From cc52c1061c39ed85f351bb6fedd8fe561b3f41cd Mon Sep 17 00:00:00 2001
From: Matt McKay <mamckay@gmail.com>
Date: Fri, 18 Sep 2026 17:23:33 +1000
Subject: [PATCH 1/2] ci: move GitHub Actions to their Node 24 majors

Node 20 reached end-of-life on 2026-04-30 and GitHub's own actions now
ship node24 majors. Moves every pin in ci.yml and data-url-guard.yml to
its current major, each of which declares node24 in its action.yml (for
the composite upload-pages-artifact, its inner upload-artifact v7.0.0
does):

- actions/checkout v4 -> v7
- actions/setup-node v4 -> v7
- actions/github-script v7 -> v9
- actions/upload-pages-artifact v3 -> v5
- actions/deploy-pages v4 -> v5

Also moves the job's own Node from 20.x (end-of-life) to 24, and adds a
grouped weekly github-actions Dependabot config so pins stay current.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml               | 19 +++++++++++++++++++
 .github/workflows/ci.yml             | 12 ++++++------
 .github/workflows/data-url-guard.yml |  2 +-
 3 files changed, 26 insertions(+), 7 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3b1ca60
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+# Keeps the GitHub Actions pins in .github/workflows/ on current majors.
+# Two groups, as QuantEcon/actions does, so updates land as at most two PRs a
+# week: minor and patch updates together, and major updates on their own.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "⬆️"
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: [minor, patch]
+      github-actions-major:
+        patterns: ["*"]
+        update-types: [major]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ae103b..2ad63d1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
     - name: Checkout current branch
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         ref: ${{ github.head_ref }}
         token: ${{ env.GH_TOKEN }}
@@ -45,9 +45,9 @@ jobs:
         echo "PR number: ${{ github.event.number }}"
         echo "Commit SHA: ${{ github.sha }}"
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v7
       with:
-        node-version: 20.x
+        node-version: 24
 
     - name: Install MyST Markdown CLI
       run: |
@@ -71,7 +71,7 @@ jobs:
         myst build --html
 
     - name: Upload build output
-      uses: actions/upload-pages-artifact@v3
+      uses: actions/upload-pages-artifact@v5
       with:
         path: './lectures/_build/html'
 
@@ -79,7 +79,7 @@ jobs:
     - name: Deploy to GitHub Pages
       if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       id: deployment
-      uses: actions/deploy-pages@v4
+      uses: actions/deploy-pages@v5
 
     - name: Install Netlify CLI
       if: github.event_name == 'pull_request'
@@ -124,7 +124,7 @@ jobs:
 
     - name: Post PR Comment with Preview Link
       if: github.event_name == 'pull_request'
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       with:
         script: |
           const deployUrl = `${{ steps.netlify-deploy.outputs.deploy_url }}`;
diff --git a/.github/workflows/data-url-guard.yml b/.github/workflows/data-url-guard.yml
index 245a100..8b10559 100644
--- a/.github/workflows/data-url-guard.yml
+++ b/.github/workflows/data-url-guard.yml
@@ -23,7 +23,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: No data-lectures read on the LFS media host
         run: |
           # media.githubusercontent.com is the LFS *media* endpoint and routes

From c834ed43da49c2afb186d4b5cc87e525adea68ad Mon Sep 17 00:00:00 2001
From: Matt McKay <mmcky@users.noreply.github.com>
Date: Fri, 18 Sep 2026 20:30:19 +1000
Subject: [PATCH 2/2] ci: quote the Node version passed to setup-node

Matches the quoted '24' used across the rest of the fleet's Node 24
move. Behaviour is unchanged: setup-node treats a bare major as a
semver range and resolves the latest 24.x, as 20.x did before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ad63d1..e687a3a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,7 @@ jobs:
 
     - uses: actions/setup-node@v7
       with:
-        node-version: 24
+        node-version: '24'
 
     - name: Install MyST Markdown CLI
       run: |