build(deps): bump actions/configure-pages from 5 to 6

[dependabot]

Bumps actions/configure-pages from 5 to 6.

Release notes

Sourced from actions/configure-pages's releases.

v6.0.0

Changelog

• upgrade to node 24 @​salmanmkc (#186)
• Upgrade IA Publish @​Jcambass (#165)
• Add workflow file for publishing releases to immutable action package @​Jcambass (#163)
• pin draft release version @​YiMysty (#162)
• Bump espree from 9.6.1 to 10.1.0 @​dependabot (#160)
• Bump eslint-config-prettier from 8.8.0 to 9.1.0 @​dependabot (#143)
• Be more friendly to Dependabot @​yoannchaudet (#158)
• Bump eslint-plugin-github from 4.10.2 to 5.0.1 @​dependabot (#154)
• Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group @​dependabot (#156)
• Bump undici from 5.28.3 to 5.28.4 @​dependabot (#145)

See details of all code changes since previous release.

Commits

• 45bfe01 Merge pull request #186 from salmanmkc/node24
• d8770c2 Update Node version from 20 to 24 in action.yml
• cb8a1a3 upgrade to node 24
• d560657 Merge pull request #165 from actions/Jcambass-patch-1
• 35e0ac4 Upgrade IA Publish
• 1dfbcbf Merge pull request #163 from actions/Jcambass-patch-1
• 2f4f988 Add workflow file for publishing releases to immutable action package
• 0d7570c Merge pull request #162 from actions/pin-draft-release-verssion
• 3ea1966 pin draft release version
• aabcbc4 Merge pull request #160 from actions/dependabot/npm_and_yarn/espree-10.1.0
• Additional commits viewable in compare view

[Claudius-Maginificent]

Security Audit — actions/configure-pages v5 → v6

Verdict: SAFE to merge (LOW risk).

Scope

Single-line change in `.github/workflows/github-pages.yml` L30. Workflow triggers only on push to `master`, runs inside a job scoped to `contents: read`, `pages: write`, `id-token: write` — blast radius limited to the GitHub Pages docs deployment.

Supply-chain verification

• Publisher: `actions` GitHub organisation (first-party, verified). Not archived, actively maintained — last push 2026-04-02.
• Tag integrity: `v6` floating tag resolves to commit `45bfe0192ca1faeb007ade9deae92b16b8254a0d` — identical SHA to the immutable `v6.0.0` tag. No tag drift, no silent rewrite.
• Advisories: queried OSV.dev (GitHub Actions ecosystem), GitHub Advisory DB, repo security advisories endpoint, and Dependabot alerts. Zero known CVEs/GHSAs against `actions/configure-pages` at any version.
• Release cadence: v6.0.0 published 2026-03-25, ~two years after v5.0.0 (2024-03-30). Mature, non-rushed release.

v6.0.0 change review

Per upstream release notes and commit history, the v6.0.0 bump is essentially a runtime upgrade:

• Runner Node version bumped 20 → 24 (`action.yml`).
• Internal devDependency refreshes (espree, eslint-config-prettier, braces, undici) — all dev-time, not shipped into runtime behaviour of the action itself.
• `undici 5.28.3 → 5.28.4` pulls in the fix for CVE-2024-30260/30261 on the bundled HTTP client path — net security positive.
• No documented breaking changes to inputs/outputs. Action surface (`Setup Pages` step with no `with:` block here) is unchanged — nothing to adapt on the caller side.

Node 24 is GA and supported on `ubuntu-latest` runners, so no runner compatibility concern.

Residual observations (LOW, not blocking)

• Floating major tag `@v6` is used rather than a pinned SHA. This is consistent with existing style in the file (`actions/checkout@v6`, `actions/upload-pages-artifact@v4`, `actions/deploy-pages@v4`) and acceptable for a first-party `actions/*` action. If the project later adopts SHA pinning policy, apply it across the whole workflow in a dedicated PR — don't bolt it onto this bump.

Note on CI

CI red is pre-existing (fmt + test-all), unrelated to this bump; expected to clear after rebase once #193 merges.

Tally

Findings: 0 CRITICAL / 0 HIGH / 0 MEDIUM / 1 LOW (informational hardening suggestion) / 0 INFO praise-only.

Recommendation: approve and merge after the rebase clears CI.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[lklimek]

@dependabot rebase