ci: upgrade GitHub Actions to Node 24 majors

.github/workflows/publish-mcp.yml

@@ -26,7 +26,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install mcp-publisher
         run: |

.github/workflows/release.yml

@@ -19,9 +19,9 @@ jobs:
     name: Build sdist + wheel (core)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
 
@@ -31,7 +31,7 @@ jobs:
           python -m build
 
       - name: Upload dist artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
@@ -40,9 +40,9 @@ jobs:
     name: Build sdist + wheel (console)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
 
@@ -52,7 +52,7 @@ jobs:
           python -m build console/ --outdir console-dist/
 
       - name: Upload console dist artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: console-dist
           path: console-dist/
@@ -66,7 +66,7 @@ jobs:
       id-token: write
     steps:
       - name: Download dist artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/
@@ -85,7 +85,7 @@ jobs:
       id-token: write
     steps:
       - name: Download console dist artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: console-dist
           path: console-dist/

.github/workflows/test.yml

@@ -28,18 +28,23 @@ jobs:
           - os: ubuntu-latest
             python-version: "3.12"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Provision Python via uv (python-build-standalone). Unlike
       # actions/setup-python, these builds are compiled with loadable-sqlite
       # extensions enabled, which sqlite-vec needs to load — the macOS
       # setup-python builds are not, so extension loading fails there.
       # One code path for both OSes.
+      # setup-uv stopped publishing major tags in v8 (supply-chain hardening),
+      # so this must pin a full release tag.
       - name: Set up uv + Python ${{ matrix.python-version }}
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v9.0.0
         with:
           python-version: ${{ matrix.python-version }}
           enable-cache: true
+          # Since setup-uv v6, python-version alone no longer activates a venv;
+          # this input restores the exported VIRTUAL_ENV the steps below rely on.
+          activate-environment: true
         env:
           # Force uv's managed python-build-standalone builds and NEVER a
           # system/toolcache interpreter: runner images vary in whether their
@@ -53,7 +58,7 @@ jobs:
       - name: Assert loadable-sqlite-extensions support
         run: uv run python -c "import sqlite3; assert hasattr(sqlite3.Connection, 'enable_load_extension'), 'CPython built without --enable-loadable-sqlite-extensions'"
 
-      # setup-uv with a python-version input already provisions and activates a
+      # setup-uv with activate-environment: true provisions and activates a
       # venv (it exports VIRTUAL_ENV), so no explicit `uv venv` step is needed —
       # the install below targets that activated environment.
       - name: Install (editable, dev + mcp extras)

CHANGELOG.md

@@ -6,7 +6,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
-Nothing yet.
+### Changed
+
+- CI: all workflow actions bumped to their Node 24 majors (checkout v7,
+  setup-python v7, upload-artifact v7, download-artifact v8, setup-uv
+  v9.0.0 with explicit `activate-environment: true`), clearing GitHub's
+  Node 20 runtime deprecation warnings. No user-facing changes.
 
 ## [0.2.1] - 2026-07-21