Cardano Updates

* Add explicit permissions to pages deploy workflow

Add permissions block with contents: write, required by
peaceiris/actions-gh-pages to push build output to the gh-pages branch.

Fixes https://github.com/IntersectMBO/cardano-updates/security/code-scanning/4

* Add explicit permissions to build workflow

Add permissions block with contents: read, required by
actions/checkout to clone the repository.

Fixes https://github.com/IntersectMBO/cardano-updates/security/code-scanning/3

* Update deploy committer to current maintainer

Add permissions block with contents: read, required by
actions/checkout to clone the repository.

Fixes https://github.com/IntersectMBO/cardano-updates/security/code-scanning/3

Add permissions block with contents: write, required by
peaceiris/actions-gh-pages to push build output to the gh-pages branch.

Fixes https://github.com/IntersectMBO/cardano-updates/security/code-scanning/4

* Upgrade Docusaurus 2.2.0 to 3.9.2

Upgrades all Docusaurus packages to 3.9.2 along with their peer
dependencies (React 17 → 18, MDX 1 → 3, prism-react-renderer 1 → 2,
clsx 1 → 2, TypeScript 4 → 5).

Fixes the `prism-react-renderer` import (themes are no longer imported
from subpaths), disables the unused docs plugin, moves
`onBrokenMarkdownLinks` to `markdown.hooks` per the v3 API, and sets
`onUntruncatedBlogPosts` to ignore (none of the posts use truncation
markers, matching the existing behaviour from v2).

Replaces the `minimatch` resolution (no longer needed) with a
`serialize-javascript` resolution.

* Update build infrastructure for Node 20

Docusaurus 3.9.2 requires Node 20. Updates the GitHub Actions workflows
to use Node 20 and bumps actions/checkout and actions/setup-node to v4.
Updates the Nix dev shell to provide pkgs.nodejs_20 so that yarn start
works locally without flags.

Adds package-lock.json to .gitignore since the project uses Yarn
exclusively and the file was removed in the previous commit.

* Fix broken relative links in ledger quarterly report

In Docusaurus 2, relative links like `(2023-01-05-ledger)` in blog/quarterly
posts resolved correctly. In Docusaurus 3.9, the broken-link checker validates
links not only from the post's own page but also from all generated pages that
embed the post (pagination pages like /quarterly/page/2, tag pages like
/quarterly/tags/ledger). Since those pages live at different URL paths, a
relative link like `2023-01-05-ledger` resolves to the wrong path
(e.g. /quarterly/page/2023-01-05-ledger instead of /quarterly/2023-01-05-ledger).

Fix: replace relative slugs with absolute paths (/quarterly/<slug>) so links
resolve correctly regardless of which generated page renders them.

* Mithril update 2026-03-11

* Update blog/2026-03-11-mithril.md

Co-authored-by: olgahryniuk <[email protected]>

* Update blog/2026-03-11-mithril.md

Fix AVK abbreviation.

---------

Co-authored-by: olgahryniuk <[email protected]>

Fix AVK abbreviation.

Co-authored-by: olgahryniuk <[email protected]>

Docusaurus 3.9.2 requires Node 20. Updates the GitHub Actions workflows
to use Node 20 and bumps actions/checkout and actions/setup-node to v4.
Updates the Nix dev shell to provide pkgs.nodejs_20 so that yarn start
works locally without flags.

Adds package-lock.json to .gitignore since the project uses Yarn
exclusively and the file was removed in the previous commit.