one-line check
A team that wants to know its exposure in five minutes can grep its workflow directory for node20, node16 and any action version older than the current one for the actions it uses most (checkout, setup-node, cache, upload-artifact). Any hit is a candidate to fail on the next run.
For a large monorepo, the same search across every action.yml inside the repository catches the private and vendored actions. The changelog does not give a count of affected repositories, but the size of the GitHub Actions ecosystem makes this a broad break, and one a team only notices when the workflow it depends on starts failing on the next run.
Source
- Node 20 is no longer available in GitHub Actions, GitHub Changelog, 2026-09-23
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
