From 40dcfa08b309fe2e869a52e0c9077b5efa7e068e Mon Sep 17 00:00:00 2001
From: Mathew Goldsborough <1759329+mgoldsborough@users.noreply.github.com>
Date: Wed, 6 May 2026 16:23:40 -1000
Subject: [PATCH 1/2] Bump actions to drop Node 20 deprecation warnings

GitHub started warning that Node 20 actions will stop running by
Sept 2026 (forced to Node 24 by default June 2026).

- actions/setup-node v4 -> v6 (composite step)
- actions/setup-python v5 -> v6 (composite step)
- astral-sh/setup-uv v4 -> v8.1.0 (composite step; v8 has no floating
  major tag, hence the explicit pin)
- actions/checkout v4 -> v6 (workflow YAMLs)
---
 .github/workflows/release.yml | 2 +-
 .github/workflows/test.yml    | 4 ++--
 action.yml                    | 8 +++++---
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7f25a53..9f7bc71 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Update major version tag
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6985be4..bccd687 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
           - runner: macos-14
             platform: darwin-arm64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Create test project
         run: |
@@ -112,7 +112,7 @@ jobs:
   test-existing-bundle:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Create test project with pre-built bundle
         run: |
diff --git a/action.yml b/action.yml
index a568d1d..fcf303c 100644
--- a/action.yml
+++ b/action.yml
@@ -70,19 +70,21 @@ runs:
   steps:
     - name: Setup Node.js
       if: inputs.build == 'true'
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version: "22"
 
     - name: Setup Python
       if: inputs.build == 'true'
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ inputs.python-version }}
 
     - name: Install uv
       if: inputs.build == 'true'
-      uses: astral-sh/setup-uv@v4
+      # Pinned to a specific tag because setup-uv doesn't publish a floating
+      # `v8` major tag (verified 2026-05-06). Bump deliberately.
+      uses: astral-sh/setup-uv@v8.1.0
 
     - name: Install mcpb CLI
       if: inputs.build == 'true'

From a5909fb5caeb008bffc0d9153b4ad253a19cabf8 Mon Sep 17 00:00:00 2001
From: Mathew Goldsborough <1759329+mgoldsborough@users.noreply.github.com>
Date: Wed, 6 May 2026 16:44:58 -1000
Subject: [PATCH 2/2] Bump softprops/action-gh-release v2 -> v3

Caught during /pr-review: v2 still uses node20, so release.yml
would still emit a deprecation warning despite the rest of the bump.
v3.0.0 (2026-04-12) is a runtime-only swap to node24 with no
behavior changes per upstream release notes.
---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9f7bc71..002cb2e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,6 +25,6 @@ jobs:
           git push origin $MAJOR --force
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           generate_release_notes: true