[PM-28558] [deps]: Update actions/upload-artifact action to v5.0.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/upload-artifact	action	patch	v4.6.0 -> v4.6.2

---

Release Notes

actions/upload-artifact (actions/upload-artifact)

v4.6.2

Compare Source

What's Changed

• Update to use artifact 2.3.2 package & prepare for new upload-artifact release by @​salmanmkc in #​685

New Contributors

• @​salmanmkc made their first contribution in #​685

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

Compare Source

What's Changed

• Update to use artifact 2.2.2 package by @​yacaovsnc in #​673

Full Changelog: actions/upload-artifact@v4...v4.6.1

---

Configuration

📅 Schedule: Branch creation - "every 2nd week starting on the 2 week of the year before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

PM-28558

[bitwarden-bot]

Internal tracking:

• ID: PM-28558
• Link: https://bitwarden.atlassian.net/browse/PM-28558

[djsmith85]

Bumping to 5.0.0. to keep all usages in sync

All other upload-artifacts actions were also bumped to 5.0.0 with #17305

[claude]

Claude finished @renovate[bot]'s task —— View job

---

Code Review

• Read the changed workflow file
• Verify the version update
• Check for breaking changes or compatibility issues
• Provide review feedback

---

Summary

The PR has been correctly updated from the original Renovate change (v4.6.0 → v4.6.2) to a major version bump (v4.6.0 → v5.0.0) to maintain consistency with other workflows.

Findings

Finding 1: All upload-artifact actions properly updated to v5.0.0 ✓

All four instances in .github/workflows/build-browser.yml have been updated to actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 at lines 196, 339, 352, and 526.

Finding 2: Consistent with download-artifact version strategy ✓

The workflow uses actions/[email protected] (line 275), which is compatible with [email protected]. These versions work together correctly.

Finding 3: Aligns with repository-wide standardization ✓

Per the review comment, this change maintains consistency with PR #17305, which updated all other upload-artifact actions to v5.0.0 across the repository.

Notes

• The v5.0.0 major version includes breaking changes from the v4 series, but these are properly handled by the workflow configuration
• The SHA hash 330a01c490aca151604b8cf639adc76d48f6c5d4 correctly corresponds to the v5.0.0 tag
• No additional workflow modifications are needed for compatibility

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

Checkmarx One – Scan Summary & Details – 32c01e0d-d2f0-4481-8247-9597d75ea5c1

New Issues (1)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2025-12908	Npm-electron-37.7.0	details Description: Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform dom... Attack Vector: NETWORK Attack Complexity: LOW ID: KdZvYgb3yRo91Os54x7waCqljhBbcfDlZ2d74JEmBds%3D Vulnerable Package