From 82a56a31c93964076903d59b12ea44b2c382057e Mon Sep 17 00:00:00 2001
From: mcp-tool-shop <64996768+mcp-tool-shop@users.noreply.github.com>
Date: Mon, 25 May 2026 23:54:48 -0400
Subject: [PATCH] chore: bump GH Actions to Node 24-compatible releases (Sep
 2026 deadline)

Bumps:
- actions/checkout v4 -> v6.0.2 (de0fac2)
- actions/setup-node v4 -> v6.4.0 (48b55a0)
- actions/upload-artifact v4 -> v7.0.1 (043fb46)
- actions/download-artifact v4 -> v7.0.0 (37930b1)
- actions/cache v4 -> v5.0.5 (27d5ce7)
- actions/github-script v7 -> v9.0.0 (3a2844b)

Context: GitHub forces Node 24 default on Jun 2, 2026 and removes Node 20
actions Sep 16, 2026. The v4 (checkout/setup-node/upload/download/cache) and
v7 (github-script) pins ran on Node 20. Bumped to latest stable Node 24
releases. download-artifact stays on v7 (v8 changes auto-unzip behavior).
---
 .github/workflows/ci.yml        | 2 +-
 .github/workflows/codeql.yml    | 2 +-
 .github/workflows/release.yml   | 6 +++---
 .github/workflows/scorecard.yml | 4 ++--
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 61eabac..6452740 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
         node-version: ["20", "22"]
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8ab31d2..0480ad4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3.35.5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3c5d7b2..85ff303 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -54,7 +54,7 @@ jobs:
     outputs:
       version: ${{ steps.extract.outputs.version }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Extract tag and package.json version
         id: extract
@@ -122,7 +122,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 7687b78..626e677 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -22,7 +22,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -34,7 +34,7 @@ jobs:
           publish_results: true
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif