Bump actions to drop Node 20 deprecation warnings

.github/workflows/release.yml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Update major version tag
         run: |
@@ -25,6 +25,6 @@ jobs:
           git push origin $MAJOR --force
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           generate_release_notes: true

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
           - runner: macos-14
             platform: darwin-arm64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Create test project
         run: |
@@ -112,7 +112,7 @@ jobs:
   test-existing-bundle:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Create test project with pre-built bundle
         run: |

action.yml

@@ -70,19 +70,21 @@ runs:
   steps:
     - name: Setup Node.js
       if: inputs.build == 'true'
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version: "22"
 
     - name: Setup Python
       if: inputs.build == 'true'
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ inputs.python-version }}
 
     - name: Install uv
       if: inputs.build == 'true'
-      uses: astral-sh/setup-uv@v4
+      # Pinned to a specific tag because setup-uv doesn't publish a floating
+      # `v8` major tag (verified 2026-05-06). Bump deliberately.
+      uses: astral-sh/setup-uv@v8.1.0
 
     - name: Install mcpb CLI
       if: inputs.build == 'true'