Development·Article

GitHub Actions removes Node 20 and ends the temporary opt-out

GitHub retired the Node 20 runtime for JavaScript actions on 23 September. Runners now use Node 24, and the temporary environment-variable opt-out no longer works.

Published 25 Sept 2026, 18:49

The retirement completes a transition that made Node 24 the default on 16 June. ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION had allowed a temporary return to Node 20; GitHub's final notice removes that route for github.com and GitHub with Data Residency.

Action maintainers are being told to declare node24 in runs.using and publish a new release. Workflow owners need compatible versions of the actions they call. This setting belongs to the JavaScript action's execution metadata, not the Node version a workflow installs for its application's build or tests.

The host requirements also change: Node 24 is incompatible with macOS 13.4 and earlier and lacks official ARM32 support. GitHub says self-hosted runners on those systems are no longer supported. Its notice does not establish a matching retirement date for GitHub Enterprise Server.

Source trail

GitHub: Node 20 removal from Actions runners

Primary · 23 Sept 2026, 02:00

https://github.blog/changelog/2026-09-23-node-20-is-no-longer-available-in-github-actions/

GitHub Actions removes Node 20 and ends the temporary opt-out

Source trail

JFrog and SafeDep trace targeted npm implants to on-chain C2 and manufactured download counts

Rust Security Team warns Miri caches can expose CI secrets to pull requests

GitHub Actions will block pull_request_target by default in public repositories

GitHub Actions removes Node 20 and ends the temporary opt-out

Source trail

Related reading

JFrog and SafeDep trace targeted npm implants to on-chain C2 and manufactured download counts

Rust Security Team warns Miri caches can expose CI secrets to pull requests

GitHub Actions will block pull_request_target by default in public repositories