[INT-3874] Harden CI workflow and fix red audit gate

.github/workflows/ci.yml

@@ -16,10 +16,21 @@ on:
   push:
     branches: [master]
 
+# Deliberately no paths-ignore: branch protection requires these checks, and
+# a workflow that is skipped for docs-only changes never reports them, which
+# leaves the PR unmergeable. Each job takes ~20s, so always running is cheap.
+
+# Cancel superseded runs on the same branch/PR so only the latest commit is
+# tested.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     name: Test (Node ${{ matrix.node-version }})
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     strategy:
       fail-fast: false
       matrix:
@@ -28,8 +39,8 @@ jobs:
         # caught here instead of at release.
         node-version: [20, 22, 24]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
@@ -39,16 +50,17 @@ jobs:
   coverage:
     name: Coverage
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
       - run: npm ci
       # Runs the suite under c8 and enforces the thresholds in .c8rc.json.
       - run: npm run coverage
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: coverage-lcov
@@ -58,9 +70,10 @@ jobs:
   audit:
     name: Security audit
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
@@ -72,9 +85,10 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm

.github/workflows/npm-publish.yml

@@ -11,9 +11,10 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20  
       - run: npm ci
@@ -22,9 +23,10 @@ jobs:
   publish:
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           registry-url: https://registry.npmjs.org/
@@ -36,6 +38,7 @@ jobs:
   notify:
     needs: publish
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: slackapi/slack-github-action@v1.18.0
         with:

CHANGELOG.md

@@ -5,6 +5,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Changed
+- CI and publish workflows: cancel superseded CI runs on the same branch (`concurrency`) and cap every job at 10 minutes.
+- CI and publish workflows: bump `actions/checkout`, `actions/setup-node` and `actions/upload-artifact` to v7 (v4 targets the deprecated Node 20 runner).
+
+### Removed
+- Dead `.travis.yml` (Travis CI has not run for this repo since GitHub Actions was adopted).
+
+### Security
+- `package-lock.json` and overrides updated to patched `js-yaml` (4.3.2) and `brace-expansion`, clearing the high-severity advisories that failed the `npm audit` gate (#131, #132).
+
 ## [1.4.1] - 2026-07-13
 ### Added
 - Regression tests covering all five error branches (RateLimitError, PermissionError, ServiceError x2, HttpError, and the ValidationError path in the Onfleet constructor), none of which had prior test coverage.